@zanii/insurance 0.1.0

package/LICENSE

@@ -0,0 +1,159 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or agreed
+      to in writing, Licensor provides the Work (and each Contributor
+      provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
+      OR CONDITIONS OF ANY KIND, either express or implied, including,
+      without limitation, any warranties or conditions of TITLE,
+      NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Zanii
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,54 @@
+# @zanii/insurance
+
+Machine-verifiable underwriting for agent liability. The commercial unlock for a
+transparency ledger is an **insurable agent**: an insurer prices a policy off the
+agent's ledger history, and a claim resolves against Merkle-proven receipts instead
+of a dispute.
+
+```sh
+npm install @zanii/insurance @zanii/core @zanii/a2a-directory @zanii/payments
+```
+
+```ts
+import { riskProfile, buildPolicyBody, signPolicy, assemblePolicy, buildClaimBody, signClaim, assembleClaim, assessClaim } from '@zanii/insurance';
+
+// 1. Risk FACTS from the ledger's own un-inflatable aggregate — never a score.
+const profile = await riskProfile(agent.did, { asOf: now, delegation: certs });
+profile.facts;   // receipts, counterparties, age_days, revoked, anchored, scopes…
+profile.flags;   // ['THIN_HISTORY', 'WILDCARD_AUTHORITY', …] — named conditions, not numbers
+
+// 2. A policy insurer and holder co-sign. Money in integer minor units.
+const body = buildPolicyBody({
+  insurer: insurer.did, holder: owner.did, subject: agent.did,
+  premium: '120.00', coverageLimit: '50000.00', currency: 'USD',
+  coveredScopes: ['deploy.*', 'email.send'],
+  period: { start, end }, riskProfileHash: riskProfileHash(profile),  // pin the underwriting basis
+  createdAt: now,
+});
+const policy = assemblePolicy(body, [signPolicy(body, insurer.did, insurerKey), signPolicy(body, owner.did, ownerKey)]);
+
+// 3. A claim cites incident receipts by hash; assessment is deterministic.
+const claim = assembleClaim(claimBody, [signClaim(claimBody, owner.did, ownerKey)]);
+const a = assessClaim(claim, policy, { [receiptHash]: { receipt, sth, index, proof } });
+a.ok;        // terms verdict: holder-signed, within limit, every incident in-period + in-scope
+a.proven;    // incidents proven in the log by supplied evidence
+a.unproven;  // cited but unproven — a fact for the adjuster, not a failure
+```
+
+Python: `from zanii.insurance import build_risk_profile, verify_policy, assess_claim, ...`
+— byte-identical JCS objects and hashes.
+
+## Why facts, never a score
+
+A score Zanii invents gets gamed and creates liability — insurers price, we state
+facts and raise deterministic flags (`REVOKED`, `NOT_FULLY_ANCHORED`, `THIN_HISTORY`,
+`STALE`, `WILDCARD_AUTHORITY`). The profile derives from the same `/v1/reputation`
+aggregate AgentCV uses: counted by the log, not asserted by the agent.
+
+## The limit, stated up front
+
+**Ledger silence is unknown, not good.** An agent that never receipts its failures
+looks safer than it is — thin or stale history is flagged, not rewarded, and an
+underwriter must treat uncovered activity as unknown risk. Cryptography verifies
+attestations, not reality: a proven incident receipt shows what was recorded, not
+everything that happened.

package/dist/index.d.ts

@@ -0,0 +1,152 @@
+import { type AgentTrust, type FetchLike } from '@zanii/a2a-directory';
+import { type DelegationCert, type Receipt, type SignedTreeHead } from '@zanii/core';
+import { type Money } from '@zanii/payments';
+export declare const SILENCE_NOTE = "ledger silence is unknown, not good \u2014 an agent that never receipts failures looks safer than it is";
+export interface RiskFacts {
+    receipts: number;
+    distinct_counterparties: number;
+    /** Whole days from first receipt to `as_of`. null when there is no history. */
+    age_days: number | null;
+    /** Whole days from the last receipt to `as_of`. null when there is no history. */
+    days_since_last: number | null;
+    revoked: boolean;
+    fully_anchored: boolean;
+    /** Scopes currently delegated to the agent, when certs were supplied. */
+    scopes?: string[];
+    /** true when any supplied cert grants `*` — unbounded authority is an underwriting fact. */
+    wildcard_authority?: boolean;
+}
+export interface RiskProfile {
+    v: 1;
+    type: 'insurance.risk_profile';
+    did: string;
+    owner: string;
+    as_of: string;
+    facts: RiskFacts;
+    /** Deterministic, named conditions — never a number. */
+    flags: string[];
+    note: string;
+}
+/** Derive the profile offline from a ledger aggregate you already hold. Pure and deterministic. */
+export declare function buildRiskProfile(trust: AgentTrust, opts: {
+    asOf: string;
+    delegation?: DelegationCert[];
+}): RiskProfile;
+/** Pull the ledger's aggregate for `did` and derive the profile. Returns null if no history. */
+export declare function riskProfile(did: string, opts: {
+    asOf: string;
+    server?: string;
+    fetchImpl?: FetchLike;
+    delegation?: DelegationCert[];
+}): Promise<RiskProfile | null>;
+/** Canonical hash — pin a policy to the exact profile it was underwritten on. */
+export declare function riskProfileHash(profile: RiskProfile): string;
+export interface PolicyBody {
+    v: 1;
+    type: 'insurance.policy';
+    /** Who underwrites. */
+    insurer: string;
+    /** Who holds the policy — the agent's owner. */
+    holder: string;
+    /** The insured agent. */
+    subject: string;
+    premium: Money;
+    coverage_limit: Money;
+    /** Incidents are covered only under these scopes. */
+    covered_scopes: string[];
+    period: {
+        start: string;
+        end: string;
+    };
+    /** Hash of the `RiskProfile` this was priced on — makes the underwriting basis auditable. */
+    risk_profile_hash?: string;
+    created_at: string;
+}
+export interface PolicySignature {
+    did: string;
+    /** `ed25519:<hex>` over the canonical (JCS) bytes of the body. */
+    sig: string;
+}
+export interface Policy {
+    body: PolicyBody;
+    signatures: PolicySignature[];
+}
+export interface PolicyInput {
+    insurer: string;
+    holder: string;
+    subject: string;
+    /** Decimal strings — never floats. */
+    premium: string;
+    coverageLimit: string;
+    currency: string;
+    coveredScopes: string[];
+    period: {
+        start: string;
+        end: string;
+    };
+    riskProfileHash?: string;
+    createdAt: string;
+}
+export declare function buildPolicyBody(input: PolicyInput): PolicyBody;
+/** One party signs the policy. Collect one from the insurer and one from the holder. */
+export declare function signPolicy(body: PolicyBody, did: string, privateKey: Uint8Array): PolicySignature;
+export declare function assemblePolicy(body: PolicyBody, signatures: PolicySignature[]): Policy;
+export declare function policyHash(policy: Policy): string;
+export interface InsuranceCheck {
+    ok: boolean;
+    reasons: string[];
+}
+/** Verify the policy: structure sane, premium/limit in the same currency, BOTH insurer and holder signed. */
+export declare function verifyPolicy(policy: Policy | undefined): InsuranceCheck;
+/** One incident the claim is about — a receipt on the ledger, cited by hash. */
+export interface Incident {
+    /** JCS hash of the incident receipt. */
+    receipt: string;
+    ts: string;
+    target: string;
+}
+export interface ClaimBody {
+    v: 1;
+    type: 'insurance.claim';
+    policy_hash: string;
+    /** Must be the policy's holder. */
+    claimant: string;
+    amount: Money;
+    incidents: Incident[];
+    ts: string;
+}
+export interface Claim {
+    body: ClaimBody;
+    signatures: PolicySignature[];
+}
+export declare function buildClaimBody(policy: Policy, fields: {
+    amount: string;
+    incidents: Incident[];
+    ts: string;
+}): ClaimBody;
+export declare function signClaim(body: ClaimBody, did: string, privateKey: Uint8Array): PolicySignature;
+export declare function assembleClaim(body: ClaimBody, signatures: PolicySignature[]): Claim;
+/** Full receipt + Merkle evidence proving one cited incident is really in the log. */
+export interface IncidentEvidence {
+    receipt: Receipt;
+    sth: SignedTreeHead;
+    index: number;
+    /** Audit path, hex-encoded. */
+    proof: string[];
+}
+export interface ClaimAssessment {
+    /** Terms verdict: policy valid, claim signed by the holder, amount within limit, every incident in-period and in-scope. */
+    ok: boolean;
+    reasons: string[];
+    /** Incident receipt hashes proven in the log by supplied evidence. */
+    proven: string[];
+    /** Incident receipt hashes cited but not (or not validly) proven. Unproven is a fact, not a failure — the adjuster decides. */
+    unproven: string[];
+}
+/**
+ * Deterministic claim assessment — facts for the adjuster, not a payout decision.
+ * `evidence` maps an incident's receipt hash to the full receipt + inclusion proof;
+ * incidents without valid evidence land in `unproven`.
+ */
+export declare function assessClaim(claim: Claim | undefined, policy: Policy, evidence?: Record<string, IncidentEvidence>): ClaimAssessment;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAgB,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EASL,KAAK,cAAc,EACnB,KAAK,OAAO,EACZ,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAc,KAAK,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEzD,eAAO,MAAM,YAAY,4GAC6E,CAAC;AAEvG,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,kFAAkF;IAClF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,4FAA4F;IAC5F,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,wBAAwB,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAA;CAAE,GAAG,WAAW,CA+BtH;AAED,gGAAgG;AAChG,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAA;CAAE,GAC5F,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAI7B;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAE5D;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,kBAAkB,CAAC;IACzB,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;IACf,cAAc,EAAE,KAAK,CAAC;IACtB,qDAAqD;IACrD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAuB9D;AAgBD,wFAAwF;AACxF,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,eAAe,CAEjG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,CAEtF;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,6GAA6G;AAC7G,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CA4BvE;AAED,gFAAgF;AAChF,MAAM,WAAW,QAAQ;IACvB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,iBAAiB,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;IACd,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC5D,SAAS,CAWX;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,eAAe,CAE/F;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,KAAK,CAEnF;AAED,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,2HAA2H;IAC3H,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sEAAsE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+HAA+H;IAC/H,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAM,GAC9C,eAAe,CAmDjB"}

package/dist/index.js

@@ -0,0 +1,247 @@
+/**
+ * @zanii/insurance — machine-verifiable underwriting for agent liability.
