@hlos-ai/schemas 0.4.2

package/dist/index.cjs

@@ -0,0 +1,1081 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  AgentListItemSchema: () => AgentListItemSchema,
+  AgentPassportStubResponseSchema: () => AgentPassportStubResponseSchema,
+  AgentStatusSchema: () => AgentStatusSchema,
+  AgentTypeSchema: () => AgentTypeSchema,
+  AgentsListResponseSchema: () => AgentsListResponseSchema,
+  ArtifactRefSchema: () => ArtifactRefSchema,
+  AvailabilityTypeSchema: () => AvailabilityTypeSchema,
+  BASE64URL_SHA256_REGEX: () => BASE64URL_SHA256_REGEX,
+  Base64urlEd25519SigSchema: () => Base64urlEd25519SigSchema,
+  Base64urlSha256Schema: () => Base64urlSha256Schema,
+  CONTENT_HASH_LENGTH: () => CONTENT_HASH_LENGTH,
+  CorrelationIdSchema: () => CorrelationIdSchema,
+  CredentialSourceSchema: () => CredentialSourceSchema,
+  CrossingHashInputV0Schema: () => CrossingHashInputV0Schema,
+  CrossingIdFormatSchema: () => CrossingIdFormatSchema,
+  CrossingIdSchema: () => CrossingIdSchema,
+  CrossingSettledReceiptSchema: () => CrossingSettledReceiptSchema,
+  CrossingSnapshotV0Schema: () => CrossingSnapshotV0Schema,
+  ERROR_CODE_STATUS: () => ERROR_CODE_STATUS,
+  ErrorResponseSchema: () => ErrorResponseSchema,
+  FINALITY_GOLDEN_FIXTURES: () => FINALITY_GOLDEN_FIXTURES,
+  FinalityLevel: () => FinalityLevel,
+  FundingSourceSchema: () => FundingSourceSchema,
+  GOLDEN_FIXTURES: () => GOLDEN_FIXTURES,
+  IdempotencyKeySchema: () => IdempotencyKeySchema,
+  KernelErrorCodeSchema: () => KernelErrorCodeSchema2,
+  KernelErrorSchema: () => KernelErrorSchema,
+  KernelOkSchema: () => KernelOkSchema,
+  LogInclusionProofSchema: () => LogInclusionProofSchema,
+  NA_ID_PREFIX: () => NA_ID_PREFIX,
+  NotarizeResponseSchema: () => NotarizeResponseSchema,
+  NotarizeStatusSchema: () => NotarizeStatusSchema,
+  NotaryAttestationIdFormatSchema: () => NotaryAttestationIdFormatSchema,
+  NotaryAttestationSchema: () => NotaryAttestationSchema,
+  NotaryRequestSchema: () => NotaryRequestSchema,
+  PassportIdFormatSchema: () => PassportIdFormatSchema,
+  PassportIdSchema: () => PassportIdSchema,
+  ProviderRoleSchema: () => ProviderRoleSchema,
+  RECEIPT_HASH_GOLDEN_FIXTURE: () => RECEIPT_HASH_GOLDEN_FIXTURE,
+  RECEIPT_TYPE_URI: () => RECEIPT_TYPE_URI,
+  RECEIPT_VERSION: () => RECEIPT_VERSION,
+  RPIDSchema: () => RPIDSchema,
+  ReceiptHashSchema: () => ReceiptHashSchema,
+  ReceiptIdFormatSchema: () => ReceiptIdFormatSchema,
+  ReceiptIdSchema: () => ReceiptIdSchema,
+  RelyingPartyIdSchema: () => RelyingPartyIdSchema,
+  RotationEpochSchema: () => RotationEpochSchema,
+  SETTLEMENT_AUTHORITY: () => SETTLEMENT_AUTHORITY,
+  SIGNATURE_LENGTH: () => SIGNATURE_LENGTH,
+  SURFACES: () => SURFACES,
+  SignedReceiptV0LooseSchema: () => SignedReceiptV0LooseSchema,
+  SignedReceiptV0Schema: () => SignedReceiptV0Schema,
+  StackConnectionSchema: () => StackConnectionSchema,
+  StackProviderSchema: () => StackProviderSchema,
+  StackSchema: () => StackSchema,
+  SuccessResponseSchema: () => SuccessResponseSchema,
+  SurfaceSchema: () => SurfaceSchema,
+  TransactionContextHashSchema: () => TransactionContextHashSchema,
+  TransactionContextSchema: () => TransactionContextSchema,
+  W_GOLDEN_FIXTURES: () => W_GOLDEN_FIXTURES,
+  W_RPID_DOMAIN: () => W_RPID_DOMAIN,
+  W_TXCTX_DOMAIN: () => W_TXCTX_DOMAIN,
+  WalletIdFormatSchema: () => WalletIdFormatSchema,
+  WalletIdSchema: () => WalletIdSchema,
+  base64urlToBytes: () => base64urlToBytes,
+  bytesToBase64url: () => bytesToBase64url,
+  computeContentHash: () => computeContentHash,
+  computeReceiptHash: () => computeReceiptHash,
+  deriveFundingSource: () => deriveFundingSource,
+  encodeEpoch: () => encodeEpoch,
+  error: () => error,
+  generateCrossingId: () => generateCrossingId,
+  generateId: () => generateId,
+  generatePassportId: () => generatePassportId,
+  generateReceiptId: () => generateReceiptId,
+  generateWalletId: () => generateWalletId,
+  isCrossingHashInputV0: () => isCrossingHashInputV0,
+  isCrossingSettledReceipt: () => isCrossingSettledReceipt,
+  isNotaryAttestation: () => isNotaryAttestation,
+  isNotaryRequest: () => isNotaryRequest,
+  isSignedReceiptV0: () => isSignedReceiptV0,
+  jcsCanonicalize: () => jcsCanonicalize,
+  kernelError: () => kernelError,
+  kernelOk: () => kernelOk,
+  success: () => success,
+  validateTimeWindow: () => validateTimeWindow
