@vauban-org/agent-sdk 1.0.0 → 1.2.0

package/dist/ports/delegation.contract.test.js

@@ -0,0 +1,337 @@
+/**
+ * DelegationPort contract tests (S7 spec).
+ *
+ * Applied to any DelegationPort implementation.
+ * Verifies: narrowing R-1 invariant, chain verification, revocation cascade,
+ * depth limits, signature validation, cycle detection, temporal frame nesting.
+ */
+import { describe, expect, test } from "vitest";
+import { DelegationNotNarrowingError, DelegationExpiredError, DelegationRevokedError, DelegationChainTooDeepError, DelegationCycleDetectedError, DelegationTemporalFrameError, } from "./delegation.js";
+/**
+ * Factory function to create a minimal valid DelegationClaim for testing.
+ */
+function makeDelegationClaim(overrides = {}) {
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + 86400000); // +24h
+    return {
+        id: crypto.randomUUID(),
+        parent_id: undefined,
+        scope: {
+            capabilities: ["read", "write"],
+            constraints: [],
+            jurisdictions: ["EU.v1"],
+            expires_at: expiresAt.toISOString(),
+        },
+        ed25519_sig: "ed25519_" + crypto.randomUUID().replace(/-/g, "").slice(0, 32),
+        ttl: 86400,
+        issuer: "issuer-agent",
+        holder: "holder-agent",
+        created_at: now.toISOString(),
+        revoked_at: null,
+        ...overrides,
+    };
+}
+function makeRootCapability(overrides = {}) {
+    const expiresAt = new Date(Date.now() + 86400000).toISOString();
+    return {
+        capabilities: ["read", "write", "delegate"],
+        constraints: [],
+        jurisdictions: ["EU.v1"],
+        expires_at: expiresAt,
+        ...overrides,
+    };
+}
+export const delegationPortContract = (factory) => {
+    describe("DelegationPort contract", () => {
+        test("mintDelegation creates narrowed claim from parent", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read", "write", "delegate"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: new Date(Date.now() + 86400000).toISOString(),
+                },
+            });
+            const narrowed = {
+                capabilities: ["read"], // narrowed from 3 to 1
+                constraints: [],
+                jurisdictions: ["EU.v1"],
+                expires_at: parent.scope.expires_at,
+            };
+            const child = await port.mintDelegation(parent, narrowed, {
+                issuerId: parent.issuer,
+                holderId: "new-holder",
+            });
+            expect(child.parent_id).toBe(parent.id);
+            expect(child.scope.capabilities).toEqual(["read"]);
+            expect(child.holder).toBe("new-holder");
+            expect(child.ed25519_sig).toBeDefined();
+        });
+        test("mintDelegation from RootCapability succeeds", async () => {
+            const port = factory();
+            const root = makeRootCapability();
+            const narrowed = {
+                capabilities: ["read"],
+                constraints: [],
+                jurisdictions: ["EU.v1"],
+                expires_at: root.expires_at,
+            };
+            const claim = await port.mintDelegation(root, narrowed, {
+                issuerId: "root-agent",
+                holderId: "delegatee-agent",
+            });
+            expect(claim.parent_id).toBeUndefined();
+            expect(claim.scope.capabilities).toEqual(["read"]);
+            expect(claim.issuer).toBe("root-agent");
+        });
+        test("mintDelegation rejects R-1 violation (capability expansion)", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: new Date(Date.now() + 86400000).toISOString(),
+                },
+            });
+            const expanded = {
+                capabilities: ["read", "write"], // expanded from 1 to 2 — R-1 violation
+                constraints: [],
+                jurisdictions: ["EU.v1"],
+                expires_at: parent.scope.expires_at,
+            };
+            await expect(port.mintDelegation(parent, expanded, { holderId: "attacker" })).rejects.toThrow(DelegationNotNarrowingError);
+        });
+        test("mintDelegation rejects jurisdiction expansion (R-1 violation)", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: new Date(Date.now() + 86400000).toISOString(),
+                },
+            });
+            const expanded = {
+                capabilities: ["read"],
+                constraints: [],
+                jurisdictions: ["EU.v1", "UK.v1"], // expanded — R-1 violation
+                expires_at: parent.scope.expires_at,
+            };
+            await expect(port.mintDelegation(parent, expanded, { holderId: "attacker" })).rejects.toThrow(DelegationNotNarrowingError);
+        });
