agent-passport-system 3.3.1 → 4.1.0

package/dist/src/core/reversibility-fold.js

@@ -0,0 +1,513 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+// Reversibility fold - foundation (spec v2, reversibility-fold-design-v2.md)
+//
+// A new primitive that reuses the trust-domain-counting and provisional/final
+// lifecycle patterns already established in APS, applied to reversibility.
+//
+// This module is the FOUNDATION only: the two-axis output types and their
+// projection (step 1), and the versioned mapping-profile registry (step 2).
+// It touches no receipt envelope, no gateway, and no existing wire shape.
+// The effect-instantiation block, lifecycle records, fold, divergence, and
+// admission checkpoint are later steps and are not implemented here.
+import { createHash } from 'node:crypto';
+import { sign, verify } from '../crypto/keys.js';
+import { canonicalizeJCS } from './canonical-jcs.js';
+/** Pure projection realized -> enforcement (spec section 0).
+ *  `unresolved` becomes `irreversible` (conservative, fail-closed). Every
+ *  other value is the identity. This is the ONLY place `unresolved` is
+ *  mapped to `irreversible`; realized truth is never rewritten. */
+export function enforcementFrom(realized) {
+    return realized === 'unresolved' ? 'irreversible' : realized;
+}
+/** Stable id of the v0 mapping profile. Chosen value; the spec fixes no
+ *  literal, only that classification_profile_id must be bound. */
+export const REVERSIBILITY_MAPPING_V0_ID = 'reversibility-mapping-v0';
+/** The v0 mapping rules (v4 sections 4, 4.1, 10), as a pure function.
+ *
+ *  v0 has NO external-compensable path. External compensability is a FUTURE
+ *  profile (reversibility-mapping-v1) built on the deferred four-object subsystem
+ *  of v4 section 10, never a branch inside the v0 profile. v4 section 10 rejects
+ *  the domain-separation-without-authority model (a non-empty reversal-right
+ *  signer different from the principal): a registration outside operator control
+ *  shows only separation, not authority-over-a-mechanism, so it cannot ground
+ *  compensability. This profile must not behave differently by entry point.
+ *
+ *  - external-irreversible AND external-reversible -> irreversible. Upper bound
+ *    (label upper_bound) unless finality is settled AND the target binding is
+ *    verified. The two external buckets are treated identically in v0.
+ *  - internal -> irreversible, treated exactly like an external-irreversible
+ *    effect (upper_bound unless finality settled AND target binding verified). A
+ *    self-declared recovery_mechanism_ref derives nothing (v4 s4 / s4.1), so v0
+ *    has no internal-compensable path.
+ *  - unbound / missing externality -> unresolved.
+ *  v0 therefore emits no compensable outcome at all. */
+export function classifyV0(facts) {
+    const ext = facts.externality;
+    // Unbound / missing externality: we cannot even name the bucket. Honest
+    // unresolved; enforcementFrom() lifts this to irreversible for admission.
+    if (ext === undefined || ext === null) {
+        return { realized: 'unresolved', reason: 'RM_V0_UNBOUND' };
+    }
+    // Any external effect -> irreversible; upper bound unless finality is settled
+    // AND target binding verified. v0 has no external-compensable path, so the
+    // legacy 'external-reversible' taxonomy value is treated exactly as
+    // 'external-irreversible' here (no compensable branch, no reversal-right read).
+    if (ext === 'external-irreversible' || ext === 'external-reversible') {
+        const finalityVerified = facts.finalityState === 'settled';
+        const definitive = finalityVerified && facts.targetBindingVerified === true;
+        return definitive
+            ? { realized: 'irreversible', reason: 'RM_V0_EXTERNAL_DEFINITIVE' }
+            : { realized: 'irreversible', label: 'upper_bound', reason: 'RM_V0_EXTERNAL_UPPER_BOUND' };
+    }
+    // internal -> irreversible in v0. A self-declared recovery_mechanism_ref is
+    // self-attestation and derives NOTHING about the class (v4 s4 / s4.1), the same
+    // conflation removed for the external path: a producer cannot mint
+    // compensability by naming a rollback path. v0 has no verifier-checked recovery
+    // evidence (recoveryMechanismRef, recoveryController, recovery_deadline, and
+    // evidence_status are all producer-declared, and the only verifier-supplied
+    // signal, targetBindingVerified, is the external resource-confirmation check).
+    // internal-compensable requires a verified recovery result that v0 defers, so
+    // internal is treated exactly as an external-irreversible effect: irreversible
+    // plus upper_bound, unless finality is settled AND the binding is verified. v0
+    // therefore has no compensable outcome at all, the sound and consistent
+    // position across both externality axes.
+    if (ext === 'internal') {
+        const finalityVerified = facts.finalityState === 'settled';
+        const definitive = finalityVerified && facts.targetBindingVerified === true;
+        return definitive
+            ? { realized: 'irreversible', reason: 'RM_V0_INTERNAL_DEFINITIVE' }
+            : { realized: 'irreversible', label: 'upper_bound', reason: 'RM_V0_INTERNAL_UPPER_BOUND' };
+    }
+    // Unreachable for typed inputs. Any unrecognized externality bucket is
+    // treated as unbound and fails to unresolved (never a compensable fall-open).