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/surface.ts
+var import_zod = require("zod");
+var SurfaceSchema = import_zod.z.enum([
+  "mcp",
+  // Model Context Protocol servers
+  "x402",
+  // x402 micropayment protocol
+  "events",
+  // events.hlos.ai
+  "cli",
+  // HLOS CLI
+  "web",
+  // hlos.ai web app
+  "acp",
+  // Agent Commerce Protocol
+  "api"
+  // Direct API calls (default for unspecified)
+]);
+var SURFACES = SurfaceSchema.options;
+
+// src/response.ts
+var import_zod3 = require("zod");
+
+// src/error-codes.ts
+var import_zod2 = require("zod");
+var KernelErrorCodeSchema = import_zod2.z.enum([
+  // 4xx Client Errors
+  "INVALID_REQUEST",
+  // 400 - Malformed request body
+  "UNAUTHORIZED",
+  // 401 - Missing/invalid auth
+  "FORBIDDEN",
+  // 403 - Insufficient permissions
+  "NOT_FOUND",
+  // 404 - Resource doesn't exist
+  "CONFLICT",
+  // 409 - General conflict
+  "IDEMPOTENCY_CONFLICT",
+  // 409 - Same idem_key, different request
+  "INSUFFICIENT_BALANCE",
+  // 402 - Wallet lacks funds
+  "SPEND_CAP_EXCEEDED",
+  // 402 - Spend cap hit
+  "RATE_LIMITED",
+  // 429 - Too many requests
+  // 5xx Server Errors
+  "INTERNAL_ERROR",
+  // 500 - Server error
+  "SERVICE_UNAVAILABLE"
+  // 503 - Temporarily unavailable
+]);
+
+// src/response.ts
+function success(data, correlationId, requestId) {
+  return {
+    success: true,
+    data,
+    meta: {
+      correlation_id: correlationId,
+      ...requestId && { request_id: requestId }
+    }
+  };
+}
+function error(code, message, correlationId, details) {
+  return {
+    success: false,
+    error: {
+      code,
+      message,
+      correlation_id: correlationId,
+      ...details !== void 0 && { details }
+    }
+  };
+}
+var SuccessResponseSchema = (dataSchema) => import_zod3.z.object({
+  success: import_zod3.z.literal(true),
+  data: dataSchema,
+  meta: import_zod3.z.object({
+    request_id: import_zod3.z.string().optional(),
+    correlation_id: import_zod3.z.string()
+  }).optional()
+});
+var ErrorResponseSchema = import_zod3.z.object({
+  success: import_zod3.z.literal(false),
+  error: import_zod3.z.object({
+    code: KernelErrorCodeSchema,
+    message: import_zod3.z.string(),
+    details: import_zod3.z.unknown().optional(),
+    correlation_id: import_zod3.z.string()
+  })
+});
+
+// src/receipt-v0.ts
+var import_zod4 = require("zod");
+var RECEIPT_TYPE_URI = "https://hlos.ai/schema/SignedReceiptV0";
+var RECEIPT_VERSION = 0;
+var CONTENT_HASH_LENGTH = 43;
+var SIGNATURE_LENGTH = 86;
+var SignedReceiptV0Schema = (contentSchema) => import_zod4.z.object({
+  "@type": import_zod4.z.literal(RECEIPT_TYPE_URI),
+  version: import_zod4.z.literal(RECEIPT_VERSION),
+  receipt_id: import_zod4.z.string(),
+  content: contentSchema,
+  // SHA-256 digest (32 bytes) = exactly 43 chars base64url
+  content_hash: import_zod4.z.string().regex(
+    /^[A-Za-z0-9_-]{43}$/,
+    "content_hash must be 43-char base64url (32-byte SHA-256)"
+  ),
+  // Ed25519 signature (64 bytes) = exactly 86 chars base64url
+  signature: import_zod4.z.string().regex(
+    /^[A-Za-z0-9_-]{86}$/,
+    "signature must be 86-char base64url (64-byte Ed25519)"
+  ),
+  key_id: import_zod4.z.string().min(1),
+  issued_at: import_zod4.z.string().datetime()
+});
+var SignedReceiptV0LooseSchema = SignedReceiptV0Schema(import_zod4.z.unknown());
+function isSignedReceiptV0(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return obj["@type"] === RECEIPT_TYPE_URI && obj["version"] === RECEIPT_VERSION && typeof obj["receipt_id"] === "string" && typeof obj["content_hash"] === "string" && typeof obj["signature"] === "string" && typeof obj["key_id"] === "string" && typeof obj["issued_at"] === "string";
+}
+
+// src/ids.ts
+var import_zod5 = require("zod");
+var WalletIdSchema = import_zod5.z.string().regex(/^wallet_[a-z0-9]{20,}$/i, "Invalid WalletId format").transform((s) => s);
+var PassportIdSchema = import_zod5.z.string().regex(/^passport_[a-z0-9]{20,}$/i, "Invalid PassportId format").transform((s) => s);
+var ReceiptIdSchema = import_zod5.z.string().regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, "Invalid ReceiptId format").transform((s) => s);
+var CorrelationIdSchema = import_zod5.z.string().min(8).max(128).transform((s) => s);
+var IdempotencyKeySchema = import_zod5.z.string().min(1).max(256).regex(/^[\x20-\x7E]+$/, "IdempotencyKey must be printable ASCII").transform((s) => s);