+        test("verifyChain validates full chain from leaf to root", async () => {
+            const port = factory();
+            const grandparent = makeDelegationClaim({
+                id: "gp-1",
+                parent_id: undefined,
+            });
+            const parent = makeDelegationClaim({
+                id: "p-1",
+                parent_id: "gp-1",
+                issuer: "gp-agent",
+            });
+            const child = makeDelegationClaim({
+                id: "c-1",
+                parent_id: "p-1",
+                issuer: "p-agent",
+            });
+            const result = await port.verifyChain(child);
+            expect(result.chain_depth).toBeGreaterThanOrEqual(1);
+            expect(grandparent.id).toBeDefined();
+            expect(parent.parent_id).toBe("gp-1");
+            if (result.valid) {
+                expect(result.errors.length).toBe(0);
+            }
+        });
+        test("verifyChain rejects expired claim", async () => {
+            const port = factory();
+            const now = new Date();
+            const expired = new Date(now.getTime() - 3600000); // 1h ago
+            const claim = makeDelegationClaim({
+                scope: {
+                    capabilities: ["read"],
+                    constraints: [],
+                    jurisdictions: ["EU.v1"],
+                    expires_at: expired.toISOString(), // already expired
+                },
+            });
+            const result = await port.verifyChain(claim);
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("expired"))).toBe(true);
+        });
+        test("revoke cascades to all descendants", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({ id: "p-1" });
+            const child1 = makeDelegationClaim({
+                id: "c-1",
+                parent_id: "p-1",
+            });
+            const child2 = makeDelegationClaim({
+                id: "c-2",
+                parent_id: "p-1",
+            });
+            const grandchild = makeDelegationClaim({
+                id: "gc-1",
+                parent_id: "c-1",
+            });
+            const revokedCount = await port.revoke("p-1", {
+                reason: "testing cascade",
+                cascade: true,
+            });
+            expect(revokedCount).toBeGreaterThanOrEqual(1);
+            expect(parent.id).toBe("p-1");
+            expect(child1.parent_id).toBe("p-1");
+            expect(child2.parent_id).toBe("p-1");
+            expect(grandchild.parent_id).toBe("c-1");
+            const childRevoked = await port.isRevoked("c-1");
+            expect(childRevoked).toBe(true);
+        });
+        test("verifyChain rejects revoked ancestor", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({
+                id: "p-1",
+                revoked_at: new Date().toISOString(),
+            });
+            const child = makeDelegationClaim({
+                id: "c-1",
+                parent_id: "p-1",
+            });
+            expect(parent.revoked_at).toBeDefined();
+            expect(child.parent_id).toBe("p-1");
+            const result = await port.verifyChain(child);
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("revoked"))).toBe(true);
+        });
+        test("verifyChain enforces max_depth limit (V0: max=5)", async () => {
+            const port = factory();
+            // Create a chain 6 levels deep (violates V0 max_depth=5)
+            let claim = makeDelegationClaim({ id: "level-0", parent_id: undefined });
+            for (let i = 1; i < 6; i++) {
+                claim = makeDelegationClaim({
+                    id: `level-${i}`,
+                    parent_id: `level-${i - 1}`,
+                });
+            }
+            const result = await port.verifyChain(claim);
+            // May fail or set chain_depth > max_depth depending on implementation
+            expect(result.chain_depth).toBeGreaterThan(0);
+        });
+        test("verifyChain detects cycle (I-S7-4 invariant)", async () => {
+            const port = factory();
+            // Claim that points back to itself (invalid cycle)
+            const cycleClaimId = "cycle-1";
+            const cycleClaim = makeDelegationClaim({
+                id: cycleClaimId,
+                parent_id: cycleClaimId, // points to itself — cycle
+            });
+            const result = await port.verifyChain(cycleClaim);
+            expect(result.valid).toBe(false);
+            expect(result.errors.some((e) => e.includes("cycle"))).toBe(true);
+        });
+        test("isRevoked returns true for revoked claim (cache TTL 60s)", async () => {
+            const port = factory();
+            const claim = makeDelegationClaim({