+    return { realized: 'unresolved', reason: 'RM_V0_UNBOUND' };
+}
+/** The v0 profile function object. */
+export const reversibilityMappingV0 = {
+    id: REVERSIBILITY_MAPPING_V0_ID,
+    classify: classifyV0,
+};
+/** The AUTHORITATIVE, canonical content of the v0 profile (v4 section 4): its
+ *  input schema, mapping rules, reason-code set, and time semantics, and nothing
+ *  else. No runtime, diagnostic, or human-facing metadata (display name,
+ *  comments, timestamps) is included, so those can change without changing the
+ *  content digest. This object is what the digest commits to. */
+export const REVERSIBILITY_PROFILE_V0_CONTENT = {
+    profile_id: REVERSIBILITY_MAPPING_V0_ID,
+    input_fields: ['externality', 'finality_state', 'target_binding_verified'],
+    externality_values: ['internal', 'external-reversible', 'external-irreversible'],
+    finality_values: ['settled', 'pending', 'expired', 'contradicted'],
+    external_compensable: false,
+    internal_compensable: false,
+    // label is present only when the rule emits one (upper_bound). No null values
+    // anywhere in the content: the three SDK JCS implementations disagree on
+    // null-valued keys (TS and Python drop them, Go keeps them), so a null-free
+    // content is the parity-safe form that canonicalizes byte-identically.
+    // v0 has no compensable outcome: both compensable strengths require verified
+    // recovery evidence that v0 defers, and a self-declared recovery_mechanism_ref
+    // derives nothing, so it is not a classification input.
+    rules: [
+        { id: 'unbound', when: 'externality_absent', realized: 'unresolved', reason: 'RM_V0_UNBOUND' },
+        { id: 'external_definitive', when: 'externality_external AND finality_settled AND target_binding_verified', realized: 'irreversible', reason: 'RM_V0_EXTERNAL_DEFINITIVE' },
+        { id: 'external_upper_bound', when: 'externality_external AND NOT(finality_settled AND target_binding_verified)', realized: 'irreversible', label: 'upper_bound', reason: 'RM_V0_EXTERNAL_UPPER_BOUND' },
+        { id: 'internal_definitive', when: 'externality_internal AND finality_settled AND target_binding_verified', realized: 'irreversible', reason: 'RM_V0_INTERNAL_DEFINITIVE' },
+        { id: 'internal_upper_bound', when: 'externality_internal AND NOT(finality_settled AND target_binding_verified)', realized: 'irreversible', label: 'upper_bound', reason: 'RM_V0_INTERNAL_UPPER_BOUND' },
+    ],
+    reason_codes: ['RM_V0_UNBOUND', 'RM_V0_EXTERNAL_DEFINITIVE', 'RM_V0_EXTERNAL_UPPER_BOUND', 'RM_V0_INTERNAL_DEFINITIVE', 'RM_V0_INTERNAL_UPPER_BOUND'],
+    time_semantics: { clock_skew_ms: 0, finality_source: 'bound_input', target_binding_source: 'verifier_supplied' },
+    schema_version: 'v0',
+};
+/** Domain-separated content digest of a profile (v4 section 4):
+ *  SHA-256( UTF8("APS-REVERSIBILITY-PROFILE-V0") || 0x00 || UTF8(JCS(content)) ).
+ *  Any language that JCS-canonicalizes the same content reproduces this byte-for-
+ *  byte. */
+export function profileContentDigest(content) {
+    const preimage = Buffer.concat([
+        Buffer.from('APS-REVERSIBILITY-PROFILE-V0', 'utf8'),
+        Buffer.from([0x00]),
+        Buffer.from(canonicalizeJCS(content), 'utf8'),
+    ]);
+    return 'sha256:' + createHash('sha256').update(preimage).digest('hex');
+}
+/** The v0 profile's content digest. */
+export const REVERSIBILITY_MAPPING_V0_DIGEST = profileContentDigest(REVERSIBILITY_PROFILE_V0_CONTENT);
+/** The immutable content-addressed registry (v4 section 4). It never mutates an
+ *  existing (id, digest) pair; a change to a profile's content yields a new
+ *  digest and is a NEW profile with a new id. Resolving an unknown id, or an
+ *  (id, digest) mismatch, is a DISTINCT failure, never a silent fallback. */
+const PROFILE_REGISTRY = new Map([
+    [REVERSIBILITY_MAPPING_V0_ID, {
+            profile: reversibilityMappingV0,
+            content: REVERSIBILITY_PROFILE_V0_CONTENT,
+            digest: REVERSIBILITY_MAPPING_V0_DIGEST,
+            metadata: {
+                display_name: 'Reversibility mapping v0',
+                description: 'Fail-closed v0 classifier: internal and external both resolve to irreversible; no compensable outcome, since verified recovery evidence is deferred.',
+            },
+        }],
+]);
+/** Resolve a mapping profile function by its classification_profile_id. Returns
+ *  undefined for an unknown id (a distinct event from unbound facts). */
+export function getClassificationProfile(id) {
+    return PROFILE_REGISTRY.get(id)?.profile;
+}
+/** Resolve the full registered profile (function, content, digest, metadata). */
+export function getRegisteredProfile(id) {
+    return PROFILE_REGISTRY.get(id);
+}
+/** The registry's content digest for a profile id, or undefined if unknown. */
+export function getProfileDigest(id) {
+    return PROFILE_REGISTRY.get(id)?.digest;
+}
+/** The set of registered profile ids. */
+export function registeredProfileIds() {
+    return [...PROFILE_REGISTRY.keys()];
+}
+/** Check a declared profile id + content digest against the immutable registry.
