@sourcey/catalog-verifier 1.1.36 → 1.2.0

package/dist/modules/agent-readiness-engine/src/documents.js

@@ -1,69 +0,0 @@
-import { parse as parseYaml } from "yaml";
-/** Reading the documents a service publishes: their shape only, never their prose. */
-/** A JSON object, or null for anything else. */
-export function record(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : null;
-}
-/** An HTTPS URL carrying no credentials, normalised, or null. */
-export function httpsUrl(value) {
-    if (typeof value !== "string")
-        return null;
-    try {
-        const url = new URL(value);
-        return url.protocol === "https:" && !url.username && !url.password ? url.href : null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Strict UTF-8, or null for bytes that are not. */
-export function utf8(bytes) {
-    try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-    }
-    catch {
-        return null;
-    }
-}
-/** Parsed JSON, or undefined for text that is not. */
-export function json(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * The OpenAPI 3.x version a document states, when it is one: its `openapi`
- * version and the `info` object (a title and a version) OpenAPI requires.
- */
-export function openApiVersion(document) {
-    const version = document?.openapi;
-    const info = record(document?.info);
-    return typeof version === "string" &&
-        /^3\.\d+\.\d+$/u.test(version) &&
-        typeof info?.title === "string" &&
-        typeof info.version === "string"
-        ? version
-        : null;
-}
-/**
- * A JSON or YAML document parsed, or undefined for text that is neither:
- * vendors publish OpenAPI documents in both. Aliases are bounded, so a small
- * document cannot expand into a large one.
- */
-export function jsonOrYaml(text) {
-    const parsed = json(text);
-    if (parsed !== undefined)
-        return parsed;
-    try {
-        return parseYaml(text, { maxAliasCount: 100 });
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=documents.js.map

package/dist/modules/agent-readiness-engine/src/documents.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documents.js","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,sFAAsF;AAEtF,gDAAgD;AAChD,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,IAAI,CAAC,KAAiB;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAwC;IACrE,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,OAAO,KAAK,QAAQ;QAChC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAY,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/modules/agent-readiness-engine/src/naming.d.ts

@@ -1,21 +0,0 @@
-/**
- * When a discovery fact names a job's endpoint (north star §5.2, Discover).
- * The engine rates Discover by this rule, and a card marks the surface the
- * job's request reached by the same one.
- */
-/**
- * Facts that name an interface an agent can call; others (metadata,
- * registration) do not. An API catalog names an API through the OpenAPI it
- * links to, whose servers are `openapi_server` facts; its anchor alone does
- * not. An ARD entry names its artifact, not the service (ARD §5.3.2): the
- * card or OpenAPI document it carries or links to names the endpoint.
- */
-export declare const AGENT_READINESS_NAMING_FACTS: ReadonlySet<string>;
-/** A URL names an endpoint when it gives its exact URI or a base the URI sits under. */
-export declare function agentReadinessNamesEndpoint(value: string, uri: string): boolean;
-/** A discovery fact that names the endpoint: one of the naming facts, naming it. */
-export declare function agentReadinessFactNamesEndpoint(fact: {
-    readonly fact: string;
-    readonly value: string;
-}, uri: string): boolean;
-//# sourceMappingURL=naming.d.ts.map

package/dist/modules/agent-readiness-engine/src/naming.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/naming.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAK3D,CAAC;AAEH,wFAAwF;AACxF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI/E;AAED,oFAAoF;AACpF,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACvD,GAAG,EAAE,MAAM,GACV,OAAO,CAIT"}

package/dist/modules/agent-readiness-engine/src/naming.js

@@ -1,29 +0,0 @@
-/**
- * When a discovery fact names a job's endpoint (north star §5.2, Discover).
- * The engine rates Discover by this rule, and a card marks the surface the
- * job's request reached by the same one.
- */
-/**
- * Facts that name an interface an agent can call; others (metadata,
- * registration) do not. An API catalog names an API through the OpenAPI it
- * links to, whose servers are `openapi_server` facts; its anchor alone does
- * not. An ARD entry names its artifact, not the service (ARD §5.3.2): the
- * card or OpenAPI document it carries or links to names the endpoint.
