@humanagencyp/hap-core 0.12.0 → 0.13.0

package/dist/index.mjs

@@ -1,4 +1,5 @@
 // src/canonicalize.ts
+var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
 function canonicalize(value) {
   if (value === void 0) {
     throw new Error("canonicalize: undefined is not serializable");
@@ -6,6 +7,9 @@ function canonicalize(value) {
   if (typeof value === "number" && !Number.isFinite(value)) {
     throw new Error(`canonicalize: ${value} is not a valid JSON number`);
   }
+  if (typeof value === "string" && LONE_SURROGATE.test(value)) {
+    throw new Error("canonicalize: string contains a lone surrogate and cannot be signed");
+  }
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value);
   }
@@ -55,6 +59,10 @@ var MANDATE_ERROR_CODES = [
   "BOUNDS_INVALID_VALUE",
   "SCOPE_INVALID_VALUE",
   "ABOVE_CAP_CONFIG_INVALID",
+  "COMMITMENT_MODE_NOT_ALLOWED",
+  // v0.8
+  "GROUP_CAP_EXCEEDED",
+  // v0.8
   "OWNER_SIGNATURE_REQUIRED",
   "OWNER_SIGNATURE_INVALID"
 ];
@@ -68,6 +76,10 @@ var TICKET_ERROR_CODES = [
   "PROFILE_NOT_FOUND",
   "INVALID_ACTION_TYPE",
   "APPROVAL_REQUIRED",
+  "APPROVAL_IMPOSSIBLE",
+  // v0.8
+  "PROPOSAL_CONTENT_MISMATCH",
+  // v0.8
   "PROPOSAL_REQUIRED",
   "PROPOSAL_NOT_FOUND",
   "PROPOSAL_NOT_APPROVED",
@@ -76,11 +88,25 @@ var TICKET_ERROR_CODES = [
   "PROPOSAL_MISMATCH",
   "PROPOSAL_MANDATE_MISMATCH",
   "PROPOSAL_ALREADY_EXECUTED",
+  "PROPOSAL_WITHDRAWN",
+  // v0.8
   "MALFORMED_TICKET_REQUEST",
+  "CONTENT_BINDING_INCOMPLETE",
+  // v0.8, Gatekeeper · local
   "IDEMPOTENCY_KEY_REQUIRED",
   "IDEMPOTENCY_MISMATCH",
   "APPROVAL_SIGNATURE_REQUIRED",
-  "APPROVAL_SIGNATURE_INVALID"
+  "APPROVAL_SIGNATURE_INVALID",
+  "TICKET_REQUEST_MISMATCH",
+  // v0.8, Gatekeeper · local
+  "POLICY_UNMET"
+  // v0.8, Verifier
+];
+var PROPOSAL_ERROR_CODES = [
+  "PROPOSAL_NOT_ENCRYPTED",
+  "DECIDER_INVALID",
+  "PROPOSAL_ALREADY_DECIDED",
+  "PROPOSAL_APPROVERS_INVALID"
 ];
 var HapError = class extends Error {
   constructor(code, message) {
@@ -91,9 +117,13 @@ var HapError = class extends Error {
 };
 
 // src/versions.ts
-var PROTOCOL_VERSION = "0.7";
-var SUPPORTED_VERSIONS = ["0.7"];
-function negotiateVersion(requested, supported = SUPPORTED_VERSIONS) {
+var PROTOCOL_VERSION = "0.8";
+var SUPPORTED_VERSIONS = ["0.8", "0.7"];
+var ISSUABLE_VERSIONS = [PROTOCOL_VERSION];
+function isSupportedVersion(v) {
+  return typeof v === "string" && SUPPORTED_VERSIONS.includes(v);
+}
+function negotiateVersion(requested, supported = ISSUABLE_VERSIONS) {
   const requestedVersions = requested ?? ["0.6"];
   const common = supported.filter((v) => requestedVersions.includes(v)).sort().reverse();
   if (common.length === 0) {
@@ -104,6 +134,14 @@ function negotiateVersion(requested, supported = SUPPORTED_VERSIONS) {
   }
   return common[0];
 }
+function assertSupportedVersion(version, what) {
+  if (!isSupportedVersion(version)) {
+    throw new HapError(
+      "VERSION_UNSUPPORTED",
+      `${what} version ${JSON.stringify(version)} is not verifiable by this implementation (verifies [${SUPPORTED_VERSIONS.join(", ")}])`
+    );
+  }
+}
 
 // src/content-binding.ts
 import { createHash } from "crypto";
@@ -214,6 +252,20 @@ function selectBoundFields(binding, args) {
 function computeFieldsContentHash(binding, args) {
   return computeContentHash(binding, selectBoundFields(binding, args));
 }
+var FIELD_KINDS = /* @__PURE__ */ new Set(["text", "list", "files"]);
+function invalidFieldKindsReason(binding) {
+  const kinds = binding.field_kinds;
+  if (kinds === void 0) return null;
+  if (!kinds || typeof kinds !== "object" || Array.isArray(kinds)) return "field_kinds must be an object";
+  for (const [field, kind] of Object.entries(kinds)) {
+    if (!(binding.fields ?? []).includes(field)) return `field_kinds names "${field}", which is not in fields`;
+    if (!FIELD_KINDS.has(kind)) return `field_kinds.${field} must be one of text, list, files`;
+  }
+  return null;
+}
+function filesFields(binding) {
+  return Object.entries(binding.field_kinds ?? {}).filter(([, k]) => k === "files").map(([f]) => f);
+}
 
 // src/intent-disclosure.ts
 import { createHash as createHash2 } from "crypto";
@@ -396,6 +448,7 @@ function computeScopeHash(params, profile) {
 
 // src/commitment-modes.ts
 var SIGNABLE_COMMITMENT_MODES = ["review", "automatic"];
+var COMMITMENT_MODES = ["automatic", "review", "review_above_cap"];
 var isSignable = (v) => typeof v === "string" && SIGNABLE_COMMITMENT_MODES.includes(v);
 function allowedCommitmentModes(profile) {
   const declared = profile.commitment_modes;
@@ -404,7 +457,9 @@ function allowedCommitmentModes(profile) {
   return SIGNABLE_COMMITMENT_MODES.filter((m) => declared.includes(m));
 }
 function isCommitmentModeAllowed(profile, mode) {
-  return isSignable(mode) && allowedCommitmentModes(profile).includes(mode);
+  const allowed = allowedCommitmentModes(profile);
+  if (mode === "review_above_cap") return allowed.includes("automatic");
+  return isSignable(mode) && allowed.includes(mode);
 }
 
 // src/profile.ts
@@ -519,6 +574,7 @@ function validateProfile(profile) {
       }
       const seen = /* @__PURE__ */ new Set();
       for (const m of declaredModes) {
+        if (m === "review_above_cap") continue;
         if (!SIGNABLE_COMMITMENT_MODES.includes(m)) {
           errors.push({
             code: "PROFILE_INVALID",
@@ -540,6 +596,46 @@ function validateProfile(profile) {
       message: "commitment_modes declares no mode this profile can actually use."