+ *  An id not in the registry fails unknown_profile; a known id whose declared
+ *  digest does not equal the registry digest fails digest_mismatch. */
+export function verifyProfileBinding(id, declaredDigest) {
+    const registered = PROFILE_REGISTRY.get(id);
+    if (registered === undefined) {
+        return { ok: false, reason: 'unknown_profile', classificationProfileId: id };
+    }
+    if (declaredDigest !== registered.digest) {
+        return { ok: false, reason: 'digest_mismatch', classificationProfileId: id, declaredDigest, expectedDigest: registered.digest };
+    }
+    return { ok: true, digest: registered.digest };
+}
+/** Map an RAPV0 externality onto the value used for EffectFacts.externality.
+ *  'none' or absent -> undefined (unbound), which classifies unresolved.
+ *  internal -> internal. Both external buckets -> external-irreversible: the
+ *  legacy 'external-reversible' taxonomy carried a stronger meaning than v0
+ *  grants, so it is NOT passed through as-is; mapping it to external-irreversible
+ *  keeps it from being a backdoor into compensability (v4 s4/s10). This is a pure
+ *  adapter, not an import-and-couple. */
+export function rapvExternalityToEffectFacts(externality) {
+    if (externality == null || externality === 'none')
+        return undefined;
+    if (externality === 'internal')
+        return 'internal';
+    return 'external-irreversible';
+}
+/** Derive the classifier externality bucket from an element's raw facts (v4
+ *  section 4.1). internal -> internal. external -> external-irreversible,
+ *  ALWAYS, in v0: there is no verified reversal right in v0, so no external
+ *  effect reaches external-reversible, and a self-declared recovery_mechanism_ref
+ *  derives NOTHING about the class. recovery_mechanism_ref remains a carried raw
+ *  fact and still informs the INTERNAL branch's observable-recovery test; it is
+ *  simply not evidence of reversibility for an external effect. Downstream, an
+ *  external effect classifies to irreversible + upper_bound (target binding is
+ *  not verified in v0), never bare irreversible and never compensable. */
+function deriveExternality(element) {
+    if (element.effect_scope === 'internal')
+        return 'internal';
+    return 'external-irreversible';
+}
+/** Build classifier facts from an element plus verifier context. Note what is
+ *  deliberately NOT supplied here: actingPrincipal and the external reversal-
+ *  right attestation are the actor axis (a later step), so an external-
+ *  reversible effect fails closed to irreversible under this recompute until
+ *  that step supplies verified actor-axis facts. targetBindingVerified comes
+ *  only from the verifier context, never from the element (hard rule). */
+function effectFactsFromElement(element, options) {
+    return {
+        externality: deriveExternality(element),
+        recoveryController: element.recovery_controller,
+        recoveryMechanismRef: element.recovery_mechanism_ref,
+        finalityState: element.finality_state,
+        targetBindingVerified: options?.targetBindingVerified === true,
+    };
+}
+/** Recompute the realized class for one effect element. Resolves the mapping
+ *  profile by classification_profile_id; an unknown id is surfaced as its own
+ *  failure and is NOT classified. Otherwise runs the profile over the element's
+ *  facts and returns the ClassificationResult. */
+export function recomputeEffect(element, options) {
+    const registered = getRegisteredProfile(element.classification_profile_id);
+    if (registered === undefined) {
+        return { status: 'unknown_profile', classificationProfileId: element.classification_profile_id };
+    }
+    // Bind id to content: a declared digest that does not match the registry is a
+    // DISTINCT failure from an unknown profile, and is not classified.
+    if (element.classification_profile_digest !== registered.digest) {
+        return {
+            status: 'profile_digest_mismatch',
+            classificationProfileId: element.classification_profile_id,
+            declaredDigest: element.classification_profile_digest,
+            expectedDigest: registered.digest,
+        };
+    }
+    const facts = effectFactsFromElement(element, options);
+    return {
+        status: 'recomputed',
+        classificationProfileId: element.classification_profile_id,
+        result: registered.profile.classify(facts),
+    };
+}
+/** Recompute every effect in a block, per element. No folding or collapsing to
+ *  a maximum here (that is the fold, a later step). */
+export function recomputeBlock(block, options) {
+    return block.instantiated_effects.map((e) => recomputeEffect(e, options));
+}
+/** Verify an element's asserted cache class (if any) against the recompute.