- */
-export const AGENT_READINESS_NAMING_FACTS = new Set([
-    "mcp_endpoint",
-    "openapi_server",
-    "oauth_protected_resource",
-    "documentation_route",
-]);
-/** A URL names an endpoint when it gives its exact URI or a base the URI sits under. */
-export function agentReadinessNamesEndpoint(value, uri) {
-    const base = value.replace(/[?#].*$/u, "").replace(/\/+$/u, "");
-    const endpoint = uri.replace(/[?#].*$/u, "").replace(/\/+$/u, "");
-    return endpoint === base || endpoint.startsWith(`${base}/`);
-}
-/** A discovery fact that names the endpoint: one of the naming facts, naming it. */
-export function agentReadinessFactNamesEndpoint(fact, uri) {
-    return (AGENT_READINESS_NAMING_FACTS.has(fact.fact) && agentReadinessNamesEndpoint(fact.value, uri));
-}
-//# sourceMappingURL=naming.js.map

package/dist/modules/agent-readiness-engine/src/naming.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"naming.js","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/naming.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,cAAc;IACd,gBAAgB;IAChB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,GAAW;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,+BAA+B,CAC7C,IAAuD,EACvD,GAAW;IAEX,OAAO,CACL,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAC5F,CAAC;AACJ,CAAC"}

package/dist/modules/agent-readiness-engine/src/path.d.ts

@@ -1,74 +0,0 @@
-import type { AgentReadinessPolicy } from "../../../contracts/agent-readiness/src/grade-policy.js";
-import { type AgentReadinessAccountOperation, type AgentReadinessJob, type AgentReadinessJobOperation, type AgentReadinessJobResult, type AgentReadinessRunRecord, type AgentReadinessStep, type AgentReadinessStepResult } from "../../../contracts/agent-readiness/src/index.js";
-/** One interface's path, and whether a later run is due soon to settle or reproduce it. */
-export interface EvaluatedPath {
-    readonly steps: readonly AgentReadinessStepResult[];
-    /** The job itself, beside the steps (north star §5.6, the job). */
-    readonly job: AgentReadinessJobResult;
-    /** A later run can settle what this path leaves open: a page answer not yet reproduced. */
-    readonly reproducible: boolean;
-    /** The probe run whose discovery decided Discover; null when none did. */
-    readonly discoveryRun: AgentReadinessRunRecord | null;
-    /** The binding's run that decided its outcomes, assessed or not; null for a probed path. */
-    readonly verifiedRun: AgentReadinessRunRecord | null;
-    /** The probe runs that reproduce a read's standing answer: unanswered on each, since it last answered. */
-    readonly standingRuns: readonly AgentReadinessRunRecord[];
-}
-/**
- * The probed path of one interface (north star §5.6). The latest probe run that
- * answered the operation decides its steps; a run that left its request, its
- * malformed request, its spec, its authority chain or a declared page
- * unanswered decides nothing, since residue is never a fact. Discovery's
- * latest run decides Discover and the payment manifests, unless an unanswered
- * read could change them: then the latest run whose reads were all answered,
- * or left unanswered only the service's standing answers, does. Earlier runs
- * count only to reproduce a page answer or a standing answer.
- */
-export declare function evaluateProbePath(input: {
-    readonly operation: AgentReadinessJobOperation;
-    /** The operation's declared endpoint URI; null for a spec operation. */
-    readonly endpoint: string | null;
-    readonly policy: Pick<AgentReadinessPolicy, "reproduction">;
-    /** The vendor's sales or approval pages that gate this interface, by page id. */
-    readonly accessGates: readonly string[];
-    /** The settings a person turns on once before an agent can use this interface, by page id. */
-    readonly accessSettings: readonly string[];
-    /** The pages where a person claims later what the agent made alone through it, by page id. */
-    readonly claimPages: readonly string[];
-    /** The pages where a person replaces its key, which the vendor expires with no API to renew it. */
-    readonly keyRenewalPages: readonly string[];
-    /** The listing rules out a checkout: the job is free, or paid per call by its request's offer. */
-    readonly checkoutRuledOut: boolean;
-    /** The account operations this interface declares: its sign-up API, its top-up. */
-    readonly accountOperations: readonly Pick<AgentReadinessAccountOperation, "operation_id" | "role">[];
-    /** Probe runs of the profile's current declaration revision, any order. */
-    readonly runs: readonly AgentReadinessRunRecord[];
-}): EvaluatedPath;
-/**
- * The verified path of one binding: proof, not the grade (north star §5.6). The
- * latest run that did the job, while it is fresh, makes the job `verified`; a
- * verified run sets no step and never makes the job `unavailable`, which only
- * the probes find. The path rests on that run, or on the latest run when none
- * did the job.
