agent-passport-system 7.0.0 → 7.2.0

package/dist/src/v2/authority-revocation/types.d.ts

@@ -0,0 +1,136 @@
+import type { AuthorityDelegationV1 } from '../authority-delegation/types.js';
+/** Draft-native direct revocation of an AuthorityDelegationV1, draft-03 section 3.5.1.
+ *
+ *  Distinct from the pre-draft `RevocationRecord` in src/types/passport.ts, which carries
+ *  a raw public key in `revokedBy`, a free-text `reason`, no cascade transaction identity,
+ *  no nonce, no record_type and no domain-separated preimage. That record cannot represent
+ *  section 3.5.1 evidence and is not reused here. The two models stay distinguishable. */
+export declare const AUTHORITY_REVOCATION_RECORD_TYPE: 'aps:authority-revocation:v1';
+export declare const AUTHORITY_REVOCATION_VERSION: '1.0';
+/** The content over which `revocation_id` is computed: the record with `revocation_id`
+ *  and `signature` absent. `revoked_at` is inside it, as section 3.5.1 requires of the
+ *  revocation time. */
+export interface AuthorityRevocationBodyV1 {
+    record_type: typeof AUTHORITY_REVOCATION_RECORD_TYPE;
+    version: typeof AUTHORITY_REVOCATION_VERSION;
+    /** Content address of the revoked delegation: `sha256:<64 lowercase hex>`. */
+    delegation_id: string;
+    /** The revoking authority. Section 3.5 names exactly one party for a direct
+     *  revocation, the target delegation's issuer, so a valid record has
+     *  `revoker === delegation.issuer` for the delegation it names. */
+    revoker: string;
+    /** Which key signed. A non-empty string, and nothing more is required of its shape: no
+     *  local rule relates it to `revoker`. Whether the method belongs to the issuer is
+     *  decided only by key resolution against the target delegation's `issuer` at
+     *  `revoked_at`, which verifyAuthorityRevocation() performs. */
+    verification_method: string;
+    /** Canonical UTC-millisecond revocation time, supplied by the caller, never read from
+     *  a clock inside issuance. */
+    revoked_at: string;
+    /** Machine-readable reason. A non-empty string; section 3.5.1 fixes no grammar for one
+     *  and none is invented here. */
+    reason_code: string;
+    /** OPTIONAL free-text detail. Absent means the key is not present at all: JCS has no
+     *  canonical form for undefined, so an absent detail is never serialized as null. */
+    detail?: string;
+    /** The transaction identity shared by every record one cascade produces. Deterministic
+     *  and content-bound; see cascadeTransactionId() in canonical.ts. */
+    cascade_transaction_id: string;
+    /** 16 random bytes as 32 lowercase hexadecimal characters. */
+    nonce: string;
+}
+export interface AuthorityRevocationV1 extends AuthorityRevocationBodyV1 {
+    /** `sha256:<64 lowercase hex>` over the ID domain tag and JCS of the body. */
+    revocation_id: string;
+    /** Raw 64-byte Ed25519 signature as 128 lowercase hexadecimal characters. */
+    signature: string;
+}
+export type AuthorityRevocationFailureCode = 'SCHEMA_INVALID' | 'UNSUPPORTED_RECORD_TYPE' | 'UNSUPPORTED_VERSION' | 'NONCANONICAL_VALUE'
+/** revocation_id does not recompute from the record's own body. */
+ | 'ID_MISMATCH'
+/** cascade_transaction_id does not recompute from the record's own body. */
+ | 'CASCADE_TRANSACTION_MISMATCH'
+/** The delegation handed in is not the one this record names. */
+ | 'TARGET_MISMATCH'
+/** The delegation handed in does not recompute its own delegation_id, so its `issuer`
+ *  is not an authenticated field and the revoker check cannot be made against it. */
+ | 'TARGET_ID_MISMATCH'
+/** `revoker` is not the target delegation's `issuer`. */
+ | 'REVOKER_NOT_ISSUER' | 'KEY_RESOLUTION_FAILED' | 'KEY_SCHEME_UNSUPPORTED' | 'KEY_NOT_FOUND' | 'KEY_AMBIGUOUS' | 'KEY_UNREACHABLE' | 'KEY_MATERIAL_MALFORMED' | 'SIGNATURE_INVALID';
+export interface AuthorityRevocationFailure {
+    code: AuthorityRevocationFailureCode;
+    message: string;
+}
+export interface AuthorityRevocationVerificationResult {
+    state: 'valid' | 'invalid' | 'indeterminate' | 'unsupported';
+    valid: boolean;
+    failures: AuthorityRevocationFailure[];
+}
+/** What a store's first-write primitive reports: whether this call was the write that
+ *  took the first-wins slot, and what the store holds for the target now.
+ *
+ *  `inserted` is the only way a caller learns which of the two happened. `stored` is the