     });
   }
+  if (boundsSchema) {
+    const readFields = /* @__PURE__ */ new Set();
+    for (const [fieldName, fieldDef] of Object.entries(boundsSchema.fields)) {
+      const bt = fieldDef.boundType;
+      if (bt && (bt.kind === "per_transaction" || bt.kind === "cumulative_sum")) readFields.add(bt.of);
+      const max = fieldDef.maximum;
+      if (max !== void 0 && (typeof max !== "number" || !Number.isFinite(max))) {
+        errors.push({
+          code: "PROFILE_INVALID",
+          field: fieldName,
+          message: `Bounds field "${fieldName}": maximum MUST be a number (Bounds Schema rule 9).`
+        });
+      }
+      const enforcedBy = fieldDef.enforcedBy;
+      if (enforcedBy !== void 0 && enforcedBy !== "gatekeeper") {
+        errors.push({
+          code: "PROFILE_INVALID",
+          field: fieldName,
+          message: `Bounds field "${fieldName}": enforcedBy MUST be "gatekeeper" when present (Bounds Schema rule 11).`
+        });
+      }
+    }
+    for (const f of profile.disclose_fields ?? []) {
+      if (!readFields.has(f)) {
+        errors.push({
+          code: "PROFILE_INVALID",
+          field: "disclose_fields",
+          message: `disclose_fields names "${f}", which no bound reads \u2014 only what a ticket carries can be disclosed.`
+        });
+      }
+    }
+  }
+  const binding = profile.content_binding;
+  if (binding && String(binding.version) === "2" && binding.kind === "text") {
+    errors.push({
+      code: "PROFILE_INVALID",
+      field: "content_binding",
+      message: 'A version-2 content_binding is defined for kind "jcs" only; kind "text" is invalid.'
+    });
+  }
   return errors;
 }
 function checkDiscloseSubset(mandateDiscloseFields, profileDiscloseFields) {
@@ -706,7 +802,7 @@ function validateMandateOwners(payload) {
   if (!Array.isArray(owners) || owners.length !== 1) {
     throw new HapError(
       "MALFORMED_MANDATE",
-      `mandate_owners MUST contain exactly one entry in v0.7, got ${Array.isArray(owners) ? owners.length : typeof owners}`
+      `mandate_owners MUST contain exactly one entry (Mandate rule 7), got ${Array.isArray(owners) ? owners.length : typeof owners}`
     );
   }
   const entry = owners[0];
@@ -725,17 +821,45 @@ function validateMandateOwners(payload) {
     throw new HapError("OWNER_SIGNATURE_INVALID", `co-signing DID ${entry.did} is not key-bearing`);
   }
 }
+function validateAboveCapFields(payload) {
+  const hasCaps = payload.above_cap_caps !== void 0;
+  const hasApprovers = payload.above_cap_approvers !== void 0;
+  const hasCount = payload.above_cap_approvals !== void 0;
+  if (hasCaps !== hasApprovers) {
+    throw new HapError("MALFORMED_MANDATE", "above_cap_caps and above_cap_approvers are present together or absent together");
+  }
+  if (payload.commitment_mode === "review_above_cap" && !hasApprovers) {
+    throw new HapError("MALFORMED_MANDATE", "a review_above_cap mandate MUST carry above_cap_caps and above_cap_approvers");
+  }
+  if (payload.version === "0.7") {
+    if (hasCount) {
+      throw new HapError("MALFORMED_MANDATE", "a v0.7 mandate carries no above_cap_approvals");
+    }
+    if (hasApprovers && payload.commitment_mode !== "review_above_cap") {
+      throw new HapError("MALFORMED_MANDATE", "a v0.7 mandate carries above-cap fields only under review_above_cap");
+    }
+    return;
+  }
+  if (hasApprovers !== hasCount) {
+    throw new HapError("MALFORMED_MANDATE", "above_cap_approvals is present exactly when above_cap_approvers is (Mandate rule 10)");
+  }
+  if (hasCount) {
+    const n = payload.above_cap_approvals;
+    if (typeof n !== "number" || !Number.isInteger(n) || n < 1) {
+      throw new HapError("MALFORMED_MANDATE", `above_cap_approvals MUST be an integer >= 1, got ${JSON.stringify(n)}`);
+    }
+  }
+  if (hasApprovers && payload.commitment_mode === "automatic") {
+    throw new HapError("MALFORMED_MANDATE", "an automatic mandate carries no above-cap fields");
+  }
+}
 async function verifyMandate(blob, opts) {
   const mandate = decodeMandateBlob(blob);
-  if (mandate.payload.version !== PROTOCOL_VERSION) {
-    throw new HapError(
-      "VERSION_UNSUPPORTED",
-      `mandate version ${JSON.stringify(mandate.payload.version)} is not verifiable by this implementation (verifies ${PROTOCOL_VERSION} only \u2014 re-issue the mandate)`
-    );
-  }
+  assertSupportedVersion(mandate.payload.version, "mandate");
   await verifyMandateSignature(mandate, opts);
   checkMandateExpiry(mandate.payload, opts?.now);
   validateMandateOwners(mandate.payload);
+  validateAboveCapFields(mandate.payload);
   return mandate.payload;
 }
 
@@ -772,9 +896,10 @@ function buildMandateProjection(payload, entry) {
       "mandate projection requires profile_hash, bounds_hash, scope_hash and commitment_mode"
     );
   }
+  const version = payload.version === "0.7" ? "0.7" : "0.8";
   const projection = {
     typ: "HAP-mandate-projection",
-    version: "0.7",
+    version,
     profile_id,
     profile_hash,
     owner_did: entry.did,
@@ -789,13 +914,32 @@ function buildMandateProjection(payload, entry) {
   if (payload.intent_disclosure_hash !== void 0) {
     projection.intent_disclosure_hash = payload.intent_disclosure_hash;
   }
-  if (payload.commitment_mode === "review_above_cap") {
-    projection.above_cap_caps = payload.above_cap_caps;
-    projection.above_cap_approvers = payload.above_cap_approvers;
+  if (version === "0.7") {
+    if (payload.commitment_mode === "review_above_cap") {
+      projection.above_cap_caps = payload.above_cap_caps;
+      projection.above_cap_approvers = payload.above_cap_approvers;
+    }
+  } else {
+    if (payload.above_cap_approvers !== void 0) {
+      projection.above_cap_caps = payload.above_cap_caps;
+      projection.above_cap_approvers = payload.above_cap_approvers;
+      projection.above_cap_approvals = payload.above_cap_approvals;
+    }
   }
   if (payload.disclose_fields !== void 0) {
     projection.disclose_fields = payload.disclose_fields;
   }
+  if (version === "0.8") {