- */
-export declare function evaluatePath(input: {
-    readonly job: AgentReadinessJob;
-    readonly policy: Pick<AgentReadinessPolicy, "fresh_for_days">;
-    /** This binding's verified runs, any order. */
-    readonly runs: readonly AgentReadinessRunRecord[];
-    /** When freshness is judged: the refresh's own probe run. */
-    readonly asOf: string;
-}): EvaluatedPath;
-/**
- * A binding's path: every step the probes', and the job verified where its run
- * proved a job the probes found reachable (north star §5.6). A verified job
- * grades as a reachable one does, so the run never changes the letter: it
- * cannot lift a probed `unavailable` or settle a job the probes left open.
- */
-export declare function combinePaths(probed: EvaluatedPath, verified: EvaluatedPath): EvaluatedPath;
-export declare function notAssessed(step: AgentReadinessStep): AgentReadinessStepResult;
-/** The job not yet settled by any run. */
-export declare const NOT_ASSESSED_JOB: AgentReadinessJobResult;
-/** The job unavailable on the run's declaration revision alone: it names no interface for the job. */
-export declare function declaredUnavailable(run: AgentReadinessRunRecord): AgentReadinessJobResult;
-//# sourceMappingURL=path.d.ts.map

package/dist/modules/agent-readiness-engine/src/path.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/path.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAEL,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAE9B,MAAM,iDAAiD,CAAC;AAezD,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACtD,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACrD,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAC5D,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,mGAAmG;IACnG,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,kGAAkG;IAClG,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,SAAS,IAAI,CACvC,8BAA8B,EAC9B,cAAc,GAAG,MAAM,CACxB,EAAE,CAAC;IACJ,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACnD,GAAG,aAAa,CAgVhB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAClD,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,aAAa,CA0BhB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,GAAG,aAAa,CAY1F;AA6HD,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,wBAAwB,CAE9E;AAED,0CAA0C;AAC1C,eAAO,MAAM,gBAAgB,EAAE,uBAAmE,CAAC;AASnG,sGAAsG;AACtG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,uBAAuB,GAAG,uBAAuB,CAEzF"}

package/dist/modules/agent-readiness-engine/src/path.js

@@ -1,437 +0,0 @@
-import { compareInstants } from "provenry/primitives";
-import { AGENT_READINESS_STEPS, } from "../../../contracts/agent-readiness/src/index.js";
-import { consentReached } from "./authority.js";
-import { agentReadinessFactNamesEndpoint, agentReadinessNamesEndpoint } from "./naming.js";
-import { probeUnanswered } from "./records.js";
-const MAXIMUM_EVIDENCE = 32;
-const DAY_MS = 24 * 60 * 60 * 1_000;
-/**
- * The probed path of one interface (north star §5.6). The latest probe run that
- * answered the operation decides its steps; a run that left its request, its
- * malformed request, its spec, its authority chain or a declared page
- * unanswered decides nothing, since residue is never a fact. Discovery's
- * latest run decides Discover and the payment manifests, unless an unanswered
- * read could change them: then the latest run whose reads were all answered,
- * or left unanswered only the service's standing answers, does. Earlier runs
- * count only to reproduce a page answer or a standing answer.
