@humanagencyp/hap-core 0.12.0 → 0.13.0

package/dist/index.d.mts

@@ -1,23 +1,22 @@
 /**
- * Canonical v0.7 error codes — protocol.md → *Error Codes*.
+ * Canonical v0.8 error codes — protocol.md → *Error Codes*.
  *
  * "Error codes are canonical across the protocol. Implementations MUST emit
  * exactly these codes and MUST NOT alias them under different names." This
  * module is the single list both the Gatekeeper (local checks) and any AS
  * client built on this library read from, so the two cannot drift.
  *
- * v0.7 renamed every code that carried a retired word (attestation → mandate,
- * context → scope, receipt → ticket) — see protocol.md → *Migration from
- * v0.6* → "Error-code renames" for the old→new map. There is no alias: a v0.6
- * code name is simply gone from this list, by design (no backward
- * compatibility — CLAUDE.md "Decided by the owner").
+ * v0.8 adds codes and retires none; every v0.7 code keeps its name.
  */
 /** Codes an Authority Server (or a local Gatekeeper check) emits refusing a mandate request. */
-declare const MANDATE_ERROR_CODES: readonly ["BOUNDS_HASH_MISMATCH", "SCOPE_HASH_MISMATCH", "INVALID_SIGNATURE", "OWNER_NOT_COVERED", "TTL_EXPIRED", "PROFILE_NOT_FOUND", "PROFILE_INVALID", "PROFILE_HASH_MISMATCH", "COVERAGE_INSUFFICIENT", "MALFORMED_MANDATE", "VERSION_UNSUPPORTED", "OWNER_NOT_APPROVER", "BOUNDS_INVALID_VALUE", "SCOPE_INVALID_VALUE", "ABOVE_CAP_CONFIG_INVALID", "OWNER_SIGNATURE_REQUIRED", "OWNER_SIGNATURE_INVALID"];
-/** Codes an Authority Server emits refusing a ticket request. */
-declare const TICKET_ERROR_CODES: readonly ["MANDATE_NOT_FOUND", "MANDATE_EXPIRED", "MANDATE_REVOKED", "BOUND_EXCEEDED", "CUMULATIVE_LIMIT_EXCEEDED", "COVERAGE_INSUFFICIENT", "PROFILE_NOT_FOUND", "INVALID_ACTION_TYPE", "APPROVAL_REQUIRED", "PROPOSAL_REQUIRED", "PROPOSAL_NOT_FOUND", "PROPOSAL_NOT_APPROVED", "PROPOSAL_EXPIRED", "PROPOSAL_REJECTED", "PROPOSAL_MISMATCH", "PROPOSAL_MANDATE_MISMATCH", "PROPOSAL_ALREADY_EXECUTED", "MALFORMED_TICKET_REQUEST", "IDEMPOTENCY_KEY_REQUIRED", "IDEMPOTENCY_MISMATCH", "APPROVAL_SIGNATURE_REQUIRED", "APPROVAL_SIGNATURE_INVALID"];
+declare const MANDATE_ERROR_CODES: readonly ["BOUNDS_HASH_MISMATCH", "SCOPE_HASH_MISMATCH", "INVALID_SIGNATURE", "OWNER_NOT_COVERED", "TTL_EXPIRED", "PROFILE_NOT_FOUND", "PROFILE_INVALID", "PROFILE_HASH_MISMATCH", "COVERAGE_INSUFFICIENT", "MALFORMED_MANDATE", "VERSION_UNSUPPORTED", "OWNER_NOT_APPROVER", "BOUNDS_INVALID_VALUE", "SCOPE_INVALID_VALUE", "ABOVE_CAP_CONFIG_INVALID", "COMMITMENT_MODE_NOT_ALLOWED", "GROUP_CAP_EXCEEDED", "OWNER_SIGNATURE_REQUIRED", "OWNER_SIGNATURE_INVALID"];
+/** Codes an Authority Server emits refusing a ticket request, plus the
+ * Gatekeeper-local and verifier codes of the same table. */
+declare const TICKET_ERROR_CODES: readonly ["MANDATE_NOT_FOUND", "MANDATE_EXPIRED", "MANDATE_REVOKED", "BOUND_EXCEEDED", "CUMULATIVE_LIMIT_EXCEEDED", "COVERAGE_INSUFFICIENT", "PROFILE_NOT_FOUND", "INVALID_ACTION_TYPE", "APPROVAL_REQUIRED", "APPROVAL_IMPOSSIBLE", "PROPOSAL_CONTENT_MISMATCH", "PROPOSAL_REQUIRED", "PROPOSAL_NOT_FOUND", "PROPOSAL_NOT_APPROVED", "PROPOSAL_EXPIRED", "PROPOSAL_REJECTED", "PROPOSAL_MISMATCH", "PROPOSAL_MANDATE_MISMATCH", "PROPOSAL_ALREADY_EXECUTED", "PROPOSAL_WITHDRAWN", "MALFORMED_TICKET_REQUEST", "CONTENT_BINDING_INCOMPLETE", "IDEMPOTENCY_KEY_REQUIRED", "IDEMPOTENCY_MISMATCH", "APPROVAL_SIGNATURE_REQUIRED", "APPROVAL_SIGNATURE_INVALID", "TICKET_REQUEST_MISMATCH", "POLICY_UNMET"];
+/** Codes an Authority Server emits refusing a proposal submission or a decision (v0.8). */
+declare const PROPOSAL_ERROR_CODES: readonly ["PROPOSAL_NOT_ENCRYPTED", "DECIDER_INVALID", "PROPOSAL_ALREADY_DECIDED", "PROPOSAL_APPROVERS_INVALID"];
 /** The full canonical surface — every code a conformant implementation may emit. */
-type HapErrorCode = (typeof MANDATE_ERROR_CODES)[number] | (typeof TICKET_ERROR_CODES)[number];
+type HapErrorCode = (typeof MANDATE_ERROR_CODES)[number] | (typeof TICKET_ERROR_CODES)[number] | (typeof PROPOSAL_ERROR_CODES)[number];
 /**
  * A refusal carrying one of the canonical codes above. Thrown by local
  * (Gatekeeper-side, no-wire-round-trip) checks in this library; an AS client
@@ -108,10 +107,14 @@ interface Subject {
     /** When the underlying verification was performed (unix seconds). */
     verified_at?: number;
 }
-/** protocol.md → *Mandate Payload (v0.7)*. */
+/** The protocol version an artifact was issued under. This package verifies
+ * each under its own rules (protocol.md → *Version negotiation*, rule 4). */
+type ProtocolVersion = '0.8' | '0.7';
+/** protocol.md → *Mandate Payload (v0.8)*; a `"0.7"` payload is the same shape
+ * without `above_cap_approvals` and without the v0.8 owner-signed fields. */
 interface MandatePayload {
     mandate_id: string;
-    version: '0.7';
+    version: ProtocolVersion;
     profile_id: string;
     /** Hash of the canonical bounds string. */
     bounds_hash: string;
@@ -128,10 +131,16 @@ interface MandatePayload {
     /** Exactly one entry in v0.7 (Mandate rule 7). */
     mandate_owners: MandateOwnerEntry[];
     gate_content_hashes: Record<string, string>;
-    commitment_mode: 'automatic' | 'review' | 'review_above_cap';
-    /** Required, together with `above_cap_approvers`, iff `commitment_mode === "review_above_cap"`. */
+    commitment_mode: CommitmentMode;
+    /** Present together with `above_cap_approvers` and (v0.8) `above_cap_approvals`:
+     * under `review_above_cap`, or `review` in a group with approval-kind caps
+     * the owner's mandate can reach (protocol.md → *Group roles*, rule 7). */
     above_cap_caps?: Record<string, number>;
     above_cap_approvers?: string[];
+    /** v0.8 — how many distinct `above_cap_approvers`, other than the Mandate
+     * Owner, must approve. Integer ≥ 1. Present exactly when
+     * `above_cap_approvers` is (Mandate rule 10). A v0.7 mandate carries none. */
+    above_cap_approvals?: number;
     /**
      * Present iff the mandate carries an encrypted-intent disclosure object
      * (companion spec `intent-disclosure@0.1`) — `sha256:`-prefixed hash
@@ -317,6 +326,15 @@ interface ProfileBoundsField {
      * min(value, maximum). Absent → no ceiling.
      */
     maximum?: number;
+    /**
+     * v0.8 (Bounds Schema rule 11) — a bound only the Gatekeeper enforces, such
+     * as a read window whose actions produce no ticket. The Authority Server
+     * still verifies the value at issuance (`maximum`, enum membership, any
+     * group ceiling) and never reads it at ticket time. A group cap on such a
+     * bound is always hard, and the signed value is the ceiling (*Group
+     * ceilings*).
+     */
+    enforcedBy?: 'gatekeeper';
 }
 /**
  * v0.5 Content Provenance — how a profile's action content is hashed into a
@@ -384,7 +402,23 @@ interface ContentBinding {
      * Absent → the binding applies to every gated action under the profile.
      */
     appliesTo?: string[];
+    /**
+     * v2 only — what kind of value each bound field holds, so a verifier (or any
+     * view) can collect and show it without guessing from the field's name:
+     * - `text`  — one string (an email body);
+     * - `list`  — an array of strings (recipients);
+     * - `files` — the sealed fingerprints of documents sent by reference:
+     *   `[{ filename, sha256 }]` — never the bytes. A verifier asks for the
+     *   files themselves and computes each SHA-256 locally.
+     *
+     * A hint only: it never changes what is hashed. Keys MUST be a subset of
+     * {@link fields}; a field without an entry is unspecified (a verifier may
+     * offer a choice, as before).
+     */
+    field_kinds?: Record<string, ContentFieldKind>;
 }
+/** See {@link ContentBinding.field_kinds}. */
+type ContentFieldKind = 'text' | 'list' | 'files';
 /**
  * Scope field definition within a profile (renamed from `ProfileContextField`
  * in v0.7 — protocol.md → *Migration from v0.6*, `contextSchema` → `scopeSchema`).
@@ -447,6 +481,8 @@ type ExecutionContextFieldDef = DeclaredFieldDef | CumulativeFieldDef;
  * is not chosen by the signer — it follows from team caps.)
  */
 type SignableCommitmentMode = 'automatic' | 'review';
+/** Every commitment mode a signed mandate can carry. */
+type CommitmentMode = SignableCommitmentMode | 'review_above_cap';
 /** protocol.md → *Owner Signatures* → "Where the requirement lives" — the
  * profile-floor tier: `minBinding` names the weakest `OwnerSignatureBinding`
  * this profile accepts for a co-signing owner. */
@@ -501,8 +537,13 @@ interface AgentProfile {
      * a mandate screen offers only the listed modes. Fail-closed: a declared
      * list with no valid entry allows nothing — a malformed declaration never
      * widens what a profile allows. See {@link allowedCommitmentModes}.
+     *
+     * v0.8 (Commitment Modes, rule 8): `review_above_cap` is admitted if and
+     * only if `automatic` is listed; an entry `review_above_cap` in the list is
+     * ignored, and a list whose only entry is it admits nothing and is
+     * malformed (`PROFILE_INVALID`).
      */
-    commitment_modes?: readonly SignableCommitmentMode[];
+    commitment_modes?: readonly CommitmentMode[];
     /**
      * The bounds schema — the enforceable parameters (protocol.md → *Bounds
      * Schema*).
@@ -652,39 +693,6 @@ type GatekeeperResult = {
     errors: GatekeeperError[];
 };
 
