@humanagencyp/hap-core 0.11.2 → 0.12.1

package/dist/index.d.ts

@@ -1,123 +1,97 @@
 /**
- * HAP Core Types — Agent Demo
+ * Canonical v0.7 error codes — protocol.md → *Error Codes*.
+ *
+ * "Error codes are canonical across the protocol. Implementations MUST emit
+ * exactly these codes and MUST NOT alias them under different names." This
+ * module is the single list both the Gatekeeper (local checks) and any AS
+ * client built on this library read from, so the two cannot drift.
+ *
+ * v0.7 renamed every code that carried a retired word (attestation → mandate,
+ * context → scope, receipt → ticket) — see protocol.md → *Migration from
+ * v0.6* → "Error-code renames" for the old→new map. There is no alias: a v0.6
+ * code name is simply gone from this list, by design (no backward
+ * compatibility — CLAUDE.md "Decided by the owner").
+ */
+/** Codes an Authority Server (or a local Gatekeeper check) emits refusing a mandate request. */
+declare const MANDATE_ERROR_CODES: readonly ["BOUNDS_HASH_MISMATCH", "SCOPE_HASH_MISMATCH", "INVALID_SIGNATURE", "OWNER_NOT_COVERED", "TTL_EXPIRED", "PROFILE_NOT_FOUND", "PROFILE_INVALID", "PROFILE_HASH_MISMATCH", "COVERAGE_INSUFFICIENT", "MALFORMED_MANDATE", "VERSION_UNSUPPORTED", "OWNER_NOT_APPROVER", "BOUNDS_INVALID_VALUE", "SCOPE_INVALID_VALUE", "ABOVE_CAP_CONFIG_INVALID", "OWNER_SIGNATURE_REQUIRED", "OWNER_SIGNATURE_INVALID"];
+/** Codes an Authority Server emits refusing a ticket request. */
+declare const TICKET_ERROR_CODES: readonly ["MANDATE_NOT_FOUND", "MANDATE_EXPIRED", "MANDATE_REVOKED", "BOUND_EXCEEDED", "CUMULATIVE_LIMIT_EXCEEDED", "COVERAGE_INSUFFICIENT", "PROFILE_NOT_FOUND", "INVALID_ACTION_TYPE", "APPROVAL_REQUIRED", "PROPOSAL_REQUIRED", "PROPOSAL_NOT_FOUND", "PROPOSAL_NOT_APPROVED", "PROPOSAL_EXPIRED", "PROPOSAL_REJECTED", "PROPOSAL_MISMATCH", "PROPOSAL_MANDATE_MISMATCH", "PROPOSAL_ALREADY_EXECUTED", "MALFORMED_TICKET_REQUEST", "IDEMPOTENCY_KEY_REQUIRED", "IDEMPOTENCY_MISMATCH", "APPROVAL_SIGNATURE_REQUIRED", "APPROVAL_SIGNATURE_INVALID"];
+/** The full canonical surface — every code a conformant implementation may emit. */
+type HapErrorCode = (typeof MANDATE_ERROR_CODES)[number] | (typeof TICKET_ERROR_CODES)[number];
+/**
+ * A refusal carrying one of the canonical codes above. Thrown by local
+ * (Gatekeeper-side, no-wire-round-trip) checks in this library; an AS client
+ * built on hap-core maps a wire `{ code, message }` error onto the same type.
+ */
+declare class HapError extends Error {
+    readonly code: HapErrorCode;
+    constructor(code: HapErrorCode, message: string);
+}
+
+/**
+ * HAP Core Types — v0.7 ("mandate" / "ticket" / "scope" / "Mandate Owner")
  *
- * Types for agent-oriented profiles with bounded execution.
+ * v0.7 is a vocabulary release (protocol.md → *Migration from v0.6*): the
+ * wire renames *attestation* → *mandate*, *context* → *scope*, *execution
+ * receipt* → *mandate ticket*, and *Decision Owner* → *Mandate Owner*. There
+ * is no backward-compat alias here — v0.6 and earlier artifacts are
+ * verification-only history outside this package (CLAUDE.md "Decided by the
+ * owner": no verify path for 0.5/0.6, no old→new code map).
  */
-interface AttestationHeader {
-    typ: 'HAP-attestation';
+interface MandateHeader {
+    typ: 'HAP-mandate';
     alg: 'EdDSA';
-    kid?: string;
-}
-interface ResolvedDomain {
-    domain: string;
-    did: string;
-}
-interface AttestationPayload {
-    attestation_id: string;
-    version: '0.3' | '0.4' | '0.5' | '0.6';
-    profile_id: string;
-    /** v0.3 (deprecated) — hash of the authorization frame */
-    frame_hash?: string;
-    /** v0.4 — hash of the bounds parameters */
-    bounds_hash?: string;
-    /** v0.4 — hash of the context parameters */
-    context_hash?: string;
-    execution_context_hash: string;
-    /**
-     * v0.4 (deprecated in v0.5) — domain-scoped owners. Optional so v0.5
-     * attestations that carry only `resolved_owners` remain valid. During the
-     * transition the AS emits BOTH `resolved_domains` (internal coverage) and
-     * `resolved_owners` (the v0.5 signed wire field).
-     */
-    resolved_domains?: ResolvedDomain[];
-    /**
-     * v0.5 — the Decision Owner DIDs this attestation covers (person-centric
-     * model; replaces the abstract domain in `resolved_domains`). Carried in the
-     * signed payload so verifiers bind the action to the human(s) who authorized it.
-     */
-    resolved_owners?: string[];
-    gate_content_hashes: Record<string, string>;
-    /**
-     * v0.5 (companion spec `intent-disclosure@0.1`) — present iff the attestation
-     * carries an encrypted-intent disclosure object. `sha256:`-prefixed hash that
-     * binds the disclosure's `intent_ciphertext` + `approvers_frozen` into the
-     * signed payload (see {@link computeIntentDisclosureHash}), so a compromised
-     * AS cannot swap the ciphertext/wrapped keys or alter the approver set
-     * without invalidating the attestation signature (companion invariant C2).
-     */
-    intent_disclosure_hash?: string;
     /**
-     * v0.6 (Identity Assurance) — optional signed overlay carrying the verified
-     * real-world identity of the Decision Owner(s), one entry per owner. Present
-     * only when identity is disclosed; an attestation with no `subjects` renders
-     * as `low` (pseudonymous, no name). See {@link Subject} and
-     * {@link deriveIdentityLine}.
-     */
-    subjects?: Subject[];
-    /**
-     * v0.4 — commitment mode chosen by the decision owner at attestation time.
-     * - 'automatic': agent may invoke bounded tools without per-action review.
-     * - 'review': every tool call requires an approved proposal before the
-     *   receipt route will sign a receipt.
-     *
-     * Cryptographically bound in the signed payload so a compromised SP cannot
-     * silently flip 'review' → 'automatic'. Absent on v0.3 attestations.
-     * `review_above_cap` (v0.5): automatic below the signed caps, proposal above.
+     * When present MUST identify the same key as `issuer` (for a `did:key`
+     * issuer, the multibase key fingerprint) — Mandate rule 8. The field a
+     * party writes (`kid`) loses to the field a party cannot forge (`issuer`).
      */
-    commitment_mode?: 'automatic' | 'review' | 'review_above_cap';
-    /**
-     * v0.6 (Owner Mandate Signatures) — the Decision Owner's own signature(s)
-     * over the mandate projection ({@link MandateProjection}), one entry per
-     * co-signing owner. Carried INSIDE the AS-signed payload, so the AS attests
-     * to having received it and cannot strip it without invalidating its own
-     * signature. Optional and additive: an attestation without it behaves as
-     * before (the v0.5 posture — the AS asserts, nobody co-signs).
-     */
-    owner_mandates?: OwnerMandate[];
-    issued_at: number;
-    expires_at: number;
+    kid?: string;
 }
-/** Mandate-assurance axis — what custody signed the mandate. Independent of
- * identity assurance ({@link Subject.method}). */
-type MandateBinding = 'raw' | 'webauthn' | 'eudi';
+/** Signature-assurance axis — what custody signed the mandate projection or
+ * approval. Independent of identity assurance ({@link Subject.method}). */
+type OwnerSignatureBinding = 'raw' | 'webauthn' | 'eudi';
 /** Which surface showed the owner what they signed. A DECLARATION, not a proof
- * — no verifier can check it; see protocol.md → Owner Mandate Signatures. */
+ * — no verifier can check it; see protocol.md → *Owner Signatures*. */
 type SigningSurface = 'gatekeeper_local' | 'as_web' | 'wallet_display';
 /**
- * v0.6 — one owner's signature over the mandate projection.
+ * v0.7 `mandate_owners` entry (protocol.md → *Mandate field: mandate_owners*).
+ * `did` is required; the remaining fields are present together when the
+ * owner co-signed and absent together when they did not (Mandate rule 7).
  *
  * There is deliberately NO `public_key` field, and it MUST NOT be added: the
  * verification key is carried in the DID itself (key-bearing `did:key`), so a
  * non-key-bearing DID fails STRUCTURALLY instead of validating against a key
- * the AS could have substituted. `alg` is kept only as curve-confusion
- * hygiene; if it disagrees with the DID's key type, the DID is authoritative.
+ * the AS could have substituted.
  */
-interface OwnerMandate {
-    /** The signing owner's key-bearing DID. MUST be a member of `resolved_owners`. */
+interface MandateOwnerEntry {
+    /** The Mandate Owner's DID. For a co-signing entry, MUST be key-bearing. */
     did: string;
     /** Signature algorithm hint. The DID's multicodec wins on any disagreement. */
-    alg: 'EdDSA' | 'ES256';
+    alg?: 'EdDSA' | 'ES256';
     /** base64url (no padding) signature over the JCS bytes of the mandate projection. */
-    signature: string;
+    signature?: string;
     /** When the owner signed (unix seconds). */
-    signed_at: number;
+    signed_at?: number;
     /** Defence-in-depth against duplicate issuance by an HONEST AS only —
      * AS-side nonce enforcement is no defence against the AS itself. */
-    nonce: string;
-    binding: MandateBinding;
+    nonce?: string;
+    /** Required-present, value-open when a signature is carried: an AS MUST
+     * NOT reject an entry for a `binding` value it does not recognize. */
+    binding?: OwnerSignatureBinding;
     signing_surface?: SigningSurface;
 }
 /**
- * v0.6 Identity Assurance — a signed overlay binding a Decision Owner's verified
- * real-world identity to the attestation, gated by HOW the identity was verified.
+ * v0.6 Identity Assurance — a signed overlay binding a Mandate Owner's verified
+ * real-world identity to the mandate, gated by HOW the identity was verified.
  *
  * Two display levels (`assurance`): `low` discloses no name; `high` MAY disclose a
  * name. At `high`, two trust roots: `as` (the AS operator vouches — valid only
  * within its own domain) and `external` (an external eID such as EUDI — carries the
- * owner's own signature, AS-independent). See review.md → "Identity Assurance".
+ * owner's own signature, AS-independent).
