@sempdev/semp 0.4.3

package/dist/reputation/observation_store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation_store.d.ts","sourceRoot":"","sources":["../../src/reputation/observation_store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAYrE,2CAA2C;AAC3C,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,0DAA0D;AAC1D,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;gBAEvB,KAAK,GAAE,MAAM,IAAuB;IAIhD,oCAAoC;IACpC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,GAAG,IAAI;IASlD,mCAAmC;IACnC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IASvD;;;;OAIG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,EAAE,GAAG,IAAI;IAQrE,yEAAyE;IACzE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAsBhC,sDAAsD;IACtD,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK;IAqC5B,uCAAuC;IACvC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAM3B,2DAA2D;IAC3D,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,KAAK;CAiBd;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,UAAU,CAqBlD"}

package/dist/reputation/observation_store.js

@@ -0,0 +1,171 @@
+/**
+ * Per-domain signal ledger + Score derivation per REPUTATION.md §4.
+ *
+ * The store records raw counters as they happen (one call per
+ * handshake/envelope/abuse) and exposes a {@link Score} query that
+ * turns the counters into a Score + {@link Assessment} + the
+ * "currently suspicious" verdict operators plug into their PoW
+ * policy hook.
+ *
+ * Production deployments wrap a durable backend; this is the
+ * reference in-memory store.
+ *
+ * @module
+ */
+/** In-memory {@link ObservationStore}. Single-process. */
+export class ObservationStore {
+    domains = new Map();
+    firstSeen = new Map();
+    nowFn;
+    constructor(nowFn = () => new Date()) {
+        this.nowFn = nowFn;
+    }
+    /** Record one handshake outcome. */
+    recordHandshake(domain, ok) {
+        const c = this.touch(domain);
+        if (ok) {
+            c.handshakes_completed++;
+        }
+        else {
+            c.handshakes_rejected++;
+        }
+    }
+    /** Record one envelope outcome. */
+    recordEnvelope(domain, accepted) {
+        const c = this.touch(domain);
+        if (accepted) {
+            c.envelopes_accepted++;
+        }
+        else {
+            c.envelopes_rejected++;
+        }
+    }
+    /**
+     * Record one abuse report. The caller is expected to have
+     * verified the report's authenticity and any embedded disclosure
+     * authorization before calling.
+     */
+    recordAbuseReport(domain, category) {
+        const c = this.touch(domain);
+        c.abuse_reports++;
+        if (category !== "") {
+            c.abuse_categories.push(category);
+        }
+    }
+    /** Snapshot of the current counters as a publishable {@link Metrics}. */
+    metrics(domain) {
+        const c = this.domains.get(normalize(domain));
+        if (c === undefined) {
+            return {
+                envelopes_received: 0,
+                envelopes_rejected: 0,
+                abuse_reports: 0,
+            };
+        }
+        const m = {
+            envelopes_received: c.envelopes_accepted + c.envelopes_rejected,
+            envelopes_rejected: c.envelopes_rejected,
+            abuse_reports: c.abuse_reports,
+            handshakes_completed: c.handshakes_completed,
+            handshakes_rejected: c.handshakes_rejected,
+        };
+        if (c.abuse_categories.length > 0) {
+            m.abuse_categories = c.abuse_categories.slice();
+        }
+        return m;
+    }
+    /** Compute the current {@link Score} for `domain`. */
+    score(domain) {
+        const d = normalize(domain);
+        const c = this.domains.get(d);
+        const firstSeen = this.firstSeen.get(d) ?? null;
+        const ageDays = firstSeen === null
+            ? -1
+            : Math.floor((this.nowFn().getTime() - firstSeen.getTime()) / (1000 * 60 * 60 * 24));
+        if (c === undefined) {
+            return {
+                domain,
+                total_envelopes: 0,
+                abuse_rate: 0,