-/**
- * JCS — JSON Canonicalization (RFC 8785) for signing.
- *
- * Both attestation and receipt signatures are computed over a canonical byte
- * serialization of the payload, so that two independent implementations (an AS,
- * a gateway, an external verifier — in any language) agree on exactly which
- * bytes were signed regardless of how they happened to construct the object.
- *
- * `JSON.stringify` is NOT sufficient: it preserves key *insertion* order, so the
- * same logical payload built with keys in a different order serializes to
- * different bytes and the signature fails to verify. Canonicalization removes
- * that dependency by sorting keys.
- *
- * This is RFC 8785-compatible and matches the v0.5 spec's normative signing
- * canonicalization (core.md "Signing Canonicalization"):
- *   1. UTF-8.
- *   2. Object keys sorted (RFC 8785 sorts by UTF-16 code units — exactly what
- *      JavaScript's default String comparison does, so `Object.keys().sort()` is
- *      correct here).
- *   3. No insignificant whitespace.
- *   4. Numbers in the shortest round-trippable form — the ECMAScript
- *      Number-to-String algorithm, which `JSON.stringify(number)` produces and
- *      RFC 8785 adopts verbatim.
- *   5. Strings escaped per RFC 8259; non-ASCII passed through as UTF-8 (this is
- *      `JSON.stringify`'s behaviour for strings).
- *   6. Array order preserved.
- *
- * Because it relies only on `JSON.stringify` for leaves plus `Object.keys`,
- * `Array`, and `String` sort — all of which are environment-independent in
- * JavaScript — Node and the browser produce byte-identical output. The
- * conformance test pins a (payload → canonical bytes) vector that any other
- * implementation can check against.
- */
 declare function canonicalize(value: unknown): string;
 
 /**
@@ -712,20 +720,31 @@ declare function toBase64Url(bytes: Uint8Array): string;
  */
 declare function fromBase64Url(s: string): Uint8Array;
 
-/** The protocol version this package issues and verifies. */
-declare const PROTOCOL_VERSION = "0.7";
-/** The protocol versions this package can verify and enforce. */
+/** The protocol version this package issues. */
+declare const PROTOCOL_VERSION = "0.8";
+/** Every version this package verifies and enforces, newest first. */
 declare const SUPPORTED_VERSIONS: readonly string[];
+/** The versions an Authority Server built on this package issues. */
+declare const ISSUABLE_VERSIONS: readonly string[];
+/** A protocol version this package knows the rules of. */
+type SupportedVersion = '0.8' | '0.7';
+declare function isSupportedVersion(v: unknown): v is SupportedVersion;
 /**
- * The highest version both the requester and this implementation support.
+ * The highest version both the requester and the issuer support.
  *
  * @param requested `supported_versions` from the mandate request. Absent →
- * read as `["0.6"]` (protocol.md rule 1) — which, against this package's
- * `SUPPORTED_VERSIONS`, has no overlap and refuses honestly rather than
- * silently assuming `0.7`.
+ * read as `["0.6"]` (protocol.md rule 1), which no issuer here supports, so
+ * the refusal is honest rather than a silent assumption.
+ * @param supported What the issuer is willing to issue. Default: v0.8 only.
  * @throws HapError `VERSION_UNSUPPORTED` when no version is common to both.
  */
 declare function negotiateVersion(requested: readonly string[] | undefined, supported?: readonly string[]): string;
+/**
+ * Refuse an artifact of a version this package cannot verify (rule 4: an
+ * artifact is read under its own version, never re-interpreted).
+ * @throws HapError `VERSION_UNSUPPORTED`
+ */
+declare function assertSupportedVersion(version: unknown, what: string): asserts version is SupportedVersion;
 
