@harrylabsj/kiwi 0.6.0

package/dist/trust/identity/signature-base.js

@@ -0,0 +1,261 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** signature-base 构造/解析失败。 */
+export class SignatureBaseError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "SignatureBaseError";
+        this.code = code;
+    }
+}
+/** 取单值 HTTP 字段；多值时按 RFC 9421 §2.1 用 ", " 连接。 */
+export function headerValue(headers, name) {
+    const value = headers[name.toLowerCase()];
+    if (value === undefined || value === null)
+        return undefined;
+    if (Array.isArray(value))
+        return value.map((v) => v.trim()).join(", ");
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+/** 引号字符串转义（RFC 9421 字典字符串值）。 */
+function escapeString(value) {
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+/** 引号字符串反转义。 */
+function unescapeString(value) {
+    return value.replace(/\\(["\\])/g, "$1");
+}
+/** 参数字典序列化：RFC 9421 §2.2 固定顺序 created, expires, nonce, keyid, alg, tag。 */
+export function serializeParams(params) {
+    let out = "";
+    if (params.created !== undefined)
+        out += `;created=${params.created}`;
+    if (params.expires !== undefined)
+        out += `;expires=${params.expires}`;
+    if (params.nonce !== undefined)
+        out += `;nonce="${escapeString(params.nonce)}"`;
+    if (params.keyid !== undefined)
+        out += `;keyid="${escapeString(params.keyid)}"`;
+    if (params.algorithm !== undefined)
+        out += `;alg="${escapeString(params.algorithm)}"`;
+    if (params.tag !== undefined)
+        out += `;tag="${escapeString(params.tag)}"`;
+    return out;
+}
+/** 格式化一条 Signature-Input 项：`label=(comps)params`。 */
+export function formatSignatureInput(label, components, params) {
+    const comps = components.map((c) => `"${c}"`).join(" ");
+    return `${label}=(${comps})${serializeParams(params)}`;
+}
+/** 解析单条 Signature-Input 项。 */
+function parseEntry(entry) {
+    const eq = entry.indexOf("=");
+    if (eq <= 0) {
+        throw new SignatureBaseError("malformed", `signature-input entry has no label: "${entry}"`);
+    }
+    const label = entry.slice(0, eq).trim();
+    const rest = entry.slice(eq + 1).trim();
+    if (!rest.startsWith("(")) {
+        throw new SignatureBaseError("malformed", `signature-input entry "${label}" has no component list`);
+    }
+    let depth = 0;
+    let close = -1;
+    for (let i = 0; i < rest.length; i++) {
+        const ch = rest[i];
+        if (ch === "(")
+            depth += 1;
+        else if (ch === ")") {
+            depth -= 1;
+            if (depth === 0) {
+                close = i;
+                break;
+            }
+        }
+    }
+    if (close < 0) {
+        throw new SignatureBaseError("malformed", `signature-input entry "${label}" has unterminated component list`);
+    }
+    const inner = rest.slice(1, close);
+    const components = inner
+        .split(/\s+/)
+        .filter((s) => s.length > 0)
+        .map((s) => {
+        const m = /^"((?:[^"\\]|\\.)*)"$/.exec(s);
+        if (m === null) {
+            throw new SignatureBaseError("malformed", `signature-input component "${s}" is not a quoted string`);
+        }
+        return unescapeString(m[1] ?? "");
+    });
+    const paramsText = rest.slice(close + 1);
+    const params = {};
+    for (const param of paramsText.split(";")) {
+        const trimmed = param.trim();
+        if (trimmed.length === 0)
+            continue;
+        const kv = trimmed.indexOf("=");
+        if (kv < 0) {
+            throw new SignatureBaseError("malformed", `signature-input parameter "${trimmed}" has no value`);
+        }
+        const key = trimmed.slice(0, kv).trim();
+        const rawValue = trimmed.slice(kv + 1).trim();
+        switch (key) {
+            case "created":
+            case "expires": {
+                const n = Number(rawValue);
+                if (!Number.isInteger(n) || n < 0) {
+                    throw new SignatureBaseError("malformed", `signature-input ${key} must be a non-negative integer`);
