@integraledger/agent-guard 0.9.0

package/dist/fetch.d.ts

@@ -0,0 +1,61 @@
+export interface FetchedTerms {
+    readonly bytes: Uint8Array;
+    readonly format: string;
+    readonly fetchedAt: string;
+}
+export interface TermsFetcher {
+    fetch(url: string): Promise<FetchedTerms>;
+}
+/** One resolved address for a host. Mirrors `node:dns/promises` `lookup(host, { all: true })`. */
+export interface ResolvedAddress {
+    readonly address: string;
+    readonly family: number;
+}
+/**
+ * The host-resolution port. REQUIRED, and deliberately not defaulted: the buyer fetches a URL the SELLER
+ * chose, so this is the guard between an agent's HTTP client and the buyer's own network — a config that
+ * can omit it silently omits the guard. Node deployments pass `nodeDnsLookup`; a Workers deployment passes
+ * its own (or one that throws, stating it relies on the platform's private-range egress blocking). The
+ * port MUST return literal-IP hosts unchanged, as `node:dns` does.
+ */
+export type HostLookup = (host: string) => Promise<readonly ResolvedAddress[]>;
+export interface CachingFetcherConfig {
+    readonly httpFetch: typeof fetch;
+    readonly now: () => string;
+    /** Resolves a hostname to the addresses the unicast guard checks. See `HostLookup` — no default. */
+    readonly lookup: HostLookup;
+    /** LCP §2.6: clients SHOULD NOT cache beyond this; default 24h. Re-fetch after it is a MUST (enforced here). */
+    readonly maxAgeSeconds?: number;
+    /** Fail-loud byte ceiling (DoS guard); default 1 MiB. */
+    readonly maxBytes?: number;
+    /** Max distinct URLs retained (bounded memory / anti-DoS); default 256. Oldest inserted entry evicted past it. */
+    readonly maxEntries?: number;
+}
+/**
+ * `node:dns/promises` as a `HostLookup`. Imported lazily so the module graph stays runtime-neutral (the
+ * gate is client-side and may run where `node:dns` does not exist) — a Workers build that never calls this
+ * never pulls it in.
+ */
+export declare const nodeDnsLookup: HostLookup;
+/**
+ * HTTPS-only, cached (LCP §2.6), size-capped, SSRF-guarded terms fetcher. The MUST (re-fetch after expiry) is
+ * unconditional; the SHOULD (≤24h) is the default cap.
+ *
+ * SSRF posture — this is the BUYER's exposure, because the URL comes off the seller's 402 challenge:
+ *  - HTTPS scheme required;
+ *  - `redirect: "error"`, so a redirect to a non-HTTPS or internal host fails loudly rather than being
+ *    followed silently;
+ *  - EVERY resolved address for the host must be public unicast (`evidence.isUnicastPublic` — the one
+ *    implementation of that predicate; this package does not re-derive it). The check runs on every
+ *    network fetch, not once per URL, so a cache expiry re-opens it rather than grandfathering a host.
+ *  - the byte cap is enforced while STREAMING, plus a `Content-Length` pre-check. Reading the whole body
+ *    and measuring afterwards protects the check but not the memory, and a chunked response with no
+ *    declared length is exactly the case the cap exists for.
+ *
+ * HONEST LIMITATION — DNS rebinding, carried verbatim from `evidence`'s resolver: the guard validates what
+ * `lookup` returns, but `httpFetch` performs its own resolution and nothing pins the connection to the
+ * validated address. This is real defense-in-depth (the naive name → private IP case is blocked outright),
+ * NOT a complete guarantee; closing it needs connection-level IP pinning inside the injected `httpFetch`.
+ */
+export declare function makeCachingFetcher(cfg: CachingFetcherConfig): TermsFetcher;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3C;AAED,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;AAE/E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,gHAAgH;IAChH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kHAAkH;IAClH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAGD;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,UAG3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,oBAAoB,GAAG,YAAY,CAmG1E"}