 /**
  * Content binding — Level 2 content proof (HAP v0.5 Content Provenance).
@@ -831,6 +850,14 @@ declare function selectBoundFields(binding: ContentBinding, args: Record<string,
  * {@link selectBoundFields} + {@link computeContentHash} for the common path.
  */
 declare function computeFieldsContentHash(binding: ContentBinding, args: Record<string, unknown>): string;
+/**
+ * Why a binding's `field_kinds` is malformed, or null when it is fine (or
+ * absent). For profile validation — a malformed hint is a profile error, not
+ * a call-time refusal, because it never changes what is hashed.
+ */
+declare function invalidFieldKindsReason(binding: ContentBinding): string | null;
+/** The bound fields declared as `files` — sealed document fingerprints. */
+declare function filesFields(binding: ContentBinding): string[];
 
 /**
  * Intent hashing + intent-disclosure binding (HAP v0.5).
@@ -1019,20 +1046,29 @@ declare function computeScopeHash(params: AgentScopeParams, profile: AgentProfil
 
 /**
  * Which commitment modes a profile allows its mandates to be signed with
- * (`AgentProfile.commitment_modes`). One source for the Authority Server's
- * refusal and the mandate screen's choice, so the two cannot disagree.
+ * (`AgentProfile.commitment_modes`; protocol.md → *Commitment Modes*, rule
+ * 8). One source for the Authority Server's refusal and the mandate screen's
+ * choice, so the two cannot disagree.
  */
 
 /** Every mode a signer can choose, in the order a mandate screen shows them. */
 declare const SIGNABLE_COMMITMENT_MODES: readonly SignableCommitmentMode[];
+/** Every mode a signed mandate can carry. */
+declare const COMMITMENT_MODES: readonly CommitmentMode[];
 /**
- * The modes a mandate under this profile may carry, in display order.
- * No declaration → all of them. A declaration is read fail-closed: entries
- * that are not a signable mode are dropped, so a malformed list can only
- * narrow — `[]`, `"review"` (not a list) or `["reveiw"]` allow nothing.
+ * The signable modes a mandate under this profile may carry, in display
+ * order. No declaration → all of them. A declaration is read fail-closed:
+ * entries that are not a signable mode are dropped (`review_above_cap` is
+ * ignored by rule 8 — it follows from `automatic`), so a malformed list can
+ * only narrow — `[]`, `"review"` (not a list) or `["reveiw"]` allow nothing.
  */
 declare function allowedCommitmentModes(profile: AgentProfile): readonly SignableCommitmentMode[];
-/** Whether a mandate under this profile may be signed with `mode`. */
+/**
+ * Whether a mandate under this profile may be SIGNED with `mode` (rule 8):
+ * `automatic` and `review` where listed; `review_above_cap` if and only if
+ * `automatic` is admitted. The Authority Server refuses any other with
+ * `COMMITMENT_MODE_NOT_ALLOWED`.
+ */
 declare function isCommitmentModeAllowed(profile: AgentProfile, mode: string): boolean;
 
 /** One authoring-time finding. `code` is always a canonical v0.7 code — in
@@ -1073,9 +1109,10 @@ declare function checkDiscloseSubset(mandateDiscloseFields: readonly string[] |
  * Renamed from `attestation.ts` (protocol.md → *Migration from v0.6*:
  * `header.typ: "HAP-attestation"` → `"HAP-mandate"`, `attestation_id` →
  * `mandate_id`). v0.3's frame-hash path and v0.4's dual frame/bounds
- * verification are retired with the rest of pre-v0.5 — this module issues
- * and verifies `version: "0.7"` mandates only (CLAUDE.md "Decided by the
- * owner": no backward-compat verify path for 0.5/0.6).
+ * verification are retired with the rest of pre-v0.5. This module issues
+ * `version: "0.8"` mandates and verifies `"0.8"` and `"0.7"` ones, each
+ * under its own rules (protocol.md → *Version negotiation*, rule 4): v0.8
+ * is a re-grant release, and a v0.7 artifact stays verifiable as evidence.
  */
 
 /**
@@ -1135,15 +1172,25 @@ declare function checkMandateExpiry(payload: MandatePayload, now?: number): void
  * violation; `OWNER_SIGNATURE_INVALID` when a co-signing DID is not key-bearing.
  */
 declare function validateMandateOwners(payload: MandatePayload): void;
+/**
+ * The above-cap fields travel together (Mandate rule 10; *Group roles*,
+ * rule 7). Under v0.8 `above_cap_approvals` is present exactly when
+ * `above_cap_approvers` is, an integer ≥ 1; under v0.7 there is no count and
+ * caps + approvers are present exactly under `review_above_cap`.
+ *
+ * @throws HapError `MALFORMED_MANDATE`
+ */
+declare function validateAboveCapFields(payload: MandatePayload): void;
 /**
  * Full mandate verification: decode, check `version`, verify the AS
- * signature, check expiry, validate `mandate_owners` shape.
+ * signature, check expiry, validate `mandate_owners` shape and the above-cap
+ * fields.
  *
  * Deliberately does NOT verify any `mandate_owners` co-signature — that is
  * `verifyOwnerSignature` in `owner-signature.ts`, a separate trust axis the
  * caller opts into.
  *
- * @throws HapError `VERSION_UNSUPPORTED` for anything other than `"0.7"`.
+ * @throws HapError `VERSION_UNSUPPORTED` for a version outside {@link SUPPORTED_VERSIONS}.
  * @throws Error (`INVALID_SIGNATURE:` / `TTL_EXPIRED:` / `MALFORMED_MANDATE:`
  * prefixed, or `OWNER_SIGNATURE_INVALID` as a HapError) on any other failure.
  */
@@ -1153,13 +1200,9 @@ declare function verifyMandate(blob: string, opts?: {
 }): Promise<MandatePayload>;
 
