agent-passport-system 1.43.0 → 1.44.0

package/README.md

@@ -123,11 +123,11 @@ Institutional governance: charters, offices, federation, reserves, multi-party a
 npx agent-passport-system-mcp
 ```
 
-20 essential tools by default. Set `APS_PROFILE=full` for all 143 tools. Profiles: essential, identity, governance, coordination, commerce, data, gateway, comms, minimal, full.
+20 essential tools by default. Set `APS_PROFILE=full` for all 149 tools. Profiles: essential, identity, governance, coordination, commerce, data, gateway, comms, minimal, full.
 
 ## Numbers
 
-2,844 tests. 8 protocol layers. 11 framework adapters. Gateway evaluation under 2ms. Zero heavy dependencies. Apache-2.0.
+2,848 tests. 8 protocol layers. 11 framework adapters. Gateway evaluation under 2ms. Zero heavy dependencies. Apache-2.0.
 
 ## Papers
 

package/dist/src/v2/attribution-primitive/canonical.d.ts

@@ -0,0 +1,45 @@
+import type { AttributionAxes, AttributionAxisTag, AttributionEnvelope, ComputeAxisItem, DataAxisItem, GovernanceAxisEntry, ProtocolAxisItem } from './types.js';
+/** Format a numeric weight or decimal-string input as the canonical
+ *  6-digit-after-point decimal string required by §2.5. Accepts numbers in
+ *  [0, 1] or already-canonical strings. */
+export declare function toWeightString(value: number | string): string;
+/** Reject timestamps that a lenient parser would accept but §2.5 forbids.
+ *  Forces ISO-8601 UTC with millisecond precision and literal Z suffix. */
+export declare function assertCanonicalTimestamp(ts: string): void;
+/** Produce the canonical timestamp for "now" or a supplied Date. Spec §2.5
+ *  rejects `+00:00` and drops sub-ms precision; toISOString() already emits
+ *  the required shape. */
+export declare function canonicalTimestamp(now?: Date): string;
+/** Sort an axis to §2.5 ordering so distinct orderings of the same logical
+ *  content produce byte-identical canonicalizations.
+ *
+ *  D: lexicographic by source_did.
+ *  P: lexicographic by module_id + '\u0000' + module_version.
+ *  C: lexicographic by provider_did.
+ *  G: preserved as-is (root-to-leaf by depth).
+ *
+ *  Residual buckets always sort to the end of their axis so their fixed
+ *  identifier does not collide with DID ordering. At most one residual is
+ *  permitted per axis; duplicates throw. */
+export declare function sortDataAxis(items: DataAxisItem[]): DataAxisItem[];
+export declare function sortProtocolAxis(items: ProtocolAxisItem[]): ProtocolAxisItem[];
+export declare function sortComputeAxis(items: ComputeAxisItem[]): ComputeAxisItem[];
+/** Governance axis is ordered by increasing depth (root principal first).
+ *  Duplicate depths within the same chain are rejected. */
+export declare function orderGovernanceAxis(items: GovernanceAxisEntry[]): GovernanceAxisEntry[];
+/** Normalize all four axes to their canonical ordering. Callers can hand us
+ *  unsorted input; the primitive never emits unsorted canonical bytes. */
+export declare function normalizeAxes(axes: AttributionAxes): AttributionAxes;
+/** SHA-256(canonical(axis_content)) as raw 32 bytes. §2.1. */
+export declare function hashAxisLeaf(axis: unknown): Buffer;
+/** Internal Merkle node: SHA-256(left_bytes || right_bytes). §2.1. */
+export declare function hashNode(left: Buffer, right: Buffer): Buffer;
+/** Hex sha256 of canonicalize(envelope). Used for signing and for deriving
+ *  action_ref from the action tuple. */
+export declare function canonicalHashHex(obj: unknown): string;
+/** The canonical envelope §2.3 that Ed25519 signs. Returned as a string so
+ *  Python and TypeScript sign/verify exactly the same bytes. */
+export declare function envelopeBytes(env: AttributionEnvelope): string;
+/** Type-safe enumeration of axis tags, for iteration. */
+export declare const ATTRIBUTION_AXIS_TAGS: ReadonlyArray<AttributionAxisTag>;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/src/v2/attribution-primitive/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/canonical.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAEjB,MAAM,YAAY,CAAA;AAKnB;;2CAE2C;AAC3C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAgB7D;AAED;2EAC2E;AAC3E,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAMzD;AAED;;0BAE0B;AAC1B,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAIjE;AAYD;;;;;;;;;;4CAU4C;AAC5C,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAQlE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CAY9E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE,CAU3E;AAED;2DAC2D;AAC3D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,EAAE,CAUvF;AAED;0EAC0E;AAC1E,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAOpE;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAElD;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;wCACwC;AACxC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAErD;AAED;gEACgE;AAChE,wBAAgB,aAAa,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAQ9D;AAED,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,kBAAkB,CAAwB,CAAA"}

package/dist/src/v2/attribution-primitive/canonical.js

@@ -0,0 +1,142 @@
+// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
+// ══════════════════════════════════════════════════════════════════
+// Attribution Primitive — canonicalization, ordering, numeric format
+// ══════════════════════════════════════════════════════════════════
+// Spec §2.5 specifies stricter canonicalization than RFC 8785. This file
+// owns the additional constraints so A1 (canonicalization injectivity,
+// §3.4) holds for schema-valid inputs.