+    if (entry.binding === void 0 || entry.signing_surface === void 0) {
+      throw new OwnerSignatureError(
+        "OWNER_SIGNATURE_INVALID",
+        "a v0.8 projection requires the entry's binding and signing_surface"
+      );
+    }
+    projection.binding = entry.binding;
+    projection.signing_surface = entry.signing_surface;
+    projection.subjects_disclosed = (payload.subjects ?? []).some((s) => s.did === entry.did);
+  }
   return projection;
 }
 function projectionSigningBytes(projection) {
@@ -841,11 +985,14 @@ async function verifyOwnerSignatures(mandate) {
   return entries;
 }
 async function verifyApproval(approval, signature, signerDid) {
+  if (approval.version === "0.8" && approval.approver_did !== signerDid) {
+    throw new OwnerSignatureError("APPROVAL_SIGNATURE_INVALID", `approval names approver ${approval.approver_did}, verified under ${signerDid}`);
+  }
   let publicKey;
   try {
     publicKey = decodeDidKey(signerDid);
   } catch (err) {
-    throw new OwnerSignatureError("OWNER_SIGNATURE_INVALID", err.message);
+    throw new OwnerSignatureError("APPROVAL_SIGNATURE_INVALID", err.message);
   }
   const ok = await ed2.verifyAsync(decodeOrThrow(signature, "APPROVAL_SIGNATURE_INVALID"), approvalSigningBytes(approval), publicKey).catch(() => false);
   if (!ok) {
@@ -853,6 +1000,9 @@ async function verifyApproval(approval, signature, signerDid) {
   }
 }
 var BINDING_RANK = { raw: 0, webauthn: 1, eudi: 2 };
+function bindingRank(binding) {
+  return BINDING_RANK[binding] ?? 0;
+}
 function checkOwnerSignatureRequirement(payload, floor) {
   if (!floor?.required) return;
   const entry = payload.mandate_owners[0];
@@ -864,7 +1014,7 @@ function checkOwnerSignatureRequirement(payload, floor) {
     );
   }
   const minRank = floor.minBinding ? BINDING_RANK[floor.minBinding] : 0;
-  const haveRank = BINDING_RANK[entry.binding] ?? 0;
+  const haveRank = bindingRank(entry.binding);
   if (haveRank < minRank) {
     throw new OwnerSignatureError(
       "OWNER_SIGNATURE_REQUIRED",
@@ -875,11 +1025,27 @@ function checkOwnerSignatureRequirement(payload, floor) {
 
 // src/ticket.ts
 import * as ed3 from "@noble/ed25519";
+var TICKET_FRESHNESS_SECONDS = 300;
 async function signTicket(payload, privateKey) {
   const signature = toBase64Url(await ed3.signAsync(new TextEncoder().encode(canonicalize(payload)), privateKey));
   return { ...payload, signature };
 }
+function assertTicketShape(ticket) {
+  if ("typ" in ticket) {
+    throw new HapError("INVALID_SIGNATURE", "a ticket carries no typ \u2014 an object with one is a projection, not a ticket");
+  }
+  if ("mandate_id" in ticket || "issued_at" in ticket) {
+    throw new HapError("INVALID_SIGNATURE", "a ticket carries no mandate_id or issued_at \u2014 this object is a mandate payload");
+  }
+  for (const required of ["id", "mandateId", "actionType", "timestamp", "issuer"]) {
+    if (ticket[required] === void 0) {
+      throw new HapError("INVALID_SIGNATURE", `ticket is missing required field ${required}`);
+    }
+  }
+}
 async function verifyTicketSignature(ticket, opts) {
+  assertTicketShape(ticket);
+  assertSupportedVersion(ticket.version, "ticket");
   const { signature, ...unsigned } = ticket;
   if (!signature) {
     throw new HapError("INVALID_SIGNATURE", "ticket carries no signature");
@@ -905,6 +1071,120 @@ async function verifyTicketSignature(ticket, opts) {
     throw new HapError("INVALID_SIGNATURE", "ticket signature verification failed");
   }
 }
+var ECHOED_FIELDS = [
+  "profileId",
+  "actionType",
+  "boundsHash",
+  "executionContext",
+  "contentHash",
+  "contentBinding",
+  "proposalId",
+  "proposalContentHash"
+];
+function verifyTicketAgainstRequest(ticket, request, opts = {}) {
+  for (const field of ECHOED_FIELDS) {
+    const sent = request[field];
+    const got = ticket[field];
+    if (sent === void 0 && got === void 0) continue;
+    if (sent === void 0 || got === void 0 || canonicalize(sent) !== canonicalize(got)) {
+      throw new HapError("TICKET_REQUEST_MISMATCH", `ticket ${field} differs from the request's`);
+    }
+  }
+  if (request.idempotencyKey !== void 0 && ticket.idempotencyKey !== request.idempotencyKey) {
+    throw new HapError(
+      "TICKET_REQUEST_MISMATCH",
+      ticket.idempotencyKey === void 0 ? "ticket carries no idempotencyKey although the request sent one" : "ticket idempotencyKey differs from the one the request sent"
+    );
+  }
+  const expectedMandateId = opts.mandate?.payload.mandate_id ?? request.mandateId;
+  if (expectedMandateId !== void 0 && ticket.mandateId !== expectedMandateId) {
+    throw new HapError("TICKET_REQUEST_MISMATCH", `ticket mandateId ${ticket.mandateId} is not the mandate this request was made under`);
+  }
+  if (opts.mandate && ticket.version !== opts.mandate.payload.version) {
+    throw new HapError("TICKET_REQUEST_MISMATCH", `ticket version ${ticket.version} differs from its mandate's ${opts.mandate.payload.version}`);
+  }
+  if (!opts.replay) {
+    const now = opts.now ?? Math.floor(Date.now() / 1e3);
+    if (Math.abs(now - ticket.timestamp) > TICKET_FRESHNESS_SECONDS) {
+      throw new HapError("TICKET_REQUEST_MISMATCH", `ticket timestamp ${ticket.timestamp} is outside the freshness window at ${now}`);
+    }
+  }
+}
+function reconstructApproval(ticket, entry, approverDid) {
+  if (!ticket.proposalId) {
+    throw new HapError("APPROVAL_SIGNATURE_INVALID", "ticket carries an approval signature but no proposalId");
+  }
+  if (ticket.version === "0.7") {
+    if (!ticket.contentHash) {
+      throw new HapError("APPROVAL_SIGNATURE_INVALID", "a v0.7 approval without a content binding is not reconstructible from the ticket alone");
+    }
+    return {
+      typ: "HAP-approval",
+      version: "0.7",
+      proposal_id: ticket.proposalId,
+      mandate_id: ticket.mandateId,
+      decision: "commit",
+      content_hash: ticket.contentHash,
+      decided_at: entry.decided_at,
+      nonce: entry.nonce
+    };
+  }
+  if (!ticket.proposalContentHash) {