+ *  A cache is a convenience only and is never trusted: a mismatch fails. An
+ *  unknown profile or a profile-digest mismatch cannot be verified and surfaces
+ *  distinctly. */
+export function verifyAssertedClass(element, options) {
+    const outcome = recomputeEffect(element, options);
+    if (outcome.status === 'unknown_profile') {
+        return { ok: false, reason: 'unknown_profile', classificationProfileId: outcome.classificationProfileId };
+    }
+    if (outcome.status === 'profile_digest_mismatch') {
+        return {
+            ok: false,
+            reason: 'profile_digest_mismatch',
+            classificationProfileId: outcome.classificationProfileId,
+            declaredDigest: outcome.declaredDigest,
+            expectedDigest: outcome.expectedDigest,
+        };
+    }
+    const recomputed = outcome.result;
+    if (element.asserted_realized_class === undefined) {
+        return { ok: true, recomputed };
+    }
+    if (element.asserted_realized_class !== recomputed.realized) {
+        return { ok: false, reason: 'mismatch', asserted: element.asserted_realized_class, recomputed: recomputed.realized };
+    }
+    return { ok: true, recomputed };
+}
+/** SHA-256 (over strict JCS bytes) of an execution receipt. Any change to the
+ *  execution receipt changes this hash, so a hash-link detects a rewrite. */
+export function hashExecutionReceipt(receipt) {
+    return 'sha256:' + createHash('sha256').update(canonicalizeJCS(receipt)).digest('hex');
+}
+/** Create a reconciliation receipt hash-linked to an execution receipt and
+ *  signed over its canonical body. Does not touch the execution receipt. */
+export function createReconciliationReceipt(execution, input) {
+    const body = {
+        stage: 'reconciliation',
+        execution_receipt_hash: hashExecutionReceipt(execution),
+        action_ref: execution.action_ref,
+        realized_class: input.realized_class,
+        evidence_status: input.evidence_status,
+        reconciled_at: input.reconciled_at,
+    };
+    const value = sign(canonicalizeJCS(body), input.signerPrivateKey);
+    return { ...body, signature: { algorithm: 'Ed25519', public_key: input.signerPublicKey, value } };
+}
+/** The realized classes a reconciliation may refine a pending stage into.
+ *  pending -> compensable and pending -> irreversible only. */
+const MONOTONIC_RECONCILED_CLASSES = new Set([
+    'compensable',
+    'irreversible',
+]);
+/** Validate a reconciliation against its execution receipt. Rejects a broken
+ *  hash-link (a rewritten execution receipt), an invalid signature, a stage
+ *  that is not pending, and any non-monotonic realized class. */
+export function validateTransition(execution, reconciliation) {
+    const errors = [];
+    // Hash-link integrity: the reconciliation must reference THIS execution
+    // receipt. A post-hoc rewrite of the execution receipt breaks the link.
+    if (reconciliation.execution_receipt_hash !== hashExecutionReceipt(execution)) {
+        errors.push('hash-link mismatch: reconciliation does not reference this execution receipt');
+    }
+    if (reconciliation.action_ref !== execution.action_ref) {
+        errors.push('action_ref mismatch between stages');
+    }
+    // Signature over the reconciliation body (excluding the signature block).
+    const { signature, ...body } = reconciliation;
+    if (!verify(canonicalizeJCS(body), signature.value, signature.public_key)) {
+        errors.push('reconciliation signature invalid');
+    }
+    // Monotonic transition: the execution stage is provisional (pending); the
+    // reconciliation may only refine to compensable or irreversible. Anything
+    // else is an arbitrary replacement and is rejected.
+    if (execution.evidence_status !== 'pending') {
+        errors.push('execution receipt is not in the pending stage');
+    }
+    if (!MONOTONIC_RECONCILED_CLASSES.has(reconciliation.realized_class)) {
+        errors.push(`non-monotonic realized_class '${reconciliation.realized_class}' (only compensable or irreversible refine a pending stage)`);
+    }
+    return { ok: errors.length === 0, errors };
+}
+/** The enforcement class that GOVERNED admission. This reads ONLY the execution
+ *  receipt: the reconciliation's realized class is audit-time truth and carries
+ *  no enforcement power, so a consumer cannot read the final class as the one
+ *  that gated the action. */
+export function admittedEnforcementClass(execution) {
+    return execution.admitted_enforcement_class;
+}
+// ══════════════════════════════════════
+// STEP v0-2 - Effect identity and lineage (v4 section 2)
+// ══════════════════════════════════════
+//
+// Every effect element carries a stable identity so precedence is defined
+// without array position. The fold (a later step) classifies from the LATEST
+// valid lineage state per effect_id, never from position in instantiated_effects
+// and never from the existence of a right. This step adds and validates the
+// identity fields only; it does not build the fold.