+// ══════════════════════════════════════════════════════════════════
+import { createHash } from 'node:crypto';
+import { canonicalize } from '../../core/canonical.js';
+const WEIGHT_PATTERN = /^\d+\.\d{6}$/;
+const ISO_8601_MS_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+/** Format a numeric weight or decimal-string input as the canonical
+ *  6-digit-after-point decimal string required by §2.5. Accepts numbers in
+ *  [0, 1] or already-canonical strings. */
+export function toWeightString(value) {
+    if (typeof value === 'string') {
+        if (!WEIGHT_PATTERN.test(value)) {
+            throw new Error(`attribution-primitive: weight string "${value}" must match /^\\d+\\.\\d{6}$/ (§2.5)`);
+        }
+        return value;
+    }
+    if (!Number.isFinite(value)) {
+        throw new Error(`attribution-primitive: weight must be finite, got ${value}`);
+    }
+    if (value < 0 || value > 1) {
+        throw new Error(`attribution-primitive: weight must be in [0, 1], got ${value}`);
+    }
+    return value.toFixed(6);
+}
+/** Reject timestamps that a lenient parser would accept but §2.5 forbids.
+ *  Forces ISO-8601 UTC with millisecond precision and literal Z suffix. */
+export function assertCanonicalTimestamp(ts) {
+    if (!ISO_8601_MS_PATTERN.test(ts)) {
+        throw new Error(`attribution-primitive: timestamp "${ts}" must be ISO-8601 UTC with millisecond precision and trailing Z (§2.5)`);
+    }
+}
+/** Produce the canonical timestamp for "now" or a supplied Date. Spec §2.5
+ *  rejects `+00:00` and drops sub-ms precision; toISOString() already emits
+ *  the required shape. */
+export function canonicalTimestamp(now = new Date()) {
+    const s = now.toISOString();
+    assertCanonicalTimestamp(s);
+    return s;
+}
+function isResidual(x) {
+    return (typeof x === 'object' &&
+        x !== null &&
+        'residual_id' in x &&
+        typeof x.residual_id === 'string' &&
+        x.residual_id.startsWith('residual:'));
+}
+/** Sort an axis to §2.5 ordering so distinct orderings of the same logical
+ *  content produce byte-identical canonicalizations.
+ *
+ *  D: lexicographic by source_did.
+ *  P: lexicographic by module_id + '\u0000' + module_version.
+ *  C: lexicographic by provider_did.
+ *  G: preserved as-is (root-to-leaf by depth).
+ *
+ *  Residual buckets always sort to the end of their axis so their fixed
+ *  identifier does not collide with DID ordering. At most one residual is
+ *  permitted per axis; duplicates throw. */
+export function sortDataAxis(items) {
+    const residuals = items.filter(isResidual);
+    if (residuals.length > 1) {
+        throw new Error('attribution-primitive: at most one residual bucket permitted in axis D');
+    }
+    const explicit = items.filter((x) => !isResidual(x));
+    explicit.sort((a, b) => (a.source_did < b.source_did ? -1 : a.source_did > b.source_did ? 1 : 0));
+    return [...explicit, ...residuals];
+}
+export function sortProtocolAxis(items) {
+    const residuals = items.filter(isResidual);
+    if (residuals.length > 1) {
+        throw new Error('attribution-primitive: at most one residual bucket permitted in axis P');
+    }
+    const explicit = items.filter((x) => !isResidual(x));
+    explicit.sort((a, b) => {
+        const ka = `${a.module_id}\u0000${a.module_version}`;
+        const kb = `${b.module_id}\u0000${b.module_version}`;
+        return ka < kb ? -1 : ka > kb ? 1 : 0;
+    });
+    return [...explicit, ...residuals];
+}
+export function sortComputeAxis(items) {
+    const residuals = items.filter(isResidual);
+    if (residuals.length > 1) {
+        throw new Error('attribution-primitive: at most one residual bucket permitted in axis C');
+    }
+    const explicit = items.filter((x) => !isResidual(x));
+    explicit.sort((a, b) => a.provider_did < b.provider_did ? -1 : a.provider_did > b.provider_did ? 1 : 0);
+    return [...explicit, ...residuals];
+}
+/** Governance axis is ordered by increasing depth (root principal first).