+                id: "revoked-1",
+                revoked_at: new Date().toISOString(),
+            });
+            expect(claim.revoked_at).toBeDefined();
+            const revoked = await port.isRevoked("revoked-1");
+            expect(revoked).toBe(true);
+        });
+        test("getChain returns full path from leaf to root", async () => {
+            const port = factory();
+            const root = makeDelegationClaim({
+                id: "root",
+                parent_id: undefined,
+            });
+            const level1 = makeDelegationClaim({
+                id: "level1",
+                parent_id: "root",
+            });
+            const level2 = makeDelegationClaim({
+                id: "level2",
+                parent_id: "level1",
+            });
+            expect(root.parent_id).toBeUndefined();
+            expect(level1.parent_id).toBe("root");
+            expect(level2.parent_id).toBe("level1");
+            const chain = await port.getChain("level2");
+            // Should return at least the queried claim
+            expect(chain.length).toBeGreaterThanOrEqual(1);
+            expect(chain[0]?.id).toBe("level2");
+        });
+        test("getDescendants returns all transitive children", async () => {
+            const port = factory();
+            const parent = makeDelegationClaim({ id: "parent" });
+            const child1 = makeDelegationClaim({
+                id: "child1",
+                parent_id: "parent",
+            });
+            const child2 = makeDelegationClaim({
+                id: "child2",
+                parent_id: "parent",
+            });
+            const grandchild = makeDelegationClaim({
+                id: "grandchild",
+                parent_id: "child1",
+            });
+            expect(parent.id).toBe("parent");
+            expect(child1.parent_id).toBe("parent");
+            expect(child2.parent_id).toBe("parent");
+            expect(grandchild.parent_id).toBe("child1");
+            const descendants = await port.getDescendants("parent");
+            // Should include all descendants
+            const ids = descendants.map((c) => c.id);
+            expect(ids).toContain("child1");
+            expect(ids).toContain("child2");
+            expect(ids).toContain("grandchild");
+        });
+    });
+};
+// ─── Error type tests ─────────────────────────────────────────────────────
+describe("DelegationPort — error types", () => {
+    test("DelegationNotNarrowingError captures violation type", () => {
+        const err = new DelegationNotNarrowingError("parent-1", "child-1", "capability_expansion");
+        expect(err.parentId).toBe("parent-1");
+        expect(err.childId).toBe("child-1");
+        expect(err.violationType).toBe("capability_expansion");
+        expect(err.name).toBe("DelegationNotNarrowingError");
+    });
+    test("DelegationExpiredError captures expiry timestamp", () => {
+        const expiresAt = "2025-01-01T00:00:00Z";
+        const err = new DelegationExpiredError("claim-1", expiresAt);
+        expect(err.claimId).toBe("claim-1");
+        expect(err.expiresAt).toBe(expiresAt);
+        expect(err.name).toBe("DelegationExpiredError");
+    });
+    test("DelegationRevokedError captures revocation details", () => {
+        const revokedAt = new Date().toISOString();
+        const err = new DelegationRevokedError("claim-1", revokedAt, "security incident");
+        expect(err.claimId).toBe("claim-1");
+        expect(err.revokedAt).toBe(revokedAt);
+        expect(err.reason).toBe("security incident");
+        expect(err.name).toBe("DelegationRevokedError");
+    });
+    test("DelegationChainTooDeepError captures depth bounds", () => {
+        const err = new DelegationChainTooDeepError("claim-1", 7, 5);
+        expect(err.claimId).toBe("claim-1");
+        expect(err.depth).toBe(7);
+        expect(err.maxDepth).toBe(5);
+        expect(err.name).toBe("DelegationChainTooDeepError");
+    });
+    test("DelegationCycleDetectedError captures cycle subject", () => {
+        const err = new DelegationCycleDetectedError("claim-1", "cycle-subject-1");
+        expect(err.claimId).toBe("claim-1");
+        expect(err.cycleSubject).toBe("cycle-subject-1");
+        expect(err.name).toBe("DelegationCycleDetectedError");
+    });
+    test("DelegationTemporalFrameError captures temporal issue", () => {
+        const err = new DelegationTemporalFrameError("claim-1", "temporal_nesting_violated");
+        expect(err.claimId).toBe("claim-1");
+        expect(err.reason).toBe("temporal_nesting_violated");
+        expect(err.name).toBe("DelegationTemporalFrameError");
+    });
+});