+/** The signed authoritative fields of one effect state as a null-free object
+ *  (v4 section 2). It commits to every signed field: effect_id, sequence,
+ *  predecessor_effect_state_hash, the raw effect facts, classification_profile_id,
+ *  classification_profile_digest, the evidence status, and the receipt/action
+ *  binding (action_ref, action_instance_id). The asserted class is signed content
+ *  and part of the state identity, so it is included when present, but it is
+ *  non-authoritative for classification (a verifier recomputes). Computed
+ *  verification outputs, the state hash itself, and out-of-object signatures are
+ *  excluded: the builder reads only the known signed fields, so an extra property
+ *  on the element object cannot enter the preimage. Only non-null fields are
+ *  included, the same parity-safe rule the profile content follows, because the
+ *  SDK JCS implementations diverge on null-valued keys. */
+export function effectStatePreimage(el) {
+    const p = {
+        effect_scope: el.effect_scope,
+        effect_target_ref: el.effect_target_ref,
+        finality_state: el.finality_state,
+        evidence_status: el.evidence_status,
+        classification_profile_id: el.classification_profile_id,
+        classification_profile_digest: el.classification_profile_digest,
+        action_ref: el.action_ref,
+        action_instance_id: el.action_instance_id,
+        effect_id: el.effect_id,
+        sequence: el.sequence,
+    };
+    if (el.recovery_mechanism_ref != null)
+        p.recovery_mechanism_ref = el.recovery_mechanism_ref;
+    if (el.recovery_controller != null)
+        p.recovery_controller = el.recovery_controller;
+    if (el.recovery_deadline != null)
+        p.recovery_deadline = el.recovery_deadline;
+    if (el.predecessor_effect_state_hash != null)
+        p.predecessor_effect_state_hash = el.predecessor_effect_state_hash;
+    if (el.asserted_realized_class !== undefined)
+        p.asserted_realized_class = el.asserted_realized_class;
+    return p;
+}
+/** Domain-separated hash of one effect state (v4 section 2):
+ *  SHA-256( UTF8("APS-REVERSIBILITY-EFFECT-STATE-V0") || 0x00 || UTF8(JCS(preimage)) )
+ *  over the null-free preimage of every signed authoritative field. Chains a
+ *  lineage: a later state's predecessor_effect_state_hash references this. Any
+ *  language that JCS-canonicalizes the same preimage reproduces it byte-for-byte. */
+export function hashEffectState(element) {
+    const preimage = Buffer.concat([
+        Buffer.from('APS-REVERSIBILITY-EFFECT-STATE-V0', 'utf8'),
+        Buffer.from([0x00]),
+        Buffer.from(canonicalizeJCS(effectStatePreimage(element)), 'utf8'),
+    ]);
+    return 'sha256:' + createHash('sha256').update(preimage).digest('hex');
+}
+/** Deterministic derivation of an effect_id (v4 section 2):
+ *  base64url( SHA-256( UTF8("APS-REVERSIBILITY-EFFECT-ID-V0") || 0x00 ||
+ *  UTF8(JCS({action_ref, action_instance_id, local_effect_id})) ) ), where
+ *  local_effect_id is unique within the receipt and STABLE across retries (an
+ *  id, not a nonce). The id is a function of stable inputs, so a retry produces
+ *  the same effect_id and the same lineage identity. */
+export function deriveEffectId(action_ref, action_instance_id, local_effect_id) {
+    const preimage = Buffer.concat([
+        Buffer.from('APS-REVERSIBILITY-EFFECT-ID-V0', 'utf8'),
+        Buffer.from([0x00]),
+        Buffer.from(canonicalizeJCS({ action_ref, action_instance_id, local_effect_id }), 'utf8'),
+    ]);
+    return createHash('sha256').update(preimage).digest('base64url');
+}
+/** Validate one effect_id's lineage, order-invariant. First removes exact
+ *  duplicates (same full hash), then enforces the graph invariant. */
+function validateOneLineage(states) {
+    // Deduplicate exact-duplicate states by full effect-state hash.
+    const byHash = new Map();
+    let duplicate_count = 0;
+    for (const s of states) {
+        const h = hashEffectState(s);
+        if (byHash.has(h))
+            duplicate_count++;
+        else
+            byHash.set(h, s);
+    }
+    const unique = [...byHash.values()];
+    // Exactly one root at sequence 0 with a null predecessor.
+    const roots = unique.filter((s) => s.predecessor_effect_state_hash === null);
+    if (roots.length > 1)
+        return { status: 'equivocation', duplicate_count };
+    if (roots.length === 0)
+        return { status: 'lineage_incomplete', duplicate_count };
+    if (roots[0].sequence !== 0)
+        return { status: 'lineage_incomplete', duplicate_count };
+    // Fork: no predecessor hash may have more than one distinct successor. This
+    // holds regardless of the successors' sequences, so a fork whose branches sit
+    // at different sequences is still a fork, not a broken link.
+    const succOfPred = new Map();
+    for (const s of unique) {
+        if (s.predecessor_effect_state_hash !== null) {
+            succOfPred.set(s.predecessor_effect_state_hash, (succOfPred.get(s.predecessor_effect_state_hash) ?? 0) + 1);
+        }
+    }
+    if ([...succOfPred.values()].some((c) => c > 1)) {
+        return { status: 'lineage_conflicted', duplicate_count };
+    }
+    // At most one state per sequence. A remaining collision (not from a shared
+    // predecessor, since forks were already caught) is an equivocation about the
+    // position: two states claim the same sequence with different hashes.
+    const bySeq = new Map();
+    for (const s of unique)
+        bySeq.set(s.sequence, (bySeq.get(s.sequence) ?? 0) + 1);
+    if ([...bySeq.values()].some((c) => c > 1)) {
+        return { status: 'equivocation', duplicate_count };
+    }
+    // Consecutive sequences 0..n-1 (a gap is incomplete), and each state at n>0
+    // references the hash of the state at n-1 (else the chain link is invalid).