+var CrossingIdSchema = import_zod5.z.string().regex(/^cross_[a-z0-9]{20,}$/i, "Invalid CrossingId format").transform((s) => s);
+function generateId(prefix) {
+  const timestamp = Date.now().toString(36);
+  const random = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
+  return `${prefix}_${timestamp}${random}`;
+}
+var generateWalletId = () => generateId("wallet");
+var generatePassportId = () => generateId("passport");
+var generateReceiptId = () => generateId("rcpt");
+var generateCrossingId = () => generateId("cross");
+
+// src/shared-contract.ts
+var import_zod6 = require("zod");
+var KernelErrorCodeSchema2 = import_zod6.z.enum([
+  // Validation / Request errors
+  "VALIDATION_ERROR",
+  // 400 - Input validation failed
+  "INVALID_REQUEST",
+  // 400 - Malformed request
+  // Auth errors
+  "UNAUTHORIZED",
+  // 401 - Missing/invalid auth
+  "FORBIDDEN",
+  // 403 - Insufficient permissions
+  // Resource errors
+  "NOT_FOUND",
+  // 404 - Generic not found
+  "CROSSING_NOT_FOUND",
+  // 404 - Crossing not found
+  "STACK_NOT_FOUND",
+  // 404 - Stack not found
+  "STACK_CONNECTION_NOT_FOUND",
+  // 404 - Stack connection not found
+  // Conflict errors
+  "CONFLICT",
+  // 409 - Generic conflict
+  "INVALID_STATE_TRANSITION",
+  // 409 - State machine violation
+  "CROSSING_ALREADY_SETTLED",
+  // 409 - Crossing already settled
+  "IDEMPOTENCY_CONFLICT",
+  // 409 - Same key, different request
+  // Payment errors
+  "INSUFFICIENT_BALANCE",
+  // 402 - Wallet lacks funds
+  "SPEND_CAP_EXCEEDED",
+  // 402 - Spend cap hit
+  // Rate limiting
+  "RATE_LIMITED",
+  // 429 - Too many requests
+  // Server errors
+  "INTERNAL_ERROR",
+  // 500 - Server error
+  "SERVICE_UNAVAILABLE"
+  // 503 - Temporarily unavailable
+]);
+var ERROR_CODE_STATUS = {
+  VALIDATION_ERROR: 400,
+  INVALID_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  CROSSING_NOT_FOUND: 404,
+  STACK_NOT_FOUND: 404,
+  STACK_CONNECTION_NOT_FOUND: 404,
+  CONFLICT: 409,
+  INVALID_STATE_TRANSITION: 409,
+  CROSSING_ALREADY_SETTLED: 409,
+  IDEMPOTENCY_CONFLICT: 409,
+  INSUFFICIENT_BALANCE: 402,
+  SPEND_CAP_EXCEEDED: 402,
+  RATE_LIMITED: 429,
+  INTERNAL_ERROR: 500,
+  SERVICE_UNAVAILABLE: 503
+};
+var KernelOkSchema = (dataSchema) => import_zod6.z.object({
+  ok: import_zod6.z.literal(true),
+  status: import_zod6.z.union([
+    import_zod6.z.number().int().min(200).max(299),
+    import_zod6.z.literal(304)
+  ]),
+  data: dataSchema
+});
+var KernelErrorSchema = import_zod6.z.object({
+  ok: import_zod6.z.literal(false),
+  status: import_zod6.z.number().int().min(400).max(599),
+  error: import_zod6.z.object({
+    code: KernelErrorCodeSchema2,
+    // P0 FIX: was z.string()
+    message: import_zod6.z.string(),
+    details: import_zod6.z.record(import_zod6.z.unknown()).optional()
+  })
+});
+var CrossingIdFormatSchema = import_zod6.z.string().regex(/^cross_[a-z0-9]{20,}$/i, "Invalid CrossingId format (expected: cross_...)");
+var ReceiptIdFormatSchema = import_zod6.z.string().regex(/^rcpt_[0-9A-HJKMNP-TV-Z]{26}$/i, "Invalid ReceiptId format (expected: rcpt_...)");
+var PassportIdFormatSchema = import_zod6.z.string().regex(/^passport_[a-z0-9]{20,}$/i, "Invalid PassportId format (expected: passport_...)");
+var WalletIdFormatSchema = import_zod6.z.string().regex(/^wallet_[a-z0-9]{20,}$/i, "Invalid WalletId format (expected: wallet_...)");
+var FundingSourceSchema = import_zod6.z.enum(["SPONSOR", "PLATFORM", "USER"]);
+var CredentialSourceSchema = import_zod6.z.enum([
+  "SPONSOR_KEY",
+  // Sponsor-provisioned key
+  "BYOK",
+  // Bring Your Own Key (user-provided)
+  "HLOS_FALLBACK"
+  // Platform fallback credential
+]);
+function deriveFundingSource(credentialSource) {
+  switch (credentialSource) {
+    case "SPONSOR_KEY":
+      return "SPONSOR";
+    case "BYOK":
+      return "USER";
+    case "HLOS_FALLBACK":
+      return "PLATFORM";
+  }
+}
+var CrossingSnapshotV0Schema = import_zod6.z.object({
+  crossingId: CrossingIdFormatSchema,
+  capabilityId: import_zod6.z.string(),
+  passportId: PassportIdFormatSchema,
+  // Scoping
+  event_id: import_zod6.z.string().nullable(),
+  access_window_id: import_zod6.z.string().nullable(),
+  access_grant_id: import_zod6.z.string().nullable(),
+  // Attribution
+  attribution_org_id: import_zod6.z.string().nullable(),
+  funding_source: FundingSourceSchema.nullable(),