+//# sourceMappingURL=delegation.contract.test.js.map

package/dist/ports/delegation.contract.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.contract.test.js","sourceRoot":"","sources":["../../src/ports/delegation.contract.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAMhD,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,SAAS,mBAAmB,CAC1B,YAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO;IAE7D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE;YACL,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC/B,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;SACpC;QACD,WAAW,EACT,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACjE,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,UAAU,EAAE,IAAI;QAChB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,YAAqC,EAAE;IAEvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO;QACL,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;QAC3C,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,CAAC,OAAO,CAAC;QACxB,UAAU,EAAE,SAAS;QACrB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAkB,EAAE,EAAE;IAC3D,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;oBAC3C,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;iBAC1D;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,uBAAuB;gBAC/C,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;gBACxD,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAElC,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,CAAC;gBACtB,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE;gBACtD,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,CAAC;oBACtB,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;iBAC1D;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,uCAAuC;gBACxE,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,CAAC;gBACxB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC;YAEF,MAAM,MAAM,CACV,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAChE,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,CAAC;oBACtB,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;iBAC1D;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAoB;gBAChC,YAAY,EAAE,CAAC,MAAM,CAAC;gBACtB,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,2BAA2B;gBAC9D,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;aACpC,CAAC;YAEF,MAAM,MAAM,CACV,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAChE,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,WAAW,GAAG,mBAAmB,CAAC;gBACtC,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,MAAM;gBACjB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS;YAE5D,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,KAAK,EAAE;oBACL,YAAY,EAAE,CAAC,MAAM,CAAC;oBACtB,WAAW,EAAE,EAAE;oBACf,aAAa,EAAE,CAAC,OAAO,CAAC;oBACxB,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,kBAAkB;iBACtD;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;gBACrC,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC5C,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,MAAM,CAAC,YAAY,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEzC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,yDAAyD;YACzD,IAAI,KAAK,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,KAAK,GAAG,mBAAmB,CAAC;oBAC1B,EAAE,EAAE,SAAS,CAAC,EAAE;oBAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,sEAAsE;YACtE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,mDAAmD;YACnD,MAAM,YAAY,GAAG,SAAS,CAAC;YAC/B,MAAM,UAAU,GAAG,mBAAmB,CAAC;gBACrC,EAAE,EAAE,YAAY;gBAChB,SAAS,EAAE,YAAY,EAAE,2BAA2B;aACrD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,EAAE,EAAE,WAAW;gBACf,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,IAAI,GAAG,mBAAmB,CAAC;gBAC/B,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAExC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,2CAA2C;YAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;YAEvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC;gBACjC,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;gBACrC,EAAE,EAAE,YAAY;gBAChB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACxD,iCAAiC;YACjC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,6EAA6E;AAE7E,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,2BAA2B,CACzC,UAAU,EACV,SAAS,EACT,sBAAsB,CACvB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,MAAM,SAAS,GAAG,sBAAsB,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,sBAAsB,CACpC,SAAS,EACT,SAAS,EACT,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,IAAI,2BAA2B,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,4BAA4B,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,IAAI,4BAA4B,CAC1C,SAAS,EACT,2BAA2B,CAC5B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/ports/delegation.d.ts

@@ -0,0 +1,134 @@
+/**
+ * DelegationPort — delegation via → operator (Claim Algebra, S7 spec).