 /**
- * Owner Signatures (v0.7) — the `HAP-mandate-projection` object, the
- * `HAP-approval` object, and their verification.
- *
- * Renamed from `mandate.ts` (protocol.md → *Migration from v0.6*: the
- * owner-signed projection's `typ` moves from `"HAP-mandate"` to
- * `"HAP-mandate-projection"`, disambiguating it from the AS-signed mandate
- * itself, which now legitimately owns the name `"HAP-mandate"`).
+ * Owner Signatures — the `HAP-mandate-projection` object, the
+ * `HAP-approval` object, and their verification (v0.8; v0.7 artifacts
+ * verified under their own field lists).
  *
  * The human signs BEFORE the AS does, so they cannot sign the finished
  * mandate (`mandate_id`/`issued_at` do not exist yet). They sign a mandate
@@ -1169,6 +1212,13 @@ declare function verifyMandate(blob: string, opts?: {
  * with the key carried in the owner's DID. No side channel, no second
  * fetch, no key directory. See protocol.md → "Owner Signatures".
  *
+ * v0.8 adds to the projection what a compromised AS could otherwise restate:
+ * `binding` and `signing_surface` (how the owner signed), `subjects_disclosed`
+ * (whether the name is attached), and `above_cap_approvals` (how many
+ * approvers). The approval gains `approver_did` (who decided) and the
+ * operation it is for (`action`, `action_type`), and always signs the
+ * proposal's content fingerprint beside the bound subset.
+ *
  * Verification here requires NO trust in the AS. What it cannot do is tell
  * the verifier WHOSE key signed — confirming the DID belongs to the
  * expected person is the out-of-band step (protocol.md → "Verification
@@ -1182,7 +1232,7 @@ declare function verifyMandate(blob: string, opts?: {
 interface MandateProjection {
     typ: 'HAP-mandate-projection';
     /** Projection/canonicalization version. A verifier MUST pin it. */
-    version: '0.7';
+    version: ProtocolVersion;
     profile_id: string;
     /** Covered deliberately: the owner signs the profile's BYTES, not only its id. */
     profile_hash: string;
@@ -1195,29 +1245,46 @@ interface MandateProjection {
     /** Included iff the mandate carries one — binds ciphertext AND the
      * frozen approver set, the swap this mechanism exists to stop. */
     intent_disclosure_hash?: string;
-    commitment_mode: string;
-    /** Included together, iff `commitment_mode === "review_above_cap"`. */
+    commitment_mode: CommitmentMode;
+    /** Included together, iff the mandate carries them (v0.8: under
+     * `review_above_cap`, or `review` in a group with approval-kind caps;
+     * v0.7: under `review_above_cap`). */
     above_cap_caps?: Record<string, number>;
     above_cap_approvers?: string[];
+    /** v0.8 only, with the other two. */
+    above_cap_approvals?: number;
     /** Included iff the mandate narrows the profile's disclose_fields. */
     disclose_fields?: string[];
     /** The replay defence: the human signs how long the authority lives. */
     expires_at: number;
     nonce: string;
+    /** v0.8, always present: MUST equal the `mandate_owners` entry's values. */
+    binding?: OwnerSignatureBinding | string;
+    signing_surface?: SigningSurface | string;
+    /** v0.8, always present: `true` exactly when the mandate carries a
+     * `subjects` entry for the owner. */
+    subjects_disclosed?: boolean;
 }
-/** Per-action approval, signed by the owner in `review` mode. Signing a
- * `reject` matters as much as a `commit`: a rejection the AS can discard is
- * a rejection that never happened. */
+/** Per-action approval, signed by the decider. Signing a `reject` matters as
+ * much as a `commit`: a rejection the AS can discard is a rejection that
+ * never happened. */
 interface ApprovalObject {
     typ: 'HAP-approval';
-    version: '0.7';
+    version: ProtocolVersion;
+    /** v0.8 — who decided: the Mandate Owner in `review`, or an above-cap approver. */
+    approver_did?: string;
     proposal_id: string;
-    /** Renamed from `attestation_id` in v0.7. */
     mandate_id: string;
+    /** v0.8 — the operation the arguments are for, exactly as the ticket carries them. */
+    action?: string;
+    action_type?: string;
     decision: 'commit' | 'reject';
-    /** What was approved: the ticket's contentHash where the profile binds
-     * content; otherwise sha256 over the JCS of the proposal's argument set. */
+    /** The ticket's contentHash where a content binding applies to the action;
+     * otherwise equal to `proposal_content_hash` (v0.8) / the JCS hash of the
+     * proposal's arguments (v0.7). */
     content_hash: string;
+    /** v0.8, always present — the proposal's content fingerprint. */
+    proposal_content_hash?: string;
     decided_at: number;
     nonce: string;
 }
@@ -1228,15 +1295,13 @@ declare class OwnerSignatureError extends Error {
 }
 /**
  * Rebuild the projection a given `mandate_owners` entry signed, from the
- * mandate's own signed fields. Field absence is defined, not incidental:
- * `intent_disclosure_hash`, `above_cap_caps`/`above_cap_approvers`, and
- * `disclose_fields` are included iff the mandate carries them.
+ * mandate's own signed fields, under the mandate's own `version`. Field
+ * absence is defined, not incidental.
  */
-declare function buildMandateProjection(payload: MandatePayload, entry: Pick<MandateOwnerEntry, 'did' | 'nonce'>): MandateProjection;
-/** The exact bytes an owner signs: RFC 8785 (JCS) canonical UTF-8. Renamed
- * from `mandateSigningBytes` in v0.7. */
+declare function buildMandateProjection(payload: MandatePayload, entry: Pick<MandateOwnerEntry, 'did' | 'nonce' | 'binding' | 'signing_surface'>): MandateProjection;
+/** The exact bytes an owner signs: RFC 8785 (JCS) canonical UTF-8. */
 declare function projectionSigningBytes(projection: MandateProjection): Uint8Array;
-/** The exact bytes an owner signs for a per-action approval. */
+/** The exact bytes a decider signs for a per-action approval. */
 declare function approvalSigningBytes(approval: ApprovalObject): Uint8Array;
 /**
  * Sign a mandate projection with a raw Ed25519 private key — the `raw`
@@ -1267,35 +1332,45 @@ declare function verifyOwnerSignature(mandate: Mandate, entry: MandateOwnerEntry
 declare function verifyOwnerSignatures(mandate: Mandate): Promise<MandateOwnerEntry[]>;
 /** Verify an approval signature against a signer's key-bearing DID. */
 declare function verifyApproval(approval: ApprovalObject, signature: string, signerDid: string): Promise<void>;
+/** Signature-assurance ranking for `OwnerSignatureBinding`, weakest first —
+ * protocol.md → *Owner Signatures* → "binding" table ordering (raw < webauthn < eudi).
+ * A binding the verifier does not know ranks as `raw` (satisfies no minimum
+ * above it). */
+declare const BINDING_RANK: Record<OwnerSignatureBinding, number>;
+declare function bindingRank(binding: string | undefined): number;
 /**
  * Enforce a profile's `ownerSignature` floor (protocol.md → *Owner
  * Signatures* → "Where the requirement lives" — the profile-floor tier,
  * checkable without trusting the AS: `profile_id`/`profile_hash` are in the
  * signed payload AND in the owner-signed projection).
  *
- * An unknown `binding` value is treated as rank 0 (weakest) rather than
- * rejected outright — "an AS MUST NOT reject a mandate_owners entry solely
- * because it does not recognize its binding value" extends naturally to a
- * verifier ranking it, since crediting an unrecognized binding with
- * unearned strength would be the more dangerous failure mode.
- *
  * @throws OwnerSignatureError `OWNER_SIGNATURE_REQUIRED` when the floor is
  * unmet — "MUST fail, not warn" (protocol.md, same section).
  */
 declare function checkOwnerSignatureRequirement(payload: MandatePayload, floor: ProfileOwnerSignatureFloor | undefined): void;
 
 /**
- * Mandate tickets (v0.7) — the wire type, signing, and holder-side
- * verification. Renamed from `receipt.ts` (protocol.md → *Mandate Tickets*:
- * "v0.4 introduced the object under the name execution receipt; v0.7 renames
- * it because the tense was wrong — a receipt follows payment, and the ticket
- * must come first").
+ * Mandate tickets — the wire type, signing, holder-side verification, and
+ * (v0.8) the Gatekeeper's check that a ticket answers the request it sent.
  *
  * Ticket payloads are camelCase on the wire (unlike the snake_case mandate
  * payload) — a shipped inconsistency the spec documents rather than breaks
  * (protocol.md → *Migration from v0.6*, "Unchanged on purpose").
  */
 