+ *  record passed in when `inserted` is true and the record already held when it is false,
+ *  so a caller that must distinguish them reads `inserted` rather than comparing bytes. */
+export interface AuthorityRevocationInsertion {
+    inserted: boolean;
+    stored: AuthorityRevocationV1;
+}
+/** The read and write boundary a revocation resolver needs.
+ *
+ *  Nothing in this interface promises durability. An implementation backed by process
+ *  memory, a file, or a replicated database all satisfy it; only the implementation says
+ *  which. Section 3.5.1 makes the cascade-completion record depend on the last
+ *  descendant's revocation being PERSISTENT, and no method here establishes persistence,
+ *  which is one reason no completion record is issued in this module.
+ *
+ *  This interface carries no method that takes an arbitrary, unverified record.
+ *  `insertVerifiedRevocation` is a persistence primitive, not an entry point: the only
+ *  supported way to move a candidate revocation into a store is
+ *  recordAuthorityRevocation() in record.ts, which verifies first and calls the primitive
+ *  only on a `valid` result. See that function for why the split exists. */
+export interface AuthorityRevocationStore {
+    /** Whether `delegationId` is inside this store's view at all.
+     *
+     *  This is what keeps absence from meaning "active". A store that has never heard of a
+     *  delegation cannot say the delegation is unrevoked; it can only say it does not know.
+     *  A store whose view covers the delegation and holds no revocation for it can. */
+    tracks(delegationId: string): boolean;
+    /** The revocation recorded for `delegationId`, or undefined when none is recorded. */
+    get(delegationId: string): AuthorityRevocationV1 | undefined;
+    /** Persistence primitive. Writes `revocation` only when this store holds no record for
+     *  `revocation.delegation_id`, and reports what it holds for that target now.
+     *
+     *  ACCEPTS ONLY A RECORD ALREADY VERIFIED AGAINST ITS TARGET DELEGATION by
+     *  recordAuthorityRevocation(). It performs no verification, and none is possible here:
+     *  verification needs the target delegation and a key resolver, neither of which a store
+     *  has. An implementation is a write path, not a trust boundary, and a caller that
+     *  reaches past recordAuthorityRevocation() to this method is the one asserting the
+     *  record was verified.
+     *
+     *  First verified revocation for a delegation wins. Revocation is irreversible (INV-5),
+     *  so a later call naming a delegation that already has a record does not replace it:
+     *  `inserted` is false and `stored` is the record already held, unchanged. The check for
+     *  an existing record and the write MUST be one indivisible operation, so that two
+     *  callers racing on the same delegation cannot both observe `inserted: true`.
+     *
+     *  For a DURABLE implementation that means the first write MUST be an atomic conditional
+     *  insert keyed by `delegation_id` — an insert the storage engine itself makes succeed
+     *  for exactly one of two concurrent callers, such as a unique-constrained primary key,
+     *  a compare-and-set, or an insert-if-absent. Reading the existing record and then
+     *  writing does NOT satisfy this contract: under concurrency two callers can both read
+     *  an empty slot before either writes, both report `inserted: true`, and the second
+     *  write displaces the first, which makes the recorded revocation time, reason and
+     *  revoker mutable after the fact and breaks first-wins and INV-5. The in-memory
+     *  reference meets the contract only because its read and write are one synchronous
+     *  statement sequence on a single-threaded runtime; that is a property of that runtime,
+     *  not a pattern a durable store may copy.
+     *
+     *  Brings its target into the tracked view: recording a revocation for a delegation is a
+     *  statement that this store has an opinion about that delegation. */
+    insertVerifiedRevocation(revocation: AuthorityRevocationV1): AuthorityRevocationInsertion;
+}
+/** What a gateway eventually supplies to the chain verifier. Interface only; no gateway
+ *  implementation lives in this repository. */
+export type AuthorityRevocationLookup = (delegation: AuthorityDelegationV1) => AuthorityRevocationV1 | undefined;
+//# sourceMappingURL=types.d.ts.map