+                reject_rate: 0,
+                handshake_reject_rate: 0,
+                first_seen: firstSeen,
+                age_days: ageDays,
+                assessment: "neutral",
+            };
+        }
+        const total = c.envelopes_accepted + c.envelopes_rejected;
+        const handshakes = c.handshakes_completed + c.handshakes_rejected;
+        const score = {
+            domain,
+            total_envelopes: total,
+            abuse_rate: total > 0 ? c.abuse_reports / total : 0,
+            reject_rate: total > 0 ? c.envelopes_rejected / total : 0,
+            handshake_reject_rate: handshakes > 0 ? c.handshakes_rejected / handshakes : 0,
+            first_seen: firstSeen,
+            age_days: ageDays,
+            assessment: "neutral",
+        };
+        score.assessment = classifyScore(score);
+        return score;
+    }
+    /** Clear all counters for `domain`. */
+    reset(domain) {
+        const d = normalize(domain);
+        this.domains.delete(d);
+        this.firstSeen.delete(d);
+    }
+    /** Number of domains with at least one recorded signal. */
+    size() {
+        return this.domains.size;
+    }
+    touch(domain) {
+        const d = normalize(domain);
+        let c = this.domains.get(d);
+        if (c === undefined) {
+            c = {
+                handshakes_completed: 0,
+                handshakes_rejected: 0,
+                envelopes_accepted: 0,
+                envelopes_rejected: 0,
+                abuse_reports: 0,
+                abuse_categories: [],
+            };
+            this.domains.set(d, c);
+            this.firstSeen.set(d, this.nowFn());
+        }
+        return c;
+    }
+}
+/**
+ * Default scoring curve (REPUTATION.md §4.6 + §8.3.2):
+ *
+ *  - abuse_rate ≥ 0.05 OR reject_rate ≥ 0.50 → hostile
+ *  - abuse_rate ≥ 0.01 OR reject_rate ≥ 0.20 → suspicious
+ *  - abuse_rate == 0 AND reject_rate < 0.05 AND total ≥ 100 → trusted
+ *  - otherwise → neutral
+ */
+export function classifyScore(s) {
+    const HOSTILE_ABUSE = 0.05;
+    const HOSTILE_REJECT = 0.5;
+    const SUSPICIOUS_ABUSE = 0.01;
+    const SUSPICIOUS_REJECT = 0.2;
+    const TRUSTED_MIN_ENVELOPES = 100;
+    const TRUSTED_MAX_REJECT = 0.05;
+    if (s.abuse_rate >= HOSTILE_ABUSE || s.reject_rate >= HOSTILE_REJECT) {
+        return "hostile";
+    }
+    if (s.abuse_rate >= SUSPICIOUS_ABUSE || s.reject_rate >= SUSPICIOUS_REJECT) {
+        return "suspicious";
+    }
+    if (s.total_envelopes >= TRUSTED_MIN_ENVELOPES &&
+        s.abuse_rate === 0 &&
+        s.reject_rate < TRUSTED_MAX_REJECT) {
+        return "trusted";
+    }
+    return "neutral";
+}
+function normalize(domain) {
+    return domain.trim().toLowerCase();
+}
+//# sourceMappingURL=observation_store.js.map

package/dist/reputation/observation_store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation_store.js","sourceRoot":"","sources":["../../src/reputation/observation_store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA+BH,0DAA0D;AAC1D,MAAM,OAAO,gBAAgB;IACV,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,SAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;IACpC,KAAK,CAAa;IAEnC,YAAY,QAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,oCAAoC;IACpC,eAAe,CAAC,MAAc,EAAE,EAAW;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,EAAE,EAAE,CAAC;YACP,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,cAAc,CAAC,MAAc,EAAE,QAAiB;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,kBAAkB,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,kBAAkB,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,MAAc,EAAE,QAA4B;QAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,aAAa,EAAE,CAAC;QAClB,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,MAAc;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,OAAO;gBACL,kBAAkB,EAAE,CAAC;gBACrB,kBAAkB,EAAE,CAAC;gBACrB,aAAa,EAAE,CAAC;aACjB,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAY;YACjB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,kBAAkB;YAC/D,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;YACxC,