+                }
+                params[key] = n;
+                break;
+            }
+            case "nonce":
+            case "keyid":
+            case "alg":
+            case "tag": {
+                const m = /^"((?:[^"\\]|\\.)*)"$/.exec(rawValue);
+                if (m === null) {
+                    throw new SignatureBaseError("malformed", `signature-input ${key} must be a quoted string`);
+                }
+                const value = unescapeString(m[1] ?? "");
+                // Signature-Input 里是 alg；内部参数名是 algorithm（与 RFC 术语区分）。
+                if (key === "alg")
+                    params.algorithm = value;
+                else
+                    params[key] = value;
+                break;
+            }
+            default:
+                // 未知参数 RFC 9421 要求拒绝（fail-closed）：签名者/验证者对参数理解不同。
+                throw new SignatureBaseError("malformed", `signature-input has unsupported parameter "${key}"`);
+        }
+    }
+    return { label, components, params };
+}
+/** 按顶层逗号切分（不在括号/引号内的逗号），支持一条头含多个签名。 */
+function splitTopLevel(value) {
+    const parts = [];
+    let depth = 0;
+    let inQuote = false;
+    let start = 0;
+    for (let i = 0; i < value.length; i++) {
+        const ch = value[i];
+        if (ch === '"' && value[i - 1] !== "\\")
+            inQuote = !inQuote;
+        if (inQuote)
+            continue;
+        if (ch === "(")
+            depth += 1;
+        else if (ch === ")")
+            depth -= 1;
+        else if (ch === "," && depth === 0) {
+            parts.push(value.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(value.slice(start));
+    return parts;
+}
+/** 解析 Signature-Input 头，返回全部签名项（可能多个）。 */
+export function parseSignatureInput(value) {
+    const entries = [];
+    for (const part of splitTopLevel(value)) {
+        const trimmed = part.trim();
+        if (trimmed.length === 0)
+            continue;
+        entries.push(parseEntry(trimmed));
+    }
+    return entries;
+}
+/** 解析 Signature 头：`label=:base64:` 序列。 */
+export function parseSignatureHeader(value) {
+    const out = {};
+    for (const part of value.trim().split(/\s+/)) {
+        const m = /^([A-Za-z0-9_!#$%&'*+\-.^`|~]+)=:([^:]*):$/.exec(part);
+        if (m === null)
+            continue;
+        out[m[1] ?? ""] = Buffer.from(m[2] ?? "", "base64");
+    }
+    return out;
+}
+/**
+ * 构造 signature base（RFC 9421 §2.1）。
+ * 每个覆盖组件渲染一行（`"name": value`），最后追加 `"@signature-params"` 行。
+ * 覆盖的字段缺失时抛 SignatureBaseError（fail-closed：不能对不存在的组件签名）。
+ */
+export function buildSignatureBase(input) {
+    const { method, targetUri, authority, headers, components, params } = input;
+    let base = "";
+    for (const component of components) {
+        switch (component) {
+            case "@method":
+                base += `"@method": ${method}\n`;
+                break;
+            case "@target-uri":
+                base += `"@target-uri": ${targetUri}\n`;
+                break;
+            case "@authority":
+                base += `"@authority": ${authority}\n`;
+                break;
+            case "@scheme": {
+                let scheme;
+                try {
+                    scheme = new URL(targetUri).protocol.replace(/:$/, "");
+                }
+                catch {
+                    throw new SignatureBaseError("malformed", `@scheme requires a parseable target URI`);
+                }
+                base += `"@scheme": ${scheme}\n`;
+                break;
+            }
+            case "@path": {
+                let path;
+                try {
+                    path = new URL(targetUri).pathname;
+                }
+                catch {
+                    throw new SignatureBaseError("malformed", `@path requires a parseable target URI`);
+                }
+                base += `"@path": ${path}\n`;
+                break;
+            }
+            case "@query": {
+                let query;
+                try {
