agent-passport-system 1.1.0

package/dist/src/core/canonical.js

@@ -0,0 +1,23 @@
+// Canonical JSON — deterministic serialization for signing
+// Sorts keys alphabetically, omits null/undefined values
+export function canonicalize(obj) {
+    if (obj === null || obj === undefined)
+        return '';
+    if (typeof obj !== 'object')
+        return JSON.stringify(obj);
+    if (Array.isArray(obj)) {
+        return '[' + obj.map(item => canonicalize(item)).join(',') + ']';
+    }
+    const sorted = Object.keys(obj)
+        .sort()
+        .filter(key => {
+        const val = obj[key];
+        return val !== null && val !== undefined;
+    })
+        .map(key => {
+        const val = obj[key];
+        return `${JSON.stringify(key)}:${canonicalize(val)}`;
+    });
+    return '{' + sorted.join(',') + '}';
+}
+//# sourceMappingURL=canonical.js.map

package/dist/src/core/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/core/canonical.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,yDAAyD;AAEzD,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC;SACvD,IAAI,EAAE;SACN,MAAM,CAAC,GAAG,CAAC,EAAE;QACZ,MAAM,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAA;QACjD,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAA;IAC1C,CAAC,CAAC;SACD,GAAG,CAAC,GAAG,CAAC,EAAE;QACT,MAAM,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAA;QACjD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAA;IACtD,CAAC,CAAC,CAAA;IACJ,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;AACrC,CAAC"}

package/dist/src/core/delegation.d.ts

@@ -0,0 +1,41 @@
+import type { Delegation, ActionReceipt, RevocationRecord, DelegationStatus } from '../types/passport.js';
+export interface CreateDelegationOptions {
+    delegatedTo: string;
+    delegatedBy: string;
+    scope: string[];
+    spendLimit?: number;
+    maxDepth?: number;
+    currentDepth?: number;
+    expiresInHours?: number;
+    privateKey: string;
+}
+export declare function createDelegation(opts: CreateDelegationOptions): Delegation;
+export interface SubDelegateOptions {
+    parentDelegation: Delegation;
+    delegatedTo: string;
+    scope: string[];
+    spendLimit?: number;
+    privateKey: string;
+}
+export declare function subDelegate(opts: SubDelegateOptions): Delegation;
+export declare function verifyDelegation(delegation: Delegation): DelegationStatus;
+export declare function revokeDelegation(delegationId: string, revokedBy: string, reason: string, privateKey: string): RevocationRecord;
+export declare function verifyRevocation(revocation: RevocationRecord): boolean;
+export interface CreateReceiptOptions {
+    agentId: string;
+    delegationId: string;
+    delegation: Delegation;
+    action: ActionReceipt['action'];
+    result: ActionReceipt['result'];
+    delegationChain: string[];
+    privateKey: string;
+}
+export declare function createReceipt(opts: CreateReceiptOptions): ActionReceipt;
+export declare function verifyReceipt(receipt: ActionReceipt, agentPublicKey: string): {
+    valid: boolean;
+    errors: string[];
+};
+export declare function getReceipts(agentId?: string): ActionReceipt[];
+export declare function getRevocation(delegationId: string): RevocationRecord | undefined;
+export declare function clearStores(): void;
+//# sourceMappingURL=delegation.d.ts.map

package/dist/src/core/delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../../src/core/delegation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAC9D,MAAM,sBAAsB,CAAA;AAY7B,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,UAAU,CAsB1E;AAMD,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,UAAU,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAqChE;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,gBAAgB,CA+BzE;AAMD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,gBAAgB,CAgBlB;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAItE;AAMD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,aAAa,CA4CvE;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,cAAc,EAAE,MAAM,GACrB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWtC;AAGD,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CAG7D;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAEhF;AAED,wBAAgB,WAAW,IAAI,IAAI,CAGlC"}