- */
-export function evaluateProbePath(input) {
-    const runs = oldestFirst(input.runs);
-    const latest = runs.at(-1);
-    if (!latest)
-        throw new Error("A probed path needs at least one probe run.");
-    const { operation } = input;
-    const id = operation.operation_id;
-    const accountIds = input.accountOperations.map(({ operation_id }) => operation_id);
-    const answeredRuns = runs.filter((run) => !probeUnanswered(run, id, accountIds));
-    const current = answeredRuns.at(-1);
-    const probe = current?.probes.find(({ operation_id }) => operation_id === id);
-    if (!current || !probe) {
-        return {
-            steps: AGENT_READINESS_STEPS.map(notAssessed),
-            job: NOT_ASSESSED_JOB,
-            reproducible: false,
-            discoveryRun: null,
-            verifiedRun: null,
-            standingRuns: [],
-        };
-    }
-    const answer = probe.request?.answer ?? null;
-    const of = (purpose) => exchangeEvidence(current, (entry) => entry.call_id === id && entry.purpose === purpose);
-    const requested = of("probe_operation");
-    const malformed = of("probe_malformed");
-    const metadata = of("probe_authorization_server");
-    const chainEvidence = [
-        ...of("probe_resource_metadata"),
-        ...metadata,
-        ...of("probe_client_registration"),
-        ...of("probe_authorization"),
-    ];
-    const pagesOf = (include) => {
-        const ids = new Set(current.pages.filter(include).map(({ page_id }) => page_id));
-        return exchangeEvidence(current, (entry) => entry.purpose === "probe_page" && ids.has(entry.call_id));
-    };
-    const spec = probe.spec;
-    const specRead = spec?.fetched === "read" ? spec : null;
-    const covered = specRead?.covers === true ? specRead : null;
-    // A spec reading rests on the spec and on each document its references reached.
-    const readFrom = (reading) => [
-        reading.attempt_digest,
-        ...(reading.references ?? []).map(({ attempt_digest }) => attempt_digest),
-    ].map((attempt_digest) => ({
-        kind: "discovery",
-        run_digest: current.run_digest,
-        attempt_digest,
-    }));
-    const specEvidence = spec ? readFrom(spec) : [];
-    // The interface's account operations, by role, as read; and those its spec covers.
-    const declaredAccounts = (role) => (current.accounts ?? []).filter(({ operation_id }) => input.accountOperations.some((declared) => declared.operation_id === operation_id && declared.role === role));
-    const accounts = (role) => declaredAccounts(role).filter(({ spec: read }) => read.fetched === "read" && read.covers);
-    // A step an account operation could have set cites its reading, whichever way it read.
-    const accountEvidence = (role) => declaredAccounts(role).flatMap(({ spec: read }) => readFrom(read));
-    const declaration = () => [{ kind: "declaration", run_digest: current.run_digest }];
-    const chain = probe.authority;
-    const refusal = answer === "offer" || answer === "authority" || answer === "error";
-    // No account is needed: the request itself answered, or the spec requires no security at
-    // all. An empty requirement beside a credential's makes security optional: some deployments
-    // let anonymous calls through (Jira, where an admin grants the public a permission), which
-    // only an answer shows. A key the listing says travels in the body (Amplitude's), which
-    // OpenAPI cannot state as a scheme, leaves the spec's empty security saying nothing.
-    const keyInBody = operation.kind === "http" && operation.body?.credential_field !== undefined;
-    const anonymous = answer === "success" ||
-        answer === "offer" ||
-        ((answer === null || answer === "error" || answer === "page") &&
-            !keyInBody &&
-            covered !== null &&
-            covered.security.length > 0 &&
-            covered.security.every((kind) => kind === "none"));
-    // An agent registration path: the chain's auth.md registration, or a sign-up API the listing
-    // declares as a registration account operation, which its spec covers and lets an agent call
-    // with no credential. A sign-up the spec does not declare anonymous is for people.
-    const signUps = accounts("registration").filter(({ spec: read }) => read.security.length > 0 && read.security.every((kind) => kind === "none"));
-    const signedUp = signUps.length > 0;
-    const registration = chain?.registration === "agent" || signedUp ? "agent" : (chain?.registration ?? null);
-    const registrationEvidence = [
-        ...(chain?.registration ? chainEvidence : []),
-        ...signUps.flatMap(({ spec: read }) => readFrom(read)),
-    ];
-    const target = operation.kind === "http" ? operation.url : input.endpoint;
-    // A read unanswered on every probe since it last answered, the first of them the policy's
-    // interval before the latest, is the service's standing answer. A run that answered it, or did
-    // not read it, starts the count again.