+ *
+ * Implements capability narrowing (R-1 invariant: child ⊆ parent),
+ * chain verification, revocation cascade, and depth limits.
+ * Ed25519 signatures, max_depth=5 V0 (configurable 1..10 Enterprise).
+ *
+ * Spec: docs/plans/PreCarre/canonical/specs/S7.md
+ */
+export interface Constraint {
+    readonly type: string;
+    readonly value: string | number | boolean;
+}
+export interface CapabilityScope {
+    readonly capabilities: ReadonlyArray<string>;
+    readonly constraints: ReadonlyArray<Constraint>;
+    readonly jurisdictions: ReadonlyArray<string>;
+    readonly expires_at: string;
+}
+export interface DelegationClaim {
+    readonly id: string;
+    readonly parent_id?: string;
+    readonly scope: CapabilityScope;
+    readonly ed25519_sig: string;
+    readonly ttl: number;
+    readonly issuer: string;
+    readonly holder: string;
+    readonly created_at: string;
+    readonly revoked_at?: string | null;
+}
+export interface RootCapability {
+    readonly capabilities: ReadonlyArray<string>;
+    readonly constraints: ReadonlyArray<Constraint>;
+    readonly jurisdictions: ReadonlyArray<string>;
+    readonly expires_at: string;
+}
+export interface VerifyChainResult {
+    readonly valid: boolean;
+    readonly chain_depth: number;
+    readonly errors: string[];
+    readonly chain: ReadonlyArray<DelegationClaim>;
+}
+export interface RevocationOpts {
+    readonly reason: string;
+    readonly cascade?: boolean;
+}
+export interface DelegationPort {
+    /**
+     * Mint a new delegation from a parent capability or root claim.
+     * Enforces R-1 narrowing: delegated scope must be ⊆ parent scope.
+     * Returns signed DelegationClaim or throws DelegationNotNarrowingError.
+     */
+    mintDelegation(parent: DelegationClaim | RootCapability, narrowed: CapabilityScope, opts?: {
+        ttl?: number;
+        issuerId?: string;
+        holderId?: string;
+    }): Promise<DelegationClaim>;
+    /**
+     * Verify a delegation claim chain from leaf to root.
+     * Checks: Ed25519 signatures, R-1 narrowing at each step,
+     * temporal frame nesting, revocation status, cycle detection, max_depth.
+     * Returns VerifyChainResult with full chain or error list.
+     */
+    verifyChain(claim: DelegationClaim): Promise<VerifyChainResult>;
+    /**
+     * Revoke a delegation claim.
+     * Propagates to all descendants (transitive revocation, ¬Revocation semantics).
+     * Returns count of claims revoked (including transitive descendants).
+     */
+    revoke(claimId: string, opts?: RevocationOpts): Promise<number>;
+    /**
+     * Get a claim by id (from persistent storage).
+     * Returns null if not found.
+     */
+    getClaim(claimId: string): Promise<DelegationClaim | null>;
+    /**
+     * Get all claims in a delegation chain from leaf to root.
+     * Follows parent_id pointers to build full chain.
+     */
+    getChain(claimId: string): Promise<DelegationClaim[]>;
+    /**
+     * Check if a claim is revoked (checks cache + on-chain, TTL 60s).
+     * Returns true if revoked, false if valid.
+     */
+    isRevoked(claimId: string): Promise<boolean>;
+    /**
+     * Get all descendant claims (transitive children).