package/dist/fetch.js

@@ -0,0 +1,126 @@
+import { isUnicastPublic } from "@integraledger/lcp-evidence";
+const DAY = 86_400;
+/**
+ * `node:dns/promises` as a `HostLookup`. Imported lazily so the module graph stays runtime-neutral (the
+ * gate is client-side and may run where `node:dns` does not exist) — a Workers build that never calls this
+ * never pulls it in.
+ */
+export const nodeDnsLookup = async (host) => {
+    const dns = await import("node:dns/promises");
+    return dns.lookup(host, { all: true });
+};
+/**
+ * HTTPS-only, cached (LCP §2.6), size-capped, SSRF-guarded terms fetcher. The MUST (re-fetch after expiry) is
+ * unconditional; the SHOULD (≤24h) is the default cap.
+ *
+ * SSRF posture — this is the BUYER's exposure, because the URL comes off the seller's 402 challenge:
+ *  - HTTPS scheme required;
+ *  - `redirect: "error"`, so a redirect to a non-HTTPS or internal host fails loudly rather than being
+ *    followed silently;
+ *  - EVERY resolved address for the host must be public unicast (`evidence.isUnicastPublic` — the one
+ *    implementation of that predicate; this package does not re-derive it). The check runs on every
+ *    network fetch, not once per URL, so a cache expiry re-opens it rather than grandfathering a host.
+ *  - the byte cap is enforced while STREAMING, plus a `Content-Length` pre-check. Reading the whole body
+ *    and measuring afterwards protects the check but not the memory, and a chunked response with no
+ *    declared length is exactly the case the cap exists for.
+ *
+ * HONEST LIMITATION — DNS rebinding, carried verbatim from `evidence`'s resolver: the guard validates what
+ * `lookup` returns, but `httpFetch` performs its own resolution and nothing pins the connection to the
+ * validated address. This is real defense-in-depth (the naive name → private IP case is blocked outright),
+ * NOT a complete guarantee; closing it needs connection-level IP pinning inside the injected `httpFetch`.
+ */
+export function makeCachingFetcher(cfg) {
+    const maxAge = cfg.maxAgeSeconds ?? DAY;
+    const maxBytes = cfg.maxBytes ?? 1024 * 1024;
+    const maxEntries = cfg.maxEntries ?? 256;
+    const cache = new Map();
+    const secs = (iso) => Math.floor(Date.parse(iso) / 1000);
+    async function assertPublicHost(url) {
+        // BRACKETS ARE URL SYNTAX, NOT ADDRESS SYNTAX, and stripping them here is what lets an IPv6 literal
+        // reach the guard at all. `new URL("https://[::1]/x").hostname` is `"[::1]"`, and `node:dns` answers
+        // that with ENOTFOUND — so the request was refused for the right outcome and the WRONG REASON: the
+        // buyer's record named a DNS failure where the truth was an SSRF refusal, and that message is what a
+        // buyer would report to a seller.
+        //
+        // It also refused hosts it should allow. `isUnicastPublic` parses the bracketed form correctly, but the
+        // lookup never returned an address for it, so a seller publishing a legitimate PUBLIC IPv6 literal was
+        // refused with the same ENOTFOUND as a loopback one.
+        //
+        // Unbracketed, `node:dns` returns a literal unchanged — `::1` comes back as `{address:"::1",family:6}`,
+        // exactly as `127.0.0.1` does — which is the behaviour the `HostLookup` contract already requires of
+        // every port. Normalising here rather than inside `nodeDnsLookup` means a Workers or Deno port inherits
+        // the fix instead of having to repeat it.
+        // ONE regex rather than `startsWith("[") && endsWith("]")`, because a matching pair is ONE fact and the
+        // conjunction spelt it as two. `new URL()` cannot produce a hostname with only one bracket, so neither
+        // conjunct was individually observable — mutating either left behaviour identical, which is a survivor
+        // no test can honestly kill. Expressing the pair as a single match makes the check say what it means and
+        // leaves nothing unobservable behind it.
+        const host = /^\[(.+)\]$/.exec(url.hostname)?.[1] ?? url.hostname;
+        const addrs = await cfg.lookup(host);
+        if (addrs.length === 0)
+            throw new Error(`no address for ${url.hostname} — refused (SSRF guard)`);
+        for (const { address } of addrs)
+            if (!isUnicastPublic(address))
+                throw new Error(`${url.hostname} resolves to a non-public address (${address}) — refused (SSRF guard)`);
+    }
+    async function readCapped(res) {
+        const body = res.body;
+        if (body === null)
+            return new Uint8Array(0);
+        const reader = body.getReader();
+        const chunks = [];
+        let total = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.length;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw new Error(`terms exceed ${maxBytes} bytes (fail-loud)`);
+            }
+            chunks.push(value);
+        }
+        const out = new Uint8Array(total);
+        let o = 0;
+        for (const c of chunks) {
+            out.set(c, o);
+            o += c.length;
+        }
+        return out;
+    }
+    return {
+        async fetch(url) {
+            if (!url.startsWith("https://"))
+                throw new Error(`terms url must be HTTPS (SSRF posture): ${url}`);
+            const nowS = secs(cfg.now());
+            const hit = cache.get(url);
+            if (hit !== undefined && nowS - hit.at < maxAge)
+                return hit.terms; // SHOULD: serve fresh from cache
+            // Re-validated on every network fetch — an expiring cache entry must not grandfather a host.
+            await assertPublicHost(new URL(url));
+            const res = await cfg.httpFetch(url, { redirect: "error" }); // MUST: re-fetch after expiry; never follow redirects
+            if (!res.ok)
+                throw new Error(`terms fetch failed: ${res.status} ${url}`);
+            const declared = res.headers.get("content-length");
+            if (declared !== null &&
+                Number.isFinite(Number(declared)) &&
+                Number(declared) > maxBytes)
+                throw new Error(`terms declare ${declared} bytes > ${maxBytes} (fail-loud): ${url}`);
+            const buf = await readCapped(res);
+            const terms = {
+                bytes: buf,
+                format: res.headers.get("content-type") ?? "application/octet-stream",
+                fetchedAt: cfg.now(),
+            };
+            cache.set(url, { at: nowS, terms });
+            if (cache.size > maxEntries) {
+                const oldest = cache.keys().next().value;
+                if (oldest !== undefined)
+                    cache.delete(oldest);
+            }
+            return terms;
+        },
+    };
+}
+//# sourceMappingURL=fetch.js.map