+ *
+ * The commercial unlock for a transparency ledger is an **insurable agent**: an insurer
+ * prices a policy off the agent's ledger history, and a claim resolves against
+ * Merkle-proven receipts instead of a dispute. This package is the three artifacts that
+ * make that work:
+ *
+ * 1. **A risk profile** (`riskProfile`) — underwriting FACTS derived from the ledger's own
+ *    un-inflatable aggregate (the same `/v1/reputation` count AgentCV uses) plus the
+ *    agent's delegated authority. Deliberately **never a score**: a score Zanii invents
+ *    gets gamed and creates liability; insurers price, we state facts and raise flags.
+ * 2. **A policy** both insurer and holder co-sign — premium and coverage limit in integer
+ *    minor units, covered scopes, coverage period, optionally pinned to the exact risk
+ *    profile it was underwritten on.
+ * 3. **A claim + a deterministic assessment** (`assessClaim`) — the claim cites incident
+ *    receipts by hash; the assessment checks terms (period, scope, limit, signatures)
+ *    and, where the full receipt + inclusion proof is supplied, proves each incident is
+ *    really in the log. Facts for the adjuster, not a payout decision.
+ *
+ * ## The limit, stated up front
+ *
+ * **Ledger silence is unknown, not good.** An agent that never receipts its failures
+ * looks safer than it is — the profile flags thin or stale history instead of rewarding
+ * it, and an underwriter must treat uncovered activity as unknown risk. Cryptography
+ * verifies attestations, not reality: a proven incident receipt shows what was recorded,
+ * not everything that happened.
+ */
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import { resolveAgent } from '@zanii/a2a-directory';
+import { canonicalBytes, jcsHash, leafHash, publicKeyFromDid, scopeCovers, verifyInclusion, verifyReceipt, verifySTH, } from '@zanii/core';
+import { parseMoney } from '@zanii/payments';
+export const SILENCE_NOTE = 'ledger silence is unknown, not good — an agent that never receipts failures looks safer than it is';
+const DAY_MS = 86_400_000;
+const daysBetween = (from, to) => Math.floor((Date.parse(to) - Date.parse(from)) / DAY_MS);
+/** Derive the profile offline from a ledger aggregate you already hold. Pure and deterministic. */
+export function buildRiskProfile(trust, opts) {
+    if (Number.isNaN(Date.parse(opts.asOf)))
+        throw new Error('asOf must be an ISO timestamp');
+    const facts = {
+        receipts: trust.receipts,
+        distinct_counterparties: trust.distinct_counterparties,
+        age_days: trust.first_ts ? daysBetween(trust.first_ts, opts.asOf) : null,
+        days_since_last: trust.last_ts ? daysBetween(trust.last_ts, opts.asOf) : null,
+        revoked: trust.revoked,
+        fully_anchored: trust.fully_anchored,
+    };
+    if (opts.delegation) {
+        const scopes = [...new Set(opts.delegation.flatMap((c) => c.scopes))].sort();
+        facts.scopes = scopes;
+        facts.wildcard_authority = scopes.includes('*');
+    }
+    const flags = [];
+    if (facts.revoked)
+        flags.push('REVOKED');
+    if (!facts.fully_anchored)
+        flags.push('NOT_FULLY_ANCHORED');
+    if (facts.receipts < 50)
+        flags.push('THIN_HISTORY');
+    if (facts.days_since_last !== null && facts.days_since_last > 30)
+        flags.push('STALE');
+    if (facts.wildcard_authority)
+        flags.push('WILDCARD_AUTHORITY');
+    return {
+        v: 1,
+        type: 'insurance.risk_profile',
+        did: trust.agent_id,
+        owner: trust.owner,
+        as_of: opts.asOf,
+        facts,
+        flags,
+        note: SILENCE_NOTE,
+    };
+}
+/** Pull the ledger's aggregate for `did` and derive the profile. Returns null if no history. */
+export async function riskProfile(did, opts) {
+    const trust = await resolveAgent(did, { server: opts.server, fetchImpl: opts.fetchImpl });
+    if (!trust)
+        return null;
+    return buildRiskProfile(trust, { asOf: opts.asOf, delegation: opts.delegation });
+}
+/** Canonical hash — pin a policy to the exact profile it was underwritten on. */
+export function riskProfileHash(profile) {
+    return jcsHash(profile);
+}
+export function buildPolicyBody(input) {
+    if (!input.insurer || !input.holder || !input.subject)
+        throw new Error('insurer, holder, and subject are required');
+    if (input.insurer === input.holder)
+        throw new Error('insurer and holder must differ (no self-insurance)');
+    if (input.coveredScopes.length === 0)
+        throw new Error('covered_scopes must not be empty');
+    if (Number.isNaN(Date.parse(input.period.start)) || Number.isNaN(Date.parse(input.period.end))) {
+        throw new Error('period start/end must be ISO timestamps');
+    }
+    if (Date.parse(input.period.start) >= Date.parse(input.period.end))
+        throw new Error('period start must be before end');
+    if (Number.isNaN(Date.parse(input.createdAt)))
+        throw new Error('createdAt must be an ISO timestamp');
+    const body = {
+        v: 1,
+        type: 'insurance.policy',
+        insurer: input.insurer,
+        holder: input.holder,
+        subject: input.subject,
+        premium: parseMoney(input.premium, input.currency),
+        coverage_limit: parseMoney(input.coverageLimit, input.currency),
+        covered_scopes: [...input.coveredScopes].sort(),
+        period: input.period,
+        created_at: input.createdAt,
+    };
+    if (input.riskProfileHash !== undefined)
+        body.risk_profile_hash = input.riskProfileHash;
+    return body;
+}
+const sign = (obj, priv) => `ed25519:${bytesToHex(ed25519.sign(canonicalBytes(obj), priv))}`;
+const sigValid = (obj, did, sig) => {
+    const pub = publicKeyFromDid(did);
+    const hex = typeof sig === 'string' && sig.startsWith('ed25519:') ? sig.slice(8) : '';