-    const stretches = latest.discovery.unanswered.map((url) => {
-        const since = runs.findLastIndex(({ discovery }) => !discovery.unanswered.includes(url));
-        return { url, runs: reproducing(runs.slice(since + 1), input.policy.reproduction) };
-    });
-    const standing = new Set(stretches.flatMap(({ url, runs: found }) => (found.length > 0 ? [url] : [])));
-    const settled = (run) => run.discovery.unanswered.every((url) => standing.has(url));
-    const settledDiscovery = [...runs].reverse().find(settled);
-    /** The discovery run that decides: the latest, unless a read there still unanswered could change the reading. */
-    const discoveryFor = (decided) => decided(latest) || settled(latest) ? latest : (settledDiscovery ?? null);
-    // A server that answers for authority before listing its tools describes them to the agent it
-    // authorizes: it asked before any tool was called. A list it refused or cut short describes none.
-    const toolCalled = current.exchanges.some((entry) => entry.call_id === id && entry.purpose === "probe_operation" && entry.role === "request");
-    const toolDescribed = operation.kind === "mcp" &&
-        (probe.tool_listed === true ||
-            (probe.tool_listed === null && answer === "authority" && !toolCalled));
-    const finds = (run) => discoverStep(run, current, operation, target, covered, specEvidence, toolDescribed);
-    const discoveryRun = discoveryFor((candidate) => finds(candidate).outcome === "machine");
-    const discover = discoveryRun ? finds(discoveryRun) : notAssessed("discover");
-    const authority = (() => {
-        if (anonymous) {
-            return result("authority", "not_applicable", null, answer === null ? specEvidence : requested);
-        }
-        if (registration !== null) {
-            return result("authority", "machine", null, [...requested, ...registrationEvidence]);
-        }
-        const authorization = current.exchanges.find((entry) => entry.call_id === id && entry.purpose === "probe_authorization");
-        if (chain?.client && authorization && consentReached(authorization.record)) {
-            return result("authority", "approval", "setup", [...requested, ...chainEvidence]);
-        }
-        // A key or token scheme, an OAuth flow the agent's own client cannot start, a key the
-        // listing says travels in the body, or nothing machine-readable: a person hands over a credential.
-        return result("authority", "workaround", "setup", [
-            ...requested,
-            ...chainEvidence,
-            ...specEvidence,
-            ...accountEvidence("registration"),
-            ...(keyInBody ? declaration() : []),
-        ]);
-    })();
-    // What the agent makes alone lasts until a person claims it later (the shape's A): the vendor's
-    // claim page this interface lists, once it is there.
-    const claimed = pagesOf(({ page_id, found }) => input.claimPages.includes(page_id) && found);
-    const onboard = (() => {
-        if (anonymous) {
-            return claimed.length > 0
-                ? result("onboard", "approval", "setup", [...authority.evidence, ...claimed])
-                : result("onboard", "not_applicable", null, authority.evidence);
-        }
-        // The vendor's decision stands before any way in: whatever registration exists, it decides.
-        const accessPage = pagesOf(({ page_id, found }) => input.accessGates.includes(page_id) && found);
-        if (accessPage.length > 0)
-            return result("onboard", "gated", null, accessPage);
-        // A setting a person on the account turns on once before the agent can use this interface (an
-        // organization's MCP write access): a decision made once, whatever way in the agent has.
-        const turnedOn = pagesOf(({ page_id, found }) => input.accessSettings.includes(page_id) && found);
-        const agentGetsIn = (evidence) => turnedOn.length > 0 || claimed.length > 0
-            ? result("onboard", "approval", "setup", [...evidence, ...turnedOn, ...claimed])
-            : result("onboard", "machine", null, evidence);
-        if (registration === "agent")
-            return agentGetsIn(registrationEvidence);
-        if (registration === "claimable") {
-            return result("onboard", "approval", "setup", [
-                ...registrationEvidence,
-                ...turnedOn,
-                ...claimed,
-            ]);
-        }
-        // The agent's own OAuth client gets it in once the server takes it to consent (the shape's A).