+  credential_source: CredentialSourceSchema
+});
+var CrossingHashInputV0Schema = import_zod6.z.object({
+  v: import_zod6.z.literal(0),
+  snapshot: CrossingSnapshotV0Schema,
+  attested_receipt_id: ReceiptIdFormatSchema
+});
+var SETTLEMENT_AUTHORITY = "hlos.ai";
+var CrossingSettledReceiptSchema = import_zod6.z.object({
+  type: import_zod6.z.literal("CrossingSettled"),
+  crossingId: CrossingIdFormatSchema,
+  // Scoping (powers adoption + ROI views)
+  event_id: import_zod6.z.string().nullable(),
+  access_window_id: import_zod6.z.string().nullable(),
+  access_grant_id: import_zod6.z.string().nullable(),
+  // Attribution
+  attribution_org_id: import_zod6.z.string().nullable(),
+  funding_source: FundingSourceSchema.nullable(),
+  credential_source: CredentialSourceSchema,
+  // Authority (LITERAL)
+  settlement_authority: import_zod6.z.literal(SETTLEMENT_AUTHORITY),
+  // Binding
+  crossing_hash: import_zod6.z.string(),
+  // sha256 base64url of CrossingHashInputV0
+  attested_receipt_id: import_zod6.z.string(),
+  // Timestamp
+  settled_at: import_zod6.z.string().datetime()
+});
+var AvailabilityTypeSchema = import_zod6.z.enum([
+  "EVENT_SPONSOR",
+  // Sponsor-funded for specific event
+  "EVERGREEN",
+  // Always available platform credit
+  "CATALOG"
+  // User-paid from catalog
+]);
+var ProviderRoleSchema = import_zod6.z.enum([
+  "AI",
+  // AI/LLM providers (Gemini, GPT, Claude)
+  "DATABASE",
+  // Database providers (MongoDB, Supabase)
+  "AUTH",
+  // Auth providers (Clerk, Auth0)
+  "DEPLOY",
+  // Deployment providers (Vercel, Cloudflare)
+  "STORAGE",
+  // Storage providers (S3, R2)
+  "SEARCH",
+  // Search providers (Algolia, Pinecone)
+  "PAYMENTS",
+  // Payment providers (Stripe)
+  "COMPUTE",
+  // Compute providers (Modal, Replicate)
+  "OTHER"
+  // Catch-all for new categories
+]);
+var StackProviderSchema = import_zod6.z.object({
+  provider_id: import_zod6.z.string(),
+  role: ProviderRoleSchema,
+  // P1: Now a constrained enum
+  display_name: import_zod6.z.string(),
+  budget_allocation: import_zod6.z.number().nonnegative(),
+  sku_ids: import_zod6.z.array(import_zod6.z.string()),
+  availability_type: AvailabilityTypeSchema
+});
+var StackSchema = import_zod6.z.object({
+  id: import_zod6.z.string(),
+  slug: import_zod6.z.string(),
+  name: import_zod6.z.string(),
+  tagline: import_zod6.z.string(),
+  icon: import_zod6.z.string(),
+  providers: import_zod6.z.array(StackProviderSchema),
+  github_template: import_zod6.z.string().nullable(),
+  total_budget: import_zod6.z.number().nonnegative(),
+  event_id: import_zod6.z.string().nullable()
+  // null = evergreen
+});
+var StackConnectionSchema = import_zod6.z.object({
+  id: import_zod6.z.string(),
+  stack_id: import_zod6.z.string(),
+  passport_id: import_zod6.z.string(),
+  team_id: import_zod6.z.string().nullable(),
+  environment_id: import_zod6.z.string(),
+  connected_at: import_zod6.z.string().datetime(),
+  connected_providers: import_zod6.z.array(import_zod6.z.string())
+});
+function kernelOk(data, status = 200) {
+  return { ok: true, status, data };
+}
+function kernelError(code, message, status, details) {
+  return {
+    ok: false,
+    status: status ?? ERROR_CODE_STATUS[code],
+    error: {
+      code,
+      message,
+      ...details && { details }
+    }
+  };
+}
+var GOLDEN_FIXTURES = {
+  /**
+   * Sample CrossingHashInputV0 for hash conformance.
+   */
+  crossingHashInput: {
+    v: 0,
+    snapshot: {
+      crossingId: "cross_test123abc456def789ghi",
+      capabilityId: "gemini.generate.v1",
+      passportId: "passport_user123abc456def789g",
+      event_id: "evt_hackathon2026",
+      access_window_id: "aw_sponsor_mongodb",
+      access_grant_id: "ag_team_001",
+      attribution_org_id: "mongodb",
+      funding_source: "SPONSOR",
+      credential_source: "SPONSOR_KEY"
+    },
+    attested_receipt_id: "rcpt_01HZABCDEF1234567890ABCDEF"
+  },
+  /**
+   * Expected crossing_hash for the above input (FROZEN).
+   * Compute: JCS canonicalize → SHA-256 → base64url (no padding)
+   *
+   * This is the golden vector. If your hash differs, your implementation
+   * is not conformant. DO NOT CHANGE unless crossingHashInput changes.
+   */
+  expectedCrossingHash_base64url_sha256_jcs_v0: "z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0",
+  /**
+   * Sample CrossingSettledReceipt.