+ *  Duplicate depths within the same chain are rejected. */
+export function orderGovernanceAxis(items) {
+    const ordered = [...items].sort((a, b) => a.depth - b.depth);
+    for (let i = 1; i < ordered.length; i++) {
+        if (ordered[i].depth === ordered[i - 1].depth) {
+            throw new Error(`attribution-primitive: governance axis has duplicate depth ${ordered[i].depth}`);
+        }
+    }
+    return ordered;
+}
+/** Normalize all four axes to their canonical ordering. Callers can hand us
+ *  unsorted input; the primitive never emits unsorted canonical bytes. */
+export function normalizeAxes(axes) {
+    return {
+        D: sortDataAxis(axes.D),
+        P: sortProtocolAxis(axes.P),
+        G: orderGovernanceAxis(axes.G),
+        C: sortComputeAxis(axes.C),
+    };
+}
+/** SHA-256(canonical(axis_content)) as raw 32 bytes. §2.1. */
+export function hashAxisLeaf(axis) {
+    return createHash('sha256').update(canonicalize(axis)).digest();
+}
+/** Internal Merkle node: SHA-256(left_bytes || right_bytes). §2.1. */
+export function hashNode(left, right) {
+    return createHash('sha256').update(Buffer.concat([left, right])).digest();
+}
+/** Hex sha256 of canonicalize(envelope). Used for signing and for deriving
+ *  action_ref from the action tuple. */
+export function canonicalHashHex(obj) {
+    return createHash('sha256').update(canonicalize(obj)).digest('hex');
+}
+/** The canonical envelope §2.3 that Ed25519 signs. Returned as a string so
+ *  Python and TypeScript sign/verify exactly the same bytes. */
+export function envelopeBytes(env) {
+    assertCanonicalTimestamp(env.timestamp);
+    return canonicalize({
+        action_ref: env.action_ref,
+        merkle_root: env.merkle_root,
+        issuer: env.issuer,
+        timestamp: env.timestamp,
+    });
+}
+/** Type-safe enumeration of axis tags, for iteration. */
+export const ATTRIBUTION_AXIS_TAGS = ['D', 'P', 'G', 'C'];
+//# sourceMappingURL=canonical.js.map

package/dist/src/v2/attribution-primitive/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/canonical.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,uCAAuC;AACvC,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAYtD,MAAM,cAAc,GAAG,cAAc,CAAA;AACrC,MAAM,mBAAmB,GAAG,+CAA+C,CAAA;AAE3E;;2CAE2C;AAC3C,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,uCAAuC,CACtF,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,KAAK,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACzB,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,EAAU;IACjD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,qCAAqC,EAAE,yEAAyE,CACjH,CAAA;IACH,CAAC;AACH,CAAC;AAED;;0BAE0B;AAC1B,MAAM,UAAU,kBAAkB,CAAC,MAAY,IAAI,IAAI,EAAE;IACvD,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC3B,wBAAwB,CAAC,CAAC,CAAC,CAAA;IAC3B,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,aAAa,IAAK,CAAY;QAC9B,OAAQ,CAAoB,CAAC,WAAW,KAAK,QAAQ;QACpD,CAAoB,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAC1D,CAAA;AACH,CAAC;AAED;;;;;;;;;;4CAU4C;AAC5C,MAAM,UAAU,YAAY,CAAC,KAAqB;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAqB,CAAA;IAC9D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAA4C,CAAA;IAC/F,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjG,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAqB,CAAA;IAC9D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAgD,CAAA;IACnG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,cAAc,EAAE,CAAA;QACpD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,cAAc,EAAE,CAAA;QACpD,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAqB,CAAA;IAC9D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAA+C,CAAA;IAClG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/E,CAAA;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAA;AACpC,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,KAA4B;IAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,8DAA8D,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CACjF,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,aAAa,CAAC,IAAqB;IACjD,OAAO;QACL,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACvB,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3B,CAAC,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3B,CAAA;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACjE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa;IAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AAC3E,CAAC;AAED;wCACwC;AACxC,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,aAAa,CAAC,GAAwB;IACpD,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACvC,OAAO,YAAY,CAAC;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAA;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA"}

package/dist/src/v2/attribution-primitive/construct.d.ts

@@ -0,0 +1,37 @@
+import type { AttributionAction, AttributionAxes, AttributionPrimitive } from './types.js';
+/** Derive action_ref from the action tuple. §1.2 / §3.4.