-        if (chain?.client && authority.outcome === "approval")
-            return agentGetsIn(chainEvidence);
-        // No path for the agent: what the probes found, or the listing itself when they sent nothing.
-        const evidence = [
-            ...requested,
-            ...pagesOf(({ role }) => role === "registration"),
-            ...chainEvidence,
-            ...specEvidence,
-            ...accountEvidence("registration"),
-        ];
-        return result("onboard", "workaround", "setup", evidence.length > 0 ? evidence : declaration());
-    })();
-    const pay = (() => {
-        if (answer === "offer")
-            return result("pay", "machine", null, requested);
-        if (covered?.payment)
-            return result("pay", "machine", null, specEvidence);
-        // The agent funds the balance the job draws on itself: a top-up its spec says is paid by 402.
-        const funded = accounts("top_up").filter(({ spec: read }) => read.payment);
-        if (funded.length > 0) {
-            return result("pay", "machine", null, funded.flatMap(({ spec: read }) => readFrom(read)));
-        }
-        const manifests = (run) => target === null
-            ? []
-            : run.discovery.facts.filter((found) => found.fact === "payment_manifest" &&
-                ownDomain(found.descriptor_url, run.discovery.domains) &&
-                agentReadinessNamesEndpoint(found.value, target));
-        const run = discoveryFor((candidate) => manifests(candidate).length > 0);
-        const named = run ? manifests(run) : [];
-        if (named.length > 0 && run) {
-            return result("pay", "machine", null, named.map(({ attempt_digest }) => ({
-                kind: "discovery",
-                run_digest: run.run_digest,
-                attempt_digest,
-            })));
-        }
-        if (anonymous) {
-            return result("pay", "not_applicable", null, answer === null ? specEvidence : requested);
-        }
-        if (input.checkoutRuledOut)
-            return result("pay", "not_applicable", null, declaration());
-        // An unanswered read could have held a manifest that names the endpoint.
-        if (!run)
-            return notAssessed("pay");
-        // A dead or invented page sets nothing: a page counts once it is found. A balance a person tops
-        // up by hand recurs (the shape's "manual top-ups"); a checkout puts a card on file once.
-        const toppedUp = pagesOf(({ role, found }) => role === "top_up" && found);
-        if (toppedUp.length > 0) {
-            return result("pay", "workaround", "recurring", [...toppedUp, ...accountEvidence("top_up")]);
-        }
-        const checkout = pagesOf(({ role, found }) => role === "checkout" && found);
-        return checkout.length > 0
-            ? result("pay", "workaround", "setup", [...checkout, ...accountEvidence("top_up")])
-            : notAssessed("pay");
-    })();
-    const pages = answeredRuns.filter((run) => run.probes.find(({ operation_id }) => operation_id === id)?.request?.answer === "page");
-    const pageRuns = answer === "page" ? reproducing(pages, input.policy.reproduction) : [];
-    const pageReproduced = pageRuns.length > 0;
-    const job = (() => {
-        // The job's tool answered, or asked for the authority it needs: whatever an anonymous list
-        // says, the server performs it for an agent with that authority.
-        if (answer === "success" || answer === "offer" || answer === "authority") {
-            return jobResult("reachable", requested);
-        }
-        // The server lists its tools, the job's is not among them, and its call is refused with an error.
-        if (operation.kind === "mcp" && probe.tool_listed === false && answer === "error") {
-            return jobResult("unavailable", requested);
-        }
-        if (refusal)
-            return jobResult("reachable", requested);
-        if (covered)
-            return jobResult("reachable", specEvidence);
-        if (answer === null)
-            return jobResult("unavailable", specEvidence);
-        if (pageReproduced) {
-            return jobResult("unavailable", pageRuns.flatMap((run) => exchangeEvidence(run, (entry) => entry.call_id === id && entry.purpose === "probe_operation")));
-        }
-        return NOT_ASSESSED_JOB;
-    })();
-    const confirm = (() => {
-        const read = refusal ? probe.request : answer === "success" ? probe.malformed : null;
-        if (read) {
-            const typedRefusal = (read.answer === "offer" || read.answer === "authority" || read.answer === "error") &&
-                read.typed === true;
-            const evidence = refusal ? requested : [...requested, ...malformed];
-            return typedRefusal
-                ? result("confirm", "machine", null, evidence)
-                : result("confirm", "workaround", "recurring", evidence);
-        }
-        // A page or a spec operation: the errors the spec declares for the job.