+   */
+  crossingSettledReceipt: {
+    type: "CrossingSettled",
+    crossingId: "cross_test123abc456def789ghi",
+    event_id: "evt_hackathon2026",
+    access_window_id: "aw_sponsor_mongodb",
+    access_grant_id: "ag_team_001",
+    attribution_org_id: "mongodb",
+    funding_source: "SPONSOR",
+    credential_source: "SPONSOR_KEY",
+    settlement_authority: "hlos.ai",
+    crossing_hash: "z8A2kCNck4rPL4ugNe-Fbxputdi3PkjkVpSrIBhojU0",
+    attested_receipt_id: "rcpt_01HZABCDEF1234567890ABCDEF",
+    settled_at: "2026-01-24T12:00:00.000Z"
+  }
+};
+function isCrossingHashInputV0(value) {
+  return CrossingHashInputV0Schema.safeParse(value).success;
+}
+function isCrossingSettledReceipt(value) {
+  return CrossingSettledReceiptSchema.safeParse(value).success;
+}
+
+// src/w.ts
+var import_zod7 = require("zod");
+var W_RPID_DOMAIN = new TextEncoder().encode("W:RPID:v1");
+var W_TXCTX_DOMAIN = new TextEncoder().encode("W:TXCTX:v1");
+var RFC3339_CAPTURING = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.(\d{1,9}))?(Z|([+-])(\d{2}):(\d{2}))$/;
+function isLeapYear(year) {
+  return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+}
+function daysInMonth(year, month) {
+  const days = [31, isLeapYear(year) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return days[month - 1] ?? 0;
+}
+function parseRfc3339StrictToMs(value) {
+  const match = RFC3339_CAPTURING.exec(value);
+  if (!match) {
+    throw new Error(
+      `Invalid epoch: "${value}" is not a valid RFC3339 datetime (requires time and timezone)`
+    );
+  }
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const hour = Number(match[4]);
+  const minute = Number(match[5]);
+  const second = Number(match[6]);
+  const fraction = match[8] ?? "";
+  const tz = match[9];
+  if (month < 1 || month > 12) {
+    throw new Error("Invalid epoch: month out of range");
+  }
+  const maxDay = daysInMonth(year, month);
+  if (day < 1 || day > maxDay) {
+    throw new Error("Invalid epoch: day out of range");
+  }
+  if (hour > 23) {
+    throw new Error("Invalid epoch: hour out of range");
+  }
+  if (minute > 59) {
+    throw new Error("Invalid epoch: minute out of range");
+  }
+  if (second > 59) {
+    throw new Error("Invalid epoch: second out of range");
+  }
+  const msFraction = fraction.length ? Number((fraction + "000").slice(0, 3)) : 0;
+  const utcMs = Date.UTC(year, month - 1, day, hour, minute, second, msFraction);
+  let offsetMs = 0;
+  if (tz !== "Z") {
+    const sign = match[10] === "-" ? -1 : 1;
+    const offsetHour = Number(match[11]);
+    const offsetMinute = Number(match[12]);
+    if (offsetHour > 23) {
+      throw new Error("Invalid epoch: tz hour out of range");
+    }
+    if (offsetMinute > 59) {
+      throw new Error("Invalid epoch: tz minute out of range");
+    }
+    offsetMs = sign * (offsetHour * 60 + offsetMinute) * 6e4;
+  }
+  const ms = utcMs - offsetMs;
+  if (!Number.isFinite(ms) || ms < 0) {
+    throw new Error("Invalid epoch: must be a non-negative timestamp");
+  }
+  return ms;
+}
+function encodeEpoch(epoch) {
+  let ms;
+  if (typeof epoch === "string") {
+    ms = parseRfc3339StrictToMs(epoch);
+  } else {
+    if (!Number.isInteger(epoch) || epoch < 0) {
+      throw new Error(`Invalid epoch: ${epoch} must be a non-negative integer`);
+    }
+    ms = epoch;
+  }
+  const buf = new ArrayBuffer(8);
+  const view = new DataView(buf);
+  view.setBigUint64(0, BigInt(ms), false);
+  return new Uint8Array(buf);
+}
+var RelyingPartyIdSchema = import_zod7.z.object({
+  /** RP domain (e.g., "merchant.example.com") */
+  domain: import_zod7.z.string().min(1).max(253),
+  /** Audience URI (e.g., "https://merchant.example.com/verify") */
+  audience_uri: import_zod7.z.string().url(),
+  /** SHA-256 hash of verifier's public key (hex, 64 chars) */
+  verifier_key_hash: import_zod7.z.string().regex(/^[a-f0-9]{64}$/, "Must be 64-char lowercase hex")
+});
+var RotationEpochSchema = import_zod7.z.union([
+  import_zod7.z.number().int().nonnegative(),
+  import_zod7.z.string().datetime({ offset: true })
+  // Requires timezone offset (RFC3339)
+]);
+var RPIDSchema = import_zod7.z.string().length(43, "RPID must be base64url-encoded 32 bytes (43 chars, no padding)").regex(/^[A-Za-z0-9_-]+$/, "Must be base64url (no padding)");
+var TransactionContextSchema = import_zod7.z.object({
+  // Required core (stable)
+  relying_party_id: RelyingPartyIdSchema,
+  /** sha256(JCS({ intent, request })) — see computeOperationHash() */
+  operation_hash: import_zod7.z.string().regex(/^[a-f0-9]{64}$/, "Must be 64-char lowercase hex"),
+  /** Validity start (RFC3339) */
+  not_before: import_zod7.z.string().datetime({ offset: true }),
+  /** Validity end (RFC3339) */
+  not_after: import_zod7.z.string().datetime({ offset: true }),
+  // Optional (part of hash, must be consistent)
+  amount: import_zod7.z.number().nonnegative().optional(),
+  currency: import_zod7.z.string().length(3).optional(),
+  surface_id: import_zod7.z.string().optional(),
+  channel_id: import_zod7.z.string().optional()
+});
+var TransactionContextHashSchema = import_zod7.z.string().regex(/^[a-f0-9]{64}$/, "Must be 64-char lowercase hex");
+var W_GOLDEN_FIXTURES = {
+  /**
+   * encodeEpoch(1706486400000) = 2024-01-29T00:00:00.000Z
+   * Expected: 8 bytes, u64 big-endian
+   */
+  epochMs: 17064864e5,
+  expectedEpochBytes: new Uint8Array([0, 0, 1, 141, 82, 132, 4, 0]),
+  /**
+   * Sample RelyingPartyId for test vectors
+   */
+  sampleRpId: {
+    domain: "merchant.example.com",
+    audience_uri: "https://merchant.example.com/verify",
+    verifier_key_hash: "a".repeat(64)
+  },
+  /**
+   * Sample TransactionContext for test vectors
+   */
+  sampleTxContext: {
+    relying_party_id: {
+      domain: "merchant.example.com",
+      audience_uri: "https://merchant.example.com/verify",
+      verifier_key_hash: "a".repeat(64)
+    },
+    operation_hash: "b".repeat(64),
+    not_before: "2026-01-29T00:00:00Z",
+    not_after: "2026-01-29T00:05:00Z"