  */
 interface Subject {
-    /** The Decision Owner DID this subject describes (matches an entry in resolved_owners). */
+    /** The Mandate Owner DID this subject describes (matches the `mandate_owners` entry). */
     did: string;
     /** `low` → no name shown; `high` → the name MAY be shown. */
     assurance: 'low' | 'high';
@@ -133,18 +107,53 @@ interface Subject {
     };
     /** When the underlying verification was performed (unix seconds). */
     verified_at?: number;
+}
+/** protocol.md → *Mandate Payload (v0.7)*. */
+interface MandatePayload {
+    mandate_id: string;
+    version: '0.7';
+    profile_id: string;
+    /** Hash of the canonical bounds string. */
+    bounds_hash: string;
+    /** Hash of the canonical scope string (sha256 of "" when scope is empty). */
+    scope_hash: string;
+    execution_context_hash: string;
+    /** `sha256` over the JCS serialization of the profile the Gatekeeper
+     * provisioned for `profile_id` — the content address of the rulebook this
+     * mandate was issued under (new in v0.7). */
+    profile_hash: string;
+    /** The Authority Server's DID — SHOULD be the `did:key` of the signing key
+     * itself (new in v0.7). */
+    issuer: string;
+    /** Exactly one entry in v0.7 (Mandate rule 7). */
+    mandate_owners: MandateOwnerEntry[];
+    gate_content_hashes: Record<string, string>;
+    commitment_mode: 'automatic' | 'review' | 'review_above_cap';
+    /** Required, together with `above_cap_approvers`, iff `commitment_mode === "review_above_cap"`. */
+    above_cap_caps?: Record<string, number>;
+    above_cap_approvers?: string[];
     /**
-     * @deprecated v0.6 — replaced by {@link AttestationPayload.owner_mandates}.
-     * This field signed the wrong object (the identity claim, not what was
-     * committed to) and was welded to one method. Implementations MUST NOT emit
-     * it; verifiers MAY ignore it on artifacts that carry it. Kept readable for
-     * audit of pre-0.6 artifacts only.
+     * Present iff the mandate carries an encrypted-intent disclosure object
+     * (companion spec `intent-disclosure@0.1`) — `sha256:`-prefixed hash
+     * binding `intent_ciphertext` + `approvers_frozen` into the signed payload.
      */
-    owner_signature?: string | null;
+    intent_disclosure_hash?: string;
+    /** Signed identity-assurance block, one entry per owner — present iff the
+     * Mandate Owner disclosed identity. */
+    subjects?: Subject[];
+    /**
+     * The owner's narrowing of the profile's `disclose_fields` list (new in
+     * v0.7) — a subset of the profile's own list. See *Ticket Disclosure Is
+     * Declared*.
+     */
+    disclose_fields?: string[];
+    issued_at: number;
+    expires_at: number;
 }
-interface Attestation {
-    header: AttestationHeader;
-    payload: AttestationPayload;
+interface Mandate {
+    header: MandateHeader;
+    payload: MandatePayload;
+    /** base64url (no padding) Ed25519 signature over the JCS-canonical payload. */
     signature: string;
 }
 /**
@@ -179,24 +188,13 @@ interface FieldConstraint {
     requiredFor?: string[];
 }
 /**
- * Frame field definition within a profile.
- */
-interface ProfileFrameField {
-    type: 'string' | 'number';
-    required: boolean;
-    description?: string;
-    constraint?: FieldConstraint;
-    enum?: string[];
-}
-/**
- * Bound enforcement semantics — how a v0.4 bound is checked.
+ * Bound enforcement semantics — how a bound is checked.
  *
- * Every bounds field in a v0.4 profile declares a `boundType` so the SP
- * receipt route and hap-core gatekeeper can dispatch on it directly,
- * without parsing field names or guessing conventions. This is the
- * single source of truth for "what does this bound mean at enforcement
- * time" — if a new kind is needed, add a variant here and update the
- * dispatch sites.
+ * Every bounds field in a profile declares a `boundType` so the AS and
+ * hap-core gatekeeper can dispatch on it directly, without parsing field
+ * names or guessing conventions. This is the single source of truth for
+ * "what does this bound mean at enforcement time" — if a new kind is needed,
+ * add a variant here and update the dispatch sites.
  *
  * See `ProfileBoundsField.boundType`.
  */
@@ -206,23 +204,15 @@ type BoundType =
  * satisfy `execution[of] <= bound` for the current call. No cumulative
  * tracking. Used by: amount_max, recipient_max, booking_duration_max, etc.
  *
- * `requiredFor` (v0.8+) closes the converse: without it, a call that does
- * not carry `of` at all is simply skipped — a 5,000 cap refuses 6,000 but
+ * `requiredFor` closes the converse: without it, a call that does not
+ * carry `of` at all is simply skipped — a 5,000 cap refuses 6,000 but
  * permits a call that declares no value whatsoever, which is indistinguishable
- * from an unenforced bound. The same hole, and the same fix, as
- * `FieldConstraint.requiredFor` on a scope constraint (below): values drawn
- * from the profile's `boundsSchema.actionTypes` registry. For a listed
- * `action_type`, an execution whose context lacks `of` — or whose value is
- * not a finite number — MUST be refused rather than skipped. For an
- * unlisted (or when `requiredFor` is absent) action type, today's
- * skip-on-absence behaviour is unchanged. Meaningful only on
- * `per_transaction`; the other `BoundType` kinds have no per-call "value
- * exposed or not" question — `cumulative_sum`/`cumulative_count` always read
- * from the execution log regardless of what this call declares, and `enum`
- * is a capability flag, not a runtime value — so the field does not exist
- * on those variants and a profile that puts it there has it silently
- * ignored by every enforcement point (TypeScript also refuses it when the
- * profile is authored against this type rather than raw JSON).
+ * from an unenforced bound. Values are drawn from the profile's
+ * `boundsSchema.actionTypes` registry. For a listed `action_type`, an
+ * execution whose context lacks `of` — or whose value is not a finite
+ * number — MUST be refused rather than skipped. `appliesTo` MUST NOT be
+ * declared on a `per_transaction` bound (protocol.md → Bounds Schema rule 7)
+ * — it applies wherever `of` is present in the execution context.
  */
 {
     kind: 'per_transaction';
@@ -230,10 +220,12 @@ type BoundType =
     requiredFor?: string[];
 }
 /**
- * Cumulative sum within a time window. The SP maintains a running sum
- * of `execution[of]` across all prior executions in the window; the
+ * Cumulative sum within a time window. The AS maintains a running sum
+ * of `execution[of]` across all prior tickets in the window; the
  * current call is approved iff `running_sum + execution[of] <= bound`.
- * Used by: amount_daily_max, spend_monthly_max, etc.
+ * AS-only enforcement (protocol.md → *Enforcement Authority*); the
+ * Gatekeeper MUST NOT enforce this locally. Used by: amount_daily_max,
+ * spend_monthly_max, etc.
  */
  | {
     kind: 'cumulative_sum';
@@ -241,10 +233,14 @@ type BoundType =
     window: CumulativeWindow;
 }
 /**
- * Cumulative count within a time window. Every qualifying execution
+ * Cumulative count within a time window. Every qualifying ticket
  * counts as +1; the current call is approved iff
  * `running_count + 1 <= bound`. No execution context field is read.
- * Used by: write_daily_max, post_monthly_max, booking_daily_max, etc.
+ * AS-only enforcement. `appliesTo` is REQUIRED on a profile published
+ * under v0.7 or later (Bounds Schema rule 7) — absence would mean
+ * "governs every action type", so a forgotten declaration silently
+ * throttles every action. Used by: write_daily_max, post_monthly_max,
+ * booking_daily_max, etc.
  */
  | {
     kind: 'cumulative_count';
@@ -252,11 +248,12 @@ type BoundType =
 }
 /**
  * String bound restricted to a fixed set of allowed values. The bound's
- * value must be one of `values` at attestation time. The gateway
+ * value must be one of `values` at mandate time. The gateway
  * tool-proxy gates tool calls based on the stored bound (via the
  * integration manifest's `boundField` + `requiredValue`). Not cumulated,
- * not checked by the SP receipt route — it's a capability flag.
- * Used by: read_access, delete_access, archive_access.
+ * not checked by the AS ticket route — it's a capability flag.
+ * `appliesTo` MUST NOT be declared here (it is a capability flag, not an
+ * action-scoped limit). Used by: read_access, delete_access, archive_access.
  */
  | {
     kind: 'enum';
@@ -274,11 +271,11 @@ type BoundType =
  */
 type FieldUnit = 'count' | 'minutes' | 'hours' | 'days' | `currency:${string}` | 'percent';
 /**
- * Bounds field definition within a v0.4 profile.
+ * Bounds field definition within a profile.
  *
- * v0.4 adds the required `boundType` — an explicit declaration of how
- * the bound is enforced. The older `constraint.enforceable` pattern is
- * deprecated and superseded by `boundType`.
+ * Every non-metadata bounds field MUST declare `boundType` — an explicit
+ * declaration of how the bound is enforced. Implementations MUST fail
+ * closed on any bounds field that omits it (Bounds Schema rule 2).
  */
 interface ProfileBoundsField {
     type: 'string' | 'number';
@@ -286,26 +283,18 @@ interface ProfileBoundsField {
     description?: string;
     displayName?: string;
     format?: 'email' | 'domain' | 'url' | 'currency';
-    /**
-     * v0.4 enforcement semantics. Required for all new profiles.
-     * Optional here only so the type stays backward compatible with v0.3
-     * profiles that predate the boundType convention — consumers must
-     * treat a missing boundType as an error when running in v0.4 mode.
-     */
+    /** Enforcement semantics. REQUIRED on every bounds field except `profile`. */
     boundType?: BoundType;
     /**
      * Which execution action types this bound governs, e.g. `["write"]`.
      *
-     * When present, this is authoritative. When absent, enforcement falls back to
-     * inferring the action type from the FIELD NAME (`send_daily_max` → `send`),
-     * which is a convention rather than a contract: a profile that names a bound
-     * after the domain concept instead of the action — calendar's
-     * `booking_daily_max` against an action type of `write` — matches nothing and
-     * is skipped, so a limit the user set is never applied and nothing says so.
-     *
-     * Declaring it removes the guess. Deliberately additive: profiles migrate one
-     * at a time, and every remaining fallback is logged, so the cases still
-     * relying on the naming convention become visible instead of staying silent.
+     * When present, this is authoritative. When absent, a `cumulative_sum` bound
+     * (or any bound on a profile published before v0.7) governs every action
+     * type in the profile's `actionTypes` registry; a `cumulative_count` bound
+     * on a v0.7+ profile MUST declare it (Bounds Schema rule 7). MUST NOT be
+     * declared on a `per_transaction` bound (it applies wherever its `of`
+     * field is present in the execution context) or on an `enum` bound (a
+     * capability flag, not an action-scoped limit).
      */
     appliesTo?: string[];
     /**
@@ -328,18 +317,14 @@ interface ProfileBoundsField {
      * min(value, maximum). Absent → no ceiling.