-        return covered?.typed_errors
-            ? result("confirm", "machine", null, specEvidence)
-            : result("confirm", "workaround", "recurring", [...requested, ...specEvidence]);
-    })();
-    const sustain = (() => {
-        if (authority.outcome === "not_applicable") {
-            return result("sustain", "not_applicable", null, authority.evidence);
-        }
-        // Either alternative keeps the agent's authority alive: its key operations, or the chain's
-        // grants, whoever obtained the first token.
-        if (covered?.key_operations)
-            return result("sustain", "machine", null, specEvidence);
-        if (chain !== null) {
-            if (!chain.renewal)
-                return result("sustain", "workaround", "recurring", metadata);
-            return chain.revocation
-                ? result("sustain", "machine", null, metadata)
-                : result("sustain", "workaround", "setup", metadata);
-        }
-        // A key the vendor expires with no API to renew it: a person replaces it each time (the shape's
-        // "keys that expire with no renewal API"), at the page this interface lists, once it is there.
-        const expiring = pagesOf(({ page_id, found }) => input.keyRenewalPages.includes(page_id) && found);
-        const evidence = [...authority.evidence, ...specEvidence];
-        return expiring.length > 0
-            ? result("sustain", "workaround", "recurring", [...evidence, ...expiring])
-            : result("sustain", "workaround", "setup", evidence);
-    })();
-    return {
-        steps: [discover, authority, onboard, pay, confirm, sustain],
-        job,
-        reproducible: answer === "page" && !pageReproduced && covered === null,
-        discoveryRun,
-        verifiedRun: null,
-        standingRuns: stretches.flatMap(({ runs: found }) => found),
-    };
-}
-/**
- * The verified path of one binding: proof, not the grade (north star §5.6). The
- * latest run that did the job, while it is fresh, makes the job `verified`; a
- * verified run sets no step and never makes the job `unavailable`, which only
- * the probes find. The path rests on that run, or on the latest run when none
- * did the job.
- */
-export function evaluatePath(input) {
-    const runs = oldestFirst(input.runs);
-    const latestRun = runs.at(-1);
-    if (!latestRun)
-        throw new Error("A verified path needs at least one run.");
-    const { job } = input;
-    const succeeded = (run) => run.assertions.length === job.assertions.length &&
-        job.assertions.every(({ name }) => run.assertions.some(({ assertion, holds }) => assertion === name && holds));
-    const fresh = (run) => Date.parse(input.asOf) - Date.parse(run.finished_at) <= input.policy.fresh_for_days * DAY_MS;
-    const proof = [...runs].reverse().find((run) => succeeded(run) && fresh(run));
-    return {
-        steps: AGENT_READINESS_STEPS.map(notAssessed),
-        job: proof
-            ? jobResult("verified", exchangeEvidence(proof, (entry) => entry.purpose === "job"))
-            : NOT_ASSESSED_JOB,
-        reproducible: false,
-        discoveryRun: null,
-        verifiedRun: proof ?? latestRun,
-        standingRuns: [],
-    };
-}
-/**
- * A binding's path: every step the probes', and the job verified where its run
- * proved a job the probes found reachable (north star §5.6). A verified job
- * grades as a reachable one does, so the run never changes the letter: it
- * cannot lift a probed `unavailable` or settle a job the probes left open.
- */
-export function combinePaths(probed, verified) {
-    return {
-        steps: probed.steps,
-        job: verified.job.outcome === "verified" && probed.job.outcome === "reachable"
-            ? verified.job
-            : probed.job,
-        reproducible: probed.reproducible,
-        discoveryRun: probed.discoveryRun,
-        verifiedRun: verified.verifiedRun,
-        standingRuns: probed.standingRuns,
-    };
-}
-/**
- * Discover (north star §5.6): `machine` when the agent finds the interface
- * from the vendor's own domains and a machine-readable description covers the
- * job. Found: a descriptor fetched on an Entity domain names the job's
- * endpoint, or a document written for agents names its origin (the route).