+  },
+  /**
+   * MAX_WINDOW_MS: Maximum allowed not_after - not_before (5 minutes)
+   */
+  MAX_WINDOW_MS: 5 * 60 * 1e3
+};
+function validateTimeWindow(context) {
+  let notBefore;
+  let notAfter;
+  try {
+    notBefore = parseRfc3339StrictToMs(context.not_before);
+    notAfter = parseRfc3339StrictToMs(context.not_after);
+  } catch {
+    throw new Error("Invalid timestamp: not_before/not_after must be RFC3339 with timezone");
+  }
+  if (notAfter <= notBefore) {
+    throw new Error("not_after must be greater than not_before");
+  }
+  const windowMs = notAfter - notBefore;
+  if (windowMs > W_GOLDEN_FIXTURES.MAX_WINDOW_MS) {
+    throw new Error(
+      `Time window ${windowMs}ms exceeds MAX_WINDOW_MS (${W_GOLDEN_FIXTURES.MAX_WINDOW_MS}ms)`
+    );
+  }
+  return true;
+}
+
+// src/agents.ts
+var import_zod8 = require("zod");
+var AgentStatusSchema = import_zod8.z.enum(["ACTIVE", "PENDING", "SUSPENDED", "REVOKED"]).or(import_zod8.z.string().min(1));
+var AgentTypeSchema = import_zod8.z.enum(["CUSTOM", "CLAUDE", "GPT", "GEMINI", "CURSOR", "COPILOT", "OTHER"]).or(import_zod8.z.string().min(1));
+var AgentListItemSchema = import_zod8.z.object({
+  id: import_zod8.z.string().min(1),
+  external_id: import_zod8.z.string().min(1),
+  name: import_zod8.z.string().min(1),
+  status: AgentStatusSchema,
+  agent_type: AgentTypeSchema,
+  trust_score: import_zod8.z.number().int().min(0).max(1e3),
+  hosting_model: import_zod8.z.null(),
+  declared_tier: import_zod8.z.null(),
+  created_at: import_zod8.z.string().datetime()
+}).passthrough();
+var AgentsListResponseSchema = import_zod8.z.object({
+  agents: import_zod8.z.array(AgentListItemSchema),
+  _meta: import_zod8.z.object({
+    source: import_zod8.z.literal("hlos")
+  })
+}).passthrough();
+var AgentPassportStubResponseSchema = import_zod8.z.object({
+  passport_id: import_zod8.z.null(),
+  agent_id: import_zod8.z.string().min(1),
+  hosting_model: import_zod8.z.null(),
+  declared_tier: import_zod8.z.null(),
+  effective_tier: import_zod8.z.null(),
+  finality_level: import_zod8.z.null(),
+  graph: import_zod8.z.object({
+    incoming_edges: import_zod8.z.null(),
+    outgoing_edges: import_zod8.z.null(),
+    active_visas: import_zod8.z.null()
+  }).passthrough(),
+  links: import_zod8.z.object({
+    passport_url: import_zod8.z.string().startsWith("/agent-passport/agents/"),
+    docs_url: import_zod8.z.literal("/agents/passport")
+  }).passthrough(),
+  _meta: import_zod8.z.object({
+    source: import_zod8.z.literal("stub")
+  })
+}).passthrough();
+
+// src/encoding.ts
+var import_zod9 = require("zod");
+function bytesToBase64url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  const base64 = btoa(binary);
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlToBytes(str) {
+  const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+var BASE64URL_SHA256_REGEX = /^[A-Za-z0-9_-]{43}$/;
+var Base64urlSha256Schema = import_zod9.z.string().regex(
+  BASE64URL_SHA256_REGEX,
+  "Must be 43-char base64url (32-byte SHA-256 digest)"
+);
+var Base64urlEd25519SigSchema = import_zod9.z.string().regex(
+  /^[A-Za-z0-9_-]{86}$/,
+  "Must be 86-char base64url (64-byte Ed25519 signature)"
+);
+
+// src/receipt-hash.ts
+var import_meta = {};
+var cachedSha256 = null;
+function sortKeysDeep(value) {
+  if (Array.isArray(value)) return value.map(sortKeysDeep);
+  if (value !== null && typeof value === "object") {
+    const obj = value;
+    const out = {};
+    for (const key of Object.keys(obj).sort()) {
+      out[key] = sortKeysDeep(obj[key]);
+    }
+    return out;
+  }
+  return value;
+}
+function jcsCanonicalize(value) {
+  return JSON.stringify(sortKeysDeep(value), (_key, v) => {
+    if (v === void 0) throw new Error("JCS: undefined is not allowed");
+    if (typeof v === "function") throw new Error("JCS: function is not allowed");
+    if (typeof v === "symbol") throw new Error("JCS: symbol is not allowed");
+    if (typeof v === "bigint") throw new Error("JCS: bigint is not allowed");
+    if (typeof v === "number" && !Number.isFinite(v))
+      throw new Error("JCS: non-finite number is not allowed");
+    return v;
+  });
+}
+function computeReceiptHash(receipt) {
+  const sha256 = loadSha256();
+  const canonical = jcsCanonicalize(receipt);
+  const digest = sha256(new TextEncoder().encode(canonical));
+  return bytesToBase64url(digest);
+}
+function computeContentHash(content) {
+  const sha256 = loadSha256();
+  const canonical = jcsCanonicalize(content);
+  const digest = sha256(new TextEncoder().encode(canonical));
+  return bytesToBase64url(digest);
+}
+function loadSha256() {
+  if (cachedSha256) return cachedSha256;
+  let _require;
+  try {
+    const { createRequire } = require("module");
+    _require = createRequire(import_meta.url);
+  } catch {
+    _require = require;
+  }
+  let sha256;
+  try {
+    sha256 = _require("@noble/hashes/sha2.js").sha256;
+  } catch {
+    try {
+      sha256 = _require("@noble/hashes/sha2").sha256;
+    } catch {
+      throw new Error(
+        "computeReceiptHash/computeContentHash requires @noble/hashes as a peer dependency. Install it: npm install @noble/hashes"
+      );
+    }
+  }
+  cachedSha256 = sha256;
+  return sha256;
+}
+var ReceiptHashSchema = Base64urlSha256Schema.describe(
+  "receipt_hash: base64url(SHA-256(JCS(receipt)))"
+);
+var RECEIPT_HASH_GOLDEN_FIXTURE = {
+  receipt: {
+    "@type": "https://hlos.ai/schema/SignedReceiptV0",
+    version: 0,
+    receipt_id: "rcpt_01HZGOLDENTEST000000000000",
+    content: {
+      type: "CrossingSettled",
+      crossingId: "cross_test123abc456def789ghi",
+      settlement_authority: "hlos.ai"
+    },
+    // Placeholder bytes (NOT a valid cryptographic signature)
+    content_hash: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+    signature: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+    key_id: "hlos-v2-1",
+    issued_at: "2026-01-27T00:00:00.000Z"
+  },
+  /**
+   * Expected JCS canonical form of the receipt.