package/dist/src/core/delegation.js

@@ -0,0 +1,173 @@
+// Delegation System — create, verify, revoke, and enforce depth limits
+// v1.1: Action Receipts + Revocation + Depth Limits
+import { v4 as uuidv4 } from 'uuid';
+import { sign, verify } from '../crypto/keys.js';
+import { canonicalize } from '../core/canonical.js';
+// In-memory revocation registry (in production, this would be persistent)
+const revocationRegistry = new Map();
+// In-memory receipt store
+const receiptStore = [];
+export function createDelegation(opts) {
+    const now = new Date();
+    const expiry = new Date(now);
+    expiry.setHours(expiry.getHours() + (opts.expiresInHours || 24));
+    const delegation = {
+        delegationId: 'del_' + uuidv4().slice(0, 12),
+        delegatedTo: opts.delegatedTo,
+        delegatedBy: opts.delegatedBy,
+        scope: opts.scope,
+        expiresAt: expiry.toISOString(),
+        spendLimit: opts.spendLimit,
+        spentAmount: 0,
+        maxDepth: opts.maxDepth ?? 1,
+        currentDepth: opts.currentDepth ?? 0,
+        createdAt: now.toISOString()
+    };
+    const canonical = canonicalize(delegation);
+    const signature = sign(canonical, opts.privateKey);
+    return { ...delegation, signature };
+}
+export function subDelegate(opts) {
+    const parent = opts.parentDelegation;
+    // Enforce depth limit — new delegation would be at parent.currentDepth + 1
+    const newDepth = parent.currentDepth + 1;
+    if (newDepth > parent.maxDepth) {
+        throw new Error(`Depth limit exceeded: would be depth ${newDepth}, max allowed is ${parent.maxDepth}`);
+    }
+    // Enforce scope narrowing
+    const invalidScopes = opts.scope.filter(s => !parent.scope.includes(s));
+    if (invalidScopes.length > 0) {
+        throw new Error(`Scope violation: [${invalidScopes}] not in parent scope [${parent.scope}]`);
+    }
+    // Enforce spend limit
+    const parentRemaining = (parent.spendLimit || Infinity) - (parent.spentAmount || 0);
+    if (opts.spendLimit && opts.spendLimit > parentRemaining) {
+        throw new Error(`Spend limit ${opts.spendLimit} exceeds parent remaining ${parentRemaining}`);
+    }
+    return createDelegation({
+        delegatedTo: opts.delegatedTo,
+        delegatedBy: parent.delegatedTo, // the current delegate becomes delegator
+        scope: opts.scope,
+        spendLimit: opts.spendLimit || parentRemaining,
+        maxDepth: parent.maxDepth,
+        currentDepth: parent.currentDepth + 1,
+        expiresInHours: 24,
+        privateKey: opts.privateKey
+    });
+}
+// ══════════════════════════════════════
+// DELEGATION VERIFICATION
+// ══════════════════════════════════════
+export function verifyDelegation(delegation) {
+    const errors = [];
+    // Check signature
+    const { signature, ...unsigned } = delegation;
+    const canonical = canonicalize(unsigned);
+    const sigValid = verify(canonical, signature, delegation.delegatedBy);
+    if (!sigValid)
+        errors.push('Invalid delegation signature');
+    // Check expiry
+    const expired = new Date(delegation.expiresAt) < new Date();
+    if (expired)
+        errors.push('Delegation expired');
+    // Check revocation
+    const revocation = revocationRegistry.get(delegation.delegationId);
+    const revoked = !!revocation;
+    if (revoked)
+        errors.push(`Revoked at ${revocation.revokedAt}: ${revocation.reason}`);
+    // Check depth
+    const depthExceeded = delegation.currentDepth > delegation.maxDepth;
+    if (depthExceeded)
+        errors.push('Depth limit exceeded');
+    return {
+        valid: errors.length === 0,
+        revoked,
+        expired,
+        depthExceeded,
+        revokedAt: revocation?.revokedAt,
+        errors
+    };
+}
+// ══════════════════════════════════════
+// REVOCATION
+// ══════════════════════════════════════
+export function revokeDelegation(delegationId, revokedBy, reason, privateKey) {
+    const record = {
+        revocationId: 'rev_' + uuidv4().slice(0, 12),
+        delegationId,
+        revokedBy,
+        revokedAt: new Date().toISOString(),
+        reason
+    };
+    const canonical = canonicalize(record);
+    const signature = sign(canonical, privateKey);
+    const revocation = { ...record, signature };
+    // Store in registry
+    revocationRegistry.set(delegationId, revocation);
+    return revocation;
+}
+export function verifyRevocation(revocation) {
+    const { signature, ...unsigned } = revocation;
+    const canonical = canonicalize(unsigned);
+    return verify(canonical, signature, revocation.revokedBy);
+}
+export function createReceipt(opts) {
+    // Verify delegation is still valid
+    const status = verifyDelegation(opts.delegation);
+    if (!status.valid) {
+        throw new Error(`Cannot create receipt: delegation invalid — ${status.errors.join(', ')}`);
+    }
+    // Verify scope
+    if (!opts.delegation.scope.includes(opts.action.scopeUsed)) {
+        throw new Error(`Scope '${opts.action.scopeUsed}' not in delegation [${opts.delegation.scope}]`);
+    }
+    // Verify spend
+    if (opts.action.spend) {
+        const remaining = (opts.delegation.spendLimit || Infinity) -
+            (opts.delegation.spentAmount || 0);
+        if (opts.action.spend.amount > remaining) {
+            throw new Error(`Spend ${opts.action.spend.amount} exceeds remaining ${remaining}`);
+        }
+    }
+    const receipt = {
+        receiptId: 'rcpt_' + uuidv4().slice(0, 12),
+        version: '1.1',
+        timestamp: new Date().toISOString(),
+        agentId: opts.agentId,
+        delegationId: opts.delegationId,
+        action: opts.action,
+        result: opts.result,
+        delegationChain: opts.delegationChain
+    };
+    const canonical = canonicalize(receipt);
+    const signature = sign(canonical, opts.privateKey);
+    const signedReceipt = { ...receipt, signature };
+    // Store receipt
+    receiptStore.push(signedReceipt);
+    return signedReceipt;
+}
+export function verifyReceipt(receipt, agentPublicKey) {
+    const errors = [];
+    const { signature, ...unsigned } = receipt;
+    const canonical = canonicalize(unsigned);
+    const sigValid = verify(canonical, signature, agentPublicKey);
+    if (!sigValid)
+        errors.push('Invalid receipt signature');
+    if (receipt.version !== '1.1')
+        errors.push('Unsupported receipt version');
+    return { valid: errors.length === 0, errors };
+}
+// Getters
+export function getReceipts(agentId) {
+    if (agentId)
+        return receiptStore.filter(r => r.agentId === agentId);
+    return [...receiptStore];
+}
+export function getRevocation(delegationId) {
+    return revocationRegistry.get(delegationId);
+}
+export function clearStores() {
+    revocationRegistry.clear();
+    receiptStore.length = 0;
+}
+//# sourceMappingURL=delegation.js.map