package/dist/src/v2/authority-revocation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;;0FAK0F;AAC1F,eAAO,MAAM,gCAAgC,EAAG,6BAAsC,CAAA;AACtF,eAAO,MAAM,4BAA4B,EAAG,KAAc,CAAA;AAE1D;;uBAEuB;AACvB,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,OAAO,gCAAgC,CAAA;IACpD,OAAO,EAAE,OAAO,4BAA4B,CAAA;IAC5C,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAA;IACrB;;uEAEmE;IACnE,OAAO,EAAE,MAAM,CAAA;IACf;;;oEAGgE;IAChE,mBAAmB,EAAE,MAAM,CAAA;IAC3B;mCAC+B;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB;qCACiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB;yFACqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;yEACqE;IACrE,sBAAsB,EAAE,MAAM,CAAA;IAC9B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,qBAAsB,SAAQ,yBAAyB;IACtE,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAA;IACrB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,8BAA8B,GACtC,gBAAgB,GAChB,yBAAyB,GACzB,qBAAqB,GACrB,oBAAoB;AACtB,mEAAmE;GACjE,aAAa;AACf,4EAA4E;GAC1E,8BAA8B;AAChC,iEAAiE;GAC/D,iBAAiB;AACnB;qFACqF;GACnF,oBAAoB;AACtB,yDAAyD;GACvD,oBAAoB,GACpB,uBAAuB,GACvB,wBAAwB,GACxB,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,wBAAwB,GACxB,mBAAmB,CAAA;AAEvB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,8BAA8B,CAAA;IACpC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,aAAa,CAAA;IAC5D,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,0BAA0B,EAAE,CAAA;CACvC;AAED;;;;;2FAK2F;AAC3F,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,qBAAqB,CAAA;CAC9B;AAED;;;;;;;;;;;;4EAY4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC;;;;uFAImF;IACnF,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC,sFAAsF;IACtF,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;IAC5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0EA6BsE;IACtE,wBAAwB,CAAC,UAAU,EAAE,qBAAqB,GAAG,4BAA4B,CAAA;CAC1F;AAED;+CAC+C;AAC/C,MAAM,MAAM,yBAAyB,GAAG,CACtC,UAAU,EAAE,qBAAqB,KAC9B,qBAAqB,GAAG,SAAS,CAAA"}

package/dist/src/v2/authority-revocation/types.js

@@ -0,0 +1,11 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+/** Draft-native direct revocation of an AuthorityDelegationV1, draft-03 section 3.5.1.
+ *
+ *  Distinct from the pre-draft `RevocationRecord` in src/types/passport.ts, which carries
+ *  a raw public key in `revokedBy`, a free-text `reason`, no cascade transaction identity,
+ *  no nonce, no record_type and no domain-separated preimage. That record cannot represent
+ *  section 3.5.1 evidence and is not reused here. The two models stay distinguishable. */
+export const AUTHORITY_REVOCATION_RECORD_TYPE = 'aps:authority-revocation:v1';
+export const AUTHORITY_REVOCATION_VERSION = '1.0';
+//# sourceMappingURL=types.js.map

package/dist/src/v2/authority-revocation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/types.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAItC;;;;;0FAK0F;AAC1F,MAAM,CAAC,MAAM,gCAAgC,GAAG,6BAAsC,CAAA;AACtF,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAc,CAAA"}