      */
     maximum?: number;
-    /** @deprecated v0.4: use boundType instead. */
-    constraint?: FieldConstraint;
-    /** @deprecated v0.4: use boundType: { kind: 'enum', values: [...] }. */
-    enum?: string[];
 }
 /**
  * v0.5 Content Provenance — how a profile's action content is hashed into a
- * signed receipt (`contentHash`). The ephemeral-content analog of Output
+ * signed ticket (`contentHash`). The ephemeral-content analog of Output
  * Provenance: it binds the *bytes* of the action rather than a location.
  *
  * Profile-bound and OPTIONAL. Absent → no content hash is produced (full
- * backward compatibility). The gateway computes the hash; the SP only ever
+ * backward compatibility). The gateway computes the hash; the AS only ever
  * receives the hash, never the content, so HAP's privacy-minimal design holds.
  *
  * At `version:"1"` the profile declares only the *policy* — whether to bind and
@@ -399,18 +384,35 @@ interface ContentBinding {
      * Absent → the binding applies to every gated action under the profile.
      */
     appliesTo?: string[];
+    /**
+     * v2 only — what kind of value each bound field holds, so a verifier (or any
+     * view) can collect and show it without guessing from the field's name:
+     * - `text`  — one string (an email body);
+     * - `list`  — an array of strings (recipients);
+     * - `files` — the sealed fingerprints of documents sent by reference:
+     *   `[{ filename, sha256 }]` — never the bytes. A verifier asks for the
+     *   files themselves and computes each SHA-256 locally.
+     *
+     * A hint only: it never changes what is hashed. Keys MUST be a subset of
+     * {@link fields}; a field without an entry is unspecified (a verifier may
+     * offer a choice, as before).
+     */
+    field_kinds?: Record<string, ContentFieldKind>;
 }
+/** See {@link ContentBinding.field_kinds}. */
+type ContentFieldKind = 'text' | 'list' | 'files';
 /**
- * Context field definition within a v0.4 profile.
+ * Scope field definition within a profile (renamed from `ProfileContextField`
+ * in v0.7 — protocol.md → *Migration from v0.6*, `contextSchema` → `scopeSchema`).
  */
-interface ProfileContextField {
+interface ProfileScopeField {
     type: 'string' | 'number';
     required: boolean;
     description?: string;
     displayName?: string;
     format?: 'email' | 'domain' | 'url' | 'currency';
     /**
-     * v0.6 — what this field NAMES on the read path. `counterparty` = the other
+     * What this field NAMES on the read path. `counterparty` = the other
      * party to a communication (matched against an item's participants);
      * `resource` = the container an item belongs to (a direct attribute match —
      * and a resource scope enforced on writes MUST also bind reads). Absent →
@@ -419,7 +421,6 @@ interface ProfileContextField {
      */
     scopeKind?: 'counterparty' | 'resource';
     constraint?: FieldConstraint;
-    enum?: string[];
 }
 /**
  * Execution context field definition — declared source (value comes from the agent's tool call).
@@ -435,13 +436,11 @@ interface DeclaredFieldDef {
  */
 type CumulativeWindow = 'daily' | 'weekly' | 'monthly';
 /**
- * Execution context field definition — cumulative source (resolved from execution log).
+ * Execution context field definition — cumulative source (resolved from the
+ * AS's ticket history; see protocol.md → *Cumulative State*).
  *
- * The gatekeeper resolves these by querying the execution log:
  * - `cumulativeField`: which declared field to sum (use "_count" for plain counting)
  * - `window`: time window for aggregation (daily, weekly, monthly)
- *
- * The resolved value = running total within window + current call value.
  */
 interface CumulativeFieldDef {
     source: 'cumulative';
@@ -456,35 +455,21 @@ interface CumulativeFieldDef {
  */
 type ExecutionContextFieldDef = DeclaredFieldDef | CumulativeFieldDef;
 /**
- * Gate question definition.
- * @deprecated v0.4 uses a single intent gate with no profile-specific questions.
- */
-interface GateQuestion {
-    question: string;
-    required: boolean;
-}
-/**
- * @deprecated Execution paths removed in v0.4. Kept for backward compatibility.
- */
-interface ExecutionPath {
-    description: string;
-    requiredDomains?: string[];
-    ttl?: {
-        default: number;
-        max: number;
-    };
-}
-/**
- * Agent Profile — defines constraint types, execution paths, gate questions,
- * and the frame/bounds/context schemas for bounded execution.
- *
- * Supports both v0.3 (frameSchema) and v0.4 (boundsSchema + contextSchema).
+ * Agent Profile — defines the bounds/scope/execution-context schemas, gates,
+ * TTL policy, and retention for a bounded authority (protocol.md → *Profiles*).
  */
 /**
  * A commitment mode a person can choose when signing a mandate. (`review_above_cap`
  * is not chosen by the signer — it follows from team caps.)
  */
 type SignableCommitmentMode = 'automatic' | 'review';
+/** protocol.md → *Owner Signatures* → "Where the requirement lives" — the
+ * profile-floor tier: `minBinding` names the weakest `OwnerSignatureBinding`
+ * this profile accepts for a co-signing owner. */
+interface ProfileOwnerSignatureFloor {
+    required: boolean;
+    minBinding?: OwnerSignatureBinding;
+}
 interface AgentProfile {
     id: string;
     name?: string;
@@ -505,9 +490,10 @@ interface AgentProfile {
      */
     whatsNew?: string;
     /**
-     * Whether receipts under this profile may be looked up BY THEIR CONTENT — a
-     * verifier holding the content supplies its hash and learns which receipts
-     * bind it, without needing a receipt id.
+     * Whether tickets under this profile may be looked up BY THEIR CONTENT — a
+     * verifier holding the content supplies its hash and learns which tickets
+     * bind it, without needing a ticket id. (Renamed from `receipt_lookup` in
+     * v0.7.)
      *
      * OFF unless declared, and that default is the point. The lookup is a
      * confirmation oracle: given a guess at the content it says whether that
@@ -519,13 +505,8 @@ interface AgentProfile {
      * Enable only when the bound content is unguessable enough that producing it
      * is equivalent to already having it: prose, an artifact URL, a whole record
      * payload. Never for a binding over a short value drawn from a small set.
-     *
-     * Why it must exist at all: most consequential actions cannot carry their
-     * receipt id. A released build was built before the receipt existed, a
-     * content-addressed artifact would change identity if the id were added, and
-     * a forwarded message has usually lost the footer that carried it.
      */
-    receipt_lookup?: boolean;
+    ticket_lookup?: boolean;
     /**
      * The commitment modes a mandate under this profile may be signed with.
      * Absent → every mode (`automatic`, `review`), as before this field existed.
@@ -539,21 +520,14 @@ interface AgentProfile {
      */
     commitment_modes?: readonly SignableCommitmentMode[];
     /**
-     * v0.3 frame schema (deprecated, kept for backward compat).
-     * Used when boundsSchema is not present.
-     */
-    frameSchema?: {
-        keyOrder: string[];
-        fields: Record<string, ProfileFrameField>;
-    };
-    /**
-     * v0.4 bounds schema — defines the authorization bounds parameters.
+     * The bounds schema — the enforceable parameters (protocol.md → *Bounds
+     * Schema*).
      */
     boundsSchema?: {
         keyOrder: string[];
         fields: Record<string, ProfileBoundsField>;
         /**
-         * v0.5+ registry of the action types this profile recognizes (e.g.
+         * Registry of the action types this profile recognizes (e.g.
          * `["send", "delete", "setup"]`). Every `execution.action_type` the
          * Authority Server and gateway accept for this profile MUST be a member
          * when the registry is declared (protocol.md → Bounds Schema, rule 2);
@@ -564,92 +538,45 @@ interface AgentProfile {
         actionTypes?: readonly string[];
     };
     /**
-     * v0.4 context schema — defines the execution context parameters (e.g., currency, action_type).
-     * May be absent or empty for profiles with no static context.
+     * The scope schema — operational scoping fields that stay local (renamed
+     * from `contextSchema` in v0.7). May be absent or empty for profiles with
+     * no static scope.
      */
-    contextSchema?: {
+    scopeSchema?: {
         keyOrder: string[];
-        fields: Record<string, ProfileContextField>;
+        fields: Record<string, ProfileScopeField>;
     };
     executionContextSchema: {
         fields: Record<string, ExecutionContextFieldDef>;
     };
-    /** @deprecated Execution paths removed in v0.4. Kept for backward compatibility. */
-    executionPaths?: Record<string, ExecutionPath>;
     requiredGates: string[];
-    /**
-     * v0.4: no gateQuestions — intent prompt is universal, defined in the gateway UI.
-     * v0.3: profile-specific gate questions (deprecated).
-     */
-    gateQuestions?: {
-        problem?: GateQuestion;
-        objective?: GateQuestion;
-        tradeoffs?: GateQuestion;
-    };
     ttl: {
         default: number;
         max: number;
     };
     retention_minimum: number;
     /**
-     * v0.5 Content Provenance (OPTIONAL, profile-bound). When present, the
+     * Content Provenance (OPTIONAL, profile-bound). When present, the
      * gateway computes a `contentHash` for gated writes under this profile and
-     * passes it (hash only) to the SP, which signs it into the receipt. Absent
+     * passes it (hash only) to the AS, which signs it into the ticket. Absent
      * → no content hash. See {@link ContentBinding}.
      */
     content_binding?: ContentBinding;
     /**
-     * Tool gating configuration — how MCP tools map to execution context.
-     * @deprecated Tool gating now lives in integration manifests (content/integrations/*.json).
-     * Kept for backward compatibility with profiles that still include it.
+     * The execution-context fields a ticket under this profile MAY disclose
+     * (new in v0.7 — protocol.md → *Ticket Disclosure Is Declared*). Absent →
+     * nothing is disclosed by default. A mandate's own `disclose_fields` (when
+     * present) MUST be a subset of this list — a mandate may narrow disclosure,
+     * never widen it.
      */
-    toolGating?: ProfileToolGating;
-}
-/**
- * Available transforms for array-aware execution mappings.
- * - length: array length → number
- * - join: array items joined by comma → string
- * - join_domains: extract email domains, deduplicate, sort, join → string
- */
-type ExecutionMappingTransform = 'join' | 'join_domains' | 'length';
-/**
- * Execution mapping value — how a tool argument maps to execution context field(s).
- * - string: direct copy (argName → fieldName)
- * - { field, divisor }: numeric division (e.g., cents ÷ 100 → EUR)
- * - { field, transform }: array transform (e.g., join_domains)
- * - Array form: one argument maps to multiple execution fields
- */
-type ExecutionMappingValue = string | {
-    field: string;
-    divisor: number;
-} | {
-    field: string;
-    transform: ExecutionMappingTransform;
-} | Array<{
-    field: string;
-    divisor?: number;
-    transform?: ExecutionMappingTransform;
-}>;
-/**
- * Tool gating entry — how a tool's calls map to execution context fields.
- * Read-only tools use { category: "read" } — they require authorization
- * but skip execution context verification.