+/** Clock-skew tolerance and freshness window (Mandate rule 9; Ticket rule 4). */
+declare const TICKET_FRESHNESS_SECONDS = 300;
+/** One verified approval carried by a ticket. */
+interface ApprovalSignatureEntry {
+    alg: 'EdDSA' | 'ES256';
+    signature: string;
+    nonce: string;
+    decided_at: number;
+}
+/** v0.8 — an above-cap approver's entry in `approvalSignatures`. */
+interface ApproverSignatureEntry extends ApprovalSignatureEntry {
+    approver_did: string;
+}
 /** Signed mandate ticket — protocol.md → *Ticket Payload Schema*. */
 interface TicketPayload {
     id: string;
@@ -1321,6 +1396,10 @@ interface TicketPayload {
     /** The AS DID, as in the mandate (new in v0.7). */
     issuer: string;
     timestamp: number;
+    /** v0.8 — copied verbatim from the request, so the ticket names the single
+     * request it answers. Present exactly when the request carried one
+     * (synchronous path). */
+    idempotencyKey?: string;
     /** Hash of the bound content, computed by the Gatekeeper, copied
      * verbatim by the AS. The AS never sees the content. */
     contentHash?: string;
@@ -1331,15 +1410,15 @@ interface TicketPayload {
     subjects?: Subject[];
     /** Review path: the proposal this ticket executed. */
     proposalId?: string;
+    /** v0.8, review path: the proposal's content fingerprint, copied verbatim
+     * from the proposal the AS compared it against. */
+    proposalContentHash?: string;
     /** Review path: the owner's HAP-approval signature for the executed
      * proposal, as the object itself — never a hash of it, which a holder
      * could check only by asking the AS. */
-    approvalSignature?: {
-        alg: 'EdDSA' | 'ES256';
-        signature: string;
-        nonce: string;
-        decided_at: number;
-    };
+    approvalSignature?: ApprovalSignatureEntry;
+    /** v0.8, above-cap path: one entry per approver signature the AS verified. */
+    approvalSignatures?: ApproverSignatureEntry[];
     /** Ed25519 over the JCS-canonical payload (this field excluded), base64url. */
     signature: string;
 }
@@ -1348,42 +1427,431 @@ interface TicketPayload {
  * the same key used for mandates.
  */
 declare function signTicket(payload: Omit<TicketPayload, 'signature'>, privateKey: Uint8Array): Promise<TicketPayload>;
+/**
+ * The structural rules that keep a ticket, a projection and a mandate
+ * payload apart (protocol.md → *Ticket Payload Schema*, "Signature"): a
+ * ticket verifier MUST require `id`, `mandateId`, `actionType`, `timestamp`
+ * and `issuer`, MUST reject an object carrying `typ` (a projection can never
+ * be accepted as a ticket), and MUST reject `mandate_id` or `issued_at`.
+ * @throws HapError `INVALID_SIGNATURE`
+ */
+declare function assertTicketShape(ticket: Record<string, unknown>): void;
 /**
  * Verify a ticket's AS signature: strip `signature`, JCS-canonicalize the
  * rest, Ed25519-verify against the key resolved from `issuer` — never
  * against a key offered alongside the ticket (protocol.md → *Ticket
  * Verification* step 1). This is holder-side verification — it needs the
  * COMPLETE ticket; a redacted public view cannot be re-verified this way
- * (see {@link publicTicketView}).
+ * (see `ticket-projection.ts` for the view that can).
  *
  * Content is checked separately: where `contentHash` is present, recompute
  * it from the held artifact via the content-binding module and compare.
  *
  * @param opts.trustedIssuers When supplied, an `issuer` not in this list is
  * rejected before any cryptography runs.
- * @throws Error prefixed `INVALID_SIGNATURE:` when verification fails.
+ * @throws HapError `INVALID_SIGNATURE` when verification fails;
+ * `VERSION_UNSUPPORTED` for a version this package cannot read.
  */
 declare function verifyTicketSignature(ticket: TicketPayload, opts?: {
     trustedIssuers?: readonly string[];
 }): Promise<void>;
+/** The fields of a ticket request a Gatekeeper compares with the ticket it
+ * receives (protocol.md → *Ticket Payload Schema*, rule 4). */
+interface TicketRequestEcho {
+    profileId: string;
+    actionType: string;
+    boundsHash: string;
+    executionContext: Record<string, unknown>;
+    mandateId?: string;
+    idempotencyKey?: string;
+    contentHash?: string;
+    contentBinding?: TicketPayload['contentBinding'];
+    proposalId?: string;
+    proposalContentHash?: string;
+}
 /**
- * A redacted public view of a ticket (new in v0.7 — protocol.md → *Ticket
- * Disclosure Is Declared*, *Ticket Verification*). Hides `userId`,
- * `cumulativeState`, and `limits` unconditionally, and narrows
- * `executionContext` to exactly the keys named by `governingDiscloseFields`
- * (the mandate's `disclose_fields` where present, otherwise the profile's).
+ * v0.8 — the Gatekeeper's half of "a ticket names the request it answers":
+ * every echoed field equals what was sent, the `idempotencyKey` it sent is
+ * the one the ticket carries, `mandateId` and `version` are the verified
+ * mandate's, and a fresh ticket's `timestamp` lies within
+ * {@link TICKET_FRESHNESS_SECONDS}. A replay (`idempotent: true`, unsigned)
+ * is exempt from freshness only; the caller passes `replay: true` and then
+ * applies *One execution per ticket*, rule 2.
  *
- * Disclose NOTHING by default: an empty or absent `governingDiscloseFields`
- * strips `executionContext` entirely. "The holder is the verifier" — this
- * view is NOT independently re-verifiable against `signature` (it is missing
- * signed fields); a "signature valid" indicator on a page showing only this
- * view is the AS re-verifying its own signature, and implementations MUST
- * NOT present it as independently verified.
+ * Does NOT verify the signature — call {@link verifyTicketSignature} first.
+ * @throws HapError `TICKET_REQUEST_MISMATCH`
+ */
+declare function verifyTicketAgainstRequest(ticket: TicketPayload, request: TicketRequestEcho, opts?: {
+    mandate?: Mandate;
+    now?: number;
+    replay?: boolean;
+}): void;
+/**
+ * Rebuild the `HAP-approval` a decider signed, from the ticket and the
+ * mandate it names (protocol.md → *Ticket Payload Schema*, `approvalSignature`):
+ * `typ` and `version`; `proposal_id` and `mandate_id` from `proposalId` and
+ * `mandateId`; `action` and `action_type` (v0.8) from `action` and
+ * `actionType`; `proposal_content_hash` from `proposalContentHash`;
+ * `content_hash` from `contentHash` where a binding applies to this action
+ * (the AS copies one only then), else `proposalContentHash`; `decision`
+ * `"commit"`; `approver_did` as given; `decided_at` and `nonce` from the
+ * entry.
+ */
+declare function reconstructApproval(ticket: TicketPayload, entry: ApprovalSignatureEntry, approverDid: string): ApprovalObject;
+/** What a ticket's approvals, once verified, establish. */
+interface VerifiedApprovals {
+    /** The Mandate Owner's DID, when `approvalSignature` verified. */
+    owner?: string;
+    /** Distinct above-cap approver DIDs whose `approvalSignatures` entries verified. */
+    approvers: string[];
+}
+/**
+ * Verify every approval a ticket carries against the mandate it names
+ * (protocol.md → *Ticket Payload Schema*, rule 4): `approvalSignature`
+ * under the Mandate Owner's DID; each `approvalSignatures` entry under its
+ * `approver_did`, which MUST be in the signed `above_cap_approvers` and
+ * MUST NOT be the Mandate Owner (the proposer never counts). Whether the
+ * verified set is ENOUGH is {@link approvalsSufficient}, so a verifier can
+ * report what it found and a policy can decide.
+ *
+ * @throws HapError `APPROVAL_SIGNATURE_INVALID`
+ */
+declare function verifyTicketApprovals(ticket: TicketPayload, mandate: Mandate): Promise<VerifiedApprovals>;
+/**
+ * Whether the verified approvals satisfy what the mandate requires for a
+ * decision above a cap: at least `above_cap_approvals` distinct approvers
+ * (v0.7: every signed approver), plus the owner's own approval in `review`.
+ */
+declare function approvalsSufficient(mandate: Mandate, verified: VerifiedApprovals, aboveCap: boolean): boolean;
+/**
+ * A redacted public view of a ticket (protocol.md → *Ticket Disclosure Is
+ * Declared*). Hides `userId`, `cumulativeState`, and `limits`, and narrows
+ * `executionContext` to the governing `disclose_fields`. NOT independently
+ * re-verifiable — since v0.8 a verifiable public view is the separately
+ * signed `HAP-ticket-projection` (`ticket-projection.ts`); a view that is
+ * not one MUST NOT be presented as independently verified.
  */
 declare function publicTicketView(ticket: TicketPayload, governingDiscloseFields?: readonly string[]): Omit<TicketPayload, 'userId' | 'cumulativeState' | 'limits'>;
 