package/dist/src/v2/authority-revocation/verify.d.ts

@@ -0,0 +1,38 @@
+import type { VerificationKeyResolver } from '../authority-delegation/types.js';
+import type { AuthorityRevocationVerificationResult } from './types.js';
+export interface AuthorityRevocationVerificationOptions {
+    /** Resolves the key that signed the revocation, selected at the revocation's own
+     *  `revoked_at`, per draft section 2.4: the key current at verification time is not
+     *  necessarily the one that signed this record. */
+    resolveVerificationKey: VerificationKeyResolver;
+}
+/**
+ * Verify one draft-03 section 3.5.1 direct revocation against the delegation it names.
+ *
+ * A revocation is never judged alone. Whether a record is a revocation of THIS delegation
+ * and whether its signer was allowed to revoke are both questions about the target, so the
+ * target is a required argument and every authorization fact is read from it.
+ *
+ * Checks, in order, returning at the first that fails:
+ *
+ *  1. closed schema and canonical values on the revocation
+ *  2. `cascade_transaction_id` recomputes from the record's own origin content
+ *  3. `revocation_id` recomputes from the record's own body
+ *  4. closed schema and canonical values on the target delegation
+ *  5. the target's `delegation_id` recomputes from the target's own body
+ *  6. the revocation's `delegation_id` equals the target's
+ *  7. the revocation's `revoker` equals the TARGET's `issuer` (draft section 3.5)
+ *  8. the revoker's key resolves, at the revocation's `revoked_at`
+ *  9. the Ed25519 signature verifies over the domain-tagged preimage
+ *
+ * Step 8 hands the resolver `target.issuer`, read from the target delegation, not the
+ * `revoker` the record carries. The two are equal by step 7, and reading the target's
+ * member is what makes the authorization external to the record: no field inside a
+ * revocation selects the key that authorizes it.
+ *
+ * Fails closed. Anything unrecognized, any resolver that throws, any shape this schema
+ * does not claim, produces invalid, indeterminate or unsupported, never valid. This
+ * function does not throw.
+ */
+export declare function verifyAuthorityRevocation(candidate: unknown, delegation: unknown, options: AuthorityRevocationVerificationOptions): AuthorityRevocationVerificationResult;
+//# sourceMappingURL=verify.d.ts.map

package/dist/src/v2/authority-revocation/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/verify.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAGV,uBAAuB,EACxB,MAAM,kCAAkC,CAAA;AASzC,OAAO,KAAK,EAIV,qCAAqC,EACtC,MAAM,YAAY,CAAA;AAEnB,MAAM,WAAW,sCAAsC;IACrD;;uDAEmD;IACnD,sBAAsB,EAAE,uBAAuB,CAAA;CAChD;AA6DD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,sCAAsC,GAC9C,qCAAqC,CA0DvC"}