+    throw new HapError("APPROVAL_SIGNATURE_INVALID", "a v0.8 review-path ticket carries proposalContentHash");
+  }
+  return {
+    typ: "HAP-approval",
+    version: "0.8",
+    approver_did: approverDid,
+    proposal_id: ticket.proposalId,
+    mandate_id: ticket.mandateId,
+    action: ticket.action,
+    action_type: ticket.actionType,
+    decision: "commit",
+    content_hash: ticket.contentHash ?? ticket.proposalContentHash,
+    proposal_content_hash: ticket.proposalContentHash,
+    decided_at: entry.decided_at,
+    nonce: entry.nonce
+  };
+}
+async function verifyTicketApprovals(ticket, mandate) {
+  if (ticket.mandateId !== mandate.payload.mandate_id) {
+    throw new HapError("APPROVAL_SIGNATURE_INVALID", "the mandate supplied is not the one the ticket names");
+  }
+  const ownerDid = mandate.payload.mandate_owners[0]?.did;
+  const result = { approvers: [] };
+  try {
+    if (ticket.approvalSignature) {
+      const approval = reconstructApproval(ticket, ticket.approvalSignature, ownerDid);
+      await verifyApproval(approval, ticket.approvalSignature.signature, ownerDid);
+      result.owner = ownerDid;
+    }
+    const signed = new Set(mandate.payload.above_cap_approvers ?? []);
+    for (const entry of ticket.approvalSignatures ?? []) {
+      if (!signed.has(entry.approver_did)) {
+        throw new HapError("APPROVAL_SIGNATURE_INVALID", `approver ${entry.approver_did} is not in the mandate's signed above_cap_approvers`);
+      }
+      if (entry.approver_did === ownerDid) {
+        throw new HapError("APPROVAL_SIGNATURE_INVALID", "the proposer never counts as an above-cap approver");
+      }
+      const approval = reconstructApproval(ticket, entry, entry.approver_did);
+      await verifyApproval(approval, entry.signature, entry.approver_did);
+      if (!result.approvers.includes(entry.approver_did)) result.approvers.push(entry.approver_did);
+    }
+  } catch (err) {
+    if (err instanceof OwnerSignatureError) throw new HapError(err.code, err.message);
+    throw err;
+  }
+  return result;
+}
+function approvalsSufficient(mandate, verified, aboveCap) {
+  const p = mandate.payload;
+  const ownerNeeded = p.commitment_mode === "review";
+  if (ownerNeeded && !verified.owner) return false;
+  if (!aboveCap) return true;
+  const required = p.version === "0.7" ? (p.above_cap_approvers ?? []).length : p.above_cap_approvals ?? 1;
+  return verified.approvers.length >= required;
+}
 function publicTicketView(ticket, governingDiscloseFields = []) {
   const { userId: _userId, cumulativeState: _cumulativeState, limits: _limits, executionContext, ...rest } = ticket;
   const allowed = new Set(governingDiscloseFields);
@@ -915,6 +1195,475 @@ function publicTicketView(ticket, governingDiscloseFields = []) {
   return { ...rest, executionContext: disclosedExecutionContext };
 }
 
+// src/ticket-projection.ts
+import * as ed4 from "@noble/ed25519";
+var PROJECTION_MAX_VALIDITY_SECONDS = 86400;
+function buildTicketProjection(ticket, mandate, opts) {
+  if (ticket.mandateId !== mandate.payload.mandate_id) {
+    throw new HapError("MALFORMED_TICKET_REQUEST", "the mandate supplied is not the one the ticket names");
+  }
+  if (opts.validUntil > ticket.timestamp + PROJECTION_MAX_VALIDITY_SECONDS) {
+    throw new HapError("MALFORMED_TICKET_REQUEST", `valid_until MUST NOT end later than ${PROJECTION_MAX_VALIDITY_SECONDS}s after the ticket's timestamp`);
+  }
+  const projection = {
+    typ: "HAP-ticket-projection",
+    version: ticket.version,
+    id: ticket.id,
+    mandateId: ticket.mandateId,
+    issuer: ticket.issuer,
+    timestamp: ticket.timestamp,
+    valid_until: opts.validUntil,
+    profileId: ticket.profileId,
+    actionType: ticket.actionType,
+    boundsHash: ticket.boundsHash
+  };
+  if (ticket.contentHash !== void 0) projection.contentHash = ticket.contentHash;
+  if (ticket.contentBinding !== void 0) projection.contentBinding = ticket.contentBinding;
+  if (ticket.subjects !== void 0) projection.subjects = ticket.subjects;
+  const disclosed = {};
+  for (const field of opts.discloseFields ?? []) {
+    if (ticket.executionContext[field] !== void 0) disclosed[field] = ticket.executionContext[field];
+  }
+  if (Object.keys(disclosed).length > 0) projection.executionContext = disclosed;
+  const owner = mandate.payload.mandate_owners[0];
+  if (owner?.signature !== void 0) projection.owner = owner;
+  return projection;
+}
+async function signTicketProjection(projection, privateKey) {
+  const signature = toBase64Url(await ed4.signAsync(new TextEncoder().encode(canonicalize(projection)), privateKey));
+  return { ...projection, signature };
+}
+async function verifyTicketProjection(projection, opts = {}) {
+  if (projection.typ !== "HAP-ticket-projection") {
+    throw new HapError("INVALID_SIGNATURE", 'a projection verifier requires typ "HAP-ticket-projection"');
+  }
+  for (const k of ["userId", "cumulativeState", "limits", "action"]) {
+    if (k in projection) throw new HapError("INVALID_SIGNATURE", `a projection MUST NOT carry ${k}`);
+  }
+  if (opts.trustedIssuers && !opts.trustedIssuers.includes(projection.issuer)) {
+    throw new HapError("INVALID_SIGNATURE", `issuer ${JSON.stringify(projection.issuer)} is not a trusted Authority Server`);
+  }
+  const { signature, ...unsigned } = projection;
+  if (!signature) throw new HapError("INVALID_SIGNATURE", "projection carries no signature");
+  let publicKey;
+  try {
+    publicKey = decodeDidKey(projection.issuer);
+  } catch (err) {
+    throw new HapError("INVALID_SIGNATURE", `cannot resolve a key from issuer ${JSON.stringify(projection.issuer)}: ${err.message}`);
+  }
+  let sigBytes;
+  try {
+    sigBytes = fromBase64Url(signature);
+  } catch (err) {
+    throw new HapError("INVALID_SIGNATURE", err.message);
+  }
+  const ok = await ed4.verifyAsync(sigBytes, new TextEncoder().encode(canonicalize(unsigned)), publicKey).catch(() => false);
+  if (!ok) throw new HapError("INVALID_SIGNATURE", "projection signature verification failed");
+  if (opts.asAuthorization) {