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;YAC5C,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,CAAC,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,MAAc;QAClB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,SAAS,KAAK,IAAI;YAChC,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,KAAK,CACR,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CACvE,CAAC;QACN,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM;gBACN,eAAe,EAAE,CAAC;gBAClB,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,CAAC;gBACd,qBAAqB,EAAE,CAAC;gBACxB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC;QAC1D,MAAM,UAAU,GAAG,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC,mBAAmB,CAAC;QAClE,MAAM,KAAK,GAAU;YACnB,MAAM;YACN,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzD,qBAAqB,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9E,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,SAAS;SACtB,CAAC;QACF,KAAK,CAAC,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,MAAc;QAClB,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAc;QAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,CAAC,GAAG;gBACF,oBAAoB,EAAE,CAAC;gBACvB,mBAAmB,EAAE,CAAC;gBACtB,kBAAkB,EAAE,CAAC;gBACrB,kBAAkB,EAAE,CAAC;gBACrB,aAAa,EAAE,CAAC;gBAChB,gBAAgB,EAAE,EAAE;aACrB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,CAAQ;IACpC,MAAM,aAAa,GAAG,IAAI,CAAC;IAC3B,MAAM,cAAc,GAAG,GAAG,CAAC;IAC3B,MAAM,gBAAgB,GAAG,IAAI,CAAC;IAC9B,MAAM,iBAAiB,GAAG,GAAG,CAAC;IAC9B,MAAM,qBAAqB,GAAG,GAAG,CAAC;IAClC,MAAM,kBAAkB,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,CAAC,WAAW,IAAI,cAAc,EAAE,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,IAAI,gBAAgB,IAAI,CAAC,CAAC,WAAW,IAAI,iBAAiB,EAAE,CAAC;QAC3E,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IACE,CAAC,CAAC,eAAe,IAAI,qBAAqB;QAC1C,CAAC,CAAC,UAAU,KAAK,CAAC;QAClB,CAAC,CAAC,WAAW,GAAG,kBAAkB,EAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACrC,CAAC"}

package/dist/reputation/pow.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Proof-of-Work challenge primitives per REPUTATION.md §8.3.
+ *
+ * The handshake layer carries the actual SHA-256 PoW solver +
+ * verifier (see `handshake/pow.ts`). This module supplies the
+ * issuer-side helpers: difficulty selection, challenge minting, and
+ * a single-use redemption ledger that prevents replay per §8.3.4.
+ *
+ * @module
+ */
+import type { Assessment } from "./types.js";
+/** Only supported PoW hash algorithm. */
+export declare const PoWAlgorithm = "sha256";
+/** Minimum entropy a challenge prefix must carry per §8.3.1. */
+export declare const MinPrefixBytes = 16;
+/** RECOMMENDED challenge TTL per §8.3.4. */
+export declare const DefaultChallengeTTLMs: number;
+/** Difficulty presets per §8.3.2. */
+export declare const DifficultyBaseline = 20;
+export declare const DifficultyRelaxed = 16;
+export declare const DifficultySuspicious = 22;
+export declare const DifficultyHostile = 26;
+/** New-domain age gate per §2.1: domains younger than this get scrutiny. */
+export declare const DomainAgeGateDays = 30;
+/** A challenge minted by the recipient server per §8.3.1. */
+export interface PoWChallenge {
+    /** ULID-shaped 26-character Crockford base32 string. */
+    id: string;
+    algorithm: typeof PoWAlgorithm;
+    /** ≥ {@link MinPrefixBytes} bytes of entropy. */
+    prefix: Uint8Array;
+    /** Leading zero bits required in the solution hash. */
+    difficulty: number;
+    /** Single-use deadline. */
+    expires: Date;
+}
+/**
+ * Difficulty for a zero-reputation, age-known domain per §8.3.2:
+ *  - age < {@link DomainAgeGateDays} → DifficultyBaseline (20)
+ *  - age ≥ DomainAgeGateDays → DifficultyRelaxed (16)
+ */
+export declare function difficultyForAge(ageDays: number): number;
+/**
+ * Difficulty for a domain whose reputation has been summarized as
+ * `assessment` per §8.3.2:
+ *  - "trusted" / "neutral" / "" → 0 (no PoW required)
+ *  - "suspicious"               → DifficultySuspicious (22)
+ *  - "hostile"                  → DifficultyHostile (26)
+ *
+ * A return of 0 MUST be interpreted as "no challenge required".