package/dist/src/core/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../../src/core/delegation.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,oDAAoD;AAEpD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKnD,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA4B,CAAA;AAE9D,0BAA0B;AAC1B,MAAM,YAAY,GAAoB,EAAE,CAAA;AAiBxC,MAAM,UAAU,gBAAgB,CAAC,IAA6B;IAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAA;IAEhE,MAAM,UAAU,GAAkC;QAChD,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE;QAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;QAC5B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC;QACpC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAA;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAElD,OAAO,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAA;AACrC,CAAC;AAcD,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;IAEpC,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;IACxC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CACtF,CAAA;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACvE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,0BAA0B,MAAM,CAAC,KAAK,GAAG,CAC5E,CAAA;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,CAAA;IACnF,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,UAAU,6BAA6B,eAAe,EAAE,CAC7E,CAAA;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,yCAAyC;QAC1E,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,eAAe;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY,GAAG,CAAC;QACrC,cAAc,EAAE,EAAE;QAClB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED,yCAAyC;AACzC,0BAA0B;AAC1B,yCAAyC;AAEzC,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,kBAAkB;IAClB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAA;IAC7C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;IACrE,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAE1D,eAAe;IACf,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAA;IAC3D,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAE9C,mBAAmB;IACnB,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAA;IAE5B,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,cAAc,UAAW,CAAC,SAAS,KAAK,UAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IAEtF,cAAc;IACd,MAAM,aAAa,GAAG,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAA;IACnE,IAAI,aAAa;QAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAEtD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO;QACP,OAAO;QACP,aAAa;QACb,SAAS,EAAE,UAAU,EAAE,SAAS;QAChC,MAAM;KACP,CAAA;AACH,CAAC;AAED,yCAAyC;AACzC,aAAa;AACb,yCAAyC;AAEzC,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,SAAiB,EACjB,MAAc,EACd,UAAkB;IAElB,MAAM,MAAM,GAAwC;QAClD,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5C,YAAY;QACZ,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM;KACP,CAAA;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAA;IAE3C,oBAAoB;IACpB,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAChD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAA4B;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAA;IAC7C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,OAAO,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;AAC3D,CAAC;AAgBD,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,mCAAmC;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC;IAED,eAAe;IACf,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,wBAAwB,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAChF,CAAA;IACH,CAAC;IAED,eAAe;IACf,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,QAAQ,CAAC;YACxD,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,CAAC,CAAA;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,sBAAsB,SAAS,EAAE,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAqC;QAChD,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;KACtC,CAAA;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAA;IAE/C,gBAAgB;IAChB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAEhC,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAsB,EACtB,cAAsB;IAEtB,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC7D,IAAI,CAAC,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;IAEvD,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAEzE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC/C,CAAC;AAED,UAAU;AACV,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,IAAI,OAAO;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IACnE,OAAO,CAAC,GAAG,YAAY,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAoB;IAChD,OAAO,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,kBAAkB,CAAC,KAAK,EAAE,CAAA;IAC1B,YAAY,CAAC,MAAM,GAAG,CAAC,CAAA;AACzB,CAAC"}