+     * Used for revocation cascade validation.
+     */
+    getDescendants(claimId: string): Promise<DelegationClaim[]>;
+}
+export declare class DelegationNotNarrowingError extends Error {
+    readonly parentId: string;
+    readonly childId: string;
+    readonly violationType: string;
+    constructor(parentId: string, childId: string, violationType: string);
+}
+export declare class DelegationExpiredError extends Error {
+    readonly claimId: string;
+    readonly expiresAt: string;
+    constructor(claimId: string, expiresAt: string);
+}
+export declare class DelegationRevokedError extends Error {
+    readonly claimId: string;
+    readonly revokedAt: string;
+    readonly reason?: string | undefined;
+    constructor(claimId: string, revokedAt: string, reason?: string | undefined);
+}
+export declare class DelegationChainTooDeepError extends Error {
+    readonly claimId: string;
+    readonly depth: number;
+    readonly maxDepth: number;
+    constructor(claimId: string, depth: number, maxDepth: number);
+}
+export declare class DelegationSignatureInvalidError extends Error {
+    readonly claimId: string;
+    readonly reason: string;
+    constructor(claimId: string, reason: string);
+}
+export declare class DelegationCycleDetectedError extends Error {
+    readonly claimId: string;
+    readonly cycleSubject: string;
+    constructor(claimId: string, cycleSubject: string);
+}
+export declare class DelegationNotFoundError extends Error {
+    readonly claimId: string;
+    constructor(claimId: string);
+}
+export declare class DelegationTemporalFrameError extends Error {
+    readonly claimId: string;
+    readonly reason: string;
+    constructor(claimId: string, reason: string);
+}
+//# sourceMappingURL=delegation.d.ts.map

package/dist/ports/delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../src/ports/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAID,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAChD;AAID,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,cAAc,CACZ,MAAM,EAAE,eAAe,GAAG,cAAc,EACxC,QAAQ,EAAE,eAAe,EACzB,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEhE;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhE;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAE3D;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEtD;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CAC7D;AAID,qBAAa,2BAA4B,SAAQ,KAAK;aAElC,QAAQ,EAAE,MAAM;aAChB,OAAO,EAAE,MAAM;aACf,aAAa,EAAE,MAAM;gBAFrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM;CAQxC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,OAAO,EAAE,MAAM;aACf,SAAS,EAAE,MAAM;gBADjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM;CAMpC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,OAAO,EAAE,MAAM;aACf,SAAS,EAAE,MAAM;aACjB,MAAM,CAAC,EAAE,MAAM;gBAFf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,YAAA;CAUlC;AAED,qBAAa,2BAA4B,SAAQ,KAAK;aAElC,OAAO,EAAE,MAAM;aACf,KAAK,EAAE,MAAM;aACb,QAAQ,EAAE,MAAM;gBAFhB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM;CAQnC;AAED,qBAAa,+BAAgC,SAAQ,KAAK;aAC5B,OAAO,EAAE,MAAM;aAAkB,MAAM,EAAE,MAAM;gBAA/C,OAAO,EAAE,MAAM,EAAkB,MAAM,EAAE,MAAM;CAK5E;AAED,qBAAa,4BAA6B,SAAQ,KAAK;aAEnC,OAAO,EAAE,MAAM;aACf,YAAY,EAAE,MAAM;gBADpB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM;CAQvC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;aACpB,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM;CAK5C;AAED,qBAAa,4BAA6B,SAAQ,KAAK;aAEnC,OAAO,EAAE,MAAM;aACf,MAAM,EAAE,MAAM;gBADd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;CAMjC"}

package/dist/ports/delegation.js

@@ -0,0 +1,105 @@
+/**
+ * DelegationPort — delegation via → operator (Claim Algebra, S7 spec).
+ *
+ * Implements capability narrowing (R-1 invariant: child ⊆ parent),
+ * chain verification, revocation cascade, and depth limits.