+ */
+export declare function difficultyForAssessment(a: Assessment | ""): number;
+/**
+ * Construct a fresh challenge at `difficulty`, with
+ * {@link MinPrefixBytes} bytes of fresh prefix entropy and a ULID
+ * id derived from the current wall clock.
+ *
+ * `ttlMs <= 0` is replaced with {@link DefaultChallengeTTLMs}.
+ */
+export declare function issueChallenge(difficulty: number, ttlMs?: number, rand?: (n: number) => Uint8Array): PoWChallenge;
+/** Base64-encoded challenge prefix — what the wire carries. */
+export declare function challengePrefixBase64(c: PoWChallenge): string;
+/**
+ * Tracks issued + redeemed challenges; prevents replay per §8.3.4.
+ * Concurrency-safe under the JS single-thread model. Production
+ * deployments wrap a durable backend.
+ */
+export declare class ChallengeLedger {
+    private readonly entries;
+    private lastSweep;
+    private readonly sweepIntervalMs;
+    private readonly nowFn;
+    constructor(sweepIntervalMs?: number, nowFn?: () => Date);
+    /** Register `c` so a later {@link redeem} call can find it. */
+    record(c: PoWChallenge): void;
+    /**
+     * Redeem the challenge with `id`. Returns the challenge on success.
+     * Throws when:
+     *  - the challenge is unknown
+     *  - the challenge has already been redeemed
+     *  - the challenge has expired
+     */
+    redeem(id: string): PoWChallenge;
+    /** Number of currently-active (unredeemed, unexpired) entries. */
+    active(): number;
+    /** Force an immediate sweep of expired entries. */
+    sweep(): void;
+    private maybeSweep;
+    private sweepNow;
+}
+//# sourceMappingURL=pow.d.ts.map

package/dist/reputation/pow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pow.d.ts","sourceRoot":"","sources":["../../src/reputation/pow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,yCAAyC;AACzC,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,gEAAgE;AAChE,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,QAAgB,CAAC;AAEnD,qCAAqC;AACrC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,OAAO,YAAY,CAAC;IAC/B,iDAAiD;IACjD,MAAM,EAAE,UAAU,CAAC;IACnB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,OAAO,EAAE,IAAI,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,UAAU,GAAG,EAAE,GAAG,MAAM,CAalE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,IAAI,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,UAAwB,GAC5C,YAAY,CAed;AAED,+DAA+D;AAC/D,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAS7D;AAKD;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqE;IAC7F,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;gBAEvB,eAAe,SAAS,EAAE,KAAK,GAAE,MAAM,IAAuB;IAK1E,+DAA+D;IAC/D,MAAM,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI;IAW7B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY;IAiBhC,kEAAkE;IAClE,MAAM,IAAI,MAAM;IAWhB,mDAAmD;IACnD,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,QAAQ;CAQjB"}

package/dist/reputation/pow.js

@@ -0,0 +1,209 @@
+/**
+ * Proof-of-Work challenge primitives per REPUTATION.md §8.3.
+ *
+ * The handshake layer carries the actual SHA-256 PoW solver +
+ * verifier (see `handshake/pow.ts`). This module supplies the
+ * issuer-side helpers: difficulty selection, challenge minting, and
+ * a single-use redemption ledger that prevents replay per §8.3.4.