package/dist/src/core/index.d.ts

@@ -0,0 +1,3 @@
+export { createPassport, signPassport, updatePassport, isExpired } from './passport.js';
+export { canonicalize } from './canonical.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/src/core/index.js

@@ -0,0 +1,3 @@
+export { createPassport, signPassport, updatePassport, isExpired } from './passport.js';
+export { canonicalize } from './canonical.js';
+//# sourceMappingURL=index.js.map

package/dist/src/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/src/core/passport.d.ts

@@ -0,0 +1,9 @@
+import type { AgentPassport, SignedPassport, KeyPair, CreatePassportOptions } from '../types/passport.js';
+export declare function createPassport(options: CreatePassportOptions): {
+    signedPassport: SignedPassport;
+    keyPair: KeyPair;
+};
+export declare function signPassport(passport: AgentPassport, privateKey: string): SignedPassport;
+export declare function updatePassport(passport: AgentPassport, updates: Partial<AgentPassport>, privateKey: string): SignedPassport;
+export declare function isExpired(passport: AgentPassport): boolean;
+//# sourceMappingURL=passport.d.ts.map

package/dist/src/core/passport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.d.ts","sourceRoot":"","sources":["../../../src/core/passport.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,aAAa,EAAE,cAAc,EAAE,OAAO,EACtC,qBAAqB,EACtB,MAAM,sBAAsB,CAAA;AAiC7B,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG;IAC9D,cAAc,EAAE,cAAc,CAAA;IAC9B,OAAO,EAAE,OAAO,CAAA;CACjB,CAyBA;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,CAQxF;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,EAC/B,UAAU,EAAE,MAAM,GACjB,cAAc,CAOhB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAE1D"}