+ *
+ *  The spec pseudocode in §2.7 uses string concatenation (`agentId || type
+ *  || canonical(params) || nonce`), but Theorem 1's reduction relies on
+ *  canonical(T) being injective (A1). Plain string concatenation is not
+ *  self-delimiting, so two distinct tuples could produce the same byte
+ *  string. We adopt canonical(T) on the full tuple, which is injective by
+ *  construction and matches the security argument. */
+export declare function computeAttributionActionRef(action: AttributionAction): string;
+export interface ConstructAttributionParams {
+    /** The action being attested. Used to derive action_ref. */
+    action: AttributionAction;
+    /** The four axes with their entries. Unsorted is fine — canonicalization
+     *  will order them. */
+    axes: AttributionAxes;
+    /** Issuer DID of the gateway or agent producing the receipt. */
+    issuer: string;
+    /** Ed25519 private key (hex) that signs the envelope. Must match the
+     *  public key registered for `issuer` out-of-band. */
+    issuerPrivateKey: string;
+    /** Override the timestamp (test fixtures, replayed audits). Must satisfy
+     *  §2.5 — millisecond precision, trailing Z. Defaults to now(). */
+    timestamp?: string;
+}
+/** Build and sign a complete AttributionPrimitive. §2.7. */
+export declare function constructAttributionPrimitive(params: ConstructAttributionParams): AttributionPrimitive;
+/** Re-sign a primitive whose axes or metadata have changed (e.g., after
+ *  applying decay in axis P). Returns a fresh primitive; the input is not
+ *  mutated. Caller is responsible for providing a new timestamp if the
+ *  resigned receipt should be distinct under replay protection. */
+export declare function resignAttributionPrimitive(primitive: AttributionPrimitive, issuerPrivateKey: string, opts?: {
+    timestamp?: string;
+    axes?: AttributionAxes;
+    action?: AttributionAction;
+}): AttributionPrimitive;
+//# sourceMappingURL=construct.d.ts.map

package/dist/src/v2/attribution-primitive/construct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"construct.d.ts","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/construct.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAEnB;;;;;;;sDAOsD;AACtD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAa7E;AAED,MAAM,WAAW,0BAA0B;IACzC,4DAA4D;IAC5D,MAAM,EAAE,iBAAiB,CAAA;IACzB;2BACuB;IACvB,IAAI,EAAE,eAAe,CAAA;IACrB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;IACd;0DACsD;IACtD,gBAAgB,EAAE,MAAM,CAAA;IACxB;uEACmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,4DAA4D;AAC5D,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CA0BtB;AAED;;;mEAGmE;AACnE,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,oBAAoB,EAC/B,gBAAgB,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAChF,oBAAoB,CAiBtB"}

package/dist/src/v2/attribution-primitive/construct.js

@@ -0,0 +1,89 @@
+// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
+// ══════════════════════════════════════════════════════════════════
+// Attribution Primitive — construction
+// ══════════════════════════════════════════════════════════════════
+// Spec §2.7 composition pipeline. Given a set of axes, an issuer DID, and
+// an action tuple, produce a signed primitive. Callers hand us already-
+// computed axis entries; weight derivation and hash computation of the
+// underlying per-axis artifacts (AccessReceipt hashes, evaluation receipt
+// hashes, delegation scope hashes, attestation hashes) is deployment
+// policy per §7.1.
+// ══════════════════════════════════════════════════════════════════
+import { sign } from '../../crypto/keys.js';
+import { assertCanonicalTimestamp, canonicalHashHex, canonicalTimestamp, envelopeBytes, } from './canonical.js';
+import { buildMerkleFrame } from './merkle.js';
+/** Derive action_ref from the action tuple. §1.2 / §3.4.
+ *
+ *  The spec pseudocode in §2.7 uses string concatenation (`agentId || type
+ *  || canonical(params) || nonce`), but Theorem 1's reduction relies on
+ *  canonical(T) being injective (A1). Plain string concatenation is not
+ *  self-delimiting, so two distinct tuples could produce the same byte
+ *  string. We adopt canonical(T) on the full tuple, which is injective by
+ *  construction and matches the security argument. */
+export function computeAttributionActionRef(action) {
+    if (!action.agentId)
+        throw new Error('attribution-primitive: action.agentId required');
+    if (!action.actionType)
+        throw new Error('attribution-primitive: action.actionType required');
+    if (!action.nonce)
+        throw new Error('attribution-primitive: action.nonce required');
+    if (typeof action.params !== 'object' || action.params === null) {
+        throw new Error('attribution-primitive: action.params must be an object');
+    }
+    return canonicalHashHex({
+        agentId: action.agentId,
+        actionType: action.actionType,
+        params: action.params,
+        nonce: action.nonce,
+    });
+}
+/** Build and sign a complete AttributionPrimitive. §2.7. */
+export function constructAttributionPrimitive(params) {
+    if (!params.issuer)
+        throw new Error('attribution-primitive: issuer required');
+    if (!params.issuerPrivateKey)
+        throw new Error('attribution-primitive: issuerPrivateKey required');
+    const action_ref = computeAttributionActionRef(params.action);
+    const frame = buildMerkleFrame(params.axes);
+    const merkle_root = frame.root.toString('hex');
+    const timestamp = params.timestamp ?? canonicalTimestamp();
+    assertCanonicalTimestamp(timestamp);