- */
-interface ProfileToolGatingEntry {
-    executionMapping: Record<string, ExecutionMappingValue>;
-    staticExecution?: Record<string, string | number>;
-    /** Read-only tools: require authorization but no execution context checks */
-    category?: 'read';
-}
-/**
- * Profile-level tool gating configuration.
- * - default: applied to all tools not listed in overrides
- * - overrides: per-tool configs keyed by original MCP tool name
- *   Use { category: "read" } for read-only tools (null is deprecated)
- */
-interface ProfileToolGating {
-    default: ProfileToolGatingEntry;
-    overrides?: Record<string, ProfileToolGatingEntry | null>;
+    disclose_fields?: string[];
+    /**
+     * Profile-floor requirement for an owner signature on a mandate under this
+     * profile (protocol.md → *Owner Signatures* → "Where the requirement
+     * lives"). Reserved for domains that cannot mean anything without a
+     * signature — used more freely it forks `charge` from `charge-with-cosign`.
+     */
+    ownerSignature?: ProfileOwnerSignatureFloor;
 }
 /**
  * A recorded execution — stored after gatekeeper approval for cumulative tracking.
@@ -685,51 +612,47 @@ interface ExecutionLogQuery {
      */
     actionTypes?: readonly string[]): number;
 }
-/**
- * Agent frame parameters — mixed types (strings and numbers).
- * Keys and values come from the profile's frameSchema.
- */
-type AgentFrameParams = Record<string, string | number>;
 /**
  * Agent bounds parameters — mixed types (strings and numbers).
- * Keys and values come from the profile's boundsSchema (v0.4).
+ * Keys and values come from the profile's boundsSchema.
  */
 type AgentBoundsParams = Record<string, string | number>;
 /**
- * Agent context parameters — mixed types (strings and numbers).
- * Keys and values come from the profile's contextSchema (v0.4).
+ * Agent scope parameters — mixed types (strings and numbers). Keys and
+ * values come from the profile's scopeSchema (renamed from
+ * `AgentContextParams` in v0.7).
  */
-type AgentContextParams = Record<string, string | number>;
+type AgentScopeParams = Record<string, string | number>;
 /**
  * Request to the Gatekeeper for bounded execution verification.
  */
 interface GatekeeperRequest {
-    /** The authorization frame (what was attested to) — v0.3 */
-    frame: AgentFrameParams;
-    /** Attestation blobs (base64url) for each domain */
-    attestations: string[];
-    /** The agent's execution values for this specific action */
+    /** The bounds the mandate(s) committed to. */
+    bounds: AgentBoundsParams;
+    /** Mandate blobs (base64url) to verify against. */
+    mandates: string[];
+    /** The agent's execution values for this specific action. */
     execution: Record<string, string | number>;
-    /** v0.4: context parameters (currency, action_type, etc.) */
-    context?: AgentContextParams;
+    /** Scope parameters (currency, action_type, allowed recipients, etc.) —
+     * enforced locally only; never sent to the Authority Server. */
+    scope?: AgentScopeParams;
     /**
-     * Authorization path used to scope cumulative lookups in the execution log.
-     *
-     * Deliberately OUTSIDE `frame`: the frame is hashed and validated against the
-     * profile's boundsSchema, so an extra key there is rejected as an unknown
-     * field and breaks attestation verification outright. Cumulative checks
-     * previously read the path from the frame, where callers cannot legally put
-     * it — so it resolved to "" while the log stored real paths, no entry ever
-     * matched, and every running total read zero. The local gate existed but
-     * could never fire.
+     * Authorization path used to scope cumulative lookups in the execution log
+     * (display only — see {@link ExecutionLogQuery}; the Gatekeeper MUST NOT
+     * enforce cumulative bounds locally, protocol.md → *Enforcement Authority*).
      */
     path?: string;
 }
 /**
- * Structured error from Gatekeeper verification.
+ * Structured error from Gatekeeper verification. Codes are the canonical
+ * v0.7 surface ({@link HapErrorCode}, `src/errors.ts`) plus the two
+ * Gatekeeper-local-only codes that never reach the wire (`FRAME_MISMATCH`
+ * is retired with v0.3; a Gatekeeper reports `BOUNDS_HASH_MISMATCH` /
+ * `SCOPE_HASH_MISMATCH` for both its own local mismatch and the AS's wire
+ * refusal, per protocol.md → *Error Codes*, "Gatekeeper · local").
  */
 interface GatekeeperError {
-    code: 'BOUND_EXCEEDED' | 'CUMULATIVE_LIMIT_EXCEEDED' | 'INVALID_SIGNATURE' | 'TTL_EXPIRED' | 'FRAME_MISMATCH' | 'BOUNDS_MISMATCH' | 'CONTEXT_MISMATCH' | 'DOMAIN_NOT_COVERED' | 'INVALID_PROFILE' | 'MALFORMED_ATTESTATION' | 'INVALID_ACTION_TYPE' | 'ATTESTATION_REVOKED' | 'APPROVAL_REQUIRED' | 'IDEMPOTENCY_MISMATCH' | 'MANDATE_SIGNATURE_REQUIRED' | 'MANDATE_SIGNATURE_INVALID' | 'APPROVAL_SIGNATURE_REQUIRED' | 'APPROVAL_SIGNATURE_INVALID' | 'BOUNDS_INVALID_VALUE' | 'CONTEXT_INVALID_VALUE';
+    code: HapErrorCode;
     field?: string;
     message: string;
     bound?: string | number;
@@ -780,6 +703,46 @@ type GatekeeperResult = {
  */
 declare function canonicalize(value: unknown): string;
 
+/**
+ * base64url (RFC 4648 §5), strict — no padding, no standard-base64 characters.
+ *
+ * protocol.md → *Mandate Payload* rule 3: "Signatures MUST be encoded as
+ * base64url without padding ... Implementations MUST NOT use standard base64
+ * (which differs in `+`/`/` vs `-`/`_` and in padding) — third-party verifiers
+ * reading the spec literally will reject standard-base64 signatures."
+ *
+ * Earlier hap-core verifiers were lenient: they translated `+`/`/` back from
+ * `-`/`_` and re-added padding before decoding, so a standard-base64 signature
+ * verified exactly as well as a base64url one — silently accepting the wire
+ * format the spec forbids. v0.7 closes that: decoding a string that is not
+ * strict base64url throws, never silently repairs it.
+ */
+/** Encode bytes as base64url with no padding. */
+declare function toBase64Url(bytes: Uint8Array): string;
+/**
+ * Decode a STRICT base64url string (no padding, no `+`/`/`/`=`).
+ *
+ * @throws Error (no protocol code — the caller knows which artifact it was
+ * decoding and assigns the code) when the input carries a `+`, `/`, `=`, or
+ * any other byte outside the base64url alphabet.
+ */
+declare function fromBase64Url(s: string): Uint8Array;
+
+/** The protocol version this package issues and verifies. */
+declare const PROTOCOL_VERSION = "0.7";
+/** The protocol versions this package can verify and enforce. */
+declare const SUPPORTED_VERSIONS: readonly string[];
+/**
+ * The highest version both the requester and this implementation support.
+ *
+ * @param requested `supported_versions` from the mandate request. Absent →
+ * read as `["0.6"]` (protocol.md rule 1) — which, against this package's
+ * `SUPPORTED_VERSIONS`, has no overlap and refuses honestly rather than
+ * silently assuming `0.7`.
+ * @throws HapError `VERSION_UNSUPPORTED` when no version is common to both.
+ */
+declare function negotiateVersion(requested: readonly string[] | undefined, supported?: readonly string[]): string;
+
 /**
  * Content binding — Level 2 content proof (HAP v0.5 Content Provenance).
  *
@@ -884,6 +847,14 @@ declare function selectBoundFields(binding: ContentBinding, args: Record<string,
  * {@link selectBoundFields} + {@link computeContentHash} for the common path.
  */
 declare function computeFieldsContentHash(binding: ContentBinding, args: Record<string, unknown>): string;
+/**
+ * Why a binding's `field_kinds` is malformed, or null when it is fine (or
+ * absent). For profile validation — a malformed hint is a profile error, not
+ * a call-time refusal, because it never changes what is hashed.
+ */
+declare function invalidFieldKindsReason(binding: ContentBinding): string | null;
+/** The bound fields declared as `files` — sealed document fingerprints. */
+declare function filesFields(binding: ContentBinding): string[];
 
 /**
  * Intent hashing + intent-disclosure binding (HAP v0.5).
@@ -950,20 +921,17 @@ interface SubjectValidation {
  *  - `self_declared` ⇒ `low` / `self`, no disclosed name.
  *  - `as_vouched`    ⇒ `high` / `as`,  `verifier` required.
  *  - `eudi`          ⇒ `high` / `external`, `verifier` required — and, when the
- *    carrying attestation's `owner_mandates` are supplied, a corresponding
+ *    carrying mandate's `mandate_owners` are supplied, a corresponding
  *    entry with `binding:"eudi"` for this subject's DID.
  *  - `disclose.name` only at `assurance:"high"`.
  *
- * v0.6: `Subject.owner_signature` is deprecated and IGNORED here — it signed
- * the identity claim, not the mandate (see the field's deprecation note). The
- * signature-bearing object is the attestation's `owner_mandates` entry, which
+ * The signature-bearing object is the mandate's `mandate_owners` entry, which
  * is payload-level context this per-subject check cannot see on its own; pass
- * `opts.ownerMandates` to enforce the eudi ⇒ mandate-entry rule, omit it to
- * validate subject shape alone (pre-0.6 callers keep their behaviour minus
- * the retired owner_signature requirement).
+ * `opts.mandateOwners` to enforce the eudi ⇒ mandate-owner-entry rule, omit it
+ * to validate subject shape alone.
  */
 declare function validateSubject(subject: Subject, opts?: {
-    ownerMandates?: OwnerMandate[];
+    mandateOwners?: MandateOwnerEntry[];
 }): SubjectValidation;
 /**
  * The footer line for a subject — the ONE place this wording lives.
@@ -991,76 +959,38 @@ declare function deriveIdentityLine(subject: Subject | undefined | null, { opera
 }): string;
 
 /**
- * Frame Canonicalization for Agent Profiles
+ * Bounds & Scope Canonicalization (protocol.md → *Bounds & Scope
+ * Canonicalization*).
  *
- * Agent profiles support mixed-type fields (strings and numbers).
  * Canonical form: `key=value` records joined with LF, keys in the profile's
  * keyOrder. Values are stringified with String(value) — the shortest
  * round-trippable form for numbers — then percent-encoded per protocol.md
  * (`=`, `%`, and every byte outside printable ASCII); a value carrying a raw
  * LF/CR is refused, never normalized. See `canonicalRecords` below.