+    if (!pub || !/^[0-9a-f]{128}$/.test(hex))
+        return false;
+    try {
+        return ed25519.verify(hexToBytes(hex), canonicalBytes(obj), pub);
+    }
+    catch {
+        return false;
+    }
+};
+/** One party signs the policy. Collect one from the insurer and one from the holder. */
+export function signPolicy(body, did, privateKey) {
+    return { did, sig: sign(body, privateKey) };
+}
+export function assemblePolicy(body, signatures) {
+    return { body, signatures };
+}
+export function policyHash(policy) {
+    return jcsHash(policy);
+}
+/** Verify the policy: structure sane, premium/limit in the same currency, BOTH insurer and holder signed. */
+export function verifyPolicy(policy) {
+    const reasons = [];
+    const p = policy ?? {};
+    const b = p.body ?? {};
+    if (b.v !== 1 || b.type !== 'insurance.policy')
+        reasons.push('not an insurance policy (v1)');
+    if (!b.insurer || !b.holder || !b.subject || b.insurer === b.holder)
+        reasons.push('missing/invalid parties');
+    for (const [label, m] of [['premium', b.premium], ['coverage_limit', b.coverage_limit]]) {
+        if (!m?.minor || !/^\d+$/.test(m.minor) || BigInt(m.minor) <= 0n)
+            reasons.push(`invalid ${label} (integer minor units required)`);
+    }
+    if (b.premium?.currency && b.coverage_limit?.currency && b.premium.currency !== b.coverage_limit.currency) {
+        reasons.push('premium and coverage_limit must be in the same currency');
+    }
+    if (!b.covered_scopes?.length)
+        reasons.push('covered_scopes must not be empty');
+    if (Number.isNaN(Date.parse(b.period?.start ?? '')) ||
+        Number.isNaN(Date.parse(b.period?.end ?? '')) ||
+        Date.parse(b.period?.start ?? '') >= Date.parse(b.period?.end ?? '')) {
+        reasons.push('invalid period');
+    }
+    if (reasons.length === 0) {
+        for (const [party, role] of [[b.insurer, 'insurer'], [b.holder, 'holder']]) {
+            const s = (p.signatures ?? []).find((x) => x.did === party);
+            if (!s)
+                reasons.push(`missing signature from ${role}`);
+            else if (!sigValid(b, s.did, s.sig))
+                reasons.push(`invalid signature from ${role}`);
+        }
+    }
+    return { ok: reasons.length === 0, reasons };
+}
+export function buildClaimBody(policy, fields) {
+    if (fields.incidents.length === 0)
+        throw new Error('a claim must cite at least one incident receipt');
+    return {
+        v: 1,
+        type: 'insurance.claim',
+        policy_hash: policyHash(policy),
+        claimant: policy.body.holder,
+        amount: parseMoney(fields.amount, policy.body.coverage_limit.currency),
+        incidents: fields.incidents,
+        ts: fields.ts,
+    };
+}
+export function signClaim(body, did, privateKey) {
+    return { did, sig: sign(body, privateKey) };
+}
+export function assembleClaim(body, signatures) {
+    return { body, signatures };
+}
+/**
+ * Deterministic claim assessment — facts for the adjuster, not a payout decision.
+ * `evidence` maps an incident's receipt hash to the full receipt + inclusion proof;
+ * incidents without valid evidence land in `unproven`.
+ */
+export function assessClaim(claim, policy, evidence = {}) {
+    const pol = verifyPolicy(policy);
+    if (!pol.ok)
+        return { ok: false, reasons: pol.reasons.map((r) => `policy: ${r}`), proven: [], unproven: [] };
+    const reasons = [];
+    const c = claim ?? {};
+    const b = c.body ?? {};
+    const pb = policy.body;
+    if (b.v !== 1 || b.type !== 'insurance.claim')
+        reasons.push('not an insurance claim (v1)');
+    if (b.policy_hash !== policyHash(policy))
+        reasons.push('claim references a different policy');
+    if (b.claimant !== pb.holder)
+        reasons.push('claimant is not the policy holder');
+    const holderSig = (c.signatures ?? []).find((s) => s.did === pb.holder);
+    if (!holderSig || !sigValid(b, holderSig.did, holderSig.sig)) {
+        reasons.push('claim is not signed by the policy holder');
+    }
+    if (!b.amount?.minor || b.amount.currency !== pb.coverage_limit.currency) {
+        reasons.push('claim amount must be in the policy currency');
+    }
+    else if (BigInt(b.amount.minor) > BigInt(pb.coverage_limit.minor)) {
+        reasons.push(`claim ${b.amount.display} exceeds the coverage limit ${pb.coverage_limit.display}`);
+    }
+    const incidents = b.incidents ?? [];
+    if (incidents.length === 0)
+        reasons.push('claim cites no incidents');
+    for (const [i, inc] of incidents.entries()) {
+        const its = Date.parse(inc.ts);
+        if (Number.isNaN(its) || its < Date.parse(pb.period.start) || its > Date.parse(pb.period.end)) {
+            reasons.push(`incident #${i} at ${inc.ts} is outside the coverage period`);
+        }
+        if (!pb.covered_scopes.some((s) => scopeCovers(s, inc.target))) {
+            reasons.push(`incident #${i} target '${inc.target}' is not within the covered scopes`);
+        }
+    }
+    const proven = [];
+    const unproven = [];
+    for (const inc of incidents) {
+        const ev = evidence[inc.receipt];
+        let good = false;
+        if (ev && jcsHash(ev.receipt) === inc.receipt && verifyReceipt(ev.receipt).ok && verifySTH(ev.sth)) {
+            const root = hexToBytes(ev.sth.root.replace('sha256:', ''));
+            good = verifyInclusion(leafHash(canonicalBytes(ev.receipt)), ev.index, ev.sth.size, ev.proof.map((h) => hexToBytes(h)), root);
+        }
+        (good ? proven : unproven).push(inc.receipt);
+    }