package/dist/src/v2/authority-revocation/verify.js

@@ -0,0 +1,139 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+import { authorityDelegationBody, computeAuthorityDelegationId, } from '../authority-delegation/canonical.js';
+import { snapshotPlainData } from '../authority-delegation/plain-data.js';
+import { validateAuthorityDelegationShape } from '../authority-delegation/schema.js';
+import { authorityRevocationBody, authorityRevocationCascadeOrigin, computeAuthorityRevocationCascadeTransactionId, computeAuthorityRevocationId, verifyAuthorityRevocationSignature, } from './canonical.js';
+import { validateAuthorityRevocationShape } from './schema.js';
+const KEY_MATERIAL = /^[0-9a-fA-F]{64}$/;
+const UNSUPPORTED_CODES = new Set([
+    'UNSUPPORTED_RECORD_TYPE',
+    'UNSUPPORTED_VERSION',
+]);
+function result(state, failures) {
+    return { state, valid: state === 'valid', failures };
+}
+function invalid(code, message) {
+    return result('invalid', [{ code, message }]);
+}
+function indeterminate(code, message) {
+    return result('indeterminate', [{ code, message }]);
+}
+/** Map a resolver's answer onto the draft's section 2.5 outcomes, or null when it
+ *  resolved usable key material. An unsupported identifier scheme is unsupported;
+ *  everything else that is not a usable key is indeterminate, never SIGNATURE_INVALID,
+ *  because in those branches no signature was checked at all. */
+function keyResolutionFailure(resolved) {
+    if (typeof resolved === 'string') {
+        return KEY_MATERIAL.test(resolved)
+            ? null
+            : indeterminate('KEY_MATERIAL_MALFORMED', 'resolved key material is not a 32-byte Ed25519 public key');
+    }
+    if (resolved && typeof resolved === 'object' && typeof resolved.outcome === 'string') {
+        switch (resolved.outcome) {
+            case 'unsupported_scheme':
+                return result('unsupported', [{ code: 'KEY_SCHEME_UNSUPPORTED', message: 'identifier scheme is not supported by the resolver' }]);
+            case 'not_found':
+                return indeterminate('KEY_NOT_FOUND', 'revoker or key was not found');
+            case 'ambiguous':
+                return indeterminate('KEY_AMBIGUOUS', 'key resolution was ambiguous');
+            case 'unreachable':
+                return indeterminate('KEY_UNREACHABLE', 'key material was unreachable');
+            case 'malformed':
+                return indeterminate('KEY_MATERIAL_MALFORMED', 'resolved key material is structurally malformed');
+            default:
+                break;
+        }
+    }
+    return indeterminate('KEY_RESOLUTION_FAILED', 'revoker verification key could not be resolved');
+}
+/**
+ * Verify one draft-03 section 3.5.1 direct revocation against the delegation it names.
+ *
+ * A revocation is never judged alone. Whether a record is a revocation of THIS delegation
+ * and whether its signer was allowed to revoke are both questions about the target, so the
+ * target is a required argument and every authorization fact is read from it.
+ *
+ * Checks, in order, returning at the first that fails:
+ *
+ *  1. closed schema and canonical values on the revocation
+ *  2. `cascade_transaction_id` recomputes from the record's own origin content
+ *  3. `revocation_id` recomputes from the record's own body
+ *  4. closed schema and canonical values on the target delegation
+ *  5. the target's `delegation_id` recomputes from the target's own body
+ *  6. the revocation's `delegation_id` equals the target's
+ *  7. the revocation's `revoker` equals the TARGET's `issuer` (draft section 3.5)
+ *  8. the revoker's key resolves, at the revocation's `revoked_at`
+ *  9. the Ed25519 signature verifies over the domain-tagged preimage
+ *
+ * Step 8 hands the resolver `target.issuer`, read from the target delegation, not the
+ * `revoker` the record carries. The two are equal by step 7, and reading the target's
+ * member is what makes the authorization external to the record: no field inside a
+ * revocation selects the key that authorizes it.
+ *
+ * Fails closed. Anything unrecognized, any resolver that throws, any shape this schema
+ * does not claim, produces invalid, indeterminate or unsupported, never valid. This
+ * function does not throw.
+ */
+export function verifyAuthorityRevocation(candidate, delegation, options) {
+    const read = (key) => {
+        try {
+            return options ? options[key] : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const resolveVerificationKey = read('resolveVerificationKey');
+    const snapshot = snapshotPlainData(candidate);
+    const shapeFailures = validateAuthorityRevocationShape(snapshot);
+    if (shapeFailures.length > 0) {
+        const unsupported = shapeFailures.every(item => UNSUPPORTED_CODES.has(item.code));
+        return result(unsupported ? 'unsupported' : 'invalid', shapeFailures);
+    }
+    const revocation = snapshot;
+    const body = authorityRevocationBody(revocation);
+    const origin = authorityRevocationCascadeOrigin(body);
+    if (computeAuthorityRevocationCascadeTransactionId(origin) !== revocation.cascade_transaction_id) {
+        return invalid('CASCADE_TRANSACTION_MISMATCH', 'cascade_transaction_id does not recompute from the record');
+    }
+    if (computeAuthorityRevocationId(body) !== revocation.revocation_id) {
+        return invalid('ID_MISMATCH', 'revocation content address does not match its body');
+    }
+    const target = snapshotPlainData(delegation);
+    const targetFailures = validateAuthorityDelegationShape(target);
+    if (targetFailures.length > 0) {
+        return invalid('SCHEMA_INVALID', `target delegation invalid (${targetFailures[0].code})`);
+    }
+    if (computeAuthorityDelegationId(authorityDelegationBody(target)) !== target.delegation_id) {
+        return invalid('TARGET_ID_MISMATCH', 'target delegation content address does not match its body');
+    }
+    if (revocation.delegation_id !== target.delegation_id) {
+        return invalid('TARGET_MISMATCH', 'revocation does not name this delegation');
+    }
+    // Draft section 3.5: a delegation may be revoked by its issuer, and by nobody else this
+    // document names.
+    if (revocation.revoker !== target.issuer) {
+        return invalid('REVOKER_NOT_ISSUER', 'revoker is not the target delegation issuer');
+    }
+    if (typeof resolveVerificationKey !== 'function') {
+        return indeterminate('KEY_RESOLUTION_FAILED', 'no verification key resolver was supplied');
+    }
+    let resolved = null;
+    try {
+        // target.issuer, not revocation.revoker: the authorizing identity comes from the
+        // record being revoked.
+        resolved = resolveVerificationKey(target.issuer, revocation.verification_method, revocation.revoked_at);
+    }
+    catch {
+        resolved = null;
+    }
+    const keyFailure = keyResolutionFailure(resolved);
+    if (keyFailure)
+        return keyFailure;
+    if (!verifyAuthorityRevocationSignature(revocation, resolved)) {
+        return invalid('SIGNATURE_INVALID', 'Ed25519 signature is invalid');
+    }
+    return result('valid', []);
+}
+//# sourceMappingURL=verify.js.map