+ *
+ * @module
+ */
+/** Only supported PoW hash algorithm. */
+export const PoWAlgorithm = "sha256";
+/** Minimum entropy a challenge prefix must carry per §8.3.1. */
+export const MinPrefixBytes = 16;
+/** RECOMMENDED challenge TTL per §8.3.4. */
+export const DefaultChallengeTTLMs = 5 * 60 * 1000;
+/** Difficulty presets per §8.3.2. */
+export const DifficultyBaseline = 20;
+export const DifficultyRelaxed = 16;
+export const DifficultySuspicious = 22;
+export const DifficultyHostile = 26;
+/** New-domain age gate per §2.1: domains younger than this get scrutiny. */
+export const DomainAgeGateDays = 30;
+/**
+ * Difficulty for a zero-reputation, age-known domain per §8.3.2:
+ *  - age < {@link DomainAgeGateDays} → DifficultyBaseline (20)
+ *  - age ≥ DomainAgeGateDays → DifficultyRelaxed (16)
+ */
+export function difficultyForAge(ageDays) {
+    return ageDays < DomainAgeGateDays ? DifficultyBaseline : DifficultyRelaxed;
+}
+/**
+ * Difficulty for a domain whose reputation has been summarized as
+ * `assessment` per §8.3.2:
+ *  - "trusted" / "neutral" / "" → 0 (no PoW required)
+ *  - "suspicious"               → DifficultySuspicious (22)
+ *  - "hostile"                  → DifficultyHostile (26)
+ *
+ * A return of 0 MUST be interpreted as "no challenge required".
+ */
+export function difficultyForAssessment(a) {
+    switch (a) {
+        case "":
+        case "trusted":
+        case "neutral":
+            return 0;
+        case "suspicious":
+            return DifficultySuspicious;
+        case "hostile":
+            return DifficultyHostile;
+        default:
+            return 0;
+    }
+}
+/**
+ * Construct a fresh challenge at `difficulty`, with
+ * {@link MinPrefixBytes} bytes of fresh prefix entropy and a ULID
+ * id derived from the current wall clock.
+ *
+ * `ttlMs <= 0` is replaced with {@link DefaultChallengeTTLMs}.
+ */
+export function issueChallenge(difficulty, ttlMs, rand = defaultRand) {
+    if (!Number.isInteger(difficulty) || difficulty < 0) {
+        throw new Error("reputation: negative or non-integer PoW difficulty");
+    }
+    if (difficulty > 256) {
+        throw new Error("reputation: PoW difficulty exceeds SHA-256 output size");
+    }
+    const ttl = ttlMs !== undefined && ttlMs > 0 ? ttlMs : DefaultChallengeTTLMs;
+    return {
+        id: newULID(rand),
+        algorithm: PoWAlgorithm,
+        prefix: rand(MinPrefixBytes),
+        difficulty,
+        expires: new Date(Date.now() + ttl),
+    };
+}
+/** Base64-encoded challenge prefix — what the wire carries. */
+export function challengePrefixBase64(c) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(c.prefix).toString("base64");
+    }
+    let bin = "";
+    for (let i = 0; i < c.prefix.length; i++) {
+        bin += String.fromCharCode(c.prefix[i] ?? 0);
+    }
+    return btoa(bin);
+}
+// ---------------------------------------------------------------------------
+// Redemption ledger
+/**
+ * Tracks issued + redeemed challenges; prevents replay per §8.3.4.
+ * Concurrency-safe under the JS single-thread model. Production
+ * deployments wrap a durable backend.
+ */
+export class ChallengeLedger {
+    entries = new Map();
+    lastSweep = 0;
+    sweepIntervalMs;
+    nowFn;
+    constructor(sweepIntervalMs = 60_000, nowFn = () => new Date()) {
+        this.sweepIntervalMs = sweepIntervalMs;
+        this.nowFn = nowFn;
+    }
+    /** Register `c` so a later {@link redeem} call can find it. */
+    record(c) {
+        if (c.id === "") {
+            throw new Error("reputation: challenge id is empty");
+        }
+        if (this.entries.has(c.id)) {
+            throw new Error(`reputation: challenge ${c.id} already recorded`);
+        }
+        this.entries.set(c.id, { challenge: c, redeemed: false });
+        this.maybeSweep();
+    }
+    /**
+     * Redeem the challenge with `id`. Returns the challenge on success.