+    const envelope = envelopeBytes({
+        action_ref,
+        merkle_root,
+        issuer: params.issuer,
+        timestamp,
+    });
+    const signature = sign(envelope, params.issuerPrivateKey);
+    return {
+        action_ref,
+        axes: frame.axes,
+        merkle_root,
+        issuer: params.issuer,
+        timestamp,
+        signature,
+    };
+}
+/** Re-sign a primitive whose axes or metadata have changed (e.g., after
+ *  applying decay in axis P). Returns a fresh primitive; the input is not
+ *  mutated. Caller is responsible for providing a new timestamp if the
+ *  resigned receipt should be distinct under replay protection. */
+export function resignAttributionPrimitive(primitive, issuerPrivateKey, opts) {
+    const axes = opts?.axes ?? primitive.axes;
+    const action_ref = opts?.action
+        ? computeAttributionActionRef(opts.action)
+        : primitive.action_ref;
+    const frame = buildMerkleFrame(axes);
+    const merkle_root = frame.root.toString('hex');
+    const timestamp = opts?.timestamp ?? canonicalTimestamp();
+    assertCanonicalTimestamp(timestamp);
+    const envelope = envelopeBytes({
+        action_ref,
+        merkle_root,
+        issuer: primitive.issuer,
+        timestamp,
+    });
+    const signature = sign(envelope, issuerPrivateKey);
+    return { action_ref, axes: frame.axes, merkle_root, issuer: primitive.issuer, timestamp, signature };
+}
+//# sourceMappingURL=construct.js.map

package/dist/src/v2/attribution-primitive/construct.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"construct.js","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/construct.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,qEAAqE;AACrE,uCAAuC;AACvC,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,mBAAmB;AACnB,qEAAqE;AAErE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAO9C;;;;;;;sDAOsD;AACtD,MAAM,UAAU,2BAA2B,CAAC,MAAyB;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACtF,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IAC5F,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAClF,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,gBAAgB,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAA;AACJ,CAAC;AAkBD,4DAA4D;AAC5D,MAAM,UAAU,6BAA6B,CAC3C,MAAkC;IAElC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC7E,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IAEjG,MAAM,UAAU,GAAG,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAA;IAC1D,wBAAwB,CAAC,SAAS,CAAC,CAAA;IAEnC,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,UAAU;QACV,WAAW;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS;KACV,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAEzD,OAAO;QACL,UAAU;QACV,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS;QACT,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;mEAGmE;AACnE,MAAM,UAAU,0BAA0B,CACxC,SAA+B,EAC/B,gBAAwB,EACxB,IAAiF;IAEjF,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC,IAAI,CAAA;IACzC,MAAM,UAAU,GAAG,IAAI,EAAE,MAAM;QAC7B,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC,UAAU,CAAA;IACxB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,kBAAkB,EAAE,CAAA;IACzD,wBAAwB,CAAC,SAAS,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,UAAU;QACV,WAAW;QACX,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS;KACV,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;IAClD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACtG,CAAC"}

package/dist/src/v2/attribution-primitive/index.d.ts

@@ -0,0 +1,11 @@
+export type { AttributionAxisTag, AttributionAction, AttributionAxes, AttributionEnvelope, AttributionPrimitive, AttributionProjection, AttributionVerifyResult, AttributionConsistencyResult, DataAxisEntry, DataAxisItem, ProtocolAxisEntry, ProtocolAxisItem, GovernanceAxisEntry, ComputeAxisEntry, ComputeAxisItem, ResidualBucket, } from './types.js';
+export { ATTRIBUTION_AXIS_TAGS, assertCanonicalTimestamp, canonicalTimestamp, canonicalHashHex, envelopeBytes, hashAxisLeaf, hashNode, normalizeAxes, orderGovernanceAxis, sortComputeAxis, sortDataAxis, sortProtocolAxis, toWeightString, } from './canonical.js';
+export { buildMerkleFrame, projectionPath, reconstructRoot } from './merkle.js';
+export type { MerkleFrame } from './merkle.js';
+export { computeAttributionActionRef, constructAttributionPrimitive, resignAttributionPrimitive, } from './construct.js';
+export type { ConstructAttributionParams } from './construct.js';
+export { projectAttribution, projectAllAxes, projectionDataAsC, projectionDataAsD, projectionDataAsG, projectionDataAsP, } from './project.js';
+export { checkProjectionConsistency, verifyAttributionPrimitive, verifyAttributionProjection, } from './verify.js';
+export { DEFAULT_MIN_WEIGHT, aggregateComputeAxis, aggregateDataAxis, aggregateProtocolAxis, } from './residual.js';
+export type { AggregateOptions, AggregationResult } from './residual.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/attribution-primitive/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/index.ts"],"names":[],"mappings":"AAOA,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,cAAc,GACf,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA"}

package/dist/src/v2/attribution-primitive/index.js

@@ -0,0 +1,13 @@
+// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
+// Attribution Primitive — public surface.
+//
+// Spec: ATTRIBUTION-PRIMITIVE-v1.1.md. See README/paper for the structural
+// motivation; this module is the protocol primitive only. Visualization,
+// cross-tenant analytics, and batch settlement are gateway-side.