+    const ordered = [...unique].sort((a, b) => a.sequence - b.sequence);
+    for (let i = 0; i < ordered.length; i++) {
+        if (ordered[i].sequence !== i)
+            return { status: 'lineage_incomplete', duplicate_count };
+    }
+    for (let i = 1; i < ordered.length; i++) {
+        if (ordered[i].predecessor_effect_state_hash !== hashEffectState(ordered[i - 1])) {
+            return { status: 'invalid_state', duplicate_count };
+        }
+    }
+    return { status: 'ok', duplicate_count };
+}
+/** Validate the identity and lineage structure of a block, independent of array
+ *  order (v4 section 2, corrected). Returns a TYPED status plus a duplicate_count.
+ *  The block is ok only when every effect_id's lineage is ok; otherwise the
+ *  status is that of the lexicographically first non-ok effect_id (deterministic).
+ *  This validates identity only; the lineage-based fold reading (classify from
+ *  the latest lineage state per effect_id) is the fold, not built here. */
+export function validateEffectLineage(block) {
+    const byEffect = new Map();
+    for (const el of block.instantiated_effects) {
+        const states = byEffect.get(el.effect_id) ?? [];
+        states.push(el);
+        byEffect.set(el.effect_id, states);
+    }
+    let duplicate_count = 0;
+    let firstNonOk;
+    for (const effectId of [...byEffect.keys()].sort()) {
+        const r = validateOneLineage(byEffect.get(effectId));
+        duplicate_count += r.duplicate_count;
+        if (r.status !== 'ok' && firstNonOk === undefined)
+            firstNonOk = r.status;
+    }
+    return { status: firstNonOk ?? 'ok', duplicate_count };
+}
+/** The latest valid state per effect_id, but ONLY for an ok lineage. Returns
+ *  undefined for any non-ok block, so a caller cannot pull a latest state from an
+ *  incomplete, conflicted, equivocating, or invalid lineage. Order-invariant. */
+export function latestValidEffectStates(block) {
+    if (validateEffectLineage(block).status !== 'ok')
+        return undefined;
+    const byEffect = new Map();
+    for (const el of block.instantiated_effects) {
+        const states = byEffect.get(el.effect_id) ?? [];
+        states.push(el);
+        byEffect.set(el.effect_id, states);
+    }
+    const latest = new Map();
+    for (const [id, states] of byEffect) {
+        latest.set(id, [...states].sort((a, b) => b.sequence - a.sequence)[0]);
+    }
+    return latest;
+}
+//# sourceMappingURL=reversibility-fold.js.map

package/dist/src/core/reversibility-fold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reversibility-fold.js","sourceRoot":"","sources":["../../../src/core/reversibility-fold.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA4BpD;;;mEAGmE;AACnE,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,OAAO,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC9D,CAAC;AAuGD;kEACkE;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;wDAkBwD;AACxD,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAA;IAE7B,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC5D,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,oEAAoE;IACpE,gFAAgF;IAChF,IAAI,GAAG,KAAK,uBAAuB,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;QACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAA;QAC1D,MAAM,UAAU,GAAG,gBAAgB,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAA;QAC3E,OAAO,UAAU;YACf,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,2BAA2B,EAAE;YACnE,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;IAC9F,CAAC;IAED,4EAA4E;IAC5E,gFAAgF;IAChF,mEAAmE;IACnE,gFAAgF;IAChF,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvB,MAAM,gBAAgB,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAA;QAC1D,MAAM,UAAU,GAAG,gBAAgB,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAA;QAC3E,OAAO,UAAU;YACf,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,2BAA2B,EAAE;YACnE,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;IAC9F,CAAC;IAED,uEAAuE;IACvE,8EAA8E;IAC9E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;AAC5D,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAA0B;IAC3D,EAAE,EAAE,2BAA2B;IAC/B,QAAQ,EAAE,UAAU;CACrB,CAAA;AAED;;;;iEAIiE;AACjE,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,UAAU,EAAE,2BAA2B;IACvC,YAAY,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,yBAAyB,CAAC;IAC1E,kBAAkB,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;IAChF,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC;IAClE,oBAAoB,EAAE,KAAK;IAC3B,oBAAoB,EAAE,KAAK;IAC3B,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,6EAA6E;IAC7E,+EAA+E;IAC/E,wDAAwD;IACxD,KAAK,EAAE;QACL,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE;QAC9F,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,uEAAuE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,2BAA2B,EAAE;QAC3K,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,4EAA4E,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE;QACxM,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,uEAAuE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,2BAA2B,EAAE;QAC3K,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,4