 /**
- * Gatekeeper — local (Phase 1) verification for bounded execution (v0.7).
+ * Public ticket projection — `HAP-ticket-projection` (protocol.md → *Public
+ * ticket projection*, new in v0.8, specification-led).
+ *
+ * A ticket is one signature over every field, so a redacted view cannot be
+ * re-verified. Where a ticket is shown to parties other than its holder —
+ * a public page, a machine verifier at an effector, an auditor — the AS
+ * serves a public-only subset, separately signed by the same key, so the
+ * public view verifies on its own. It never widens what the ticket
+ * discloses: `executionContext` carries only the governing
+ * `disclose_fields`, and `userId`, `cumulativeState`, `limits` and `action`
+ * never appear.
+ */
+
+/** The AS may not let a projection be accepted as authorization later than
+ * this after the ticket's timestamp (rule 3). */
+declare const PROJECTION_MAX_VALIDITY_SECONDS = 86400;
+interface TicketProjection {
+    typ: 'HAP-ticket-projection';
+    version: string;
+    id: string;
+    mandateId: string;
+    issuer: string;
+    timestamp: number;
+    /** Set by the AS at projection time; governs acceptance as authorization, not evidence. */
+    valid_until: number;
+    profileId: string;
+    actionType: string;
+    boundsHash: string;
+    contentHash?: string;
+    contentBinding?: TicketPayload['contentBinding'];
+    subjects?: Subject[];
+    /** Exactly the governing `disclose_fields` the ticket carries; absent when none. */
+    executionContext?: Record<string, unknown>;
+    /** The mandate's `mandate_owners` entry, present exactly when it carries a signature. */
+    owner?: MandateOwnerEntry;
+    signature: string;
+}
+/**
+ * Build the projection of a ticket (rule 1). `discloseFields` is the
+ * governing list — the mandate's `disclose_fields` where present, else the
+ * profile's; nothing when neither declares one.
+ */
+declare function buildTicketProjection(ticket: TicketPayload, mandate: Mandate, opts: {
+    validUntil: number;
+    discloseFields?: readonly string[];
+}): Omit<TicketProjection, 'signature'>;
+/** Sign a projection with the key that signed its ticket (rule 2). */
+declare function signTicketProjection(projection: Omit<TicketProjection, 'signature'>, privateKey: Uint8Array): Promise<TicketProjection>;
+/**
+ * Verify a projection on its own: `typ` required, signature under the key
+ * `issuer` names. With `asAuthorization`, a projection past `valid_until`
+ * is refused (rule 3); as evidence it is not.
+ * @throws HapError `INVALID_SIGNATURE`, `POLICY_UNMET` (validity window)
+ */
+declare function verifyTicketProjection(projection: TicketProjection, opts?: {
+    trustedIssuers?: readonly string[];
+    now?: number;
+    asAuthorization?: boolean;
+}): Promise<void>;
+/**
+ * Verify the projection's `owner` entry against the mandate obtained through
+ * the third-party verification API (rule 4): the entry is the mandate's
+ * own, and its signature verifies over the projection rebuilt from the
+ * mandate. The projection alone cannot establish this.
+ * @throws HapError `OWNER_SIGNATURE_INVALID`
+ */
+declare function verifyProjectionOwner(projection: TicketProjection, mandate: Mandate): Promise<void>;
+
+/**
+ * Verifier policy — `HAP-verifier-policy` (protocol.md → *Owner Signatures*
+ * → *Verifier policy*, new in v0.8, specification-led).
+ *
+ * The relying party's own, declarative statement of what it demands of a
+ * ticket (or projection) before acting on or trusting it. Every present
+ * line is a conjunct; an unmet line is a refusal naming the line and its
+ * code; absent lines impose nothing. The policy is never sent to the
+ * Authority Server.
+ */
+
+interface VerifierPolicy {
+    typ: 'HAP-verifier-policy';
+    version: string;
+    trusted_issuers?: string[];
+    min_binding?: OwnerSignatureBinding | string;
+    required_owners?: string[];
+    profile_hashes?: Record<string, string>;
+    action_types?: string[];
+    freshness_seconds?: number;
+    required_fields?: string[];
+    require_approval_signature?: boolean;
+}
+/** A refusal naming the policy line that failed. */
+declare class PolicyError extends HapError {
+    readonly line: keyof VerifierPolicy;
+    constructor(line: keyof VerifierPolicy, code: HapErrorCode, message: string);
+}
+interface PolicyInput {
+    /** The complete ticket, where the relying party holds it. */
+    ticket?: TicketPayload;
+    /** Or the projection, where only the public view was served. */
+    projection?: TicketProjection;
+    /** The mandate the artifact chains to, where the policy needs it
+     * (`min_binding`, `required_owners`, `profile_hashes`, `require_approval_signature`). */
+    mandate?: Mandate;
+    now?: number;
+    /** The relying party acts on the artifact (freshness applies to `valid_until`). */
+    asAuthorization?: boolean;
+    /** Whether the ticket's action exceeded an approval-kind cap — known to a
+     * party that holds the mandate's caps and the execution context. */
+    aboveCap?: boolean;
+}
+/**
+ * Evaluate a policy (protocol.md → *Verifier policy*, "Evaluation"). The
+ * artifact's own signature is verified first under `trusted_issuers` where
+ * present, else under any resolvable issuer.
+ * @throws PolicyError with the line and the code the table assigns.
+ */
+declare function evaluateVerifierPolicy(policy: VerifierPolicy, input: PolicyInput): Promise<void>;
+
+/**
+ * Proposal content — what the Authority Server receives of a proposal
+ * (protocol.md → *Proposals — what the Authority Server receives*, v0.8).
+ *
+ * The content is the action's argument object, serialized as RFC 8785 JCS.
+ * Its fingerprint, `proposalContentHash`, is what the AS compares, what the
+ * ticket carries and what every `HAP-approval` signs. The content itself is
+ * encrypted to its readers — the Mandate Owner and every signed decider —
+ * with exactly the construction rule 3 pins byte for byte:
+ *
+ * - a fresh 32-byte content key (CEK) per proposal;
+ * - AES-256-GCM under the CEK, random 12-byte IV, no associated data,
+ *   16-byte tag; `ciphertext` = IV ‖ GCM ciphertext ‖ tag;
+ * - per reader, HPKE (RFC 9180) base mode, DHKEM(X25519, HKDF-SHA256),
+ *   HKDF-SHA256, AES-256-GCM, empty `info`, the CEK sealed single-shot with
+ *   empty associated data; `enc` the 32-byte encapsulated key, `ct` the
+ *   48-byte sealed CEK;
+ * - every binary value base64url without padding; `encrypted_keys` keyed by
+ *   the reader's DID. The reader key is an X25519 key distinct from the
+ *   DID's signing key.
+ *
+ * The conformance vector `proposal-encryption.json` fixes the CEK, the IV
+ * and the ephemeral keys so the output is reproducible; real use draws all
+ * three at random, and the deterministic hooks exist for that test only.
+ */
+interface ProposalContentEnvelope {
+    ciphertext: string;
+    encrypted_keys: Record<string, {
+        ct: string;
+        enc: string;
+    }>;
+    readers: string[];
+    unreadable: string[];
+}
+interface ReaderKeyPair {
+    /** Raw X25519 private key, 32 bytes. */
+    privateKey: Uint8Array;
+    /** Raw X25519 public key, 32 bytes. */
+    publicKey: Uint8Array;
+}
+/** The content's JCS bytes, as a string (rule 1). */
+declare function proposalContentJcs(args: Record<string, unknown>): string;
+/** `proposalContentHash` — `"sha256:" + hex(sha256(JCS(content)))` (rule 4). */
+declare function computeProposalContentHash(args: Record<string, unknown>): string;
+/** A fresh reader key pair (X25519). */
+declare function generateReaderKeyPair(): Promise<ReaderKeyPair>;
+/** A reader key pair derived from input keying material (RFC 9180