package/dist/src/core/passport.js

@@ -0,0 +1,76 @@
+// Core Passport Operations — create, sign, update, expire
+import { generateKeyPair, sign } from '../crypto/keys.js';
+import { canonicalize } from './canonical.js';
+const DEFAULT_EXPIRY_DAYS = 365;
+function defaultReputation() {
+    return {
+        overall: 1,
+        collaborationsCompleted: 0,
+        proposalsSubmitted: 0,
+        proposalsApproved: 0,
+        tokensContributed: 0,
+        tasksCompleted: 0,
+        lastUpdated: new Date().toISOString()
+    };
+}
+function calculateVoteWeight(capabilities) {
+    // Base weight 1, increases with capabilities
+    const weights = {
+        code_execution: 0.5,
+        system_control: 0.5,
+        web_search: 0.2,
+        email_management: 0.3,
+        file_management: 0.3,
+        git_operations: 0.3,
+        browser_automation: 0.2,
+        voice_transcription: 0.1,
+        social_media_posting: 0.1
+    };
+    const bonus = capabilities.reduce((sum, cap) => sum + (weights[cap] || 0.1), 0);
+    return Math.max(1, Math.round(1 + bonus));
+}
+export function createPassport(options) {
+    const keyPair = generateKeyPair();
+    const now = new Date();
+    const expiry = new Date(now);
+    expiry.setDate(expiry.getDate() + (options.expiresInDays || DEFAULT_EXPIRY_DAYS));
+    const passport = {
+        version: '1.0.0',
+        agentId: options.agentId,
+        agentName: options.agentName,
+        ownerAlias: options.ownerAlias,
+        publicKey: keyPair.publicKey,
+        mission: options.mission,
+        capabilities: options.capabilities,
+        runtime: options.runtime,
+        createdAt: now.toISOString(),
+        expiresAt: expiry.toISOString(),
+        voteWeight: calculateVoteWeight(options.capabilities),
+        reputation: defaultReputation(),
+        delegations: options.delegations || [],
+        metadata: options.metadata || {}
+    };
+    const signedPassport = signPassport(passport, keyPair.privateKey);
+    return { signedPassport, keyPair };
+}
+export function signPassport(passport, privateKey) {
+    const canonical = canonicalize(passport);
+    const signature = sign(canonical, privateKey);
+    return {
+        passport,
+        signature,
+        signedAt: new Date().toISOString()
+    };
+}
+export function updatePassport(passport, updates, privateKey) {
+    const updated = { ...passport, ...updates };
+    // Recalculate vote weight if capabilities changed
+    if (updates.capabilities) {
+        updated.voteWeight = calculateVoteWeight(updates.capabilities);
+    }
+    return signPassport(updated, privateKey);
+}
+export function isExpired(passport) {
+    return new Date(passport.expiresAt) < new Date();
+}
+//# sourceMappingURL=passport.js.map

package/dist/src/core/passport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport.js","sourceRoot":"","sources":["../../../src/core/passport.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAG1D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAM7C,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAE/B,SAAS,iBAAiB;IACxB,OAAO;QACL,OAAO,EAAE,CAAC;QACV,uBAAuB,EAAE,CAAC;QAC1B,kBAAkB,EAAE,CAAC;QACrB,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAsB;IACjD,6CAA6C;IAC7C,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,GAAG;QACnB,cAAc,EAAE,GAAG;QACnB,UAAU,EAAE,GAAG;QACf,gBAAgB,EAAE,GAAG;QACrB,eAAe,EAAE,GAAG;QACpB,cAAc,EAAE,GAAG;QACnB,kBAAkB,EAAE,GAAG;QACvB,mBAAmB,EAAE,GAAG;QACxB,oBAAoB,EAAE,GAAG;KAC1B,CAAA;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAI3D,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,CAAA;IAEjF,MAAM,QAAQ,GAAkB;QAC9B,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE;QAC/B,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC;QACrD,UAAU,EAAE,iBAAiB,EAAE;QAC/B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;KACjC,CAAA;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACjE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAuB,EAAE,UAAkB;IACtE,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC7C,OAAO;QACL,QAAQ;QACR,SAAS;QACT,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,QAAuB,EACvB,OAA+B,EAC/B,UAAkB;IAElB,MAAM,OAAO,GAAkB,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAA;IAC1D,kDAAkD;IAClD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,CAAC,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAuB;IAC/C,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAA;AAClD,CAAC"}