package/dist/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAqC9D,MAAM,GAAG,GAAG,MAAM,CAAC;AAEnB;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,IAAY,EAAE,EAAE;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAyB;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,GAAG,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+C,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAEzE,KAAK,UAAU,gBAAgB,CAAC,GAAQ;QACtC,oGAAoG;QACpG,qGAAqG;QACrG,mGAAmG;QACnG,qGAAqG;QACrG,kCAAkC;QAClC,EAAE;QACF,wGAAwG;QACxG,uGAAuG;QACvG,qDAAqD;QACrD,EAAE;QACF,wGAAwG;QACxG,qGAAqG;QACrG,wGAAwG;QACxG,0CAA0C;QAC1C,wGAAwG;QACxG,uGAAuG;QACvG,uGAAuG;QACvG,yGAAyG;QACzG,yCAAyC;QACzC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,QAAQ,yBAAyB,CAAC,CAAC;QAC3E,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK;YAC7B,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,QAAQ,sCAAsC,OAAO,0BAA0B,CACvF,CAAC;IACR,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAa;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,oBAAoB,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAW;YACrB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,MAAM;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,iCAAiC;YAEpG,6FAA6F;YAC7F,MAAM,gBAAgB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAErC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,sDAAsD;YACnH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACnD,IACE,QAAQ,KAAK,IAAI;gBACjB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ;gBAE3B,MAAM,IAAI,KAAK,CACb,iBAAiB,QAAQ,YAAY,QAAQ,iBAAiB,GAAG,EAAE,CACpE,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,GAAiB;gBAC1B,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;gBACrE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACzC,IAAI,MAAM,KAAK,SAAS;oBAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/fingerprint.d.ts

@@ -0,0 +1,14 @@
+import type { HaltClass } from "@integraledger/lcp-binding-core";
+export type FingerprintOutcome = {
+    readonly status: "proved";
+    readonly atrHash: `0x${string}`;
+} | {
+    readonly status: "failed";
+    readonly haltClass: HaltClass;
+    readonly recomputed: `0x${string}`;
+    readonly advertised: string;
+};
+/** The LCP §5.3 core: recompute SHA-256 over the fetched terms bytes and compare to the advertised atrHash. A
+ *  mismatch is `failed(verification-failure)` — the caller MUST halt before invoking any signing key. */
+export declare function recomputeAndCompare(bytes: Uint8Array, advertisedAtrHash: string): Promise<FingerprintOutcome>;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GAC9D;IACE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,KAAK,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN;yGACyG;AACzG,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,UAAU,EACjB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAU7B"}