package/dist/src/v2/authority-revocation/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/authority-revocation/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AAEtC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAA;AAMpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,8CAA8C,EAC9C,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAe9D,MAAM,YAAY,GAAG,mBAAmB,CAAA;AAExC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAiC;IAChE,yBAAyB;IACzB,qBAAqB;CACtB,CAAC,CAAA;AAEF,SAAS,MAAM,CACb,KAAqD,EACrD,QAAsC;IAEtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,OAAO,CACd,IAAoC,EACpC,OAAe;IAEf,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,aAAa,CACpB,IAAoC,EACpC,OAAe;IAEf,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;iEAGiE;AACjE,SAAS,oBAAoB,CAC3B,QAA0D;IAE1D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,aAAa,CAAC,wBAAwB,EAAE,2DAA2D,CAAC,CAAA;IAC1G,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAQ,QAAiC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/G,QAAS,QAAiC,CAAC,OAAO,EAAE,CAAC;YACnD,KAAK,oBAAoB;gBACvB,OAAO,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC,CAAA;YACnI,KAAK,WAAW;gBACd,OAAO,aAAa,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAA;YACvE,KAAK,WAAW;gBACd,OAAO,aAAa,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAA;YACvE,KAAK,aAAa;gBAChB,OAAO,aAAa,CAAC,iBAAiB,EAAE,8BAA8B,CAAC,CAAA;YACzE,KAAK,WAAW;gBACd,OAAO,aAAa,CAAC,wBAAwB,EAAE,iDAAiD,CAAC,CAAA;YACnG;gBACE,MAAK;QACT,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,uBAAuB,EAAE,gDAAgD,CAAC,CAAA;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAkB,EAClB,UAAmB,EACnB,OAA+C;IAE/C,MAAM,IAAI,GAAG,CAAC,GAAiD,EAAW,EAAE;QAC1E,IAAI,CAAC;YAAC,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAA;QAAC,CAAC;IAC9E,CAAC,CAAA;IACD,MAAM,sBAAsB,GAAG,IAAI,CAAC,wBAAwB,CAAwC,CAAA;IAEpG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAA;IAC7C,MAAM,aAAa,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAA;IAChE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACjF,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,QAAiC,CAAA;IAEpD,MAAM,IAAI,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,8CAA8C,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,sBAAsB,EAAE,CAAC;QACjG,OAAO,OAAO,CAAC,8BAA8B,EAAE,2DAA2D,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;QACpE,OAAO,OAAO,CAAC,aAAa,EAAE,oDAAoD,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAA0B,CAAA;IACrE,MAAM,cAAc,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAA;IAC/D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,gBAAgB,EAAE,8BAA8B,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,4BAA4B,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3F,OAAO,OAAO,CAAC,oBAAoB,EAAE,2DAA2D,CAAC,CAAA;IACnG,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAA;IAC/E,CAAC;IACD,wFAAwF;IACxF,kBAAkB;IAClB,IAAI,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,oBAAoB,EAAE,6CAA6C,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,OAAO,sBAAsB,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,QAAQ,GAAyC,IAAI,CAAA;IACzD,IAAI,CAAC;QACH,iFAAiF;QACjF,wBAAwB;QACxB,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,mBAAmB,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACjD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IAEjC,IAAI,CAAC,kCAAkC,CAAC,UAAU,EAAE,QAAkB,CAAC,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAC5B,CAAC"}