+    const now = opts.now ?? Math.floor(Date.now() / 1e3);
+    if (now > projection.valid_until) {
+      throw new HapError("POLICY_UNMET", `projection presented after valid_until ${projection.valid_until}`);
+    }
+  }
+}
+async function verifyProjectionOwner(projection, mandate) {
+  if (!projection.owner) {
+    throw new HapError("OWNER_SIGNATURE_INVALID", "projection carries no owner entry");
+  }
+  if (projection.mandateId !== mandate.payload.mandate_id) {
+    throw new HapError("OWNER_SIGNATURE_INVALID", "the mandate supplied is not the one the projection names");
+  }
+  const own = mandate.payload.mandate_owners[0];
+  if (!own || canonicalize(own) !== canonicalize(projection.owner)) {
+    throw new HapError("OWNER_SIGNATURE_INVALID", "projection owner entry differs from the mandate's mandate_owners entry");
+  }
+  try {
+    await verifyOwnerSignature(mandate, projection.owner);
+  } catch (err) {
+    if (err instanceof OwnerSignatureError) throw new HapError(err.code, err.message);
+    throw err;
+  }
+}
+
+// src/verifier-policy.ts
+var PolicyError = class extends HapError {
+  constructor(line, code, message) {
+    super(code, `${line}: ${message}`);
+    this.line = line;
+    this.name = "PolicyError";
+  }
+};
+async function evaluateVerifierPolicy(policy, input) {
+  if (policy.typ !== "HAP-verifier-policy") {
+    throw new HapError("POLICY_UNMET", 'policy document must carry typ "HAP-verifier-policy"');
+  }
+  const artifact = input.ticket ?? input.projection;
+  if (!artifact) throw new HapError("POLICY_UNMET", "no ticket or projection to evaluate");
+  const now = input.now ?? Math.floor(Date.now() / 1e3);
+  try {
+    if (input.ticket) {
+      await verifyTicketSignature(input.ticket, { trustedIssuers: policy.trusted_issuers });
+    } else if (input.projection) {
+      await verifyTicketProjection(input.projection, { trustedIssuers: policy.trusted_issuers, now, asAuthorization: input.asAuthorization });
+    }
+    if (input.mandate) {
+      await verifyMandateSignature(input.mandate, { trustedIssuers: policy.trusted_issuers });
+    }
+  } catch (err) {
+    const code = err instanceof HapError ? err.code : "INVALID_SIGNATURE";
+    throw new PolicyError(code === "POLICY_UNMET" ? "freshness_seconds" : "trusted_issuers", code, err.message);
+  }
+  let verifiedOwnerDids;
+  const needOwners = policy.min_binding !== void 0 || policy.required_owners !== void 0;
+  if (needOwners) {
+    verifiedOwnerDids = /* @__PURE__ */ new Map();
+    if (input.mandate) {
+      try {
+        const entries = await verifyOwnerSignatures(input.mandate);
+        for (const e of entries) verifiedOwnerDids.set(e.did, e.binding ?? "raw");
+        if (input.projection?.owner) await verifyProjectionOwner(input.projection, input.mandate);
+      } catch (err) {
+        throw new PolicyError("min_binding", "OWNER_SIGNATURE_REQUIRED", `no verifiable owner signature: ${err.message}`);
+      }
+    }
+  }
+  if (policy.min_binding !== void 0) {
+    const minRank = BINDING_RANK[policy.min_binding];
+    if (minRank === void 0) {
+      throw new PolicyError("min_binding", "OWNER_SIGNATURE_REQUIRED", `unknown binding "${policy.min_binding}" \u2014 satisfies no minimum`);
+    }
+    const best = Math.max(-1, ...[...verifiedOwnerDids.values()].map(bindingRank));
+    if (best < minRank) {
+      throw new PolicyError("min_binding", "OWNER_SIGNATURE_REQUIRED", `no verified owner signature at binding >= "${policy.min_binding}"`);
+    }
+  }
+  if (policy.required_owners !== void 0) {
+    for (const did of policy.required_owners) {
+      if (!verifiedOwnerDids.has(did)) {
+        throw new PolicyError("required_owners", "OWNER_SIGNATURE_REQUIRED", `no verified owner signature by ${did}`);
+      }
+    }
+  }
+  if (policy.profile_hashes !== void 0) {
+    const mandate = input.mandate;
+    if (!mandate) throw new PolicyError("profile_hashes", "PROFILE_HASH_MISMATCH", "the mandate is needed to check profile_hashes");
+    const expected = policy.profile_hashes[mandate.payload.profile_id];
+    if (expected === void 0) {
+      throw new PolicyError("profile_hashes", "PROFILE_HASH_MISMATCH", `profile ${mandate.payload.profile_id} is not listed`);
+    }
+    if (expected !== mandate.payload.profile_hash) {
+      throw new PolicyError("profile_hashes", "PROFILE_HASH_MISMATCH", `profile_hash differs from the listed one for ${mandate.payload.profile_id}`);
+    }
+    if (mandate.payload.mandate_id !== artifact.mandateId) {
+      throw new PolicyError("profile_hashes", "PROFILE_HASH_MISMATCH", "the mandate supplied is not the one the artifact names");
+    }
+  }
+  if (policy.action_types !== void 0 && !policy.action_types.includes(artifact.actionType)) {
+    throw new PolicyError("action_types", "POLICY_UNMET", `actionType ${artifact.actionType} is not in the listed set`);
+  }
+  if (policy.freshness_seconds !== void 0) {
+    if (now - artifact.timestamp > policy.freshness_seconds) {
+      throw new PolicyError("freshness_seconds", "POLICY_UNMET", `ticket is ${now - artifact.timestamp}s old, policy allows ${policy.freshness_seconds}s`);
+    }
+    if (input.projection && input.asAuthorization && now > input.projection.valid_until) {
+      throw new PolicyError("freshness_seconds", "POLICY_UNMET", "projection presented after valid_until");
+    }
+  }
+  if (policy.required_fields !== void 0) {
+    const ctx = input.ticket?.executionContext ?? input.projection?.executionContext ?? {};
+    for (const f of policy.required_fields) {
+      if (ctx[f] === void 0) {
+        throw new PolicyError("required_fields", "POLICY_UNMET", `execution-context field ${f} is not ${input.ticket ? "present" : "disclosed"}`);
+      }
+    }
+  }
+  if (policy.require_approval_signature) {
+    const ticket = input.ticket;
+    const mandate = input.mandate;
+    if (!ticket || !mandate) {
+      throw new PolicyError("require_approval_signature", "APPROVAL_SIGNATURE_REQUIRED", "the complete ticket and its mandate are needed to verify approvals");