+     * Throws when:
+     *  - the challenge is unknown
+     *  - the challenge has already been redeemed
+     *  - the challenge has expired
+     */
+    redeem(id) {
+        const e = this.entries.get(id);
+        if (e === undefined) {
+            throw new Error(`reputation: challenge ${id} not found`);
+        }
+        if (e.redeemed) {
+            throw new Error(`reputation: challenge ${id} already used`);
+        }
+        if (this.nowFn().getTime() >= e.challenge.expires.getTime()) {
+            // Drop expired entry now that we've checked it.
+            this.entries.delete(id);
+            throw new Error(`reputation: challenge ${id} has expired`);
+        }
+        e.redeemed = true;
+        return e.challenge;
+    }
+    /** Number of currently-active (unredeemed, unexpired) entries. */
+    active() {
+        let n = 0;
+        const now = this.nowFn().getTime();
+        for (const e of this.entries.values()) {
+            if (!e.redeemed && now < e.challenge.expires.getTime()) {
+                n++;
+            }
+        }
+        return n;
+    }
+    /** Force an immediate sweep of expired entries. */
+    sweep() {
+        this.sweepNow(this.nowFn().getTime());
+    }
+    maybeSweep() {
+        const now = this.nowFn().getTime();
+        if (now - this.lastSweep >= this.sweepIntervalMs) {
+            this.sweepNow(now);
+        }
+    }
+    sweepNow(nowMs) {
+        for (const [id, e] of this.entries) {
+            if (nowMs >= e.challenge.expires.getTime()) {
+                this.entries.delete(id);
+            }
+        }
+        this.lastSweep = nowMs;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+function defaultRand(n) {
+    const out = new Uint8Array(n);
+    globalThis.crypto.getRandomValues(out);
+    return out;
+}
+const ULID_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function newULID(rand) {
+    const bits = new Uint8Array(16);
+    const ms = BigInt(Date.now());
+    bits[0] = Number((ms >> 40n) & 0xffn);
+    bits[1] = Number((ms >> 32n) & 0xffn);
+    bits[2] = Number((ms >> 24n) & 0xffn);
+    bits[3] = Number((ms >> 16n) & 0xffn);
+    bits[4] = Number((ms >> 8n) & 0xffn);
+    bits[5] = Number(ms & 0xffn);
+    const random = rand(10);
+    for (let i = 0; i < 10; i++) {
+        bits[6 + i] = random[i] ?? 0;
+    }
+    let u = 0n;
+    for (let i = 0; i < 8; i++) {
+        u = (u << 8n) | BigInt(bits[i] ?? 0);
+    }
+    let u2 = 0n;
+    for (let i = 8; i < 16; i++) {
+        u2 = (u2 << 8n) | BigInt(bits[i] ?? 0);
+    }
+    const out = new Array(26);
+    for (let i = 25; i >= 13; i--) {
+        out[i] = ULID_ALPHABET[Number(u2 & 31n)] ?? "0";
+        u2 >>= 5n;
+    }
+    for (let i = 12; i >= 0; i--) {
+        out[i] = ULID_ALPHABET[Number(u & 31n)] ?? "0";
+        u >>= 5n;
+    }
+    return out.join("");
+}
+//# sourceMappingURL=pow.js.map

package/dist/reputation/pow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pow.js","sourceRoot":"","sources":["../../src/reputation/pow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,yCAAyC;AACzC,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,qCAAqC;AACrC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAepC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAC9E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAAkB;IACxD,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,EAAE,CAAC;QACR,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC;QACX,KAAK,YAAY;YACf,OAAO,oBAAoB,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC;QAC3B;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,KAAc,EACd,OAAkC,WAAW;IAE7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC7E,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC;QACjB,SAAS,EAAE,YAAY;QACvB,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC;QAC5B,UAAU;QACV,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,qBAAqB,CAAC,CAAe;IACnD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AAEpB;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAA0D,CAAC;IACrF,SAAS,GAAG,CAAC,CAAC;IACL,eAAe,CAAS;IACxB,KAAK,CAAa;IAEnC,YAAY,eAAe,GAAG,MAAM,EAAE,QAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACxE,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,CAAe;QACpB,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,EAAU;QACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,gDAAgD;YAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;QAC7D,CAAC;QACD,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;QAClB,OAAO,CAAC,CAAC,SAAS,CAAC;IACrB,CAAC;IAED,kEAAkE;IAClE,MAAM;QACJ,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACvD,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,mDAAmD;IACnD,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,UAAU;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACzB,CAAC;CACF;AAED,8EAA8E;AAC9E,UAAU;AAEV,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,SAAS,OAAO,CAAC,IAA+B;IAC9C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,EAAE,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAChD,EAAE,KAAK,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAC/C,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC"}

package/dist/reputation/sign.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Sign / verify primitives for reputation wire records per
+ * REPUTATION.md §4.2 + §3.5 + §5.