+                    query = new URL(targetUri).search.replace(/^\?/, "");
+                }
+                catch {
+                    throw new SignatureBaseError("malformed", `@query requires a parseable target URI`);
+                }
+                base += `"@query": ${query}\n`;
+                break;
+            }
+            default: {
+                const value = headerValue(headers, component);
+                if (value === undefined) {
+                    throw new SignatureBaseError("missing_component", `covered component "${component}" is not present in the request`);
+                }
+                base += `"${component}": ${value}\n`;
+                break;
+            }
+        }
+    }
+    const comps = components.map((c) => `"${c}"`).join(" ");
+    base += `"@signature-params": (${comps})${serializeParams(params)}\n`;
+    return base;
+}
+//# sourceMappingURL=signature-base.js.map

package/dist/trust/identity/signature-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-base.js","sourceRoot":"","sources":["../../../src/trust/identity/signature-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA8DH,8BAA8B;AAC9B,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAoC;IACjD,YAAY,IAAgC,EAAE,OAAe;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,gDAAgD;AAChD,MAAM,UAAU,WAAW,CACzB,OAAsD,EACtD,IAAY;IAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,gCAAgC;AAChC,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,gBAAgB;AAChB,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,GAAG,IAAI,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC;IACtE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,GAAG,IAAI,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC;IACtE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,IAAI,WAAW,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAChF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,IAAI,WAAW,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAChF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,IAAI,SAAS,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;IACtF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,IAAI,SAAS,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,UAAoB,EACpB,MAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,KAAK,KAAK,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,8BAA8B;AAC9B,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,wCAAwC,KAAK,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,0BAA0B,KAAK,yBAAyB,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,KAAK,GAAG,CAAC,CAAC;gBACV,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,0BAA0B,KAAK,mCAAmC,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK;SACrB,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,8BAA8B,CAAC,0BAA0B,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEL,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,8BAA8B,OAAO,gBAAgB,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,SAAS,CAAC;YACf,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,mBAAmB,GAAG,iCAAiC,CAAC,CAAC;gBACrG,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC;YACb,KAAK,OAAO,CAAC;YACb,KAAK,KAAK,CAAC;YACX,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACf,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,mBAAmB,GAAG,0BAA0B,CAAC,CAAC;gBAC9F,CAAC;gBACD,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzC,uDAAuD;gBACvD,IAAI,GAAG,KAAK,KAAK;oBAAE,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;;oBACvC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACzB,MAAM;YACR,CAAC;YACD;gBACE,kDAAkD;gBAClD,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,8CAA8C,GAAG,GAAG,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,uCAAuC;AACvC,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QAC5D,IAAI,OAAO;YAAE,SAAS;QACtB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACtB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACzB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC5E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,SAAS;gBACZ,IAAI,IAAI,cAAc,MAAM,IAAI,CAAC;gBACjC,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,IAAI,kBAAkB,SAAS,IAAI,CAAC;gBACxC,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,IAAI,iBAAiB,SAAS,IAAI,CAAC;gBACvC,MAAM;YACR,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACzD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,IAAI,cAAc,MAAM,IAAI,CAAC;gBACjC,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;gBACrF,CAAC;gBACD,IAAI,IAAI,YAAY,IAAI,IAAI,CAAC;gBAC7B,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,KAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,IAAI,aAAa,KAAK,IAAI,CAAC;gBAC/B,MAAM;YACR,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,sBAAsB,SAAS,iCAAiC,CACjE,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,IAAI,SAAS,MAAM,KAAK,IAAI,CAAC;gBACrC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,yBAAyB,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/trust/identity/trust-policy.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Trust Levels 与 TrustPolicy（基线 §28 / §31）。
+ *
+ * Trust level 只控制协议/自动化风险，不等于产品或 Merchant 推荐等级（§28）。
+ * 本策略表把「是否强制某类身份证据」按对端 trust level 分级：
+ *
+ * | level | 含义                    | 强制 HTTP Message Signature | 强制 Agent Card JWS | 强制 nonce |
+ * |-------|-------------------------|-----------------------------|----------------------|------------|
+ * | T0    | UNKNOWN                 | 否（未认证可匿名访问）       | 否                   | 否         |
+ * | T1    | DISCOVERED              | 是                          | 否                   | 否         |
+ * | T2    | AUTHENTICATED           | 是                          | 是                   | 否         |
+ * | T3    | VERIFIED_RELATIONSHIP   | 是                          | 是                   | 是         |
+ *
+ * §31（digest ≠ authentication）：签名/验签与完整性是两件事。HTTP Message
+ * Signature 提供认证与防篡改绑定；Agent Card JWS 提供「卡片确实是该 key 所属方
+ * 发布的」证据。是否强制由部署策略（本表）决定，不由算法本身决定。
+ */
+export type TrustLevel = "T0" | "T1" | "T2" | "T3";
+export declare const TRUST_LEVELS: readonly TrustLevel[];
+export declare function isTrustLevel(value: unknown): value is TrustLevel;
+/** T0=0 … T3=3。 */
+export declare function trustLevelRank(level: TrustLevel): number;
+/**
+ * 取两个 trust level 中更保守（更低）的一个。
+ * WP1 集成：签名密钥档案的 trustLevel 优先，但 record 推导值对它是保守校验——
+ * 冲突时绝不向更乐观的一侧取齐（§28 trust level 只控制协议/自动化风险）。
+ */
+export declare function conservativeLevel(a: TrustLevel, b: TrustLevel): TrustLevel;
+/**
+ * 信任策略：按对端 trust level 决定对请求身份证据的强制程度。
+ * 全部为纯查询接口，便于测试矩阵。
+ */
+export interface TrustPolicy {
+    /** 该 level 是否强制请求携带 HTTP Message Signature。 */
+    requireHttpSignature(level: TrustLevel): boolean;
+    /** 该 level 是否强制请求/卡片携带可验证的 Agent Card JWS。 */
+    requireCardJws(level: TrustLevel): boolean;
+    /** 该 level 是否强制签名携带 nonce（防重放）。 */
+    requireNonce(level: TrustLevel): boolean;
+    /** created/expires 时钟偏差容忍（秒）。 */
+    maxClockSkewSeconds(level: TrustLevel): number;
+    /** 无 expires 时签名允许的最大年龄（秒）。 */
+    maxSignatureAgeSeconds(level: TrustLevel): number;
+}
+/** 默认部署策略（上面的矩阵）。可注入自定义策略。 */
+export declare const DEFAULT_TRUST_POLICY: TrustPolicy;
+export interface PolicyEvaluationInput {
+    level: TrustLevel;
+    hasHttpSignature: boolean;
+    hasCardJws: boolean;
+    /** 卡片 JWS 是否验证通过（未提供时 undefined）。 */
+    cardJwsValid?: boolean;
+    hasNonce?: boolean;
+    /**
+     * WP1：对端 TrustRecord 评估推导出的信任信号（可选）。签名密钥档案的
+     * trustLevel（`level`）优先；两者同时提供且冲突时取更保守者
+     * （conservativeLevel）。`record.rejected === true` 时直接拒绝（fail-closed，
+     * §4.6）。
+     */
+    record?: {
+        trustLevel: TrustLevel;
+        rejected?: boolean;
+    };
+}
+export interface PolicyEvaluationResult {
+    allowed: boolean;
+    /** 未通过时的协议错误码。 */
+    protocolCode?: "authentication_required" | "authorization_failed";
+    reason?: string;
+    /** 缺失的证据类别（diagnostic）。 */
+    missing: string[];
+}
+/**
+ * 按策略表评估一次请求的身份证据。这是 TrustPolicy 矩阵的单一入口：
+ * 签名是否强制、JWS 是否强制、nonce 是否强制都在这里判定。
+ */
+export declare function evaluatePolicy(policy: TrustPolicy, input: PolicyEvaluationInput): PolicyEvaluationResult;