EAA4E,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE;KACzM;IACD,YAAY,EAAE,CAAC,eAAe,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,4BAA4B,CAAC;IACrJ,cAAc,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,EAAE;IAChH,cAAc,EAAE,IAAI;CACrB,CAAA;AAED;;;YAGY;AACZ,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,MAAM,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxE,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,MAAM,+BAA+B,GAAG,oBAAoB,CAAC,gCAAgC,CAAC,CAAA;AAarG;;;6EAG6E;AAC7E,MAAM,gBAAgB,GAA2C,IAAI,GAAG,CAAC;IACvE,CAAC,2BAA2B,EAAE;YAC5B,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,gCAAgC;YACzC,MAAM,EAAE,+BAA+B;YACvC,QAAQ,EAAE;gBACR,YAAY,EAAE,0BAA0B;gBACxC,WAAW,EAAE,sJAAsJ;aACpK;SACF,CAAC;CACH,CAAC,CAAA;AAEF;yEACyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,EAAU;IACjD,OAAO,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;AAC1C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,OAAO,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AACjC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;AACzC,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AASD;;uEAEuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,cAAsB;IACrE,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC3C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,EAAE,EAAE,CAAA;IAC9E,CAAC;IACD,IAAI,cAAc,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,CAAA;IACjI,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAA;AAChD,CAAC;AA4ED;;;;;;yCAMyC;AACzC,MAAM,UAAU,4BAA4B,CAC1C,WAA+C;IAE/C,IAAI,WAAW,IAAI,IAAI,IAAI,WAAW,KAAK,MAAM;QAAE,OAAO,SAAS,CAAA;IACnE,IAAI,WAAW,KAAK,UAAU;QAAE,OAAO,UAAU,CAAA;IACjD,OAAO,uBAAuB,CAAA;AAChC,CAAC;AAoBD;;;;;;;;0EAQ0E;AAC1E,SAAS,iBAAiB,CAAC,OAAmC;IAC5D,IAAI,OAAO,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,UAAU,CAAA;IAC1D,OAAO,uBAAuB,CAAA;AAChC,CAAC;AAED;;;;;0EAK0E;AAC1E,SAAS,sBAAsB,CAC7B,OAAmC,EACnC,OAA0B;IAE1B,OAAO;QACL,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACvC,kBAAkB,EAAE,OAAO,CAAC,mBAAmB;QAC/C,oBAAoB,EAAE,OAAO,CAAC,sBAAsB;QACpD,aAAa,EAAE,OAAO,CAAC,cAAc;QACrC,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,KAAK,IAAI;KAC/D,CAAA;AACH,CAAC;AAED;;;kDAGkD;AAClD,MAAM,UAAU,eAAe,CAC7B,OAAmC,EACnC,OAA0B;IAE1B,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,OAAO,CAAC,yBAAyB,EAAE,CAAA;IAClG,CAAC;IACD,8EAA8E;IAC9E,mEAAmE;IACnE,IAAI,OAAO,CAAC,6BAA6B,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,yBAAyB;YACjC,uBAAuB,EAAE,OAAO,CAAC,yBAAyB;YAC1D,cAAc,EAAE,OAAO,CAAC,6BAA6B;YACrD,cAAc,EAAE,UAAU,CAAC,MAAM;SAClC,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACtD,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,uBAAuB,EAAE,OAAO,CAAC,yBAAyB;QAC1D,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;KAC3C,CAAA;AACH,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,cAAc,CAC5B,KAA+B,EAC/B,OAA0B;IAE1B,OAAO,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AAC3E,CAAC;AAWD;;;kBAGkB;AAClB,MAAM,UAAU,mBAAmB,CACjC,OAAmC,EACnC,OAA0B;IAE1B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,CAAA;IAC3G,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yBAAyB;YACjC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;YACxD,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,OAAO,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,uBAAuB,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,uBAAuB,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAA;IACtH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AACjC,CAAC;AA4DD;6EAC6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxF,CAAC;AAUD;4EAC4E;AAC5E,MAAM,UAAU,2BAA2B,CACzC,SAAgC,EAChC,KAAgC;IAEhC,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,gBAAyB;QAChC,sBAAsB,EAAE,oBAAoB,CAAC,SAAS,CAAC;QACvD,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAA;IACjE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAA;AACnG,CAAC;AAED;+DAC+D;AAC/D,MAAM,4BAA4B,GAA+B,IAAI,GAAG,CAAgB;IACtF,aAAa;IACb,cAAc;CACf,CAAC,CAAA;AAOF;;iEAEiE;AACjE,MAAM,UAAU,kBAAkB,CAChC,SAAgC,EAChC,cAA0C;IAE1C,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,cAAc,CAAC,sBAAsB,KAAK,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAA;IAC7F,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACnD,CAAC;IAED,0EAA0E;IAC1E,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,cAAc,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CACT,iCAAiC,cAAc,CAAC,cAAc,6DAA6D,CAC5H,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED;;;6BAG6B;AAC7B,MAAM,UAAU,wBAAwB,CAAC,SAAgC;IACvE,OAAO,SAAS,CAAC,0BAA0B,CAAA;AAC7C,CAAC;AAED,yCAAyC;AACzC,yDAAyD;AACzD,yCAAyC;AACzC,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,iFAAiF;AACjF,4EAA4E;AAC5E,oDAAoD;AAEpD;;;;;;;;;;;2DAW2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,EAA8B;IAChE,MAAM,CAAC,GAA4B;QACjC,YAAY,EAAE,EAAE,CAAC,YAAY;QAC7B,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;QACvC,cAAc,EAAE,EAAE,CAAC,cAAc;QACjC,eAAe,EAAE,EAAE,CAAC,eAAe;QACnC,yBAAyB,EAAE,EAAE,CAAC,yBAAyB;QACvD,6BAA6B,EAAE,EAAE,CAAC,6BAA6B;QAC/D,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;QACzC,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,QAAQ,EAAE,EAAE,CAAC,