+ * DeriveKeyPair) — deterministic; for tests and vectors. */
+declare function deriveReaderKeyPair(ikm: Uint8Array): Promise<ReaderKeyPair>;
+interface EncryptOptions {
+    /** Signed deciders for whom no reader key exists; listed, notified, unable to decide. */
+    unreadable?: string[];
+    /** Deterministic inputs — TESTS AND VECTORS ONLY. */
+    deterministic?: {
+        contentKey: Uint8Array;
+        iv: Uint8Array;
+        /** Per reader DID: the ephemeral key material for its HPKE wrap. */
+        ephemeralIkm: Record<string, Uint8Array>;
+    };
+}
+/**
+ * Encrypt a proposal's content to its readers and compute its fingerprint.
+ * @param readers Each reader's DID and raw X25519 reader public key.
+ */
+declare function encryptProposalContent(args: Record<string, unknown>, readers: ReadonlyArray<{
+    did: string;
+    publicKey: Uint8Array;
+}>, opts?: EncryptOptions): Promise<{
+    content: ProposalContentEnvelope;
+    proposalContentHash: string;
+}>;
+/**
+ * Decrypt a proposal's content as one reader. A reader whose HPKE open or
+ * GCM decryption fails MUST treat the proposal as unreadable — never as
+ * empty or partial content (rule 3); this throws rather than returning.
+ * @returns the argument object and its JCS, so the caller recomputes the
+ * fingerprint and refuses on a mismatch (rule 8).
+ */
+declare function decryptProposalContent(content: ProposalContentEnvelope, readerDid: string, readerPrivateKey: Uint8Array): Promise<{
+    arguments: Record<string, unknown>;
+    contentJcs: string;
+    proposalContentHash: string;
+}>;
+/**
+ * The reader-set rules an Authority Server applies at submission (rule 2):
+ * `readers` ∪ `unreadable` equals the owner plus the signed deciders;
+ * `readers` equals the key set of `encrypted_keys`.
+ * @throws HapError `PROPOSAL_APPROVERS_INVALID` | `PROPOSAL_NOT_ENCRYPTED`
+ */
+declare function checkProposalReaders(content: ProposalContentEnvelope, expected: {
+    ownerDid: string;
+    deciders: readonly string[];
+}): void;
+
+/**
+ * Pure checks both enforcement points apply around issuance and execution
+ * (v0.8). An Authority Server composes them into its stage order
+ * (protocol.md → *Mandate Issuance & Validation*, *Ticket Issuance*); a
+ * Gatekeeper applies the execution-side ones locally (*Validation Steps*).
+ * They live here so the two cannot disagree about what a value means.
+ */
+
+/**
+ * `execution_context_hash` — sha256 over the JCS of the profile's
+ * `executionContextSchema`, or of `{}` when the profile has none (protocol.md
+ * → *Execution Context Schema*, stated in v0.8).
+ */
+declare function computeExecutionContextHash(profile: Pick<AgentProfile, 'executionContextSchema'>): string;
+/** The execution-context fields some bound of the profile reads
+ * (`boundType.of` of every `per_transaction` and `cumulative_sum` bound). */
+declare function boundReadFields(profile: AgentProfile): Set<string>;
+/**
+ * Build the wire execution context (*Validation Steps*, step 11; *Ticket
+ * Request Schema*, rules 7–8): only what a bound reads travels. `action_type`
+ * travels as the request's own `actionType`, scope values never travel,
+ * `_`-prefixed keys are advisory metadata. A `null` value is no value.
+ */
+declare function wireExecutionContext(execution: Record<string, unknown>, profile: AgentProfile): Record<string, unknown>;
+/**
+ * Every value present for a field some bound reads MUST be a finite,
+ * non-negative number (*Ticket Issuance*, stage 7; *Validation Steps*, step
+ * 8). `null` counts as absent. A `_`-prefixed key is refused.
+ * @throws HapError `MALFORMED_TICKET_REQUEST`
+ */
+declare function checkExecutionValues(execution: Record<string, unknown>, profile: AgentProfile): void;
+/** Whether a cumulative bound governs this action type: its `appliesTo`
+ * names it, or it has none (Bounds Schema rule 7). */
+declare function boundGoverns(def: ProfileBoundsField, actionType: string): boolean;
+/**
+ * The `cumulative_sum` bounds that govern this action type and whose field is
+ * absent from the execution context (*Ticket Issuance*, stage 7): each is a
+ * `BOUND_EXCEEDED`, unless a committed above-cap approval covers the action.
+ */
+declare function missingSumFields(execution: Record<string, unknown>, profile: AgentProfile, actionType: string): Array<{
+    bound: string;
+    field: string;
+}>;
+/**
+ * Bounds values against the profile at issuance (*Mandate Issuance*, stage
+ * 4): a number where the field is numeric (`"100"` is refused), no higher
+ * than a declared `maximum`, and an `enum` value in its `values`.
+ * @throws HapError `BOUNDS_INVALID_VALUE`
+ */
+declare function checkBoundsValues(bounds: AgentBoundsParams, profile: AgentProfile): void;
+/** A group's caps for one profile, as the AS holds them. */
+interface GroupCaps {
+    /** Caps a proposal may lift (`approval` kind) — numeric per_transaction fields only. */
+    approval?: Record<string, number>;
+    /** Hard caps: refused at signing, never routed. Numeric or enum values. */
+    hard?: Record<string, number | string>;
+}
+/**
+ * Whether a bound value exceeds a cap. For an `enum` bound the cap is one of
+ * its values, and a value that comes EARLIER in the profile's `values` order
+ * (more permissive) exceeds it (Bounds Schema rule 10; *Group ceilings*).
+ */
+declare function exceedsCap(value: string | number, cap: string | number, def: ProfileBoundsField): boolean;
+/**
+ * Hard group ceilings at signing (*Group ceilings*; *Group roles*, rule 5):
+ * a cap on a bound the Gatekeeper alone enforces (`enforcedBy: "gatekeeper"`)
+ * or on an `enum` bound is always hard, as is every cap in `hard`; a bound
+ * above one, or an optional bound omitted where a cap exists, is refused.
+ * Caps in `approval` on a cumulative bound are hard too (Commitment Modes,
+ * rule 7). An omitted REQUIRED bound is `MALFORMED_MANDATE`, checked
+ * elsewhere.
+ * @throws HapError `GROUP_CAP_EXCEEDED`
+ */
+declare function checkGroupCeilings(bounds: AgentBoundsParams, profile: AgentProfile, caps: GroupCaps): void;
+/**
+ * The above-cap configuration a mandate request or a group supplies
+ * (*Commitment Modes*, rule 7; *Group roles*, rules 2 and 4; Mandate rule
+ * 10): caps name numeric `per_transaction` bounds of the profile and never
+ * `profile`; approvers are key-bearing DIDs; outside a group the count is an
+ * integer ≥ 1 and no greater than the approvers other than the owner.
+ * @throws HapError `ABOVE_CAP_CONFIG_INVALID`
+ */
+declare function validateAboveCapConfig(config: {
+    caps?: Record<string, number>;
+    approvers?: readonly string[];
+    approvals?: number;
+}, profile: AgentProfile, opts: {
+    ownerDid: string;
+    inGroup: boolean;
+}): void;
+/**
+ * Whether a request exceeds an approval-kind cap of the mandate, or — v0.8 —
+ * the field the cap reads is absent (an action of unknown amount is above
+ * the cap). Returns the offending caps.
+ */
+declare function capsExceeded(execution: Record<string, unknown>, mandate: Pick<MandatePayload, 'above_cap_caps'>, profile: AgentProfile): Array<{
+    bound: string;
+    field: string;
+    cap: number;
+    value: unknown;
+}>;
+
+/**
+ * Gatekeeper — local (Phase 1) verification for bounded execution (v0.8;
+ * v0.7 mandates verified under their own rules).
  *
  * protocol.md → *Validation Steps* (Phase 1, never reaches the wire):
  *   1. Resolve profile from bounds.profile
@@ -1477,4 +1945,4 @@ declare function decodeDidKey(did: string): Uint8Array;
 /** True iff the DID decodes as a key-bearing Ed25519 did:key. Never throws. */
 declare function isKeyBearingDid(did: string): boolean;
 