+    return { ok: reasons.length === 0, reasons, proven, unproven };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAmC,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,cAAc,EACd,OAAO,EACP,QAAQ,EACR,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,aAAa,EACb,SAAS,GAIV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAEzD,MAAM,CAAC,MAAM,YAAY,GACvB,oGAAoG,CAAC;AA6BvG,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAU,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAEnH,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,KAAiB,EAAE,IAAqD;IACvG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAc;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACxE,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC7E,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,QAAQ,GAAG,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,GAAG,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,kBAAkB;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,wBAAwB;QAC9B,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,IAAI,CAAC,IAAI;QAChB,KAAK;QACL,KAAK;QACL,IAAI,EAAE,YAAY;KACnB,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,IAA6F;IAE7F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,OAAO,OAAO,CAAC,OAA6C,CAAC,CAAC;AAChE,CAAC;AA8CD,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpH,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC1G,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrG,MAAM,IAAI,GAAe;QACvB,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;QAClD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC/D,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC;IACF,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,eAAe,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAA4B,EAAE,IAAgB,EAAU,EAAE,CACtE,WAAW,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;AAEnE,MAAM,QAAQ,GAAG,CAAC,GAA4B,EAAE,GAAW,EAAE,GAAY,EAAW,EAAE;IACpF,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,IAAgB,EAAE,GAAW,EAAE,UAAsB;IAC9E,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAA0C,EAAE,UAAU,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,UAA6B;IAC5E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,OAAO,CAAC,MAA4C,CAAC,CAAC;AAC/D,CAAC;AAOD,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,IAAK,EAAa,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAK,EAAiB,CAAC;IACvC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC7F,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC7G,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAU,EAAE,CAAC;QACjG,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,iCAAiC,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC1G,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAChF,IACE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,EACpE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAU,EAAE,CAAC;YACpF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;iBAClD,IAAI,CAAC,QAAQ,CAAC,CAAuC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AA0BD,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,MAA6D;IAE7D,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACtG,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC;QAC/B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;QAC5B,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,GAAW,EAAE,UAAsB;IAC5E,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAA0C,EAAE,UAAU,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,UAA6B;IAC1E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAqBD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,KAAwB,EACxB,MAAc,EACd,WAA6C,EAAE;IAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7G,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,KAAK,IAAK,EAAY,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAK,EAAgB,CAAC;IACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAEvB,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,CAAuC,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,+BAA+B,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;IACpC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,GAAG,CAAC,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,GAAG,CAAC,MAAM,oCAAoC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,EAAE,IAAI,OAAO,CAAC,EAAE,CAAC,OAA6C,CAAC,KAAK,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACzI,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,GAAG,eAAe,CACpB,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,OAA6C,CAAC,CAAC,EAC1E,EAAE,CAAC,KAAK,EACR,EAAE,CAAC,GAAG,CAAC,IAAI,EACX,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAClC,IAAI,CACL,CAAC;QACJ,CAAC;QACD,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@zanii/insurance",
+  "version": "0.1.0",
+  "description": "Machine-verifiable underwriting for agent liability - risk FACTS from the ledger's own un-inflatable aggregate (never a score), a co-signed policy, and claims that resolve against Merkle-proven receipts instead of disputes. Zanii states facts; insurers price. Ledger silence is unknown, not good.",
+  "license": "Apache-2.0",
+  "homepage": "https://ledger.zanii.agency",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.9"
+  },
+  "dependencies": {
+    "@noble/curves": "^1.8.1",
+    "@noble/hashes": "^1.7.1",
+    "@zanii/core": "0.4.0",
+    "@zanii/a2a-directory": "0.1.0",
+    "@zanii/payments": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/index.ts

@@ -0,0 +1,388 @@
+/**
+ * @zanii/insurance — machine-verifiable underwriting for agent liability.
+ *
+ * The commercial unlock for a transparency ledger is an **insurable agent**: an insurer
+ * prices a policy off the agent's ledger history, and a claim resolves against
+ * Merkle-proven receipts instead of a dispute. This package is the three artifacts that
+ * make that work:
+ *
+ * 1. **A risk profile** (`riskProfile`) — underwriting FACTS derived from the ledger's own
+ *    un-inflatable aggregate (the same `/v1/reputation` count AgentCV uses) plus the
+ *    agent's delegated authority. Deliberately **never a score**: a score Zanii invents
+ *    gets gamed and creates liability; insurers price, we state facts and raise flags.