package/dist/fingerprint.js

@@ -0,0 +1,15 @@
+import { hashAtr } from "@integraledger/lcp-kernel";
+/** The LCP §5.3 core: recompute SHA-256 over the fetched terms bytes and compare to the advertised atrHash. A
+ *  mismatch is `failed(verification-failure)` — the caller MUST halt before invoking any signing key. */
+export async function recomputeAndCompare(bytes, advertisedAtrHash) {
+    const recomputed = await hashAtr(bytes);
+    return recomputed.toLowerCase() === advertisedAtrHash.toLowerCase()
+        ? { status: "proved", atrHash: recomputed }
+        : {
+            status: "failed",
+            haltClass: "verification-failure",
+            recomputed,
+            advertised: advertisedAtrHash,
+        };
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAUpD;yGACyG;AACzG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAiB,EACjB,iBAAyB;IAEzB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE;QACjE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE;QAC3C,CAAC,CAAC;YACE,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,sBAAsB;YACjC,UAAU;YACV,UAAU,EAAE,iBAAiB;SAC9B,CAAC;AACR,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export { type Disposition, decideOutcome, foldDispositions, type GateDecision, type StepStatus, } from "./decision.js";
+export { evaluate, type GatePorts } from "./evaluate.js";
+export { type CachingFetcherConfig, type FetchedTerms, type HostLookup, makeCachingFetcher, nodeDnsLookup, type ResolvedAddress, type TermsFetcher, } from "./fetch.js";
+export { type FingerprintOutcome, recomputeAndCompare } from "./fingerprint.js";
+export { InMemoryOrc4Log, type Orc4Entry, type Orc4Log } from "./log.js";
+export { type MechanicalPorts, verifySettled } from "./mechanical.js";
+export { type BuyerPolicy, evaluatePolicy, type PolicyResult, } from "./policy.js";
+export { type GateProposal, type ProposalContext, parseProposalFromChallenge, } from "./proposal.js";
+export { ACK_DID_METHODS, type AckReceiptContribution, type AckReceiptFacts, ackReceiptContribution, parseAckReceipt, } from "./proposal-ack.js";
+export { parseProposalFromAcpCheckout } from "./proposal-acp.js";
+export { AP2_HALT_POINT, type Ap2HaltPoint, type Ap2ProposalContext, type Ap2Step, assertBeforeAp2HaltPoint, isAp2SigningStep, parseProposalFromAp2Envelope, } from "./proposal-ap2.js";
+export { parseProposalFromMppRequest } from "./proposal-mpp.js";
+export { ACP_SESSION_STATUS, type AdvertisedTerms, type AdvertisedTermsUrl, detectProtocol, matchProtocols, PROPOSAL_PARSERS, PROTOCOL_DISCRIMINANTS, type ProposalParser, type ProtocolDiscriminant, parseableProtocols, parseProposalUniversal, readAdvertisedTerms, VI_OPEN_MANDATE_VCT, } from "./proposal-universal.js";
+export { type GuardedSigner, type TransactResult, transact, } from "./transact.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,aAAa,EACb,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,kBAAkB,EAClB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EACL,KAAK,WAAW,EAChB,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,QAAQ,GACT,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+export { decideOutcome, foldDispositions, } from "./decision.js";
+export { evaluate } from "./evaluate.js";
+export { makeCachingFetcher, nodeDnsLookup, } from "./fetch.js";
+export { recomputeAndCompare } from "./fingerprint.js";
+export { InMemoryOrc4Log } from "./log.js";
+export { verifySettled } from "./mechanical.js";
+export { evaluatePolicy, } from "./policy.js";
+export { parseProposalFromChallenge, } from "./proposal.js";
+export { ACK_DID_METHODS, ackReceiptContribution, parseAckReceipt, } from "./proposal-ack.js";
+export { parseProposalFromAcpCheckout } from "./proposal-acp.js";
+export { AP2_HALT_POINT, assertBeforeAp2HaltPoint, isAp2SigningStep, parseProposalFromAp2Envelope, } from "./proposal-ap2.js";
+export { parseProposalFromMppRequest } from "./proposal-mpp.js";
+export { ACP_SESSION_STATUS, detectProtocol, matchProtocols, PROPOSAL_PARSERS, PROTOCOL_DISCRIMINANTS, parseableProtocols, parseProposalUniversal, readAdvertisedTerms, VI_OPEN_MANDATE_VCT, } from "./proposal-universal.js";
+export { transact, } from "./transact.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EACb,gBAAgB,GAGjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AACzD,OAAO,EAIL,kBAAkB,EAClB,aAAa,GAGd,MAAM,YAAY,CAAC;AACpB,OAAO,EAA2B,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAgC,MAAM,UAAU,CAAC;AACzE,OAAO,EAAwB,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAEL,cAAc,GAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EAGf,sBAAsB,EACtB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,cAAc,EAId,wBAAwB,EACxB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAGlB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EAGtB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,QAAQ,GACT,MAAM,eAAe,CAAC"}