+   * Keys are lexicographically sorted at all levels.
+   */
+  expectedJcs: '{"@type":"https://hlos.ai/schema/SignedReceiptV0","content":{"crossingId":"cross_test123abc456def789ghi","settlement_authority":"hlos.ai","type":"CrossingSettled"},"content_hash":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","issued_at":"2026-01-27T00:00:00.000Z","key_id":"hlos-v2-1","receipt_id":"rcpt_01HZGOLDENTEST000000000000","signature":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","version":0}',
+  /**
+   * Expected receipt_hash (FROZEN).
+   * Compute: JCS canonicalize receipt → SHA-256 → base64url (no padding)
+   *
+   * DO NOT CHANGE unless the receipt fixture above changes.
+   */
+  expectedReceiptHash: "uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg"
+};
+
+// src/finality.ts
+var import_zod10 = require("zod");
+var NA_ID_PREFIX = "na_";
+var FinalityLevel = {
+  SOFT: "SOFT",
+  HARD: "HARD"
+};
+var NotaryAttestationIdFormatSchema = import_zod10.z.string().regex(
+  /^na_[a-zA-Z0-9]{20,}$/,
+  "NA ID must match na_[a-zA-Z0-9]{20,}"
+);
+var LogInclusionProofSchema = import_zod10.z.object({
+  /** Merkle root hash (base64url SHA-256) */
+  root: Base64urlSha256Schema,
+  /** Sibling hashes along the path (base64url SHA-256 each) */
+  proof: import_zod10.z.array(Base64urlSha256Schema),
+  /** Leaf index in the log */
+  index: import_zod10.z.number().int().nonnegative()
+});
+var NotaryAttestationSchema = import_zod10.z.object({
+  // --- Required ---
+  /** Unique NA identifier */
+  na_id: NotaryAttestationIdFormatSchema,
+  /** The receipt_hash this NA attests to */
+  receipt_hash: Base64urlSha256Schema,
+  /** Notary service identifier (e.g. "staampid") */
+  notary_id: import_zod10.z.string().min(1),
+  /** ISO 8601 timestamp when NA was issued */
+  issued_at: import_zod10.z.string().datetime(),
+  /** Notary's countersignature (base64url encoded) */
+  signature: import_zod10.z.string().min(1),
+  /** Signature algorithm (e.g. "EdDSA") */
+  signature_alg: import_zod10.z.string().min(1),
+  // --- Optional (future-proof) ---
+  /** Receipt type being attested */
+  receipt_type: import_zod10.z.string().optional(),
+  /** Receipt version being attested */
+  receipt_version: import_zod10.z.number().int().nonnegative().optional(),
+  /** Settlement authority that issued the receipt (cross-check) */
+  settlement_authority: import_zod10.z.string().optional(),
+  /** TTL in seconds for this attestation */
+  validity_window_seconds: import_zod10.z.number().int().positive().optional(),
+  /** ISO 8601 expiry (derived from issued_at + validity_window_seconds) */
+  expires_at: import_zod10.z.string().datetime().optional(),
+  /** Merkle proof for append-only log inclusion */
+  log_inclusion: LogInclusionProofSchema.optional()
+});
+var NotaryRequestSchema = import_zod10.z.object({
+  /** receipt_hash to be attested (base64url SHA-256) */
+  receipt_hash: Base64urlSha256Schema,
+  /** Must be literal 'hlos.ai' */
+  settlement_authority: import_zod10.z.literal(SETTLEMENT_AUTHORITY),
+  /** Crossing this receipt belongs to */
+  crossing_id: import_zod10.z.string().min(1),
+  /** Type of the receipt being attested */
+  receipt_type: import_zod10.z.string().min(1),
+  /** Version of the receipt being attested */
+  receipt_version: import_zod10.z.number().int().nonnegative(),
+  /** ISO 8601 timestamp of the request */
+  timestamp: import_zod10.z.string().datetime(),
+  /** Optional: requested validity window in seconds */
+  validity_window_seconds: import_zod10.z.number().int().positive().optional()
+});
+var NotarizeStatusSchema = import_zod10.z.enum([
+  "HARD",
+  // NA obtained, finality upgraded
+  "PENDING",
+  // Notarization in progress (async)
+  "FAILED",
+  // Notarization failed
+  "ALREADY_HARD"
+  // Receipt already has NA
+]);
+var NotarizeResponseSchema = import_zod10.z.object({
+  /** Finality status after this operation */
+  status: NotarizeStatusSchema,
+  /** The receipt_hash that was notarized */
+  receipt_hash: Base64urlSha256Schema,
+  /** Hash of the NA itself (optional, present when status is HARD) */
+  na_hash: Base64urlSha256Schema.optional(),
+  /** The full NA object (optional embed) */
+  na: NotaryAttestationSchema.optional(),
+  /** Notary service identifier */