  *
- * v0.3: frameSchema
- * v0.4: boundsSchema + contextSchema (separate hashes)
+ * v0.3's `frameSchema` / `canonicalFrame` / `computeFrameHash` are retired
+ * with the rest of v0.3 (CLAUDE.md "Decided by the owner": no backward
+ * compatibility). v0.7 renames `contextSchema` → `scopeSchema` and
+ * `AgentContextParams` → `AgentScopeParams` (protocol.md → *Migration from
+ * v0.6*); the functions below follow suit (`canonicalContext` →
+ * `canonicalScope`, `computeContextHash` → `computeScopeHash`,
+ * `validateContextParams` → `validateScopeParams`).
  */
 
 /**
- * Validates frame parameters against the profile's frame schema.
- */
-declare function validateFrameParams(params: AgentFrameParams, profile: AgentProfile): {
-    valid: boolean;
-    errors: string[];
-};
-/**
- * Builds the canonical frame string from parameters.
- * All values are converted to strings. Keys are ordered per profile's keyOrder.
- *
- * @throws Error if any field fails validation
- */
-declare function canonicalFrame(params: AgentFrameParams, profile: AgentProfile): string;
-/**
- * Computes the frame hash from a canonical frame string.
- *
- * @returns Hash in format "sha256:<64 hex chars>"
- */
-declare function frameHash(canonicalFrameString: string): string;
-/**
- * Convenience: builds canonical frame and computes hash in one step.
- */
-declare function computeFrameHash(params: AgentFrameParams, profile: AgentProfile): string;
-/**
- * Validates bounds parameters against the profile's boundsSchema (v0.4).
+ * Validates bounds parameters against the profile's boundsSchema.
  */
 declare function validateBoundsParams(params: AgentBoundsParams, profile: AgentProfile): {
     valid: boolean;
     errors: string[];
 };
 /**
- * Validates context parameters against the profile's contextSchema (v0.4).
+ * Validates scope parameters against the profile's scopeSchema.
  */
-declare function validateContextParams(params: AgentContextParams, profile: AgentProfile): {
+declare function validateScopeParams(params: AgentScopeParams, profile: AgentProfile): {
     valid: boolean;
     errors: string[];
 };
-/**
- * Authoring-time check for `per_transaction` bound `requiredFor` (v0.8+):
- * entries must name a real `action_type` from the profile's declared
- * `boundsSchema.actionTypes` registry, and the field is only meaningful on
- * `per_transaction` bounds (see `BoundType`'s doc comment for why the other
- * kinds don't carry it).
- *
- * This is NOT wired into `registerProfile` or any enforcement path — nothing
- * in hap-core validates profile JSON at load time today (the pre-existing
- * `requiredFor` on a context/scope constraint has the same gap), so adding
- * an automatic refusal here would be new behaviour beyond this change's
- * scope. Call it explicitly from an authoring tool, a hap-profiles CI check,
- * or a test, to catch a `requiredFor` entry that can never match (misspelled
- * action type) or is attached to a bound kind that silently ignores it.
- *
- * Returns an empty array when the profile has no boundsSchema or nothing to
- * check — never throws.
- */
-declare function validateBoundsRequiredFor(profile: AgentProfile): string[];
 /**
  * Thrown when a value cannot be canonicalized at all — currently only for raw
  * LF/CR inside a value. Carries the protocol error code so callers can map it
@@ -1073,9 +1003,9 @@ declare function validateBoundsRequiredFor(profile: AgentProfile): string[];
  *    does not faithfully represent the input."
  */
 declare class CanonicalValueError extends Error {
-    readonly code: 'BOUNDS_INVALID_VALUE' | 'CONTEXT_INVALID_VALUE';
+    readonly code: 'BOUNDS_INVALID_VALUE' | 'SCOPE_INVALID_VALUE';
     readonly field: string;
-    constructor(code: 'BOUNDS_INVALID_VALUE' | 'CONTEXT_INVALID_VALUE', field: string, message: string);
+    constructor(code: 'BOUNDS_INVALID_VALUE' | 'SCOPE_INVALID_VALUE', field: string, message: string);
 }
 /**
  * Builds the canonical bounds string from parameters.
@@ -1087,29 +1017,29 @@ declare class CanonicalValueError extends Error {
  */
 declare function canonicalBounds(params: AgentBoundsParams, profile: AgentProfile): string;
 /**
- * Builds the canonical context string from parameters.
- * Keys are ordered per profile's contextSchema.keyOrder; values are encoded per
+ * Builds the canonical scope string from parameters.
+ * Keys are ordered per profile's scopeSchema.keyOrder; values are encoded per
  * protocol.md → *Value encoding* (see `canonicalRecords`).
- * For empty context (no contextSchema or no fields), returns "".
+ * For empty scope (no scopeSchema or no fields), returns "".
  *
  * @throws Error if any field fails validation
- * @throws CanonicalValueError (code CONTEXT_INVALID_VALUE) if a value carries a raw LF/CR
+ * @throws CanonicalValueError (code SCOPE_INVALID_VALUE) if a value carries a raw LF/CR
  */
-declare function canonicalContext(params: AgentContextParams, profile: AgentProfile): string;
+declare function canonicalScope(params: AgentScopeParams, profile: AgentProfile): string;
 /**
- * Computes the bounds hash from bounds parameters (v0.4).
+ * Computes the bounds hash from bounds parameters.
  *
  * @returns Hash in format "sha256:<64 hex chars>"
  */
 declare function computeBoundsHash(params: AgentBoundsParams, profile: AgentProfile): string;
 /**
- * Computes the context hash from context parameters (v0.4).
- * For empty context {}, returns the sha256 of "":
+ * Computes the scope hash from scope parameters.
+ * For empty scope {}, returns the sha256 of "":
  *   "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  *
  * @returns Hash in format "sha256:<64 hex chars>"
  */
-declare function computeContextHash(params: AgentContextParams, profile: AgentProfile): string;
+declare function computeScopeHash(params: AgentScopeParams, profile: AgentProfile): string;
 
 /**
  * Which commitment modes a profile allows its mandates to be signed with
@@ -1128,248 +1058,208 @@ declare const SIGNABLE_COMMITMENT_MODES: readonly SignableCommitmentMode[];
 declare function allowedCommitmentModes(profile: AgentProfile): readonly SignableCommitmentMode[];
 /** Whether a mandate under this profile may be signed with `mode`. */
 declare function isCommitmentModeAllowed(profile: AgentProfile, mode: string): boolean;
-/**
- * Authoring check for a profile's `commitment_modes` declaration — for
- * hap-profiles CI, an authoring tool or a test. Like `validateBoundsRequiredFor`
- * it is not wired into profile loading; enforcement reads the declaration
- * fail-closed through `allowedCommitmentModes`. Empty array = nothing to fix.
- */
-declare function validateCommitmentModes(profile: AgentProfile): string[];
-
-/**
- * Attestation Encoding, Decoding, and Verification
- *
- * Supports both v0.3 (frame_hash) and v0.4 (bounds_hash + context_hash).
- */
 
+/** One authoring-time finding. `code` is always a canonical v0.7 code — in
+ * practice always `PROFILE_INVALID`, since that is the only mandate-request
+ * refusal the protocol attributes to "the profile fails validation"
+ * (protocol.md → Error Codes). */
+interface ProfileValidationError {
+    code: HapErrorCode;
+    field?: string;
+    message: string;
+}
 /**
- * Decodes a base64url-encoded attestation blob.
- */
-declare function decodeAttestationBlob(blob: string): Attestation;
-/**
- * Encodes an attestation as a base64url blob (no padding).
- */
-declare function encodeAttestationBlob(attestation: Attestation): string;
-/**
- * Computes the attestation ID (hash of the blob).
+ * `profile_hash` — `"sha256:" + sha256(JCS(parsed))`, over the PARSED
+ * profile document. Formatting, key order, and a trailing newline on disk
+ * never change it (protocol.md → *Profile hash*; conformance vector set
+ * `profile-hash.json`).
  */
-declare function attestationId(blob: string): string;
+declare function computeProfileHash(parsed: unknown): string;
 /**
- * Verifies an attestation signature using the SP public key.
- *
- * @returns true if valid
- * @throws Error with code prefix if invalid
+ * Authoring-time structural validation (protocol.md → *Bounds Schema*,
+ * *Owner Signatures* → "Where the requirement lives", *Migration from
+ * v0.6*). Returns `[]` for a clean profile; never throws.
  */
-declare function verifyAttestationSignature(attestation: Attestation, publicKeyHex: string): Promise<void>;
+declare function validateProfile(profile: AgentProfile): ProfileValidationError[];
 /**
- * Checks if an attestation has expired.
+ * A mandate's `disclose_fields` MUST be a subset of the profile's own list
+ * (protocol.md → *Mandate Payload*, conditional field `disclose_fields`: "a
+ * subset of the profile's `disclose_fields` list"). A mandate may narrow
+ * disclosure, never widen it.
  *
- * @throws Error if expired
+ * @throws Error prefixed `MALFORMED_MANDATE:` when it is not a subset.
  */
-declare function checkAttestationExpiry(payload: AttestationPayload, now?: number): void;
+declare function checkDiscloseSubset(mandateDiscloseFields: readonly string[] | undefined, profileDiscloseFields: readonly string[] | undefined): void;
+
 /**
- * Verifies that the frame hash in the attestation matches the expected hash (v0.3).
+ * Mandate encoding, decoding, signing, and verification (v0.7).
  *
- * @throws Error if frame hash doesn't match
+ * Renamed from `attestation.ts` (protocol.md → *Migration from v0.6*:
+ * `header.typ: "HAP-attestation"` → `"HAP-mandate"`, `attestation_id` →
+ * `mandate_id`). v0.3's frame-hash path and v0.4's dual frame/bounds
+ * verification are retired with the rest of pre-v0.5 — this module issues
+ * and verifies `version: "0.7"` mandates only (CLAUDE.md "Decided by the
+ * owner": no backward-compat verify path for 0.5/0.6).
  */
-declare function verifyFrameHash(attestation: Attestation, expectedFrameHash: string): void;
+
 /**
- * Detects whether an attestation is v0.4 (has bounds_hash + context_hash)
- * or v0.3 (has frame_hash).
- *
- * Migration rule: if attestation has frame_hash but not bounds_hash, it is v0.3.
+ * Decodes a base64url-encoded mandate blob.
+ * @throws HapError `MALFORMED_MANDATE` on anything that is not a strict
+ * base64url-encoded JSON mandate.
  */
-declare function isV4Attestation(attestation: Attestation): boolean;
+declare function decodeMandateBlob(blob: string): Mandate;
 /**
- * Verifies that the bounds hash in the attestation matches the expected hash (v0.4).
- *
- * @throws Error if bounds hash doesn't match
+ * Encodes a mandate as a base64url blob (no padding).
  */
-declare function verifyBoundsHash(attestation: Attestation, expectedBoundsHash: string): void;
+declare function encodeMandateBlob(mandate: Mandate): string;
 /**
- * Verifies that the context hash in the attestation matches the expected hash (v0.4).
- *
- * @throws Error if context hash doesn't match
+ * Computes the mandate blob id (hash of the blob) — renamed from
+ * `attestationId`.
  */
-declare function verifyContextHash(attestation: Attestation, expectedContextHash: string): void;
+declare function mandateBlobId(blob: string): string;
 /**
- * Full attestation verification (signature + expiry + frame hash) — v0.3.