package/dist/trust/identity/trust-policy.js

@@ -0,0 +1,95 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export const TRUST_LEVELS = ["T0", "T1", "T2", "T3"];
+export function isTrustLevel(value) {
+    return typeof value === "string" && TRUST_LEVELS.includes(value);
+}
+/** T0=0 … T3=3。 */
+export function trustLevelRank(level) {
+    return TRUST_LEVELS.indexOf(level);
+}
+/**
+ * 取两个 trust level 中更保守（更低）的一个。
+ * WP1 集成：签名密钥档案的 trustLevel 优先，但 record 推导值对它是保守校验——
+ * 冲突时绝不向更乐观的一侧取齐（§28 trust level 只控制协议/自动化风险）。
+ */
+export function conservativeLevel(a, b) {
+    return trustLevelRank(a) <= trustLevelRank(b) ? a : b;
+}
+/** 默认部署策略（上面的矩阵）。可注入自定义策略。 */
+export const DEFAULT_TRUST_POLICY = {
+    requireHttpSignature: (level) => level !== "T0",
+    requireCardJws: (level) => level === "T2" || level === "T3",
+    requireNonce: (level) => level === "T3",
+    maxClockSkewSeconds: () => 300,
+    maxSignatureAgeSeconds: () => 900,
+};
+/**
+ * 按策略表评估一次请求的身份证据。这是 TrustPolicy 矩阵的单一入口：
+ * 签名是否强制、JWS 是否强制、nonce 是否强制都在这里判定。
+ */
+export function evaluatePolicy(policy, input) {
+    if (input.record?.rejected === true) {
+        return {
+            allowed: false,
+            protocolCode: "authorization_failed",
+            reason: "TrustRecord evaluation rejected counterparty (fail-closed)",
+            missing: [],
+        };
+    }
+    // 有效 level：密钥档案 level 优先，record 推导值做保守校验（冲突取更保守者）。
+    const level = input.record === undefined
+        ? input.level
+        : conservativeLevel(input.level, input.record.trustLevel);
+    const missing = [];
+    if (policy.requireHttpSignature(level) && !input.hasHttpSignature) {
+        return {
+            allowed: false,
+            protocolCode: "authentication_required",
+            reason: `HTTP Message Signature required at ${level}`,
+            missing: ["http-signature"],
+        };
+    }
+    if (policy.requireCardJws(level)) {
+        if (!input.hasCardJws) {
+            return {
+                allowed: false,
+                protocolCode: "authentication_required",
+                reason: `Agent Card JWS required at ${level}`,
+                missing: ["card-jws"],
+            };
+        }
+        if (input.cardJwsValid === false) {
+            return {
+                allowed: false,
+                protocolCode: "authorization_failed",
+                reason: `Agent Card JWS verification failed at ${level}`,
+                missing: [],
+            };
+        }
+    }
+    if (policy.requireNonce(level) && input.hasHttpSignature && input.hasNonce !== true) {
+        // hasNonce 缺省/未知按缺失处理（fail-closed）：T3 的 nonce 强制不容模糊。
+        return {
+            allowed: false,
+            protocolCode: "authorization_failed",
+            reason: `signature nonce required at ${level}`,
+            missing: ["nonce"],
+        };
+    }
+    return { allowed: true, missing };
+}
+//# sourceMappingURL=trust-policy.js.map

package/dist/trust/identity/trust-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-policy.js","sourceRoot":"","sources":["../../../src/trust/identity/trust-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAsBH,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE5E,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,mBAAmB;AACnB,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAmBD,8BAA8B;AAC9B,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI;IAC/C,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;IAC3D,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI;IACvC,mBAAmB,EAAE,GAAG,EAAE,CAAC,GAAG;IAC9B,sBAAsB,EAAE,GAAG,EAAE,CAAC,GAAG;CAClC,CAAC;AA2BF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,KAA4B;IAE5B,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,sBAAsB;YACpC,MAAM,EAAE,4DAA4D;YACpE,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IACD,mDAAmD;IACnD,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,KAAK,SAAS;QACxB,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAClE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,yBAAyB;YACvC,MAAM,EAAE,sCAAsC,KAAK,EAAE;YACrD,OAAO,EAAE,CAAC,gBAAgB,CAAC;SAC5B,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,yBAAyB;gBACvC,MAAM,EAAE,8BAA8B,KAAK,EAAE;gBAC7C,OAAO,EAAE,CAAC,UAAU,CAAC;aACtB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,sBAAsB;gBACpC,MAAM,EAAE,yCAAyC,KAAK,EAAE;gBACxD,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpF,sDAAsD;QACtD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,sBAAsB;YACpC,MAAM,EAAE,+BAA+B,KAAK,EAAE;YAC9C,OAAO,EAAE,CAAC,OAAO,CAAC;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/trust/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * trust — 信任层（基线 §27-§28 / §31）。WP5 落地 identity 子层；WP1 落地
+ * records 子层（对端信任记录：事实观察 + 评估 + 持久化）。
+ */
+export * from "./identity/index.js";
+export * from "./records/index.js";

package/dist/trust/index.js

@@ -0,0 +1,22 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * trust — 信任层（基线 §27-§28 / §31）。WP5 落地 identity 子层；WP1 落地
+ * records 子层（对端信任记录：事实观察 + 评估 + 持久化）。
+ */
+export * from "./identity/index.js";
+export * from "./records/index.js";
+//# sourceMappingURL=index.js.map

package/dist/trust/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/trust/records/evaluator.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * trust/records — 评估器（从事实观察推导 trust_level 建议值，基线 §27 / §28）。
+ *
+ * 评估规则确定、可测、无模型参与：
+ *   - 初始 T0；
+ *   - 成功交换 ≥ successToT1 → T1（成功发现/交互）；
+ *   - 连续验签成功 ≥ consecutiveVerifiedToT2 → T2（验签身份连续有效）；
+ *   - 对端在 establishedRelationships（部署配置）→ T3；
+ *   - signature_failure / replay 超阈值，或存在 third_party_adjudicated 争议
+ *     → 拒绝（rejected），level 置 T0（fail-closed，§4.6）；
+ *   - 未解决争议保守封顶：mutually_acknowledged → 封顶 T1；local_asserted → 封顶 T2。
+ *
+ * 维度分离（§27/§28）：trust level 只控制协议/自动化风险。dispute 是 reputation
+ * 维度 —— 评估器只对已知事实做保守封顶/拒绝，不把本地单方标记伪装成全球事实，
+ * 也不让 reputation 直接写进协议 level。reputation 以 ReputationSignal 透传，
+ * 无数据时 Ranker 侧拿到显式 unknown（绝不 0.5）。
+ */
+import { type TrustLevel } from "../identity/trust-policy.js";
+import type { CounterpartyTrustRecord, ReputationSignal, ReputationSource, TrustRecordFacts } from "./types.js";
+export interface TrustEvaluatorConfig {
+    /** 成功交换 ≥ 此值 → T1（成功发现/交互）。默认 1。 */
+    successToT1: number;
+    /** 连续验签成功 ≥ 此值 → T2（验签身份连续有效）。默认 3。 */
+    consecutiveVerifiedToT2: number;
+    /** signature_failure ≥ 此值 → 拒绝。默认 3。 */
+    signatureFailureRejectThreshold: number;
+    /** replay ≥ 此值 → 拒绝。默认 2。 */
+    replayRejectThreshold: number;
+}
+export declare const DEFAULT_TRUST_EVALUATOR_CONFIG: TrustEvaluatorConfig;
+export type EvaluationRule = "initial_t0" | "successful_exchange_t1" | "signature_continuity_t2" | "established_relationship_t3" | "rejected_signature_failures" | "rejected_replay" | "rejected_adjudicated_dispute" | "capped_mutual_dispute" | "capped_local_dispute";
+export interface EvaluationResult {
+    /** 建议 trust level（T0-T3）。 */
+    level: TrustLevel;
+    /** 拒绝建议（超硬阈值 / 已裁决争议）：调用方应拒绝自动化交互。 */
+    rejected: boolean;
+    reason?: string;
+    /** 生效的评估规则（升级路径 / 拒绝 / 封顶，diagnostic）。 */
+    applied: EvaluationRule[];
+    /** §27 Commercial Reputation：无数据必须是显式 unknown，绝不返回 0.5。 */
+    reputation: ReputationSignal;
+}
+export interface EvaluateOptions {
+    config?: TrustEvaluatorConfig;
+    /** 已建立关系标记（部署配置）：在此集合中的对端 → T3。 */
+    establishedRelationships?: ReadonlySet<string>;
+    /** Reputation 来源；缺省恒返回显式 unknown。 */
+    reputation?: ReputationSource;
+}
+/** 无 reputation 数据的默认来源：恒返回显式 unknown（§27：绝不 0.5）。 */
+export declare const NO_REPUTATION: ReputationSource;
+/** 把 record 转成 evaluatePolicy 的 record 输入（WP1 集成，见 trust-policy.ts）。 */
+export declare function recordPolicyInput(record: CounterpartyTrustRecord): {
+    trustLevel: TrustLevel;
+    rejected: boolean;
+};
+/**
+ * 从事实推导 trust_level 建议值（纯函数，无模型参与）。输入是 record 的事实面，
+ * 结论字段（trust_level / rejected / evaluated_at）不参与推导。
+ */
+export declare function evaluateTrustRecord(record: TrustRecordFacts, options?: EvaluateOptions): EvaluationResult;