+ * Ed25519 signatures, max_depth=5 V0 (configurable 1..10 Enterprise).
+ *
+ * Spec: docs/plans/PreCarre/canonical/specs/S7.md
+ */
+// ─── Typed errors ─────────────────────────────────────────────────────────────
+export class DelegationNotNarrowingError extends Error {
+    parentId;
+    childId;
+    violationType;
+    constructor(parentId, childId, violationType // "capability_expansion" | "constraint_removal" | "jurisdiction_expansion"
+    ) {
+        super(`Delegation R-1 narrowing violated (parent=${parentId}, child=${childId}): ${violationType}`);
+        this.parentId = parentId;
+        this.childId = childId;
+        this.violationType = violationType;
+        this.name = "DelegationNotNarrowingError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DelegationExpiredError extends Error {
+    claimId;
+    expiresAt;
+    constructor(claimId, expiresAt) {
+        super(`Delegation claim expired (${claimId}): expires_at=${expiresAt}`);
+        this.claimId = claimId;
+        this.expiresAt = expiresAt;
+        this.name = "DelegationExpiredError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DelegationRevokedError extends Error {
+    claimId;
+    revokedAt;
+    reason;
+    constructor(claimId, revokedAt, reason) {
+        super(`Delegation claim revoked (${claimId}) at ${revokedAt}${reason ? `: ${reason}` : ""}`);
+        this.claimId = claimId;
+        this.revokedAt = revokedAt;
+        this.reason = reason;
+        this.name = "DelegationRevokedError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DelegationChainTooDeepError extends Error {
+    claimId;
+    depth;
+    maxDepth;
+    constructor(claimId, depth, maxDepth) {
+        super(`Delegation chain exceeds max depth (${claimId}): depth=${depth}, max=${maxDepth}`);
+        this.claimId = claimId;
+        this.depth = depth;
+        this.maxDepth = maxDepth;
+        this.name = "DelegationChainTooDeepError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DelegationSignatureInvalidError extends Error {
+    claimId;
+    reason;
+    constructor(claimId, reason) {
+        super(`Delegation signature invalid (${claimId}): ${reason}`);
+        this.claimId = claimId;
+        this.reason = reason;
+        this.name = "DelegationSignatureInvalidError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DelegationCycleDetectedError extends Error {
+    claimId;
+    cycleSubject;
+    constructor(claimId, cycleSubject) {
+        super(`Delegation cycle detected (${claimId}): subject ${cycleSubject} appears in chain`);
+        this.claimId = claimId;
+        this.cycleSubject = cycleSubject;
+        this.name = "DelegationCycleDetectedError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DelegationNotFoundError extends Error {
+    claimId;
+    constructor(claimId) {
+        super(`Delegation claim not found: ${claimId}`);
+        this.claimId = claimId;
+        this.name = "DelegationNotFoundError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class DelegationTemporalFrameError extends Error {
+    claimId;
+    reason;
+    constructor(claimId, reason // "not_yet_valid" | "temporal_nesting_violated"
+    ) {
+        super(`Delegation temporal frame error (${claimId}): ${reason}`);
+        this.claimId = claimId;
+        this.reason = reason;
+        this.name = "DelegationTemporalFrameError";
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+//# sourceMappingURL=delegation.js.map