package/dist/src/core/values.d.ts

@@ -0,0 +1,49 @@
+import type { ValuesFloor, FloorAttestation, ComplianceReport, SharedGround, AgentPassport, ActionReceipt } from '../types/passport.js';
+/**
+ * Parse the Values Floor from a JSON object.
+ *
+ * v2 design: JSON, not YAML. The floor is a protocol artifact,
+ * not a config file. JSON is unambiguous, universally parseable,
+ * and requires zero dependencies. Every language on earth can
+ * read JSON. Not every language can read YAML the same way.
+ *
+ * We still support YAML for human authoring (loadFloorFromYaml),
+ * but the canonical representation is JSON.
+ */
+export declare function loadFloor(input: string): ValuesFloor;
+export declare function loadFloorFromFile(filePath: string): ValuesFloor;
+/**
+ * An attestation is minimal: agent signs {floorVersion, extensions, timestamp}.
+ * That's it. No performative commitment text.
+ *
+ * The attestation says: "I recognize this floor version."
+ * The receipts say: "Here's what I actually did."
+ * The compliance check compares the two.
+ *
+ * Truth is in the receipts, not in the attestation.
+ */
+export declare function attestFloor(agentId: string, publicKey: string, floorVersion: string, extensions: string[], privateKey: string, expiresInDays?: number): FloorAttestation;
+export declare function verifyAttestation(attestation: FloorAttestation): {
+    valid: boolean;
+    errors: string[];
+};
+/**
+ * Evaluate compliance by producing FACTS about each principle.
+ *
+ * Previous version: returned overallCompliance: 0.943 (opinion).
+ * This version: returns each principle's status as a verifiable fact,
+ * PLUS a summary that separates what's proven from what's claimed.
+ *
+ * The compliance report is evidence. What you do with evidence
+ * is your decision — not the protocol's.
+ */
+export declare function evaluateCompliance(agentId: string, receipts: ActionReceipt[], floor: ValuesFloor, delegations: Map<string, {
+    scope: string[];
+    revoked: boolean;
+}>, verifierPrivateKey: string): ComplianceReport;
+/**
+ * Determine shared ethical ground between two agents.
+ * Simple: same major floor version + intersection of extensions.
+ */
+export declare function negotiateCommonGround(passportA: AgentPassport, attestationA: FloorAttestation, passportB: AgentPassport, attestationB: FloorAttestation): SharedGround;
+//# sourceMappingURL=values.d.ts.map

package/dist/src/core/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/core/values.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,WAAW,EAAkB,gBAAgB,EAC5B,gBAAgB,EAAE,YAAY,EAC/C,aAAa,EAAE,aAAa,EAC7B,MAAM,sBAAsB,CAAA;AAM7B;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAYpD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAG/D;AAiFD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAAE,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,GAAE,MAAY,GAC1B,gBAAgB,CAqBlB;AAED,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,gBAAgB,GAC5B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAgBtC;AAMD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,aAAa,EAAE,EACzB,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,EAC/D,kBAAkB,EAAE,MAAM,GACzB,gBAAgB,CAyClB;AAiED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,aAAa,EACxB,YAAY,EAAE,gBAAgB,EAC9B,SAAS,EAAE,aAAa,EACxB,YAAY,EAAE,gBAAgB,GAC7B,YAAY,CA8Bd"}