package/dist/log.d.ts

@@ -0,0 +1,32 @@
+import type { HaltClass } from "@integraledger/lcp-binding-core";
+export interface Orc4Entry {
+    readonly timestamp: string;
+    readonly decision: "proceed" | "decline" | "escalate";
+    readonly haltClass?: HaltClass;
+    readonly code: string;
+    readonly detail: string;
+    readonly atrHash?: string;
+    /**
+     * The discovery document the proposal pointed at — the terms this decision was reached about.
+     *
+     * WITHOUT IT AN ENTRY NAMES A VERDICT AND NOT ITS SUBJECT. `atrHash` alone does not identify the
+     * document: on the decision that matters most — a fingerprint mismatch — the advertised hash is by
+     * construction NOT the hash of what was served, so a reader holding only that value cannot say which
+     * document disagreed with it. A seller told "your terms did not match" and given a hash it cannot
+     * reproduce learns nothing it can act on; given the URL, it can fetch the bytes and see.
+     *
+     * Optional for the same reason `atrHash` is: this is the sink's input type, and a producer other than
+     * `evaluate` — a mechanical verification, say — may legitimately have no document to name. `evaluate`
+     * always sets it.
+     */
+    readonly legalContextUrl?: string;
+}
+export interface Orc4Log {
+    append(e: Orc4Entry): void;
+}
+/** A real, complete in-memory ORC-4 sink (not a mock) — a deployment injects a durable one. */
+export declare class InMemoryOrc4Log implements Orc4Log {
+    readonly entries: Orc4Entry[];
+    append(e: Orc4Entry): void;
+}
+//# sourceMappingURL=log.d.ts.map

package/dist/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AACD,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAC5B;AACD,+FAA+F;AAC/F,qBAAa,eAAgB,YAAW,OAAO;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,CAAM;IACnC,MAAM,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAEzB;CACF"}

package/dist/log.js

@@ -0,0 +1,8 @@
+/** A real, complete in-memory ORC-4 sink (not a mock) — a deployment injects a durable one. */
+export class InMemoryOrc4Log {
+    entries = [];
+    append(e) {
+        this.entries.push(e);
+    }
+}
+//# sourceMappingURL=log.js.map

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AA2BA,+FAA+F;AAC/F,MAAM,OAAO,eAAe;IACjB,OAAO,GAAgB,EAAE,CAAC;IACnC,MAAM,CAAC,CAAY;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/mechanical.d.ts

@@ -0,0 +1,30 @@
+import type { Assurance } from "@integraledger/lcp-authority";
+import type { SettlementRef, VerifierPorts, WeldAdapter } from "@integraledger/lcp-binding-core";
+import { type TransactionClass, type VerificationReport } from "@integraledger/lcp-verify";
+/** Inputs for the post-settlement mechanical verify. `verifierPorts` (chain + artifacts) is INJECTED, which is
+ *  what keeps the gate viem-free. `atrBytes` is the fetched ATR; `coverage` matches verify's shape. */
+export interface MechanicalPorts {
+    readonly verifierPorts: VerifierPorts;
+    readonly atrBytes: Uint8Array;
+    readonly asOf: string;
+    readonly coverage: {
+        ports: string[];
+        bindings: string[];
+    };
+    readonly claimedClass?: TransactionClass;
+    /**
+     * The parties as the buyer resolved them (IDN-1/3). TC-1 and up require the attribution rung, so a
+     * record verified without this reads honestly as unverified — the gate KNOWS both sides at this point
+     * (it holds the seller's stated assurance from the proposal and it is itself the payer), so it says so.
+     */
+    readonly identity: {
+        readonly sellerAssurance: Assurance;
+        readonly payer: string;
+    };
+}
+/** Turn a settled receipt into a TC-2/TC-3 *transaction* record: recover the on-chain atrHash via the injected
+ *  binding adapter, then run `verify({depth:"mechanical"})` — `verified` is raised honestly iff the ATR bytes
+ *  hash to the recovered atrHash (and the class-required steps hold). A refused recovery leaves settledAtrHash
+ *  absent → the fingerprint is indeterminate → verified stays false. */
+export declare function verifySettled(ref: SettlementRef, adapter: Pick<WeldAdapter, "recover">, ports: MechanicalPorts): Promise<VerificationReport>;
+//# sourceMappingURL=mechanical.d.ts.map