+export { ATTRIBUTION_AXIS_TAGS, assertCanonicalTimestamp, canonicalTimestamp, canonicalHashHex, envelopeBytes, hashAxisLeaf, hashNode, normalizeAxes, orderGovernanceAxis, sortComputeAxis, sortDataAxis, sortProtocolAxis, toWeightString, } from './canonical.js';
+export { buildMerkleFrame, projectionPath, reconstructRoot } from './merkle.js';
+export { computeAttributionActionRef, constructAttributionPrimitive, resignAttributionPrimitive, } from './construct.js';
+export { projectAttribution, projectAllAxes, projectionDataAsC, projectionDataAsD, projectionDataAsG, projectionDataAsP, } from './project.js';
+export { checkProjectionConsistency, verifyAttributionPrimitive, verifyAttributionProjection, } from './verify.js';
+export { DEFAULT_MIN_WEIGHT, aggregateComputeAxis, aggregateDataAxis, aggregateProtocolAxis, } from './residual.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/attribution-primitive/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,iEAAiE;AAqBjE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,cAAc,GACf,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAG/E,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,eAAe,CAAA"}

package/dist/src/v2/attribution-primitive/merkle.d.ts

@@ -0,0 +1,28 @@
+import type { AttributionAxes, AttributionAxisTag } from './types.js';
+export interface MerkleFrame {
+    /** Canonically-ordered axes used to derive the leaves. */
+    axes: AttributionAxes;
+    leaves: {
+        D: Buffer;
+        P: Buffer;
+        G: Buffer;
+        C: Buffer;
+    };
+    nodes: {
+        N_content: Buffer;
+        N_auth_infra: Buffer;
+    };
+    root: Buffer;
+}
+/** Build the full tree for a set of axes. Callers pass the raw (possibly
+ *  unsorted) axes; we normalize before hashing so the caller can't produce
+ *  two different canonical representations of the same logical content. */
+export declare function buildMerkleFrame(rawAxes: AttributionAxes): MerkleFrame;
+/** The sibling path for a projection, in the order §2.2 specifies:
+ *  [sibling_leaf_within_pair_hex, sibling_internal_node_hex]. */
+export declare function projectionPath(frame: MerkleFrame, axis: AttributionAxisTag): [string, string];
+/** Reconstruct the root from an axis's canonical leaf hash and the two-hop
+ *  sibling path. §2.3 algorithm. Returns raw bytes so callers can diff the
+ *  buffers; hex comparison is lossy under case normalization. */
+export declare function reconstructRoot(axisLeaf: Buffer, path: [string, string], axis: AttributionAxisTag): Buffer;
+//# sourceMappingURL=merkle.d.ts.map

package/dist/src/v2/attribution-primitive/merkle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.d.ts","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/merkle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAErE,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,IAAI,EAAE,eAAe,CAAA;IACrB,MAAM,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;2EAE2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,WAAW,CAetE;AAED;iEACiE;AACjE,wBAAgB,cAAc,CAC5B,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,kBAAkB,GACvB,CAAC,MAAM,EAAE,MAAM,CAAC,CAelB;AAED;;iEAEiE;AACjE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EACtB,IAAI,EAAE,kBAAkB,GACvB,MAAM,CA2BR"}

package/dist/src/v2/attribution-primitive/merkle.js

@@ -0,0 +1,76 @@
+// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
+// ══════════════════════════════════════════════════════════════════
+// Attribution Primitive — balanced four-leaf Merkle tree
+// ══════════════════════════════════════════════════════════════════
+// Spec §2.1: four leaves in fixed positions. Content pair (D, P) on the
+// left, authority-infrastructure pair (G, C) on the right, balanced above.
+// All projections share a path length of two.