-export { type AgentBoundsParams, type AgentProfile, type AgentScopeParams, type ApprovalObject, type BoundType, CanonicalValueError, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type FieldConstraint, type FieldUnit, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, HapError, type HapErrorCode, MANDATE_ERROR_CODES, type Mandate, type MandateHeader, type MandateOwnerEntry, type MandatePayload, type MandateProjection, type OwnerSignatureBinding, OwnerSignatureError, PROTOCOL_VERSION, type ProfileBoundsField, type ProfileOwnerSignatureFloor, type ProfileScopeField, type ProfileValidationError, SIGNABLE_COMMITMENT_MODES, SUPPORTED_VERSIONS, type SignableCommitmentMode, type SigningSurface, type Subject, type SubjectValidation, TICKET_ERROR_CODES, type TicketPayload, type VerifyOptions, allowedCommitmentModes, approvalSigningBytes, bindingAppliesTo, boundActionTypes, buildMandateProjection, canonicalBounds, canonicalScope, canonicalize, canonicalizeText, checkDiscloseSubset, checkMandateExpiry, checkOwnerSignatureRequirement, clearProfiles, computeBoundsHash, computeContentHash, computeFieldsContentHash, computeIntentDisclosureHash, computeIntentHash, computeProfileHash, computeScopeHash, contentCanonicalBytes, decodeDidKey, decodeMandateBlob, deriveIdentityLine, encodeDidKey, encodeMandateBlob, fromBase64Url, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isCommitmentModeAllowed, isFieldBinding, isKeyBearingDid, listProfiles, mandateBlobId, negotiateVersion, projectionSigningBytes, publicTicketView, registerProfile, selectBoundFields, signApproval, signMandate, signMandateProjection, signTicket, toBase64Url, validateBoundsParams, validateMandateOwners, validateProfile, validateScopeParams, validateSubject, verify, verifyApproval, verifyMandate, verifyMandateSignature, verifyOwnerSignature, verifyOwnerSignatures, verifyTicketSignature };
+export { type AgentBoundsParams, type AgentProfile, type AgentScopeParams, type ApprovalObject, type ApprovalSignatureEntry, type ApproverSignatureEntry, BINDING_RANK, type BoundType, COMMITMENT_MODES, CanonicalValueError, type CommitmentMode, type ContentBinding, ContentBindingError, type ContentBindingErrorCode, type ContentFieldKind, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type EncryptOptions, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type FieldConstraint, type FieldUnit, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type GroupCaps, HapError, type HapErrorCode, ISSUABLE_VERSIONS, MANDATE_ERROR_CODES, type Mandate, type MandateHeader, type MandateOwnerEntry, type MandatePayload, type MandateProjection, type OwnerSignatureBinding, OwnerSignatureError, PROJECTION_MAX_VALIDITY_SECONDS, PROPOSAL_ERROR_CODES, PROTOCOL_VERSION, PolicyError, type PolicyInput, type ProfileBoundsField, type ProfileOwnerSignatureFloor, type ProfileScopeField, type ProfileValidationError, type ProposalContentEnvelope, type ProtocolVersion, type ReaderKeyPair, SIGNABLE_COMMITMENT_MODES, SUPPORTED_VERSIONS, type SignableCommitmentMode, type SigningSurface, type Subject, type SubjectValidation, type SupportedVersion, TICKET_ERROR_CODES, TICKET_FRESHNESS_SECONDS, type TicketPayload, type TicketProjection, type TicketRequestEcho, type VerifiedApprovals, type VerifierPolicy, type VerifyOptions, allowedCommitmentModes, approvalSigningBytes, approvalsSufficient, assertSupportedVersion, assertTicketShape, bindingAppliesTo, bindingRank, boundActionTypes, boundGoverns, boundReadFields, buildMandateProjection, buildTicketProjection, canonicalBounds, canonicalScope, canonicalize, canonicalizeText, capsExceeded, checkBoundsValues, checkDiscloseSubset, checkExecutionValues, checkGroupCeilings, checkMandateExpiry, checkOwnerSignatureRequirement, checkProposalReaders, clearProfiles, computeBoundsHash, computeContentHash, computeExecutionContextHash, computeFieldsContentHash, computeIntentDisclosureHash, computeIntentHash, computeProfileHash, computeProposalContentHash, computeScopeHash, contentCanonicalBytes, decodeDidKey, decodeMandateBlob, decryptProposalContent, deriveIdentityLine, deriveReaderKeyPair, encodeDidKey, encodeMandateBlob, encryptProposalContent, evaluateVerifierPolicy, exceedsCap, filesFields, fromBase64Url, generateReaderKeyPair, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, invalidFieldKindsReason, isCommitmentModeAllowed, isFieldBinding, isKeyBearingDid, isSupportedVersion, listProfiles, mandateBlobId, missingSumFields, negotiateVersion, projectionSigningBytes, proposalContentJcs, publicTicketView, reconstructApproval, registerProfile, selectBoundFields, signApproval, signMandate, signMandateProjection, signTicket, signTicketProjection, toBase64Url, validateAboveCapConfig, validateAboveCapFields, validateBoundsParams, validateMandateOwners, validateProfile, validateScopeParams, validateSubject, verify, verifyApproval, verifyMandate, verifyMandateSignature, verifyOwnerSignature, verifyOwnerSignatures, verifyProjectionOwner, verifyTicketAgainstRequest, verifyTicketApprovals, verifyTicketProjection, verifyTicketSignature, wireExecutionContext };