+    }
+    if (ticket.proposalId !== void 0) {
+      let verified;
+      try {
+        verified = await verifyTicketApprovals(ticket, mandate);
+      } catch (err) {
+        throw new PolicyError("require_approval_signature", "APPROVAL_SIGNATURE_REQUIRED", err.message);
+      }
+      const aboveCap = input.aboveCap ?? (ticket.approvalSignatures !== void 0 && ticket.approvalSignatures.length > 0);
+      if (!approvalsSufficient(mandate, verified, aboveCap)) {
+        throw new PolicyError("require_approval_signature", "APPROVAL_SIGNATURE_REQUIRED", "the ticket lacks a verifiable signature for each decision it rests on");
+      }
+    }
+  }
+}
+
+// src/proposal-content.ts
+import { createHash as createHash6 } from "crypto";
+import { CipherSuite, DhkemX25519HkdfSha256, HkdfSha256, Aes256Gcm } from "@hpke/core";
+function suite() {
+  return new CipherSuite({ kem: new DhkemX25519HkdfSha256(), kdf: new HkdfSha256(), aead: new Aes256Gcm() });
+}
+var webCrypto = () => {
+  const c = globalThis.crypto;
+  if (!c?.subtle) throw new Error("WebCrypto is not available in this runtime");
+  return c;
+};
+function proposalContentJcs(args) {
+  if (args === null || typeof args !== "object" || Array.isArray(args)) {
+    throw new HapError("PROPOSAL_NOT_ENCRYPTED", "proposal content is one object \u2014 the action's argument object");
+  }
+  return canonicalize(args);
+}
+function computeProposalContentHash(args) {
+  return `sha256:${createHash6("sha256").update(proposalContentJcs(args), "utf8").digest("hex")}`;
+}
+async function generateReaderKeyPair() {
+  const kp = await suite().kem.generateKeyPair();
+  return exportKeyPair(kp);
+}
+async function deriveReaderKeyPair(ikm) {
+  const kp = await suite().kem.deriveKeyPair(ikm);
+  return exportKeyPair(kp);
+}
+async function exportKeyPair(kp) {
+  const s = suite();
+  return {
+    privateKey: new Uint8Array(await s.kem.serializePrivateKey(kp.privateKey)),
+    publicKey: new Uint8Array(await s.kem.serializePublicKey(kp.publicKey))
+  };
+}
+async function encryptProposalContent(args, readers, opts = {}) {
+  if (readers.length === 0) {
+    throw new HapError("PROPOSAL_NOT_ENCRYPTED", "a proposal has at least one reader (the Mandate Owner)");
+  }
+  const jcs = proposalContentJcs(args);
+  const proposalContentHash = computeProposalContentHash(args);
+  const crypto = webCrypto();
+  const s = suite();
+  const cek = opts.deterministic?.contentKey ?? crypto.getRandomValues(new Uint8Array(32));
+  const iv = opts.deterministic?.iv ?? crypto.getRandomValues(new Uint8Array(12));
+  if (cek.length !== 32 || iv.length !== 12) {
+    throw new HapError("PROPOSAL_NOT_ENCRYPTED", "content key is 32 bytes and IV is 12 bytes");
+  }
+  const aesKey = await crypto.subtle.importKey("raw", cek, { name: "AES-GCM", length: 256 }, false, ["encrypt"]);
+  const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, new TextEncoder().encode(jcs)));
+  const ciphertext = new Uint8Array(iv.length + sealed.length);
+  ciphertext.set(iv, 0);
+  ciphertext.set(sealed, iv.length);
+  const encrypted_keys = {};
+  for (const { did, publicKey } of readers) {
+    const recipientPublicKey = await s.kem.deserializePublicKey(publicKey);
+    const ekmIkm = opts.deterministic?.ephemeralIkm[did];
+    const sender = await s.createSenderContext({
+      recipientPublicKey,
+      ...ekmIkm ? { ekm: await s.kem.deriveKeyPair(ekmIkm) } : {}
+    });
+    const ct = new Uint8Array(await sender.seal(cek));
+    encrypted_keys[did] = { ct: toBase64Url(ct), enc: toBase64Url(new Uint8Array(sender.enc)) };
+  }
+  return {
+    content: {
+      ciphertext: toBase64Url(ciphertext),
+      encrypted_keys,
+      readers: readers.map((r) => r.did),
+      unreadable: [...opts.unreadable ?? []]
+    },
+    proposalContentHash
+  };
+}
+async function decryptProposalContent(content, readerDid, readerPrivateKey) {
+  const wrap = content.encrypted_keys[readerDid];
+  if (!wrap) throw new HapError("PROPOSAL_NOT_ENCRYPTED", `no key wrapped for reader ${readerDid}`);
+  const s = suite();
+  const crypto = webCrypto();
+  let cek;
+  try {
+    const recipient = await s.createRecipientContext({
+      recipientKey: await s.kem.deserializePrivateKey(readerPrivateKey),
+      enc: fromBase64Url(wrap.enc)
+    });
+    cek = new Uint8Array(await recipient.open(fromBase64Url(wrap.ct)));
+  } catch (err) {
+    throw new HapError("PROPOSAL_NOT_ENCRYPTED", `proposal content is unreadable for ${readerDid}: ${err.message}`);
+  }
+  const bytes = fromBase64Url(content.ciphertext);
+  if (bytes.length < 12 + 16) throw new HapError("PROPOSAL_NOT_ENCRYPTED", "ciphertext is shorter than IV + tag");
+  let plaintext;
+  try {
+    const aesKey = await crypto.subtle.importKey("raw", cek, { name: "AES-GCM", length: 256 }, false, ["decrypt"]);
+    plaintext = new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv: bytes.subarray(0, 12) }, aesKey, bytes.subarray(12)));
+  } catch (err) {
+    throw new HapError("PROPOSAL_NOT_ENCRYPTED", `proposal content is unreadable for ${readerDid}: ${err.message}`);
+  }
+  const contentJcs = new TextDecoder().decode(plaintext);
+  let args;
+  try {
+    args = JSON.parse(contentJcs);
+  } catch {
+    throw new HapError("PROPOSAL_NOT_ENCRYPTED", "decrypted content is not JSON");
+  }
+  return { arguments: args, contentJcs, proposalContentHash: computeProposalContentHash(args) };
+}
+function checkProposalReaders(content, expected) {
+  const want = /* @__PURE__ */ new Set([expected.ownerDid, ...expected.deciders]);
+  const have = /* @__PURE__ */ new Set([...content.readers, ...content.unreadable]);
+  if (want.size !== have.size || [...want].some((d) => !have.has(d))) {
+    throw new HapError("PROPOSAL_APPROVERS_INVALID", "readers \u222A unreadable differs from the owner plus the signed deciders");
+  }
+  const keyed = new Set(Object.keys(content.encrypted_keys));
+  const readers = new Set(content.readers);
+  if (keyed.size !== readers.size || [...readers].some((d) => !keyed.has(d))) {