QAAQ;KACtB,CAAA;IACD,IAAI,EAAE,CAAC,sBAAsB,IAAI,IAAI;QAAE,CAAC,CAAC,sBAAsB,GAAG,EAAE,CAAC,sBAAsB,CAAA;IAC3F,IAAI,EAAE,CAAC,mBAAmB,IAAI,IAAI;QAAE,CAAC,CAAC,mBAAmB,GAAG,EAAE,CAAC,mBAAmB,CAAA;IAClF,IAAI,EAAE,CAAC,iBAAiB,IAAI,IAAI;QAAE,CAAC,CAAC,iBAAiB,GAAG,EAAE,CAAC,iBAAiB,CAAA;IAC5E,IAAI,EAAE,CAAC,6BAA6B,IAAI,IAAI;QAAE,CAAC,CAAC,6BAA6B,GAAG,EAAE,CAAC,6BAA6B,CAAA;IAChH,IAAI,EAAE,CAAC,uBAAuB,KAAK,SAAS;QAAE,CAAC,CAAC,uBAAuB,GAAG,EAAE,CAAC,uBAAuB,CAAA;IACpG,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;qFAIqF;AACrF,MAAM,UAAU,eAAe,CAAC,OAAmC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,MAAM,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;KACnE,CAAC,CAAA;IACF,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxE,CAAC;AAED;;;;;wDAKwD;AACxD,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,kBAA0B,EAAE,eAAuB;IACpG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,MAAM,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC;KAC1F,CAAC,CAAA;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAuBD;sEACsE;AACtE,SAAS,kBAAkB,CAAC,MAAoC;IAC9D,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsC,CAAA;IAC5D,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QAC5B,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,eAAe,EAAE,CAAA;;YAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAEnC,0DAA0D;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,6BAA6B,KAAK,IAAI,CAAC,CAAA;IAC5E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,CAAA;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAA;IAChF,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAA;IAErF,4EAA4E;IAC5E,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,6BAA6B,KAAK,IAAI,EAAE,CAAC;YAC7C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7G,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAA;IAC1D,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/E,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,CAAA;IACpD,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAA;IACzF,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;AAC1C,CAAC;AAED;;;;;2EAK2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,KAA+B;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwC,CAAA;IAChE,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACf,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACpC,CAAC;IACD,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,IAAI,UAAqC,CAAA;IACzC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAA;QACrD,eAAe,IAAI,CAAC,CAAC,eAAe,CAAA;QACpC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;YAAE,UAAU,GAAG,CAAC,CAAC,MAAM,CAAA;IAC1E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,eAAe,EAAE,CAAA;AACxD,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,uBAAuB,CACrC,KAA+B;IAE/B,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwC,CAAA;IAChE,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACf,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsC,CAAA;IAC5D,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/index.d.ts

@@ -148,7 +148,7 @@ export { computeContentHash, verifyContentHash, createContentAddressableIntent,
 export type { ScopeInterpretation, ContentHash, ContentHashAlgorithm, DecisionSemantics, DecisionArtifact, DecisionArtifactVerification, } from './types/decision-semantics.js';
 export type { CharterStatus, OfficeHolderMode, OfficeStatus, OfficeHolder, OfficeDelegationPolicy, Office, CharterSignature, DelegationSurvival, DissolutionPolicy, DisputeVenue, CharterCore, SuccessionTrigger, SuccessionRule, QuorumFailurePolicy, OfficeRegistry, CharterAmendment, CharterVerification, AmendmentVerification, OfficeTransfer, } from './types/charter.js';
 export type { KeyClassRequirement, MultiClassThresholdPolicy, ApprovalType, ApprovalPolicy, ApprovalSignature, ApprovalSubjectType, ApprovalRequest, ApprovalEvaluation, KeyClassStatus, } from './types/approval.js';
-export { createCharter, signCharter, verifyCharter, createAmendment, signAmendment, verifyAmendment, evaluateThreshold, createOfficeRegistry, createOfficeTransfer, createApprovalRequest, addApprovalSignature, evaluateApprovalRequest, findOffice, findOfficesByHolder, resolveSuccessor, checkIncompatibility, checkQuorum, } from './core/charter.js';
+export { createCharter, signCharter, verifyCharter, createAmendment, signAmendment, verifyAmendment, evaluateThreshold, createOfficeRegistry, createOfficeTransfer, createApprovalRequest, addApprovalSignature, evaluateApprovalRequest, approvalSignContent, findOffice, findOfficesByHolder, resolveSuccessor, checkIncompatibility, checkQuorum, } from './core/charter.js';
 export type { CreateCharterOptions, CreateAmendmentOptions, CreateOfficeTransferOptions } from './core/charter.js';
 export type { HybridTimestamp, TemporalBound, TemporalRights, TemporalOrdering, TemporalValidation, SessionBoundary, } from './types/time.js';
 export { DEFAULT_NTP_DRIFT_MS, DEFAULT_SESSION_GAP_MS, createHybridTimestamp, createHybridTimestampAt, createTemporalBound, compareTimestamps, isTemporalBoundExpired, validateTemporalRights, resetLogicalCounter, extractSessions, } from './core/time.js';