package/dist/mechanical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mechanical.d.ts","sourceRoot":"","sources":["../src/mechanical.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,WAAW,EACZ,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EAExB,MAAM,2BAA2B,CAAC;AAEnC;uGACuG;AACvG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3D,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;;wEAGwE;AACxE,wBAAsB,aAAa,CACjC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EACrC,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CA8B7B"}

package/dist/mechanical.js

@@ -0,0 +1,35 @@
+import { verify, } from "@integraledger/lcp-verify";
+/** Turn a settled receipt into a TC-2/TC-3 *transaction* record: recover the on-chain atrHash via the injected
+ *  binding adapter, then run `verify({depth:"mechanical"})` — `verified` is raised honestly iff the ATR bytes
+ *  hash to the recovered atrHash (and the class-required steps hold). A refused recovery leaves settledAtrHash
+ *  absent → the fingerprint is indeterminate → verified stays false. */
+export async function verifySettled(ref, adapter, ports) {
+    const recovered = await adapter.recover(ref, ports.verifierPorts);
+    // The buyer resolves the seller at the assurance the proposal stated, and itself at the level the rail
+    // actually supports: a wallet signature. Stating the low level honestly is conformant (IDN-3); claiming
+    // a level the rail cannot support would not be.
+    const identity = {
+        seller: {
+            subject: "seller",
+            assurance: ports.identity.sellerAssurance,
+            chain: [{ via: "domain-control" }],
+        },
+        buyer: {
+            subject: ports.identity.payer,
+            assurance: "wallet-signature-only",
+            chain: [{ via: "key" }],
+        },
+    };
+    const base = {
+        depth: "mechanical",
+        atrBytes: ports.atrBytes,
+        coverage: ports.coverage,
+        claimedClass: ports.claimedClass ?? "TC-2",
+        asOf: ports.asOf,
+        // The settlement the buyer just made IS the enumeration it can honestly attest to (PAY).
+        settlements: [ref],
+        identity,
+    };
+    return verify("ok" in recovered ? { ...base, settledAtrHash: recovered.value } : base);
+}
+//# sourceMappingURL=mechanical.js.map

package/dist/mechanical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mechanical.js","sourceRoot":"","sources":["../src/mechanical.ts"],"names":[],"mappings":"AAMA,OAAO,EAIL,MAAM,GACP,MAAM,2BAA2B,CAAC;AAqBnC;;;wEAGwE;AACxE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAkB,EAClB,OAAqC,EACrC,KAAsB;IAEtB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,uGAAuG;IACvG,wGAAwG;IACxG,gDAAgD;IAChD,MAAM,QAAQ,GAAmB;QAC/B,MAAM,EAAE;YACN,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe;YACzC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;SACnC;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC7B,SAAS,EAAE,uBAAuB;YAClC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACxB;KACF,CAAC;IACF,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,YAAqB;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAK,MAA2B;QAChE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,yFAAyF;QACzF,WAAW,EAAE,CAAC,GAAG,CAAC;QAClB,QAAQ;KACT,CAAC;IACF,OAAO,MAAM,CACX,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CACxE,CAAC;AACJ,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,36 @@
+import type { Assurance } from "@integraledger/lcp-authority";
+import type { LegalContextJson } from "@integraledger/lcp-discovery";
+import type { Disposition } from "./decision.js";
+/**
+ * The buyer's stated policy.
+ *
+ * **`onNotAttempted` is the only gap disposition here, and its absent sibling is the point.** An earlier
+ * shape also required `onIndeterminate`, which `evaluate` never read — and could not have, because no step
+ * it runs yields `indeterminate`: the fingerprint proves or fails, and the record parses or does not. A
+ * required field promising a disposition the gate cannot reach is worse than no field, because a buyer
+ * reads it as a control. Consumers folding their own step ladders use `decideOutcome`, which carries its
+ * own four-valued gaps shape and does handle `indeterminate`.
+ */
+export interface BuyerPolicy {
+    readonly requiredLevel: 1 | 2 | 3 | 4;
+    readonly acceptableJurisdictions: readonly string[] | "any";
+    readonly acceptableDisputeMethods: readonly string[] | "any";
+    readonly maxCommitment: Readonly<Record<string, string>>;
+    readonly forbiddenClauseCategories: readonly string[];
+    readonly requiredAssurance: Assurance | "any";
+    readonly onNotAttempted: Disposition;
+}
+export type PolicyResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly detail: string;
+};
+/** Evaluate the buyer policy on the TYPED legal-context envelope + the typed offer — NEVER on prose (LCP §12.7).
+ *  Every check reads a structured field; the function's inputs cannot carry the natural-language body. */
+export declare function evaluatePolicy(policy: BuyerPolicy, terms: LegalContextJson, offer: {
+    amount: string;
+    unit: string;
+}): PolicyResult;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,QAAQ,CAAC,uBAAuB,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAC5D,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAC7D,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;CACtC;AACD,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAO3E;0GAC0G;AAC1G,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,YAAY,CAgGd"}