+    throw new HapError("PROPOSAL_NOT_ENCRYPTED", "readers differs from the key set of encrypted_keys");
+  }
+}
+
+// src/issuance.ts
+import { createHash as createHash7 } from "crypto";
+function computeExecutionContextHash(profile) {
+  const schema = profile.executionContextSchema ?? {};
+  return `sha256:${createHash7("sha256").update(canonicalize(schema), "utf8").digest("hex")}`;
+}
+function boundReadFields(profile) {
+  const fields = /* @__PURE__ */ new Set();
+  for (const def of Object.values(profile.boundsSchema?.fields ?? {})) {
+    const bt = def.boundType;
+    if (bt && (bt.kind === "per_transaction" || bt.kind === "cumulative_sum")) fields.add(bt.of);
+  }
+  return fields;
+}
+function wireExecutionContext(execution, profile) {
+  const allowed = boundReadFields(profile);
+  const out = {};
+  for (const [k, v] of Object.entries(execution)) {
+    if (!allowed.has(k) || k.startsWith("_") || v === void 0 || v === null) continue;
+    out[k] = v;
+  }
+  return out;
+}
+function checkExecutionValues(execution, profile) {
+  for (const k of Object.keys(execution)) {
+    if (k.startsWith("_")) {
+      throw new HapError("MALFORMED_TICKET_REQUEST", `executionContext key "${k}" is reserved and MUST NOT travel`);
+    }
+  }
+  for (const field of boundReadFields(profile)) {
+    const v = execution[field];
+    if (v === void 0 || v === null) continue;
+    if (typeof v !== "number" || !Number.isFinite(v) || v < 0) {
+      throw new HapError(
+        "MALFORMED_TICKET_REQUEST",
+        `executionContext.${field} MUST be a finite, non-negative number, got ${JSON.stringify(v)}`
+      );
+    }
+  }
+}
+function boundGoverns(def, actionType) {
+  return !def.appliesTo || def.appliesTo.includes(actionType);
+}
+function missingSumFields(execution, profile, actionType) {
+  const missing = [];
+  for (const [name, def] of Object.entries(profile.boundsSchema?.fields ?? {})) {
+    const bt = def.boundType;
+    if (!bt || bt.kind !== "cumulative_sum" || !boundGoverns(def, actionType)) continue;
+    const v = execution[bt.of];
+    if (v === void 0 || v === null) missing.push({ bound: name, field: bt.of });
+  }
+  return missing;
+}
+function checkBoundsValues(bounds, profile) {
+  for (const [name, def] of Object.entries(profile.boundsSchema?.fields ?? {})) {
+    if (name === "profile") continue;
+    const v = bounds[name];
+    if (v === void 0 || v === null) continue;
+    if (def.type === "number" || def.maximum !== void 0) {
+      if (typeof v !== "number" || !Number.isFinite(v)) {
+        throw new HapError("BOUNDS_INVALID_VALUE", `bound "${name}" MUST be a number, got ${JSON.stringify(v)}`);
+      }
+      if (def.maximum !== void 0 && v > def.maximum) {
+        throw new HapError("BOUNDS_INVALID_VALUE", `bound "${name}" = ${v} exceeds the profile's maximum ${def.maximum}`);
+      }
+    }
+    const bt = def.boundType;
+    if (bt?.kind === "enum" && !bt.values.includes(String(v))) {
+      throw new HapError("BOUNDS_INVALID_VALUE", `bound "${name}" = ${JSON.stringify(v)} is not in [${bt.values.join(", ")}]`);
+    }
+  }
+}
+function exceedsCap(value, cap, def) {
+  const bt = def.boundType;
+  if (bt?.kind === "enum") {
+    const order = bt.values;
+    const vi = order.indexOf(String(value));
+    const ci = order.indexOf(String(cap));
+    if (vi < 0 || ci < 0) return true;
+    return vi < ci;
+  }
+  return typeof value !== "number" || typeof cap !== "number" || value > cap;
+}
+function checkGroupCeilings(bounds, profile, caps) {
+  const fields = profile.boundsSchema?.fields ?? {};
+  const hard = { ...caps.hard ?? {} };
+  for (const [name, cap] of Object.entries(caps.approval ?? {})) {
+    const def = fields[name];
+    const bt = def?.boundType;
+    if (!def || !bt) continue;
+    if (bt.kind !== "per_transaction" || def.enforcedBy === "gatekeeper") hard[name] = cap;
+  }
+  for (const [name, def] of Object.entries(fields)) {
+    if (name === "profile") continue;
+    const cap = hard[name];
+    if (cap === void 0) continue;
+    const v = bounds[name];
+    if (v === void 0 || v === null) {
+      if (!def.required) {
+        throw new HapError("GROUP_CAP_EXCEEDED", `bound "${name}" is omitted under a group ceiling of ${JSON.stringify(cap)} \u2014 an omitted bound is unlimited`);
+      }
+      continue;
+    }
+    if (exceedsCap(v, cap, def)) {
+      throw new HapError("GROUP_CAP_EXCEEDED", `bound "${name}" = ${JSON.stringify(v)} exceeds the group's hard cap ${JSON.stringify(cap)}`);
+    }
+  }
+}
+function validateAboveCapConfig(config, profile, opts) {
+  const fields = profile.boundsSchema?.fields ?? {};
+  for (const name of Object.keys(config.caps ?? {})) {
+    if (name === "profile") throw new HapError("ABOVE_CAP_CONFIG_INVALID", "above_cap_caps MUST NOT name profile");
+    const def = fields[name];
+    if (!def || def.boundType?.kind !== "per_transaction" || def.type !== "number") {
+      throw new HapError("ABOVE_CAP_CONFIG_INVALID", `above_cap_caps names "${name}", which is not a numeric per_transaction bound of ${profile.id}`);
+    }
+  }
+  for (const did of config.approvers ?? []) {
+    if (!isKeyBearingDid(did)) {
+      throw new HapError("ABOVE_CAP_CONFIG_INVALID", `above-cap approver ${did} is not a key-bearing DID`);
+    }
+  }
+  if (config.approvers !== void 0 && !opts.inGroup) {
+    const others = config.approvers.filter((d) => d !== opts.ownerDid).length;
+    const n = config.approvals;
+    if (n === void 0 || !Number.isInteger(n) || n < 1 || n > others) {
+      throw new HapError(
+        "ABOVE_CAP_CONFIG_INVALID",
+        `above_cap_approvals MUST be an integer between 1 and the ${others} approver(s) other than the owner, got ${JSON.stringify(n)}`
+      );
+    }
+  }
+}
+function capsExceeded(execution, mandate, profile) {
+  const out = [];
+  for (const [name, cap] of Object.entries(mandate.above_cap_caps ?? {})) {
+    const bt = profile.boundsSchema?.fields[name]?.boundType;
+    if (!bt || bt.kind !== "per_transaction") continue;
+    const v = execution[bt.of];