- * Covered: the named spec covers the job, the MCP server lists the job's tool
- * (or lists tools only after authority), or that document for agents. A spec
- * operation has no endpoint to name: its spec, covering the job, is the
- * machine-readable interface. Otherwise a setup workaround: a person tells the
- * agent where the interface is or how to call it.
- */
-function discoverStep(run, current, operation, target, covered, specEvidence, 
-/** An MCP server listed the job's tool, or lists tools only to the agent it authorizes. */
-toolDescribed) {
-    const { attempts, facts, domains } = run.discovery;
-    const discovery = (attempt) => ({
-        kind: "discovery",
-        run_digest: run.run_digest,
-        attempt_digest: attempt,
-    });
-    if (operation.kind === "spec") {
-        return covered
-            ? result("discover", "machine", null, specEvidence)
-            : result("discover", "workaround", "setup", specEvidence);
-    }
-    const named = target
-        ? facts.filter((fact) => agentReadinessFactNamesEndpoint(fact, target) && ownDomain(fact.descriptor_url, domains))
-        : [];
-    const described = covered !== null || toolDescribed;
-    const routed = named.some(({ fact }) => fact === "documentation_route");
-    if (routed || (named.length > 0 && described)) {
-        return result("discover", "machine", null, [
-            ...named.map(({ attempt_digest }) => discovery(attempt_digest)),
-            ...specEvidence,
-        ]);
-    }
-    const evidence = [...attempts.map(discovery), ...specEvidence];
-    return result("discover", "workaround", "setup", evidence.length > 0 ? evidence : [{ kind: "declaration", run_digest: current.run_digest }]);
-}
-/** Whether a URL is on one of the Entity's domains, or a subdomain of one. */
-function ownDomain(url, domains) {
-    const host = new URL(url).hostname.toLowerCase();
-    return domains.some((domain) => host === domain || host.endsWith(`.${domain}`));
-}
-/**
- * The latest of `found` that reproduce a finding, the fewest that do, or none:
- * a revision cites only these (north star §5.4).
- */
-function reproducing(found, rule) {
-    for (let start = found.length - rule.attempts; start >= 0; start -= 1) {
-        const stretch = found.slice(start);
-        if (reproduced(stretch, rule))
-            return stretch;
-    }
-    return [];
-}
-/**
- * A finding reproduced as the policy asks: in the latest run and in earlier
- * ones, at least `attempts` runs whose first and last are the interval apart.
- */
-function reproduced(found, rule) {
-    const first = found[0];
-    const last = found.at(-1);
-    return (first !== undefined &&
-        last !== undefined &&
-        found.length >= rule.attempts &&
-        Date.parse(last.finished_at) - Date.parse(first.finished_at) >=
-            rule.minimum_interval_seconds * 1_000);
-}
-function oldestFirst(runs) {
-    return [...runs].sort((left, right) => compareInstants(left.finished_at, right.finished_at) ||
-        (left.run_digest < right.run_digest ? -1 : 1));
-}
-function exchangeEvidence(run, include) {
-    return run.exchanges.filter(include).map((entry) => ({
-        kind: "exchange",
-        run_digest: run.run_digest,
-        exchange_digest: entry.record.exchange_digest,
-    }));
-}
-function result(step, outcome, timing, evidence) {
-    return { step, outcome, timing, evidence: evidence.slice(0, MAXIMUM_EVIDENCE) };
-}
-export function notAssessed(step) {
-    return { step, outcome: "not_assessed", timing: null, evidence: [] };
-}
-/** The job not yet settled by any run. */
-export const NOT_ASSESSED_JOB = { outcome: "not_assessed", evidence: [] };
-function jobResult(outcome, evidence) {
-    return { outcome, evidence: evidence.slice(0, MAXIMUM_EVIDENCE) };
-}
-/** The job unavailable on the run's declaration revision alone: it names no interface for the job. */
-export function declaredUnavailable(run) {
-    return jobResult("unavailable", [{ kind: "declaration", run_digest: run.run_digest }]);
-}
-//# sourceMappingURL=path.js.map