package/dist/policy.js

@@ -0,0 +1,96 @@
+const accepts = (allow, v) => (allow === "any" ? true : v !== undefined && allow.includes(v));
+/** Evaluate the buyer policy on the TYPED legal-context envelope + the typed offer — NEVER on prose (LCP §12.7).
+ *  Every check reads a structured field; the function's inputs cannot carry the natural-language body. */
+export function evaluatePolicy(policy, terms, offer) {
+    // NARROWED, not cast — the same treatment `clauseCategories` gets below, and for the same reason. The
+    // cast that stood here asserted `{ jurisdiction?: string; method?: string }` about a value the discovery
+    // parser never checked, which made the two fields policy actually reads the two the type system was not
+    // checking. It failed closed, so this was never a bypass: a seller publishing `"disputeResolution":
+    // "arbitration"` yielded `undefined` for both members and declined. It declined for the WRONG REASON —
+    // "jurisdiction (none) not acceptable" tells a seller its jurisdiction is unacceptable when its actual
+    // defect is that the field is a string. A gate whose refusals misdescribe the defect cannot be acted on,
+    // and being right by accident is not the same as being right.
+    const rawDr = terms.disputeResolution;
+    if (rawDr !== undefined &&
+        (typeof rawDr !== "object" || rawDr === null || Array.isArray(rawDr)))
+        return {
+            ok: false,
+            code: "policy/malformed-dispute-resolution",
+            detail: `seller's disputeResolution is ${Array.isArray(rawDr) ? "an array" : rawDr === null ? "null" : typeof rawDr}, not an object`,
+        };
+    const drRecord = (rawDr ?? {});
+    // A member that is present and not a string is the seller's defect too, named rather than silently read
+    // as absent. Absent stays absent: that is the ordinary "no jurisdiction declared" path, and it is the
+    // buyer's stated policy that decides whether absence is acceptable.
+    for (const member of ["jurisdiction", "method"]) {
+        const v = drRecord[member];
+        if (v !== undefined && typeof v !== "string")
+            return {
+                ok: false,
+                code: "policy/malformed-dispute-resolution",
+                detail: `seller's disputeResolution.${member} is ${typeof v}, not a string`,
+            };
+    }
+    // NOT optionally chained, and the narrowing above is why. The cast that stood here produced a possibly
+    // absent object, so every read was `dr?.member`; the loop has now proved both members are a string or
+    // absent, so the object is always there and `?.` could never short-circuit. Mutation testing is what
+    // surfaced it — four optional-chaining mutants survived because no input could reach the branch they
+    // removed, which is the signature of a branch that cannot happen.
+    const jurisdiction = drRecord["jurisdiction"];
+    const method = drRecord["method"];
+    if (!accepts(policy.acceptableJurisdictions, jurisdiction))
+        return {
+            ok: false,
+            code: "policy/jurisdiction",
+            detail: `jurisdiction ${jurisdiction ?? "(none)"} not acceptable`,
+        };
+    if (!accepts(policy.acceptableDisputeMethods, method))
+        return {
+            ok: false,
+            code: "policy/dispute-method",
+            detail: `dispute method ${method ?? "(none)"} not acceptable`,
+        };
+    // `Object.hasOwn`, never a bare index read. `offer.unit` is SELLER-DERIVED — on the ACP path it is the
+    // session's `currency`, an unconstrained string — so a bare read answers from `Object.prototype` for
+    // `constructor`, `toString`, `valueOf`, `hasOwnProperty` or `__proto__`. Each returns a non-undefined
+    // non-string, slips past the `undefined` check below, and reaches `BigInt()`, which throws a SyntaxError
+    // out of `evaluate` naming nothing a buyer can act on. An own-property read makes every one of them the