package/dist/src/v2/authority-state/fencing.d.ts

@@ -0,0 +1,49 @@
+import type { FencedWrite, FencedWriteOutcome, StateMarker } from './types.js';
+/**
+ * An authority-state publication log with a fencing gate on every write.
+ *
+ * Generic in the payload on purpose: this class orders writes and stores nothing about
+ * authority itself. The payload is whatever the deployment publishes as a state view, a
+ * store handle, a snapshot identifier or a record set. The SDK has no opinion about it.
+ *
+ * The gate, in one line each:
+ *
+ *  - a token BELOW the highest already accepted is refused, `stale_fencing_token`
+ *  - a token EQUAL to it is accepted, because equal has not gone backwards: the same holder
+ *    is retrying, and the retry is idempotent
+ *  - a token ABOVE it is accepted, and so is a token the log has never seen before, as long
+ *    as it does not go backwards. The gate fences state that is behind, not state that
+ *    merely differs
+ *  - a token counted in a DIFFERENT SCOPE from the log's is refused,
+ *    `fencing_scope_mismatch`, and an absent or malformed token is refused
+ *    `fencing_token_unreadable`. Two markers from different scopes order nothing, and a
+ *    write path that cannot order a token is not fenced. Neither refusal is in any source;
+ *    both are this module's choice, and they are kept apart because an unreadable token is
+ *    a different finding from a backwards one
+ *
+ * A refused write changes nothing: not the published payload, not the highest token. That
+ * is the property the whole class exists for, and a caller reads `accepted` to learn which
+ * of the two happened rather than comparing payloads.
+ *
+ * NOT DURABLE, NOT CONCURRENT, NOT A LOCK SERVICE. This holds one token and one payload in
+ * this process's heap. It acquires no lock, contacts no lock service, and its check-then-set
+ * is one synchronous statement sequence, which is safe on this runtime and is a property of
+ * the runtime rather than a pattern a durable store may copy. The same warning
+ * `InMemoryAuthorityRevocationStore` carries applies here for the same reason.
+ */
+export declare class FencedAuthorityStateLog<T> {
+    private highest;
+    private payload;
+    private written;
+    /** The highest token accepted so far, or `null` when nothing has been published. */
+    highestToken(): StateMarker | null;
+    /** What is published now. `undefined` when no write has landed, which a caller must tell
+     *  apart from a write that landed carrying `undefined`; `hasPublished()` is how. */
+    published(): T | undefined;
+    hasPublished(): boolean;
+    /** Submit a write. See the class doc for the four outcomes. Never throws for a malformed
+     *  token: an unreadable token is one that cannot be shown to have moved forward, so it is
+     *  refused. */
+    write(write: FencedWrite<T>): FencedWriteOutcome<T>;
+}
+//# sourceMappingURL=fencing.d.ts.map

package/dist/src/v2/authority-state/fencing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fencing.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/fencing.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,uBAAuB,CAAC,CAAC;IACpC,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,OAAO,CAAQ;IAEvB,oFAAoF;IACpF,YAAY,IAAI,WAAW,GAAG,IAAI,CAEjC;IAED;wFACoF;IACpF,SAAS,IAAI,CAAC,GAAG,SAAS,CAEzB;IAED,YAAY,IAAI,OAAO,CAEtB;IAED;;mBAEe;IACf,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAmBlD;CACF"}