+    if (v === void 0 || v === null || typeof v !== "number" || v > cap) {
+      out.push({ bound: name, field: bt.of, cap, value: v });
+    }
+  }
+  return out;
+}
+
 // src/profiles/index.ts
 var PROFILES = {};
 function registerProfile(profileId, profile) {
@@ -973,8 +1722,9 @@ async function verify(request, opts = {}) {
   }
   const expectedProfileHash = computeProfileHash(profile);
   const errors = [];
+  const verifiedPayloads = [];
   for (const blob of request.mandates) {
-    const mandateErrors = await verifyOneMandate(blob, {
+    const { errors: mandateErrors, payload } = await verifyOneMandate(blob, {
       expectedBoundsHash,
       expectedScopeHash,
       expectedProfileHash,
@@ -982,6 +1732,7 @@ async function verify(request, opts = {}) {
       now
     });
     errors.push(...mandateErrors);
+    if (payload) verifiedPayloads.push(payload);
   }
   if (errors.length > 0) {
     return { approved: false, errors };
@@ -1000,6 +1751,31 @@ async function verify(request, opts = {}) {
       };
     }
   }
+  try {
+    checkExecutionValues(request.execution, profile);
+  } catch (err) {
+    return { approved: false, errors: [{ code: codeFromThrown(err), message: err.message }] };
+  }
+  if (actionType !== void 0) {
+    const capped = /* @__PURE__ */ new Set();
+    for (const p of verifiedPayloads) {
+      for (const name of Object.keys(p.above_cap_caps ?? {})) {
+        const bt = profile.boundsSchema?.fields[name]?.boundType;
+        if (bt && bt.kind === "per_transaction") capped.add(bt.of);
+      }
+    }
+    const missing = missingSumFields(request.execution, profile, actionType).filter((m) => !capped.has(m.field));
+    if (missing.length > 0) {
+      return {
+        approved: false,
+        errors: missing.map(({ bound, field }) => ({
+          code: "BOUND_EXCEEDED",
+          field,
+          message: `Bound "${bound}" governs "${actionType}" and reads "${field}", but this call exposes no ${field}. Refusing: an action without an amount would consume nothing of the limit (v0.8: a missing amount fails safe).`
+        }))
+      };
+    }
+  }
   const boundsErrors = checkBounds(request, profile, actionType);
   if (boundsErrors.length > 0) {
     return { approved: false, errors: boundsErrors };
@@ -1033,16 +1809,21 @@ function codeFromThrown(err) {
   return "MALFORMED_MANDATE";
 }
 async function verifyOneMandate(blob, opts) {
+  const errors = await verifyOneMandateErrors(blob, opts);
+  if (errors.length > 0) return { errors };
+  return { errors, payload: decodeMandateBlob(blob).payload };
+}
+async function verifyOneMandateErrors(blob, opts) {
   let mandate;
   try {
     mandate = decodeMandateBlob(blob);
   } catch (err) {
     return [{ code: "MALFORMED_MANDATE", message: err.message }];
   }
-  if (mandate.payload.version !== PROTOCOL_VERSION) {
+  if (!isSupportedVersion(mandate.payload.version)) {
     return [{
       code: "VERSION_UNSUPPORTED",
-      message: `mandate version ${JSON.stringify(mandate.payload.version)} is not verifiable by this Gatekeeper (verifies ${PROTOCOL_VERSION} only)`
+      message: `mandate version ${JSON.stringify(mandate.payload.version)} is not verifiable by this Gatekeeper (verifies [${SUPPORTED_VERSIONS.join(", ")}])`
     }];
   }
   try {
@@ -1057,6 +1838,7 @@ async function verifyOneMandate(blob, opts) {
   }
   try {
     validateMandateOwners(mandate.payload);
+    validateAboveCapFields(mandate.payload);
   } catch (err) {
     return [{ code: codeFromThrown(err), message: err.message }];
   }
@@ -1222,60 +2004,96 @@ function checkScopeConstraints(scope, execution, profile) {
   return errors;
 }
 export {
+  BINDING_RANK,
+  COMMITMENT_MODES,
   CanonicalValueError,
   ContentBindingError,
   HapError,
+  ISSUABLE_VERSIONS,
   MANDATE_ERROR_CODES,
   OwnerSignatureError,
+  PROJECTION_MAX_VALIDITY_SECONDS,
+  PROPOSAL_ERROR_CODES,
   PROTOCOL_VERSION,
+  PolicyError,
   SIGNABLE_COMMITMENT_MODES,
   SUPPORTED_VERSIONS,
   TICKET_ERROR_CODES,
+  TICKET_FRESHNESS_SECONDS,
   allowedCommitmentModes,
   approvalSigningBytes,
+  approvalsSufficient,
+  assertSupportedVersion,
+  assertTicketShape,
   bindingAppliesTo,
+  bindingRank,
   boundActionTypes,
+  boundGoverns,
+  boundReadFields,
   buildMandateProjection,
+  buildTicketProjection,
   canonicalBounds,
   canonicalScope,
   canonicalize,
   canonicalizeText,
+  capsExceeded,
+  checkBoundsValues,
   checkDiscloseSubset,
+  checkExecutionValues,
+  checkGroupCeilings,
   checkMandateExpiry,
   checkOwnerSignatureRequirement,
+  checkProposalReaders,
   clearProfiles,
   computeBoundsHash,
   computeContentHash,
+  computeExecutionContextHash,
   computeFieldsContentHash,
   computeIntentDisclosureHash,
   computeIntentHash,
   computeProfileHash,
+  computeProposalContentHash,
   computeScopeHash,
   contentCanonicalBytes,
   decodeDidKey,
   decodeMandateBlob,
+  decryptProposalContent,
   deriveIdentityLine,
+  deriveReaderKeyPair,
   encodeDidKey,
   encodeMandateBlob,
+  encryptProposalContent,
+  evaluateVerifierPolicy,
+  exceedsCap,
+  filesFields,
   fromBase64Url,
+  generateReaderKeyPair,
   getAllProfiles,
   getProfile,
   intentDisclosureCanonicalBytes,
+  invalidFieldKindsReason,
   isCommitmentModeAllowed,
   isFieldBinding,
   isKeyBearingDid,
+  isSupportedVersion,
   listProfiles,
   mandateBlobId,
+  missingSumFields,
   negotiateVersion,
   projectionSigningBytes,
+  proposalContentJcs,
   publicTicketView,
+  reconstructApproval,
   registerProfile,
   selectBoundFields,
   signApproval,
   signMandate,
   signMandateProjection,
   signTicket,
+  signTicketProjection,
   toBase64Url,
+  validateAboveCapConfig,
+  validateAboveCapFields,
   validateBoundsParams,
   validateMandateOwners,
   validateProfile,
@@ -1287,5 +2105,10 @@ export {
   verifyMandateSignature,
   verifyOwnerSignature,
   verifyOwnerSignatures,
-  verifyTicketSignature
+  verifyProjectionOwner,
+  verifyTicketAgainstRequest,
+  verifyTicketApprovals,
+  verifyTicketProjection,
+  verifyTicketSignature,
+  wireExecutionContext
 };