+    // ordinary "no cap declared" decline.
+    const cap = Object.hasOwn(policy.maxCommitment, offer.unit)
+        ? policy.maxCommitment[offer.unit]
+        : undefined;
+    if (typeof cap !== "string")
+        return {
+            ok: false,
+            code: "policy/unit",
+            detail: `no cap declared for unit ${offer.unit}`,
+        };
+    if (BigInt(offer.amount) > BigInt(cap))
+        return {
+            ok: false,
+            code: "policy/over-cap",
+            detail: `offer ${offer.amount} exceeds cap ${cap} (${offer.unit})`,
+        };
+    // NARROWED, not cast. `clauseCategories` is not in the discovery schema at all — it arrives through the
+    // record's loose index signature as `unknown`, so it is whatever the SELLER wrote. A cast asserting
+    // `readonly string[]` was a claim about a hostile value: a seller publishing `"clauseCategories":
+    // "arbitration"` made `cats.find` a TypeError that escaped `evaluate` entirely, past its contract to
+    // RETURN a GateDecision. A malformed field is now the seller's defect, named as such and declined.
+    const raw = terms.clauseCategories;
+    if (raw !== undefined && !Array.isArray(raw))
+        return {
+            ok: false,
+            code: "policy/malformed-clause-categories",
+            detail: `seller's clauseCategories is ${typeof raw}, not an array of category strings`,
+        };
+    const cats = raw ?? [];
+    const forbidden = cats.find((c) => typeof c === "string" && policy.forbiddenClauseCategories.includes(c));
+    if (forbidden !== undefined)
+        return {
+            ok: false,
+            code: "policy/forbidden-clause",
+            detail: `forbidden clause category: ${forbidden}`,
+        };
+    return { ok: true };
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AA2BA,MAAM,OAAO,GAAG,CACd,KAAgC,EAChC,CAAqB,EACZ,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E;0GAC0G;AAC1G,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,KAAuB,EACvB,KAAuC;IAEvC,sGAAsG;IACtG,yGAAyG;IACzG,wGAAwG;IACxG,oGAAoG;IACpG,uGAAuG;IACvG,uGAAuG;IACvG,yGAAyG;IACzG,8DAA8D;IAC9D,MAAM,KAAK,GAAI,KAAyC,CAAC,iBAAiB,CAAC;IAC3E,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qCAAqC;YAC3C,MAAM,EAAE,iCAAiC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,iBAAiB;SACrI,CAAC;IACJ,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAAsC,CAAC;IACpE,wGAAwG;IACxG,sGAAsG;IACtG,oEAAoE;IACpE,KAAK,MAAM,MAAM,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAU,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ;YAC1C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,qCAAqC;gBAC3C,MAAM,EAAE,8BAA8B,MAAM,OAAO,OAAO,CAAC,gBAAgB;aAC5E,CAAC;IACN,CAAC;IACD,uGAAuG;IACvG,sGAAsG;IACtG,qGAAqG;IACrG,qGAAqG;IACrG,kEAAkE;IAClE,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAuB,CAAC;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,YAAY,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,gBAAgB,YAAY,IAAI,QAAQ,iBAAiB;SAClE,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,kBAAkB,MAAM,IAAI,QAAQ,iBAAiB;SAC9D,CAAC;IACJ,uGAAuG;IACvG,qGAAqG;IACrG,sGAAsG;IACtG,yGAAyG;IACzG,wGAAwG;IACxG,sCAAsC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,4BAA4B,KAAK,CAAC,IAAI,EAAE;SACjD,CAAC;IACJ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,SAAS,KAAK,CAAC,MAAM,gBAAgB,GAAG,KAAK,KAAK,CAAC,IAAI,GAAG;SACnE,CAAC;IACJ,wGAAwG;IACxG,oGAAoG;IACpG,kGAAkG;IAClG,qGAAqG;IACrG,mGAAmG;IACnG,MAAM,GAAG,GAAI,KAAwC,CAAC,gBAAgB,CAAC;IACvE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oCAAoC;YAC1C,MAAM,EAAE,gCAAgC,OAAO,GAAG,oCAAoC;SACvF,CAAC;IACJ,MAAM,IAAI,GAAuB,GAAG,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,CAAC,CAAC,EAAe,EAAE,CACjB,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CACxE,CAAC;IACF,IAAI,SAAS,KAAK,SAAS;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,8BAA8B,SAAS,EAAE;SAClD,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}