+ * 2. **A policy** both insurer and holder co-sign — premium and coverage limit in integer
+ *    minor units, covered scopes, coverage period, optionally pinned to the exact risk
+ *    profile it was underwritten on.
+ * 3. **A claim + a deterministic assessment** (`assessClaim`) — the claim cites incident
+ *    receipts by hash; the assessment checks terms (period, scope, limit, signatures)
+ *    and, where the full receipt + inclusion proof is supplied, proves each incident is
+ *    really in the log. Facts for the adjuster, not a payout decision.
+ *
+ * ## The limit, stated up front
+ *
+ * **Ledger silence is unknown, not good.** An agent that never receipts its failures
+ * looks safer than it is — the profile flags thin or stale history instead of rewarding
+ * it, and an underwriter must treat uncovered activity as unknown risk. Cryptography
+ * verifies attestations, not reality: a proven incident receipt shows what was recorded,
+ * not everything that happened.
+ */
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import { resolveAgent, type AgentTrust, type FetchLike } from '@zanii/a2a-directory';
+import {
+  canonicalBytes,
+  jcsHash,
+  leafHash,
+  publicKeyFromDid,
+  scopeCovers,
+  verifyInclusion,
+  verifyReceipt,
+  verifySTH,
+  type DelegationCert,
+  type Receipt,
+  type SignedTreeHead,
+} from '@zanii/core';
+import { parseMoney, type Money } from '@zanii/payments';
+
+export const SILENCE_NOTE =
+  'ledger silence is unknown, not good — an agent that never receipts failures looks safer than it is';
+
+export interface RiskFacts {
+  receipts: number;
+  distinct_counterparties: number;
+  /** Whole days from first receipt to `as_of`. null when there is no history. */
+  age_days: number | null;
+  /** Whole days from the last receipt to `as_of`. null when there is no history. */
+  days_since_last: number | null;
+  revoked: boolean;
+  fully_anchored: boolean;
+  /** Scopes currently delegated to the agent, when certs were supplied. */
+  scopes?: string[];
+  /** true when any supplied cert grants `*` — unbounded authority is an underwriting fact. */
+  wildcard_authority?: boolean;
+}
+
+export interface RiskProfile {
+  v: 1;
+  type: 'insurance.risk_profile';
+  did: string;
+  owner: string;
+  as_of: string;
+  facts: RiskFacts;
+  /** Deterministic, named conditions — never a number. */
+  flags: string[];
+  note: string;
+}
+
+const DAY_MS = 86_400_000;
+const daysBetween = (from: string, to: string): number => Math.floor((Date.parse(to) - Date.parse(from)) / DAY_MS);
+
+/** Derive the profile offline from a ledger aggregate you already hold. Pure and deterministic. */
+export function buildRiskProfile(trust: AgentTrust, opts: { asOf: string; delegation?: DelegationCert[] }): RiskProfile {
+  if (Number.isNaN(Date.parse(opts.asOf))) throw new Error('asOf must be an ISO timestamp');
+  const facts: RiskFacts = {
+    receipts: trust.receipts,
+    distinct_counterparties: trust.distinct_counterparties,
+    age_days: trust.first_ts ? daysBetween(trust.first_ts, opts.asOf) : null,
+    days_since_last: trust.last_ts ? daysBetween(trust.last_ts, opts.asOf) : null,
+    revoked: trust.revoked,
+    fully_anchored: trust.fully_anchored,
+  };
+  if (opts.delegation) {
+    const scopes = [...new Set(opts.delegation.flatMap((c) => c.scopes))].sort();
+    facts.scopes = scopes;
+    facts.wildcard_authority = scopes.includes('*');
+  }
+  const flags: string[] = [];
+  if (facts.revoked) flags.push('REVOKED');
+  if (!facts.fully_anchored) flags.push('NOT_FULLY_ANCHORED');
+  if (facts.receipts < 50) flags.push('THIN_HISTORY');
+  if (facts.days_since_last !== null && facts.days_since_last > 30) flags.push('STALE');
+  if (facts.wildcard_authority) flags.push('WILDCARD_AUTHORITY');
+  return {
+    v: 1,
+    type: 'insurance.risk_profile',
+    did: trust.agent_id,
+    owner: trust.owner,
+    as_of: opts.asOf,
+    facts,
+    flags,
+    note: SILENCE_NOTE,
+  };
+}
+
+/** Pull the ledger's aggregate for `did` and derive the profile. Returns null if no history. */
+export async function riskProfile(
+  did: string,
+  opts: { asOf: string; server?: string; fetchImpl?: FetchLike; delegation?: DelegationCert[] },
+): Promise<RiskProfile | null> {
+  const trust = await resolveAgent(did, { server: opts.server, fetchImpl: opts.fetchImpl });
+  if (!trust) return null;
+  return buildRiskProfile(trust, { asOf: opts.asOf, delegation: opts.delegation });
+}
+
+/** Canonical hash — pin a policy to the exact profile it was underwritten on. */
+export function riskProfileHash(profile: RiskProfile): string {
+  return jcsHash(profile as unknown as Record<string, unknown>);
+}
+
+export interface PolicyBody {
+  v: 1;
+  type: 'insurance.policy';
+  /** Who underwrites. */
+  insurer: string;
+  /** Who holds the policy — the agent's owner. */
+  holder: string;
+  /** The insured agent. */
+  subject: string;
+  premium: Money;