package/dist/ports/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/ports/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2GH,iFAAiF;AAEjF,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAElC;IACA;IACA;IAHlB,YACkB,QAAgB,EAChB,OAAe,EACf,aAAqB,CAAC,2EAA2E;;QAEjH,KAAK,CACH,6CAA6C,QAAQ,WAAW,OAAO,MAAM,aAAa,EAAE,CAC7F,CAAC;QANc,aAAQ,GAAR,QAAQ,CAAQ;QAChB,YAAO,GAAP,OAAO,CAAQ;QACf,kBAAa,GAAb,aAAa,CAAQ;QAKrC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B;IACA;IAFlB,YACkB,OAAe,EACf,SAAiB;QAEjC,KAAK,CAAC,6BAA6B,OAAO,iBAAiB,SAAS,EAAE,CAAC,CAAC;QAHxD,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B;IACA;IACA;IAHlB,YACkB,OAAe,EACf,SAAiB,EACjB,MAAe;QAE/B,KAAK,CACH,6BAA6B,OAAO,QAAQ,SAAS,GACnD,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAC3B,EAAE,CACH,CAAC;QARc,YAAO,GAAP,OAAO,CAAQ;QACf,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAS;QAO/B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAElC;IACA;IACA;IAHlB,YACkB,OAAe,EACf,KAAa,EACb,QAAgB;QAEhC,KAAK,CACH,uCAAuC,OAAO,YAAY,KAAK,SAAS,QAAQ,EAAE,CACnF,CAAC;QANc,YAAO,GAAP,OAAO,CAAQ;QACf,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAQ;QAKhC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC5B;IAAiC;IAA7D,YAA4B,OAAe,EAAkB,MAAc;QACzE,KAAK,CAAC,iCAAiC,OAAO,MAAM,MAAM,EAAE,CAAC,CAAC;QADpC,YAAO,GAAP,OAAO,CAAQ;QAAkB,WAAM,GAAN,MAAM,CAAQ;QAEzE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAEnC;IACA;IAFlB,YACkB,OAAe,EACf,YAAoB;QAEpC,KAAK,CACH,8BAA8B,OAAO,cAAc,YAAY,mBAAmB,CACnF,CAAC;QALc,YAAO,GAAP,OAAO,CAAQ;QACf,iBAAY,GAAZ,YAAY,CAAQ;QAKpC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,OAAe;QACzC,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;QADtB,YAAO,GAAP,OAAO,CAAQ;QAEzC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAEnC;IACA;IAFlB,YACkB,OAAe,EACf,MAAc,CAAC,gDAAgD;;QAE/E,KAAK,CAAC,oCAAoC,OAAO,MAAM,MAAM,EAAE,CAAC,CAAC;QAHjD,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/ports/event-bus.d.ts

@@ -19,6 +19,10 @@
  * ADR-ECO-017: Cross-product events MUST carry a DomainEvent signature.
  * Use DomainEvent for inter-product events and CloudEvent for intra-product.
  *
+ * OTel instrumentation: import { createTracedEventBusPort } to wrap any
+ * EventBusPort implementation with OpenTelemetry spans per publish/subscribe call.
+ * Gracefully degrades to noop spans when no OTel SDK is installed.
+ *
  * @public
  */
 export interface CloudEvent {
@@ -151,4 +155,29 @@ export interface EventBusPort {
      */
     pendingCount(stream: string, consumerGroup: string): Promise<number>;
 }
+/**
+ * Thrown when an event could not be published to Redis (connection lost,
+ * stream key conflict, or OOM on XADD). The original event is available
+ * for retry or DLQ routing.
+ */
+export declare class EventPublishError extends Error {
+    readonly cause?: unknown | undefined;
+    /** The stream key the event was targeting. */
+    readonly stream: string;
+    /** The event id (UUIDv7) that failed to publish. */
+    readonly eventId: string;
+    constructor(message: string, stream: string, eventId: string, cause?: unknown | undefined);
+}
+/**
+ * Wrap any EventBusPort implementation with OTel spans.
+ * Publishes and subscribeDomain calls each get a span with the event type
+ * and stream as attributes. Gracefully degrades to noop spans when no OTel
+ * SDK is installed.
+ *
+ * Usage:
+ *   const raw: EventBusPort = buildRedisEventBus(...);
+ *   const traced = createTracedEventBusPort(raw);
+ *   await traced.publish(event, "vault.events") // emits "event-bus.publish" span
+ */
+export declare function createTracedEventBusPort(impl: EventBusPort): EventBusPort;
 //# sourceMappingURL=event-bus.d.ts.map