+// ══════════════════════════════════════════════════════════════════
+import { hashAxisLeaf, hashNode, normalizeAxes } from './canonical.js';
+/** Build the full tree for a set of axes. Callers pass the raw (possibly
+ *  unsorted) axes; we normalize before hashing so the caller can't produce
+ *  two different canonical representations of the same logical content. */
+export function buildMerkleFrame(rawAxes) {
+    const axes = normalizeAxes(rawAxes);
+    const leafD = hashAxisLeaf(axes.D);
+    const leafP = hashAxisLeaf(axes.P);
+    const leafG = hashAxisLeaf(axes.G);
+    const leafC = hashAxisLeaf(axes.C);
+    const nContent = hashNode(leafD, leafP);
+    const nAuthInfra = hashNode(leafG, leafC);
+    const root = hashNode(nContent, nAuthInfra);
+    return {
+        axes,
+        leaves: { D: leafD, P: leafP, G: leafG, C: leafC },
+        nodes: { N_content: nContent, N_auth_infra: nAuthInfra },
+        root,
+    };
+}
+/** The sibling path for a projection, in the order §2.2 specifies:
+ *  [sibling_leaf_within_pair_hex, sibling_internal_node_hex]. */
+export function projectionPath(frame, axis) {
+    switch (axis) {
+        case 'D':
+            return [frame.leaves.P.toString('hex'), frame.nodes.N_auth_infra.toString('hex')];
+        case 'P':
+            return [frame.leaves.D.toString('hex'), frame.nodes.N_auth_infra.toString('hex')];
+        case 'G':
+            return [frame.leaves.C.toString('hex'), frame.nodes.N_content.toString('hex')];
+        case 'C':
+            return [frame.leaves.G.toString('hex'), frame.nodes.N_content.toString('hex')];
+        default: {
+            const exhaustive = axis;
+            throw new Error(`attribution-primitive: unknown axis tag ${String(exhaustive)}`);
+        }
+    }
+}
+/** Reconstruct the root from an axis's canonical leaf hash and the two-hop
+ *  sibling path. §2.3 algorithm. Returns raw bytes so callers can diff the
+ *  buffers; hex comparison is lossy under case normalization. */
+export function reconstructRoot(axisLeaf, path, axis) {
+    const sibling = Buffer.from(path[0], 'hex');
+    const siblingInternal = Buffer.from(path[1], 'hex');
+    if (sibling.length !== 32 || siblingInternal.length !== 32) {
+        throw new Error(`attribution-primitive: merkle path hashes must be 32-byte sha256 (got ${sibling.length}, ${siblingInternal.length})`);
+    }
+    let internal;
+    switch (axis) {
+        case 'D':
+            internal = hashNode(axisLeaf, sibling); // leaf_D || leaf_P
+            return hashNode(internal, siblingInternal); // N_content || N_auth_infra
+        case 'P':
+            internal = hashNode(sibling, axisLeaf); // leaf_D || leaf_P
+            return hashNode(internal, siblingInternal);
+        case 'G':
+            internal = hashNode(axisLeaf, sibling); // leaf_G || leaf_C
+            return hashNode(siblingInternal, internal); // N_content || N_auth_infra
+        case 'C':
+            internal = hashNode(sibling, axisLeaf); // leaf_G || leaf_C
+            return hashNode(siblingInternal, internal);
+        default: {
+            const exhaustive = axis;
+            throw new Error(`attribution-primitive: unknown axis tag ${String(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=merkle.js.map

package/dist/src/v2/attribution-primitive/merkle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/merkle.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,qEAAqE;AACrE,yDAAyD;AACzD,qEAAqE;AACrE,wEAAwE;AACxE,2EAA2E;AAC3E,8CAA8C;AAC9C,qEAAqE;AAErE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAWtE;;2EAE2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACvC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAC3C,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE;QAClD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE;QACxD,IAAI;KACL,CAAA;AACH,CAAC;AAED;iEACiE;AACjE,MAAM,UAAU,cAAc,CAC5B,KAAkB,EAClB,IAAwB;IAExB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACnF,KAAK,GAAG;YACN,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACnF,KAAK,GAAG;YACN,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAChF,KAAK,GAAG;YACN,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAChF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAA;YAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;iEAEiE;AACjE,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,IAAsB,EACtB,IAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,yEAAyE,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,GAAG,CACtH,CAAA;IACH,CAAC;IACD,IAAI,QAAgB,CAAA;IACpB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA,CAAC,mBAAmB;YAC1D,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA,CAAC,4BAA4B;QACzE,KAAK,GAAG;YACN,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA,CAAC,mBAAmB;YAC1D,OAAO,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA,CAAC,mBAAmB;YAC1D,OAAO,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA,CAAC,4BAA4B;QACzE,KAAK,GAAG;YACN,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA,CAAC,mBAAmB;YAC1D,OAAO,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;QAC5C,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAA;YAC9B,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/v2/attribution-primitive/project.d.ts

@@ -0,0 +1,24 @@
+import type { AttributionAxisTag, AttributionPrimitive, AttributionProjection, ComputeAxisItem, DataAxisItem, GovernanceAxisEntry, ProtocolAxisItem } from './types.js';
+/** Extract a single axis projection from a primitive. §2.2. The projection
+ *  carries a copy of the axis content (no deep clone — callers treating
+ *  projections as transport should serialize immediately) plus the two-hop
+ *  sibling path to reconstruct the root. */
+export declare function projectAttribution(primitive: AttributionPrimitive, axis: AttributionAxisTag): AttributionProjection;
+/** Convenience: extract all four projections in one call. Useful when an
+ *  issuer wants to emit projections to four independent settlement queues
+ *  in parallel. */
+export declare function projectAllAxes(primitive: AttributionPrimitive): {
+    D: AttributionProjection;
+    P: AttributionProjection;
+    G: AttributionProjection;
+    C: AttributionProjection;
+};
+/** Type-narrowing helpers so callers can pull a projection's axis_data with
+ *  the right shape. Throws if the tag doesn't match the expected axis.