+ *
+ * Reputation records use a NO-PREFIX signing input — the canonical
+ * bytes with `signature.value` elided are signed directly under
+ * Ed25519. Other SEMP records use SEMP-* domain-separation
+ * prefixes (registered in ENVELOPE.md §4.3) but reputation ones do
+ * not in the current spec.
+ *
+ * @module
+ */
+import { type AbuseReport, type DisclosureAuthorization, type Observation, type ReputationSignature, type TrustObservations } from "./types.js";
+/** Only signature algorithm currently defined. */
+export declare const SignatureAlgorithmEd25519 = "ed25519";
+/**
+ * Bucketize metrics in place (per §4.5.1), then Ed25519-sign
+ * `obs.signature` over the canonical bytes with `signature.value`
+ * elided.
+ */
+export declare function signObservation(obs: Observation, observerPriv: Uint8Array, observerKeyId: string): string;
+/** Verify `obs.signature` against `observerPub`. */
+export declare function verifyObservation(obs: Observation, observerPub: Uint8Array): boolean;
+/** Sign a {@link TrustObservations} response under the observer's signing key. */
+export declare function signTrustObservations(resp: TrustObservations, observerPriv: Uint8Array, observerKeyId: string): string;
+/** Verify a {@link TrustObservations} response. */
+export declare function verifyTrustObservations(resp: TrustObservations, observerPub: Uint8Array): boolean;
+/** Sign a {@link DisclosureAuthorization} under the affected user's identity key. */
+export declare function signDisclosureAuthorization(auth: DisclosureAuthorization, userPriv: Uint8Array, userKeyId: string): string;
+/** Verify a {@link DisclosureAuthorization} against the user's identity public key. */
+export declare function verifyDisclosureAuthorization(auth: DisclosureAuthorization, userPub: Uint8Array): boolean;
+/** Report whether the scope permits disclosing brief content. */
+export declare function authAllowsBrief(auth: DisclosureAuthorization): boolean;
+/** Report whether the scope permits disclosing enclosure content. */
+export declare function authAllowsEnclosure(auth: DisclosureAuthorization): boolean;
+/** Structural validation of an {@link AbuseReport} per §3.2. Throws on first violation. */
+export declare function validateAbuseReport(r: AbuseReport): void;
+/** Re-export so callers can wire the algorithm tag explicitly. */
+export type { ReputationSignature };
+//# sourceMappingURL=sign.d.ts.map

package/dist/reputation/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/reputation/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAEpB,kDAAkD;AAClD,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAKnD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,EAChB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CAqBR;AAED,oDAAoD;AACpD,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,WAAW,EAChB,WAAW,EAAE,UAAU,GACtB,OAAO,CAeT;AAKD,kFAAkF;AAClF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,iBAAiB,EACvB,YAAY,EAAE,UAAU,EACxB,aAAa,EAAE,MAAM,GACpB,MAAM,CAeR;AAED,mDAAmD;AACnD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,iBAAiB,EACvB,WAAW,EAAE,UAAU,GACtB,OAAO,CAeT;AAKD,qFAAqF;AACrF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,MAAM,GAChB,MAAM,CAeR;AAED,uFAAuF;AACvF,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,uBAAuB,EAC7B,OAAO,EAAE,UAAU,GAClB,OAAO,CAeT;AAED,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAEtE;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAE1E;AAKD,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,CA0CxD;AAuBD,kEAAkE;AAClE,YAAY,EAAE,mBAAmB,EAAE,CAAC"}