+ * Sign a mandate payload with the Authority Server's Ed25519 private key.
  *
- * @returns The decoded attestation payload
- * @throws Error on any validation failure
+ * @param opts.kid Optional key id for the envelope header. When present it
+ * MUST identify the same key as `payload.issuer` (Mandate rule 8) — this
+ * function does not enforce that on the signer's side; `verifyMandateSignature`
+ * enforces it on the verifier's side, where a mismatch is actually dangerous.
  */
-declare function verifyAttestation(blob: string, publicKeyHex: string, expectedFrameHash: string): Promise<AttestationPayload>;
+declare function signMandate(payload: MandatePayload, privateKey: Uint8Array, opts?: {
+    kid?: string;
+}): Promise<Mandate>;
 /**
- * Full attestation verification for v0.4 (signature + expiry + bounds_hash + context_hash).
+ * Verifies a mandate's Ed25519 signature. The verification key is resolved
+ * from `payload.issuer` itself — never from a key offered alongside the
+ * artifact (protocol.md → *Ticket Verification* step 1, which states the
+ * same rule for tickets; mandates follow it identically).
  *
- * @returns The decoded attestation payload
- * @throws Error on any validation failure
+ * @param opts.trustedIssuers When supplied, an `issuer` not in this list is
+ * rejected before any cryptography runs — "a verifier MUST reject a [...]
+ * whose `issuer` it does not trust" (protocol.md → *Ticket Verification*).
+ * @throws Error prefixed `INVALID_SIGNATURE:` on any verification failure.
  */
-declare function verifyAttestationV4(blob: string, publicKeyHex: string, expectedBoundsHash: string, expectedContextHash: string): Promise<AttestationPayload>;
-
+declare function verifyMandateSignature(mandate: Mandate, opts?: {
+    trustedIssuers?: readonly string[];
+}): Promise<void>;
 /**
- * Gatekeeper — Stateless Verification for Bounded Execution
- *
- * Supports both v0.3 (frameSchema / frame_hash) and v0.4 (boundsSchema + contextSchema /
- * bounds_hash + context_hash).
+ * Checks a mandate payload's time rules (Mandate rule 9): `expires_at` is
+ * authoritative, with a {@link CLOCK_SKEW_SECONDS} tolerance that never
+ * extends life past `expires_at + 300s`.
  *
- * v0.3 flow (§8.6):
- *   1. Resolve profile from frame
- *   2. Recompute frame_hash
- *   3. For each required domain: find attestation, verify signature, verify frame_hash, verify TTL
- *   4. Check bounds: max → actual <= bound, enum → actual in allowed
- *   5. Return { approved } or { approved: false, errors: [...] }
- *
- * v0.4 flow:
- *   1. Resolve profile from bounds.profile
- *   2. Recompute bounds_hash and context_hash
- *   3. For each required domain: find attestation, verify signature, verify bounds_hash + context_hash, verify TTL
- *   4. Check bounds (from boundsSchema), check context constraints (from contextSchema)
- *   5. Resolve cumulative fields, check cumulative limits
- *   6. Return { approved } or { approved: false, errors: [...] }
+ * @throws Error prefixed `TTL_EXPIRED:` when expired.
  */
-
+declare function checkMandateExpiry(payload: MandatePayload, now?: number): void;
 /**
- * Verify an execution request against attested authorization.
- *
- * For v0.4 profiles (have boundsSchema), the `frame` param is interpreted as `bounds`,
- * and the optional `context` param is used for the context hash check.
+ * Validates the structural shape of `mandate_owners` (Mandate rule 7):
+ * exactly one entry, `did` required, and the signature fields present
+ * together or absent together. A co-signing entry's `did` MUST be key-bearing.
  *
- * For v0.3 profiles (have frameSchema only), existing logic is used unchanged.
- *
- * @param request - The frame/bounds, attestations, execution values, and optional context
- * @param publicKeyHex - The SP's public key in hex (cached locally by MCP server)
- * @param now - Current timestamp in seconds (for testing)
- * @param executionLog - Optional execution log for resolving cumulative fields
+ * @throws HapError `MALFORMED_MANDATE` on a cardinality or completeness
+ * violation; `OWNER_SIGNATURE_INVALID` when a co-signing DID is not key-bearing.
  */
-declare function verify(request: GatekeeperRequest, publicKeyHex: string, now?: number, executionLog?: ExecutionLogQuery): Promise<GatekeeperResult>;
+declare function validateMandateOwners(payload: MandatePayload): void;
 /**
- * Which action types' executions count toward this cumulative bound's running
- * total. `undefined` means all of them.
+ * Full mandate verification: decode, check `version`, verify the AS
+ * signature, check expiry, validate `mandate_owners` shape.
  *
- * `boundGovernsAction` decides whether a bound applies to the current call; this
- * decides what the bound's total is made of. Both are needed: selecting the right
- * bound and then feeding it the profile's combined total is still wrong — sales'
- * "orders per day" was checked only on orders, but counted every quote and send.
- * Consumption is partitioned by action type (*Cumulative Tracking* rule 4), as
- * the Authority Server already does.
+ * Deliberately does NOT verify any `mandate_owners` co-signature — that is
+ * `verifyOwnerSignature` in `owner-signature.ts`, a separate trust axis the
+ * caller opts into.
  *
- * Same answer, same order of preference as `boundGovernsAction`: the declared
- * `appliesTo`; else, for a count bound named for an action (`delete_daily_max`),
- * that action; else every action type. Exported so display surfaces report the
- * same totals the gate enforces.
+ * @throws HapError `VERSION_UNSUPPORTED` for anything other than `"0.7"`.
+ * @throws Error (`INVALID_SIGNATURE:` / `TTL_EXPIRED:` / `MALFORMED_MANDATE:`
+ * prefixed, or `OWNER_SIGNATURE_INVALID` as a HapError) on any other failure.
  */
-declare function boundActionTypes(fieldName: string, fieldDef: ProfileBoundsField): readonly string[] | undefined;
+declare function verifyMandate(blob: string, opts?: {
+    trustedIssuers?: readonly string[];
+    now?: number;
+}): Promise<MandatePayload>;
 
 /**
- * Profile Registry — dynamically populated from git-hosted profile sources.
- */
-
-declare function registerProfile(profileId: string, profile: AgentProfile): void;
-declare function getProfile(profileId: string): AgentProfile | undefined;
-declare function listProfiles(): string[];
-declare function getAllProfiles(): AgentProfile[];
-declare function clearProfiles(): void;
-
-/**
- * did:key — encode/decode for KEY-BEARING DIDs (HAP v0.6).
- *
- * A real `did:key` is self-certifying: the public key IS the identifier, so
- * substituting the key produces a DIFFERENT DID and no key directory is ever
- * consulted. That property is what the Owner Mandate design stands on
- * (protocol.md → "Identity DIDs vs signing DIDs"): a signing DID MUST be
- * key-bearing, and verification uses the key carried in the identifier —
- * deliberately, there is no `public_key` field anywhere on the wire.
- *
- * Format (W3C did:key method, Ed25519):
- *   did:key:z<base58btc( 0xed 0x01 ‖ 32-byte-public-key )>
- * `z` is the multibase prefix for base58btc; `0xed 0x01` is the multicodec
- * varint for ed25519-pub. The result always starts `did:key:z6Mk`.
- *
- * Scope: Ed25519 only — the one signing curve this protocol version uses.
- * Anything else (including the reference implementation's legacy decorative
- * `did:key:<uuid-fragment>` identifiers) decodes as NOT key-bearing.
- */
-/** Encode a 32-byte Ed25519 public key as a key-bearing `did:key:z6Mk…`. */
-declare function encodeDidKey(publicKey: Uint8Array): string;
-/**
- * Decode a key-bearing `did:key` to its Ed25519 public key bytes.
- *
- * @throws Error prefixed `NOT_KEY_BEARING:` for anything that is not a valid
- * base58btc-multibase Ed25519 did:key — including the legacy decorative
- * `did:key:<uuid-fragment>` identifiers, other multibase prefixes, and other
- * key types. The error name is the point: under the mandate design, a
- * non-key-bearing signing DID must fail STRUCTURALLY, never fall back.
- */
-declare function decodeDidKey(did: string): Uint8Array;
-/** True iff the DID decodes as a key-bearing Ed25519 did:key. Never throws. */
-declare function isKeyBearingDid(did: string): boolean;
-
-/**
- * Owner Mandate Signatures (HAP v0.6) — the `HAP-mandate` projection, the
+ * Owner Signatures (v0.7) — the `HAP-mandate-projection` object, the
  * `HAP-approval` object, and their verification.
  *
+ * Renamed from `mandate.ts` (protocol.md → *Migration from v0.6*: the
+ * owner-signed projection's `typ` moves from `"HAP-mandate"` to
+ * `"HAP-mandate-projection"`, disambiguating it from the AS-signed mandate
+ * itself, which now legitimately owns the name `"HAP-mandate"`).
+ *
  * The human signs BEFORE the AS does, so they cannot sign the finished
- * attestation (`attestation_id`/`issued_at` do not exist yet). They sign a
- * mandate PROJECTION: a canonical object every field of which is known at
- * approval time and reconstructible from the finished attestation — so a
- * verifier rebuilds it from the attestation it already holds and checks the
- * signature with the key carried in the owner's DID. No side channel, no
- * second fetch, no key directory. See protocol.md → "Owner Mandate Signatures".
- *
- * Verification here requires NO trust in the AS. What it cannot do is tell the
- * verifier WHOSE key signed — confirming the DID belongs to the expected
- * person is the out-of-band step (protocol.md → "Identity DIDs vs signing
- * DIDs"), and it is the honest cost of cold verification.
+ * mandate (`mandate_id`/`issued_at` do not exist yet). They sign a mandate
+ * PROJECTION: a canonical object every field of which is known at approval
+ * time and reconstructible from the finished mandate — so a verifier
+ * rebuilds it from the mandate it already holds and checks the signature
+ * with the key carried in the owner's DID. No side channel, no second
+ * fetch, no key directory. See protocol.md → "Owner Signatures".
+ *
+ * Verification here requires NO trust in the AS. What it cannot do is tell
+ * the verifier WHOSE key signed — confirming the DID belongs to the
+ * expected person is the out-of-band step (protocol.md → "Verification
+ * procedure" step 5), and it is the honest cost of cold verification.
  */
 
-/** The object the owner signs — a canonical projection of the mandate. */
+/** The object the owner signs — a canonical projection of the mandate.