+ *  (Verification happens separately in verify.ts — these helpers only do
+ *  runtime-tag dispatch, no signature checking.) */
+export declare function projectionDataAsD(p: AttributionProjection): DataAxisItem[];
+export declare function projectionDataAsP(p: AttributionProjection): ProtocolAxisItem[];
+export declare function projectionDataAsG(p: AttributionProjection): GovernanceAxisEntry[];
+export declare function projectionDataAsC(p: AttributionProjection): ComputeAxisItem[];
+//# sourceMappingURL=project.d.ts.map

package/dist/src/v2/attribution-primitive/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../../src/v2/attribution-primitive/project.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAEV,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,YAAY,CAAA;AAenB;;;4CAG4C;AAC5C,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,oBAAoB,EAC/B,IAAI,EAAE,kBAAkB,GACvB,qBAAqB,CAsBvB;AAED;;mBAEmB;AACnB,wBAAgB,cAAc,CAC5B,SAAS,EAAE,oBAAoB,GAC9B;IAAE,CAAC,EAAE,qBAAqB,CAAC;IAAC,CAAC,EAAE,qBAAqB,CAAC;IAAC,CAAC,EAAE,qBAAqB,CAAC;IAAC,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAO5G;AAED;;;oDAGoD;AACpD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,GAAG,YAAY,EAAE,CAG1E;AACD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,GAAG,gBAAgB,EAAE,CAG9E;AACD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAGjF;AACD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,GAAG,eAAe,EAAE,CAG7E"}

package/dist/src/v2/attribution-primitive/project.js

@@ -0,0 +1,84 @@
+// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
+// ══════════════════════════════════════════════════════════════════
+// Attribution Primitive — axis projections
+// ══════════════════════════════════════════════════════════════════
+// Spec §2.2 / §2.3. Each projection extracts one axis's content plus the
+// sibling-hash path needed to reconstruct the signed root. The other three
+// axes' contents are not recoverable from a single projection (I3, §3.3).
+// ══════════════════════════════════════════════════════════════════
+import { normalizeAxes } from './canonical.js';
+import { buildMerkleFrame, projectionPath } from './merkle.js';
+function selectAxis(axes, axis) {
+    switch (axis) {
+        case 'D':
+            return axes.D;
+        case 'P':
+            return axes.P;
+        case 'G':
+            return axes.G;
+        case 'C':
+            return axes.C;
+    }
+}
+/** Extract a single axis projection from a primitive. §2.2. The projection
+ *  carries a copy of the axis content (no deep clone — callers treating
+ *  projections as transport should serialize immediately) plus the two-hop
+ *  sibling path to reconstruct the root. */
+export function projectAttribution(primitive, axis) {
+    if (axis !== 'D' && axis !== 'P' && axis !== 'G' && axis !== 'C') {
+        throw new Error(`attribution-primitive: invalid axis tag "${String(axis)}"`);
+    }
+    // Re-normalize to guarantee the tree we build here matches whatever the
+    // original issuer produced. Primitive fields other than axes could have
+    // been tampered with after construction — we don't trust primitive inputs
+    // to be canonical on their own.
+    const normalized = normalizeAxes(primitive.axes);
+    const frame = buildMerkleFrame(normalized);
+    const path = projectionPath(frame, axis);
+    return {
+        action_ref: primitive.action_ref,
+        axis_tag: axis,
+        axis_data: selectAxis(frame.axes, axis),
+        merkle_path: path,
+        merkle_root: primitive.merkle_root,
+        issuer: primitive.issuer,
+        timestamp: primitive.timestamp,
+        signature: primitive.signature,
+    };
+}
+/** Convenience: extract all four projections in one call. Useful when an
+ *  issuer wants to emit projections to four independent settlement queues
+ *  in parallel. */
+export function projectAllAxes(primitive) {
+    return {
+        D: projectAttribution(primitive, 'D'),
+        P: projectAttribution(primitive, 'P'),
+        G: projectAttribution(primitive, 'G'),
+        C: projectAttribution(primitive, 'C'),
+    };
+}
+/** Type-narrowing helpers so callers can pull a projection's axis_data with
+ *  the right shape. Throws if the tag doesn't match the expected axis.
+ *  (Verification happens separately in verify.ts — these helpers only do
+ *  runtime-tag dispatch, no signature checking.) */
+export function projectionDataAsD(p) {
+    if (p.axis_tag !== 'D')
+        throw new Error(`expected axis D projection, got ${p.axis_tag}`);
+    return p.axis_data;
+}
+export function projectionDataAsP(p) {
+    if (p.axis_tag !== 'P')
+        throw new Error(`expected axis P projection, got ${p.axis_tag}`);
+    return p.axis_data;
+}
+export function projectionDataAsG(p) {
+    if (p.axis_tag !== 'G')
+        throw new Error(`expected axis G projection, got ${p.axis_tag}`);
+    return p.axis_data;
+}
+export function projectionDataAsC(p) {
+    if (p.axis_tag !== 'C')
+        throw new Error(`expected axis C projection, got ${p.axis_tag}`);
+    return p.axis_data;
+}
+//# sourceMappingURL=project.js.map