+  coverage_limit: Money;
+  /** Incidents are covered only under these scopes. */
+  covered_scopes: string[];
+  period: { start: string; end: string };
+  /** Hash of the `RiskProfile` this was priced on — makes the underwriting basis auditable. */
+  risk_profile_hash?: string;
+  created_at: string;
+}
+
+export interface PolicySignature {
+  did: string;
+  /** `ed25519:<hex>` over the canonical (JCS) bytes of the body. */
+  sig: string;
+}
+
+export interface Policy {
+  body: PolicyBody;
+  signatures: PolicySignature[];
+}
+
+export interface PolicyInput {
+  insurer: string;
+  holder: string;
+  subject: string;
+  /** Decimal strings — never floats. */
+  premium: string;
+  coverageLimit: string;
+  currency: string;
+  coveredScopes: string[];
+  period: { start: string; end: string };
+  riskProfileHash?: string;
+  createdAt: string;
+}
+
+export function buildPolicyBody(input: PolicyInput): PolicyBody {
+  if (!input.insurer || !input.holder || !input.subject) throw new Error('insurer, holder, and subject are required');
+  if (input.insurer === input.holder) throw new Error('insurer and holder must differ (no self-insurance)');
+  if (input.coveredScopes.length === 0) throw new Error('covered_scopes must not be empty');
+  if (Number.isNaN(Date.parse(input.period.start)) || Number.isNaN(Date.parse(input.period.end))) {
+    throw new Error('period start/end must be ISO timestamps');
+  }
+  if (Date.parse(input.period.start) >= Date.parse(input.period.end)) throw new Error('period start must be before end');
+  if (Number.isNaN(Date.parse(input.createdAt))) throw new Error('createdAt must be an ISO timestamp');
+  const body: PolicyBody = {
+    v: 1,
+    type: 'insurance.policy',
+    insurer: input.insurer,
+    holder: input.holder,
+    subject: input.subject,
+    premium: parseMoney(input.premium, input.currency),
+    coverage_limit: parseMoney(input.coverageLimit, input.currency),
+    covered_scopes: [...input.coveredScopes].sort(),
+    period: input.period,
+    created_at: input.createdAt,
+  };
+  if (input.riskProfileHash !== undefined) body.risk_profile_hash = input.riskProfileHash;
+  return body;
+}
+
+const sign = (obj: Record<string, unknown>, priv: Uint8Array): string =>
+  `ed25519:${bytesToHex(ed25519.sign(canonicalBytes(obj), priv))}`;
+
+const sigValid = (obj: Record<string, unknown>, did: string, sig: unknown): boolean => {
+  const pub = publicKeyFromDid(did);
+  const hex = typeof sig === 'string' && sig.startsWith('ed25519:') ? sig.slice(8) : '';
+  if (!pub || !/^[0-9a-f]{128}$/.test(hex)) return false;
+  try {
+    return ed25519.verify(hexToBytes(hex), canonicalBytes(obj), pub);
+  } catch {
+    return false;
+  }
+};
+
+/** One party signs the policy. Collect one from the insurer and one from the holder. */
+export function signPolicy(body: PolicyBody, did: string, privateKey: Uint8Array): PolicySignature {
+  return { did, sig: sign(body as unknown as Record<string, unknown>, privateKey) };
+}
+
+export function assemblePolicy(body: PolicyBody, signatures: PolicySignature[]): Policy {
+  return { body, signatures };
+}
+
+export function policyHash(policy: Policy): string {
+  return jcsHash(policy as unknown as Record<string, unknown>);
+}
+
+export interface InsuranceCheck {
+  ok: boolean;
+  reasons: string[];
+}
+
+/** Verify the policy: structure sane, premium/limit in the same currency, BOTH insurer and holder signed. */
+export function verifyPolicy(policy: Policy | undefined): InsuranceCheck {
+  const reasons: string[] = [];
+  const p = policy ?? ({} as Policy);
+  const b = p.body ?? ({} as PolicyBody);
+  if (b.v !== 1 || b.type !== 'insurance.policy') reasons.push('not an insurance policy (v1)');
+  if (!b.insurer || !b.holder || !b.subject || b.insurer === b.holder) reasons.push('missing/invalid parties');
+  for (const [label, m] of [['premium', b.premium], ['coverage_limit', b.coverage_limit]] as const) {
+    if (!m?.minor || !/^\d+$/.test(m.minor) || BigInt(m.minor) <= 0n) reasons.push(`invalid ${label} (integer minor units required)`);
+  }
+  if (b.premium?.currency && b.coverage_limit?.currency && b.premium.currency !== b.coverage_limit.currency) {
+    reasons.push('premium and coverage_limit must be in the same currency');
+  }
+  if (!b.covered_scopes?.length) reasons.push('covered_scopes must not be empty');
+  if (
+    Number.isNaN(Date.parse(b.period?.start ?? '')) ||
+    Number.isNaN(Date.parse(b.period?.end ?? '')) ||
+    Date.parse(b.period?.start ?? '') >= Date.parse(b.period?.end ?? '')
+  ) {
+    reasons.push('invalid period');
+  }
+  if (reasons.length === 0) {
+    for (const [party, role] of [[b.insurer, 'insurer'], [b.holder, 'holder']] as const) {
+      const s = (p.signatures ?? []).find((x) => x.did === party);
+      if (!s) reasons.push(`missing signature from ${role}`);
+      else if (!sigValid(b as unknown as Record<string, unknown>, s.did, s.sig)) reasons.push(`invalid signature from ${role}`);