+ * Field absence is defined, not incidental (protocol.md → *The signed
+ * object: HAP-mandate-projection*): each conditional field is included
+ * exactly when the mandate carries it and omitted otherwise. */
 interface MandateProjection {
-    typ: 'HAP-mandate';
+    typ: 'HAP-mandate-projection';
     /** Projection/canonicalization version. A verifier MUST pin it. */
-    version: '0.6';
+    version: '0.7';
     profile_id: string;
-    /** The signing owner's own DID. MUST be a member of `resolved_owners`. */
+    /** Covered deliberately: the owner signs the profile's BYTES, not only its id. */
+    profile_hash: string;
+    /** The signing owner's own DID. MUST equal the carrying mandate's `mandate_owners[0].did`. */
     owner_did: string;
     bounds_hash: string;
-    context_hash: string;
+    scope_hash: string;
     execution_context_hash: string;
     gate_content_hashes: Record<string, string>;
-    /** Included iff the attestation carries one — binds ciphertext AND the
+    /** Included iff the mandate carries one — binds ciphertext AND the
      * frozen approver set, the swap this mechanism exists to stop. */
     intent_disclosure_hash?: string;
     commitment_mode: string;
+    /** Included together, iff `commitment_mode === "review_above_cap"`. */
+    above_cap_caps?: Record<string, number>;
+    above_cap_approvers?: string[];
+    /** Included iff the mandate narrows the profile's disclose_fields. */
+    disclose_fields?: string[];
     /** The replay defence: the human signs how long the authority lives. */
     expires_at: number;
     nonce: string;
 }
 /** Per-action approval, signed by the owner in `review` mode. Signing a
- * `reject` matters as much as a `commit`: a rejection the AS can discard is a
- * rejection that never happened. */
+ * `reject` matters as much as a `commit`: a rejection the AS can discard is
+ * a rejection that never happened. */
 interface ApprovalObject {
     typ: 'HAP-approval';
-    version: '0.6';
+    version: '0.7';
     proposal_id: string;
-    attestation_id: string;
+    /** Renamed from `attestation_id` in v0.7. */
+    mandate_id: string;
     decision: 'commit' | 'reject';
-    /** What was approved: the receipt's contentHash where the profile binds
+    /** What was approved: the ticket's contentHash where the profile binds
      * content; otherwise sha256 over the JCS of the proposal's argument set. */
     content_hash: string;
     decided_at: number;
     nonce: string;
 }
-declare class MandateError extends Error {
-    code: 'MANDATE_SIGNATURE_INVALID' | 'APPROVAL_SIGNATURE_INVALID' | 'NOT_KEY_BEARING' | 'OWNER_NOT_RESOLVED' | 'MALFORMED_ATTESTATION';
-    constructor(code: 'MANDATE_SIGNATURE_INVALID' | 'APPROVAL_SIGNATURE_INVALID' | 'NOT_KEY_BEARING' | 'OWNER_NOT_RESOLVED' | 'MALFORMED_ATTESTATION', message: string);
+/** Renamed from `MandateError` in v0.7 — carries a canonical {@link HapErrorCode}. */
+declare class OwnerSignatureError extends Error {
+    code: HapErrorCode;
+    constructor(code: HapErrorCode, message: string);
 }
 /**
- * Rebuild the projection a given `owner_mandates` entry signed, from the
- * attestation's own signed fields. Field absence is defined, not incidental:
- * `intent_disclosure_hash` is included iff the attestation carries one.
+ * Rebuild the projection a given `mandate_owners` entry signed, from the
+ * mandate's own signed fields. Field absence is defined, not incidental:
+ * `intent_disclosure_hash`, `above_cap_caps`/`above_cap_approvers`, and
+ * `disclose_fields` are included iff the mandate carries them.
  */
-declare function buildMandateProjection(payload: AttestationPayload, entry: Pick<OwnerMandate, 'did' | 'nonce'>): MandateProjection;
-/** The exact bytes an owner signs: RFC 8785 (JCS) canonical UTF-8. */
-declare function mandateSigningBytes(projection: MandateProjection): Uint8Array;
+declare function buildMandateProjection(payload: MandatePayload, entry: Pick<MandateOwnerEntry, 'did' | 'nonce'>): MandateProjection;
+/** The exact bytes an owner signs: RFC 8785 (JCS) canonical UTF-8. Renamed
+ * from `mandateSigningBytes` in v0.7. */
+declare function projectionSigningBytes(projection: MandateProjection): Uint8Array;
 /** The exact bytes an owner signs for a per-action approval. */
 declare function approvalSigningBytes(approval: ApprovalObject): Uint8Array;
 /**
@@ -1382,40 +1272,61 @@ declare function signMandateProjection(projection: MandateProjection, privateKey
 /** Sign an approval object with a raw Ed25519 private key (`raw` binding). */
 declare function signApproval(approval: ApprovalObject, privateKey: Uint8Array): Promise<string>;
 /**
- * Verify ONE `owner_mandates` entry against the attestation that carries it.
+ * Verify ONE `mandate_owners` entry against the mandate that carries it.
  *
- * Steps (protocol.md → "Verification procedure", steps 4 of 6): membership in
- * `resolved_owners`, key-bearing DID, projection reconstruction, Ed25519 over
- * JCS bytes. The DID is authoritative over `alg` — a disagreement is
- * MANDATE_SIGNATURE_INVALID, never a fallback to the claimed algorithm.
+ * Steps (protocol.md → "Verification procedure", step 4 of 6): the entry
+ * names this mandate's sole owner, its signing DID is key-bearing,
+ * projection reconstruction, Ed25519 over JCS bytes. The DID is
+ * authoritative over `alg` — a disagreement is `OWNER_SIGNATURE_INVALID`,
+ * never a fallback to the claimed algorithm.
  *
- * What this deliberately does NOT verify: that the DID belongs to the person
- * the verifier expects (out-of-band, step 5) and the AS's own signature over
- * the attestation (verifyAttestationSignature, step 1).
+ * What this deliberately does NOT verify: that the DID belongs to the
+ * person the verifier expects (out-of-band, step 5) and the AS's own
+ * signature over the mandate (`verifyMandateSignature`, step 1).
  */
-declare function verifyOwnerMandate(attestation: Attestation, entry: OwnerMandate): Promise<void>;
-/** Verify every `owner_mandates` entry an attestation carries. Resolves to the
- * verified entries; an attestation with none resolves to `[]` (the v0.5
- * posture — nothing to check, and nothing claimed). */
-declare function verifyOwnerMandates(attestation: Attestation): Promise<OwnerMandate[]>;
+declare function verifyOwnerSignature(mandate: Mandate, entry: MandateOwnerEntry): Promise<void>;
+/** Verify every co-signing `mandate_owners` entry a mandate carries (i.e.
+ * every entry that carries a signature). Resolves to the verified entries;
+ * a mandate with none resolves to `[]` — nothing to check, nothing claimed. */
+declare function verifyOwnerSignatures(mandate: Mandate): Promise<MandateOwnerEntry[]>;
 /** Verify an approval signature against a signer's key-bearing DID. */
 declare function verifyApproval(approval: ApprovalObject, signature: string, signerDid: string): Promise<void>;
+/**
+ * Enforce a profile's `ownerSignature` floor (protocol.md → *Owner
+ * Signatures* → "Where the requirement lives" — the profile-floor tier,
+ * checkable without trusting the AS: `profile_id`/`profile_hash` are in the
+ * signed payload AND in the owner-signed projection).
+ *
+ * An unknown `binding` value is treated as rank 0 (weakest) rather than
+ * rejected outright — "an AS MUST NOT reject a mandate_owners entry solely
+ * because it does not recognize its binding value" extends naturally to a
+ * verifier ranking it, since crediting an unrecognized binding with
+ * unearned strength would be the more dangerous failure mode.
+ *
+ * @throws OwnerSignatureError `OWNER_SIGNATURE_REQUIRED` when the floor is
+ * unmet — "MUST fail, not warn" (protocol.md, same section).
+ */
+declare function checkOwnerSignatureRequirement(payload: MandatePayload, floor: ProfileOwnerSignatureFloor | undefined): void;
 
 /**
- * Execution receipts (HAP v0.5/v0.6) — the wire type and holder-side
- * verification. Until v0.6 this library had no receipt surface at all; every
- * verifier hand-assembled the strip→canonicalize→verify dance. This module is
- * that dance, once.
+ * Mandate tickets (v0.7) — the wire type, signing, and holder-side
+ * verification. Renamed from `receipt.ts` (protocol.md → *Mandate Tickets*:
+ * "v0.4 introduced the object under the name execution receipt; v0.7 renames
+ * it because the tense was wrong — a receipt follows payment, and the ticket
+ * must come first").
  *
- * Receipt payloads are camelCase on the wire (unlike the snake_case
- * attestation payload) — a shipped inconsistency v0.6 chose to document
- * rather than break (changelog.md → "Renames and terminology").
+ * Ticket payloads are camelCase on the wire (unlike the snake_case mandate
+ * payload) — a shipped inconsistency the spec documents rather than breaks
+ * (protocol.md → *Migration from v0.6*, "Unchanged on purpose").
  */
 
-/** Signed execution receipt — protocol.md → "Receipt Payload Schema". */
-interface ReceiptPayload {
+/** Signed mandate ticket — protocol.md → *Ticket Payload Schema*. */
+interface TicketPayload {
     id: string;
-    groupId?: string | null;
+    /** The mandate this ticket was issued under (new in v0.7). Audit and
+     * chain-of-custody only — `boundsHash` remains the AS's lookup key. */
+    mandateId: string;
+    groupId: string | null;
     userId?: string;
     boundsHash: string;
     profileId: string;
@@ -1425,35 +1336,169 @@ interface ReceiptPayload {
     actionType: string;
     executionContext: Record<string, unknown>;
     cumulativeState?: Record<string, unknown>;
-    limits?: Record<string, unknown>;
+    /** The mandate's plaintext bounds object, exactly as the AS enforced them
+     * for this ticket (new in v0.7 — required). */
+    limits: Record<string, unknown>;
+    /** Protocol version of the ticket — the version of the mandate it was
+     * issued under (new in v0.7). */
+    version: string;
+    /** The AS DID, as in the mandate (new in v0.7). */
+    issuer: string;
     timestamp: number;
-    /** v0.6 — hash of the bound content, computed by the Gatekeeper, copied
+    /** Hash of the bound content, computed by the Gatekeeper, copied
      * verbatim by the AS. The AS never sees the content. */
     contentHash?: string;
-    /** v0.6 — the binding declaration echoed into the signed receipt, so a
+    /** The binding declaration echoed into the signed ticket, so a
      * verifier knows exactly what `contentHash` covers. */
     contentBinding?: Pick<ContentBinding, 'version' | 'kind' | 'fields' | 'required_fields' | 'appliesTo'>;
-    /** v0.6 — disclosed subset of the attestation's identity overlay. */
+    /** Disclosed subset of the mandate's identity overlay. */
     subjects?: Subject[];
-    /** v0.6 — review path: the proposal this receipt executed. */
+    /** Review path: the proposal this ticket executed. */
     proposalId?: string;
-    /** v0.6 — review path: the owner's HAP-approval signature (or its sha256)
-     * for the executed proposal. */
-    approvalSignature?: string;
+    /** Review path: the owner's HAP-approval signature for the executed
+     * proposal, as the object itself — never a hash of it, which a holder
+     * could check only by asking the AS. */
+    approvalSignature?: {
+        alg: 'EdDSA' | 'ES256';
+        signature: string;
+        nonce: string;
+        decided_at: number;
+    };
     /** Ed25519 over the JCS-canonical payload (this field excluded), base64url. */
     signature: string;
 }
 /**
- * Verify a receipt's AS signature: strip `signature`, JCS-canonicalize the
- * rest, Ed25519-verify against the AS public key (hex). This is holder-side
- * verification — it needs the COMPLETE receipt; a redacted public view cannot
- * be re-verified this way (protocol.md → "Receipt Verification").