+  notary: import_zod10.z.string().min(1).optional(),
+  /** NA ID for retrieval */
+  notary_receipt_id: import_zod10.z.string().optional(),
+  /** ISO 8601 timestamp */
+  timestamp: import_zod10.z.string().datetime(),
+  /** Error details (present when status is FAILED) */
+  error: import_zod10.z.string().optional()
+});
+function isNotaryAttestation(value) {
+  return NotaryAttestationSchema.safeParse(value).success;
+}
+function isNotaryRequest(value) {
+  return NotaryRequestSchema.safeParse(value).success;
+}
+var ArtifactRefSchema = import_zod10.z.object({
+  /** Artifact type */
+  type: import_zod10.z.enum(["CR", "LAT", "EGP", "SA", "SignedReceiptV0", "NA"]),
+  /** base64url SHA-256 hash of the artifact */
+  hash: Base64urlSha256Schema,
+  /** Issuer of the artifact */
+  issuer: import_zod10.z.string().min(1),
+  /** Schema version */
+  version: import_zod10.z.string().min(1),
+  /** Optional retrieval URI */
+  uri: import_zod10.z.string().url().optional()
+});
+var FINALITY_GOLDEN_FIXTURES = {
+  /** Sample NotaryAttestation */
+  notaryAttestation: {
+    na_id: "na_01HZGOLDENNATEST00000000",
+    receipt_hash: "uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg",
+    notary_id: "staampid",
+    issued_at: "2026-01-27T00:01:00.000Z",
+    signature: "dGVzdF9ub3Rhcnlfc2lnbmF0dXJlXzY0X2J5dGVzX3BhZGRlZF90b19maWxsXzg2X2NoYXJhY3RlcnNf",
+    signature_alg: "EdDSA",
+    receipt_type: "SignedReceiptV0",
+    receipt_version: 0,
+    settlement_authority: "hlos.ai"
+  },
+  /** Sample NotaryRequest */
+  notaryRequest: {
+    receipt_hash: "uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg",
+    settlement_authority: "hlos.ai",
+    crossing_id: "cross_test123abc456def789ghi",
+    receipt_type: "SignedReceiptV0",
+    receipt_version: 0,
+    timestamp: "2026-01-27T00:00:30.000Z"
+  },
+  /** Sample successful notarize response */
+  notarizeResponseHard: {
+    status: "HARD",
+    receipt_hash: "uLiQVUeVKcE35Rdje2fArZQfTcECDgwK6UbmQB_36Pg",
+    na_hash: "_rkedsyWZhokzye55M9NRAvIKFTxFCYTHVOPjg9cAfU",
+    notary: "staampid",
+    notary_receipt_id: "na_01HZGOLDENNATEST00000000",
+    timestamp: "2026-01-27T00:01:00.000Z"
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AgentListItemSchema,
+  AgentPassportStubResponseSchema,
+  AgentStatusSchema,
+  AgentTypeSchema,
+  AgentsListResponseSchema,
+  ArtifactRefSchema,
+  AvailabilityTypeSchema,
+  BASE64URL_SHA256_REGEX,
+  Base64urlEd25519SigSchema,
+  Base64urlSha256Schema,
+  CONTENT_HASH_LENGTH,
+  CorrelationIdSchema,
+  CredentialSourceSchema,
+  CrossingHashInputV0Schema,
+  CrossingIdFormatSchema,
+  CrossingIdSchema,
+  CrossingSettledReceiptSchema,
+  CrossingSnapshotV0Schema,
+  ERROR_CODE_STATUS,
+  ErrorResponseSchema,
+  FINALITY_GOLDEN_FIXTURES,
+  FinalityLevel,
+  FundingSourceSchema,
+  GOLDEN_FIXTURES,
+  IdempotencyKeySchema,
+  KernelErrorCodeSchema,
+  KernelErrorSchema,
+  KernelOkSchema,
+  LogInclusionProofSchema,
+  NA_ID_PREFIX,
+  NotarizeResponseSchema,
+  NotarizeStatusSchema,
+  NotaryAttestationIdFormatSchema,
+  NotaryAttestationSchema,
+  NotaryRequestSchema,
+  PassportIdFormatSchema,
+  PassportIdSchema,
+  ProviderRoleSchema,
+  RECEIPT_HASH_GOLDEN_FIXTURE,
+  RECEIPT_TYPE_URI,
+  RECEIPT_VERSION,
+  RPIDSchema,
+  ReceiptHashSchema,
+  ReceiptIdFormatSchema,
+  ReceiptIdSchema,
+  RelyingPartyIdSchema,
+  RotationEpochSchema,
+  SETTLEMENT_AUTHORITY,
+  SIGNATURE_LENGTH,
+  SURFACES,
+  SignedReceiptV0LooseSchema,
+  SignedReceiptV0Schema,
+  StackConnectionSchema,
+  StackProviderSchema,
+  StackSchema,
+  SuccessResponseSchema,
+  SurfaceSchema,
+  TransactionContextHashSchema,
+  TransactionContextSchema,
+  W_GOLDEN_FIXTURES,
+  W_RPID_DOMAIN,
+  W_TXCTX_DOMAIN,
+  WalletIdFormatSchema,
+  WalletIdSchema,
+  base64urlToBytes,
+  bytesToBase64url,
+  computeContentHash,
+  computeReceiptHash,
+  deriveFundingSource,
+  encodeEpoch,
+  error,
+  generateCrossingId,
+  generateId,
+  generatePassportId,
+  generateReceiptId,
+  generateWalletId,
+  isCrossingHashInputV0,
+  isCrossingSettledReceipt,
+  isNotaryAttestation,
+  isNotaryRequest,
+  isSignedReceiptV0,
+  jcsCanonicalize,
+  kernelError,
+  kernelOk,
+  success,
+  validateTimeWindow
+});
+//# sourceMappingURL=index.cjs.map