+    }
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+
+/** One incident the claim is about — a receipt on the ledger, cited by hash. */
+export interface Incident {
+  /** JCS hash of the incident receipt. */
+  receipt: string;
+  ts: string;
+  target: string;
+}
+
+export interface ClaimBody {
+  v: 1;
+  type: 'insurance.claim';
+  policy_hash: string;
+  /** Must be the policy's holder. */
+  claimant: string;
+  amount: Money;
+  incidents: Incident[];
+  ts: string;
+}
+
+export interface Claim {
+  body: ClaimBody;
+  signatures: PolicySignature[];
+}
+
+export function buildClaimBody(
+  policy: Policy,
+  fields: { amount: string; incidents: Incident[]; ts: string },
+): ClaimBody {
+  if (fields.incidents.length === 0) throw new Error('a claim must cite at least one incident receipt');
+  return {
+    v: 1,
+    type: 'insurance.claim',
+    policy_hash: policyHash(policy),
+    claimant: policy.body.holder,
+    amount: parseMoney(fields.amount, policy.body.coverage_limit.currency),
+    incidents: fields.incidents,
+    ts: fields.ts,
+  };
+}
+
+export function signClaim(body: ClaimBody, did: string, privateKey: Uint8Array): PolicySignature {
+  return { did, sig: sign(body as unknown as Record<string, unknown>, privateKey) };
+}
+
+export function assembleClaim(body: ClaimBody, signatures: PolicySignature[]): Claim {
+  return { body, signatures };
+}
+
+/** Full receipt + Merkle evidence proving one cited incident is really in the log. */
+export interface IncidentEvidence {
+  receipt: Receipt;
+  sth: SignedTreeHead;
+  index: number;
+  /** Audit path, hex-encoded. */
+  proof: string[];
+}
+
+export interface ClaimAssessment {
+  /** Terms verdict: policy valid, claim signed by the holder, amount within limit, every incident in-period and in-scope. */
+  ok: boolean;
+  reasons: string[];
+  /** Incident receipt hashes proven in the log by supplied evidence. */
+  proven: string[];
+  /** Incident receipt hashes cited but not (or not validly) proven. Unproven is a fact, not a failure — the adjuster decides. */
+  unproven: string[];
+}
+
+/**
+ * Deterministic claim assessment — facts for the adjuster, not a payout decision.
+ * `evidence` maps an incident's receipt hash to the full receipt + inclusion proof;
+ * incidents without valid evidence land in `unproven`.
+ */
+export function assessClaim(
+  claim: Claim | undefined,
+  policy: Policy,
+  evidence: Record<string, IncidentEvidence> = {},
+): ClaimAssessment {
+  const pol = verifyPolicy(policy);
+  if (!pol.ok) return { ok: false, reasons: pol.reasons.map((r) => `policy: ${r}`), proven: [], unproven: [] };
+  const reasons: string[] = [];
+  const c = claim ?? ({} as Claim);
+  const b = c.body ?? ({} as ClaimBody);
+  const pb = policy.body;
+
+  if (b.v !== 1 || b.type !== 'insurance.claim') reasons.push('not an insurance claim (v1)');
+  if (b.policy_hash !== policyHash(policy)) reasons.push('claim references a different policy');
+  if (b.claimant !== pb.holder) reasons.push('claimant is not the policy holder');
+  const holderSig = (c.signatures ?? []).find((s) => s.did === pb.holder);
+  if (!holderSig || !sigValid(b as unknown as Record<string, unknown>, holderSig.did, holderSig.sig)) {
+    reasons.push('claim is not signed by the policy holder');
+  }
+  if (!b.amount?.minor || b.amount.currency !== pb.coverage_limit.currency) {
+    reasons.push('claim amount must be in the policy currency');
+  } else if (BigInt(b.amount.minor) > BigInt(pb.coverage_limit.minor)) {
+    reasons.push(`claim ${b.amount.display} exceeds the coverage limit ${pb.coverage_limit.display}`);
+  }
+  const incidents = b.incidents ?? [];
+  if (incidents.length === 0) reasons.push('claim cites no incidents');
+  for (const [i, inc] of incidents.entries()) {
+    const its = Date.parse(inc.ts);
+    if (Number.isNaN(its) || its < Date.parse(pb.period.start) || its > Date.parse(pb.period.end)) {
+      reasons.push(`incident #${i} at ${inc.ts} is outside the coverage period`);
+    }
+    if (!pb.covered_scopes.some((s) => scopeCovers(s, inc.target))) {
+      reasons.push(`incident #${i} target '${inc.target}' is not within the covered scopes`);
+    }
+  }
+
+  const proven: string[] = [];
+  const unproven: string[] = [];
+  for (const inc of incidents) {
+    const ev = evidence[inc.receipt];
+    let good = false;
+    if (ev && jcsHash(ev.receipt as unknown as Record<string, unknown>) === inc.receipt && verifyReceipt(ev.receipt).ok && verifySTH(ev.sth)) {
+      const root = hexToBytes(ev.sth.root.replace('sha256:', ''));
+      good = verifyInclusion(
+        leafHash(canonicalBytes(ev.receipt as unknown as Record<string, unknown>)),
+        ev.index,
+        ev.sth.size,
+        ev.proof.map((h) => hexToBytes(h)),
+        root,
+      );
+    }
+    (good ? proven : unproven).push(inc.receipt);
+  }
+
+  return { ok: reasons.length === 0, reasons, proven, unproven };
+}