+ * Sign a ticket payload with the Authority Server's Ed25519 private key —
+ * the same key used for mandates.
+ */
+declare function signTicket(payload: Omit<TicketPayload, 'signature'>, privateKey: Uint8Array): Promise<TicketPayload>;
+/**
+ * Verify a ticket's AS signature: strip `signature`, JCS-canonicalize the
+ * rest, Ed25519-verify against the key resolved from `issuer` — never
+ * against a key offered alongside the ticket (protocol.md → *Ticket
+ * Verification* step 1). This is holder-side verification — it needs the
+ * COMPLETE ticket; a redacted public view cannot be re-verified this way
+ * (see {@link publicTicketView}).
  *
- * Content is checked separately: where `contentHash` is present, recompute it
- * from the held artifact via the content-binding module and compare.
+ * Content is checked separately: where `contentHash` is present, recompute
+ * it from the held artifact via the content-binding module and compare.
  *
+ * @param opts.trustedIssuers When supplied, an `issuer` not in this list is
+ * rejected before any cryptography runs.
  * @throws Error prefixed `INVALID_SIGNATURE:` when verification fails.
  */
-declare function verifyReceiptSignature(receipt: ReceiptPayload, publicKeyHex: string): Promise<void>;
+declare function verifyTicketSignature(ticket: TicketPayload, opts?: {
+    trustedIssuers?: readonly string[];
+}): Promise<void>;
+/**
+ * A redacted public view of a ticket (new in v0.7 — protocol.md → *Ticket
+ * Disclosure Is Declared*, *Ticket Verification*). Hides `userId`,
+ * `cumulativeState`, and `limits` unconditionally, and narrows
+ * `executionContext` to exactly the keys named by `governingDiscloseFields`
+ * (the mandate's `disclose_fields` where present, otherwise the profile's).
+ *
+ * Disclose NOTHING by default: an empty or absent `governingDiscloseFields`
+ * strips `executionContext` entirely. "The holder is the verifier" — this
+ * view is NOT independently re-verifiable against `signature` (it is missing
+ * signed fields); a "signature valid" indicator on a page showing only this
+ * view is the AS re-verifying its own signature, and implementations MUST
+ * NOT present it as independently verified.
+ */
+declare function publicTicketView(ticket: TicketPayload, governingDiscloseFields?: readonly string[]): Omit<TicketPayload, 'userId' | 'cumulativeState' | 'limits'>;
+
+/**
+ * Gatekeeper — local (Phase 1) verification for bounded execution (v0.7).
+ *
+ * protocol.md → *Validation Steps* (Phase 1, never reaches the wire):
+ *   1. Resolve profile from bounds.profile
+ *   2. Recompute bounds_hash and scope_hash
+ *   3. For each mandate: decode, verify AS signature, verify version,
+ *      verify bounds_hash / scope_hash / profile_hash, verify expiry
+ *   4. Check actionType registry membership
+ *   5. Check per_transaction bounds and enum capability flags locally
+ *      (Enforcement Authority: this is what makes per_transaction
+ *      compromise-resistant — *Enforcement classes*)
+ *   6. Check scope constraints (enum, subset, requiredFor) locally — the AS
+ *      never sees scope plaintext, so the Gatekeeper is the sole enforcer
+ *   7. Return { approved } or { approved: false, errors: [...] }
+ *
+ * What this module deliberately does NOT do (protocol.md → *Enforcement
+ * Authority*, *Migration from v0.6* semantic change 9): enforce
+ * `cumulative_sum` / `cumulative_count` bounds. "Local cumulative
+ * enforcement is removed, not merely deprecated: a Gatekeeper MUST NOT
+ * refuse an execution on a cumulative bound from its own records" — only
+ * the Authority Server's ticket history is authoritative for a running
+ * total across every Gatekeeper exercising the bucket. v0.3/v0.4's
+ * frame-based path is retired entirely (CLAUDE.md "Decided by the owner").
+ */
+
+/** Options for {@link verify}. */
+interface VerifyOptions {
+    /** Restricts mandate-signature verification to these Authority Server
+     * DIDs — protocol.md → *Ticket Verification* step 1 applies identically
+     * to mandates: "a verifier MUST reject a [...] whose issuer it does not
+     * trust." Omitted → any issuer that resolves a valid did:key is accepted
+     * (appropriate for a Gatekeeper that has not yet pinned an AS). */
+    trustedIssuers?: readonly string[];
+    now?: number;
+}
+/**
+ * Verify an execution request against the mandates supplied.
+ *
+ * @param request bounds, mandate blobs, execution values, and optional scope
+ */
+declare function verify(request: GatekeeperRequest, opts?: VerifyOptions): Promise<GatekeeperResult>;
+/**
+ * Which action types' executions count toward this cumulative bound's
+ * running total — `undefined` means all of them. Display-only now that
+ * local cumulative enforcement is removed (protocol.md → *Enforcement
+ * Authority*: cumulative bounds are AS-only). Exported so a gateway's own
+ * usage display partitions totals the same way the Authority Server does.
+ */
+declare function boundActionTypes(fieldName: string, fieldDef: ProfileBoundsField): readonly string[] | undefined;
+
+/**
+ * Profile Registry — dynamically populated from git-hosted profile sources.
+ */
+
+declare function registerProfile(profileId: string, profile: AgentProfile): void;
+declare function getProfile(profileId: string): AgentProfile | undefined;
+declare function listProfiles(): string[];
+declare function getAllProfiles(): AgentProfile[];
+declare function clearProfiles(): void;
+
+/**
+ * did:key — encode/decode for KEY-BEARING DIDs (HAP v0.6).
+ *
+ * A real `did:key` is self-certifying: the public key IS the identifier, so
+ * substituting the key produces a DIFFERENT DID and no key directory is ever
+ * consulted. That property is what the Owner Mandate design stands on
+ * (protocol.md → "Identity DIDs vs signing DIDs"): a signing DID MUST be
+ * key-bearing, and verification uses the key carried in the identifier —
+ * deliberately, there is no `public_key` field anywhere on the wire.
+ *
+ * Format (W3C did:key method, Ed25519):
+ *   did:key:z<base58btc( 0xed 0x01 ‖ 32-byte-public-key )>
+ * `z` is the multibase prefix for base58btc; `0xed 0x01` is the multicodec
+ * varint for ed25519-pub. The result always starts `did:key:z6Mk`.
+ *
+ * Scope: Ed25519 only — the one signing curve this protocol version uses.
+ * Anything else (including the reference implementation's legacy decorative
+ * `did:key:<uuid-fragment>` identifiers) decodes as NOT key-bearing.
+ */
+/** Encode a 32-byte Ed25519 public key as a key-bearing `did:key:z6Mk…`. */
+declare function encodeDidKey(publicKey: Uint8Array): string;
+/**
+ * Decode a key-bearing `did:key` to its Ed25519 public key bytes.
+ *
+ * @throws Error prefixed `NOT_KEY_BEARING:` for anything that is not a valid
+ * base58btc-multibase Ed25519 did:key — including the legacy decorative
+ * `did:key:<uuid-fragment>` identifiers, other multibase prefixes, and other
+ * key types. The error name is the point: under the mandate design, a
+ * non-key-bearing signing DID must fail STRUCTURALLY, never fall back.
+ */
+declare function decodeDidKey(did: string): Uint8Array;
+/** True iff the DID decodes as a key-bearing Ed25519 did:key. Never throws. */
+declare function isKeyBearingDid(did: string): boolean;
 
-export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type ApprovalObject, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, CanonicalValueError, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type MandateBinding, MandateError, type MandateProjection, type OwnerMandate, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ReceiptPayload, type ResolvedDomain, SIGNABLE_COMMITMENT_MODES, type SignableCommitmentMode, type SigningSurface, type Subject, type SubjectValidation, allowedCommitmentModes, approvalSigningBytes, attestationId, bindingAppliesTo, boundActionTypes, buildMandateProjection, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFieldsContentHash, computeFrameHash, computeIntentDisclosureHash, computeIntentHash, contentCanonicalBytes, decodeAttestationBlob, decodeDidKey, deriveIdentityLine, encodeAttestationBlob, encodeDidKey, frameHash, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isCommitmentModeAllowed, isFieldBinding, isKeyBearingDid, isV4Attestation, listProfiles, mandateSigningBytes, registerProfile, selectBoundFields, signApproval, signMandateProjection, validateBoundsParams, validateBoundsRequiredFor, validateCommitmentModes, validateContextParams, validateFrameParams, validateSubject, verify, verifyApproval, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash, verifyOwnerMandate, verifyOwnerMandates, verifyReceiptSignature };
+export { type AgentBoundsParams, type AgentProfile, type AgentScopeParams, type ApprovalObject, type BoundType, CanonicalValueError, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type ContentFieldKind, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type FieldConstraint, type FieldUnit, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, HapError, type HapErrorCode, MANDATE_ERROR_CODES, type Mandate, type MandateHeader, type MandateOwnerEntry, type MandatePayload, type MandateProjection, type OwnerSignatureBinding, OwnerSignatureError, PROTOCOL_VERSION, type ProfileBoundsField, type ProfileOwnerSignatureFloor, type ProfileScopeField, type ProfileValidationError, SIGNABLE_COMMITMENT_MODES, SUPPORTED_VERSIONS, type SignableCommitmentMode, type SigningSurface, type Subject, type SubjectValidation, TICKET_ERROR_CODES, type TicketPayload, type VerifyOptions, allowedCommitmentModes, approvalSigningBytes, bindingAppliesTo, boundActionTypes, buildMandateProjection, canonicalBounds, canonicalScope, canonicalize, canonicalizeText, checkDiscloseSubset, checkMandateExpiry, checkOwnerSignatureRequirement, clearProfiles, computeBoundsHash, computeContentHash, computeFieldsContentHash, computeIntentDisclosureHash, computeIntentHash, computeProfileHash, computeScopeHash, contentCanonicalBytes, decodeDidKey, decodeMandateBlob, deriveIdentityLine, encodeDidKey, encodeMandateBlob, filesFields, fromBase64Url, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, invalidFieldKindsReason, isCommitmentModeAllowed, isFieldBinding, isKeyBearingDid, listProfiles, mandateBlobId, negotiateVersion, projectionSigningBytes, publicTicketView, registerProfile, selectBoundFields, signApproval, signMandate, signMandateProjection, signTicket, toBase64Url, validateBoundsParams, validateMandateOwners, validateProfile, validateScopeParams, validateSubject, verify, verifyApproval, verifyMandate, verifyMandateSignature, verifyOwnerSignature, verifyOwnerSignatures, verifyTicketSignature };