package/dist/src/v2/authority-state/fencing.js

@@ -0,0 +1,92 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Fencing on the authority-state WRITE path.
+// See ./types.ts for the specification position. Proposed.
+//
+// WHY THIS IS A SEPARATE AXIS FROM THE READ PATH. A read-side high-water mark protects one
+// verifier that has already seen the newer state. It does nothing for a verifier that has
+// seen nothing, reading a published view that a stale writer republished underneath it. A
+// partition that resolves the wrong way rolls authority back with no restore involved, and
+// the read path never sees a regression because the published state simply IS the old
+// state. So the check has to exist where the write lands.
+//
+// The rule implemented here is the one Kleppmann's "How to do distributed locking" states:
+// the storage server takes an active role in checking tokens and rejects any write on which
+// the token has gone backwards. `OPEN-QUESTIONS.md` names authority rollback as open and
+// names an append-only revocation log a restore must replay as the other candidate
+// mechanism in the same sentence. That one is NOT modelled here. Neither is specified.
+import { compareStateMarker, sameScope } from './marker.js';
+/**
+ * An authority-state publication log with a fencing gate on every write.
+ *
+ * Generic in the payload on purpose: this class orders writes and stores nothing about
+ * authority itself. The payload is whatever the deployment publishes as a state view, a
+ * store handle, a snapshot identifier or a record set. The SDK has no opinion about it.
+ *
+ * The gate, in one line each:
+ *
+ *  - a token BELOW the highest already accepted is refused, `stale_fencing_token`
+ *  - a token EQUAL to it is accepted, because equal has not gone backwards: the same holder
+ *    is retrying, and the retry is idempotent
+ *  - a token ABOVE it is accepted, and so is a token the log has never seen before, as long
+ *    as it does not go backwards. The gate fences state that is behind, not state that
+ *    merely differs
+ *  - a token counted in a DIFFERENT SCOPE from the log's is refused,
+ *    `fencing_scope_mismatch`, and an absent or malformed token is refused
+ *    `fencing_token_unreadable`. Two markers from different scopes order nothing, and a
+ *    write path that cannot order a token is not fenced. Neither refusal is in any source;
+ *    both are this module's choice, and they are kept apart because an unreadable token is
+ *    a different finding from a backwards one
+ *
+ * A refused write changes nothing: not the published payload, not the highest token. That
+ * is the property the whole class exists for, and a caller reads `accepted` to learn which
+ * of the two happened rather than comparing payloads.
+ *
+ * NOT DURABLE, NOT CONCURRENT, NOT A LOCK SERVICE. This holds one token and one payload in
+ * this process's heap. It acquires no lock, contacts no lock service, and its check-then-set
+ * is one synchronous statement sequence, which is safe on this runtime and is a property of
+ * the runtime rather than a pattern a durable store may copy. The same warning
+ * `InMemoryAuthorityRevocationStore` carries applies here for the same reason.
+ */
+export class FencedAuthorityStateLog {
+    highest = null;
+    payload = undefined;
+    written = false;
+    /** The highest token accepted so far, or `null` when nothing has been published. */
+    highestToken() {
+        return this.highest;
+    }
+    /** What is published now. `undefined` when no write has landed, which a caller must tell
+     *  apart from a write that landed carrying `undefined`; `hasPublished()` is how. */
+    published() {
+        return this.payload;
+    }
+    hasPublished() {
+        return this.written;
+    }
+    /** Submit a write. See the class doc for the four outcomes. Never throws for a malformed
+     *  token: an unreadable token is one that cannot be shown to have moved forward, so it is
+     *  refused. */
+    write(write) {
+        const token = write?.token;
+        // Read the token on its own first. An unreadable token is a different finding from a
+        // stale one, and collapsing them would report a backwards move that never happened.
+        if (compareStateMarker(token, token) !== 'forward') {
+            return { accepted: false, code: 'fencing_token_unreadable', published: this.highest };
+        }
+        if (this.highest !== null) {
+            if (!sameScope(this.highest, token)) {
+                return { accepted: false, code: 'fencing_scope_mismatch', published: this.highest };
+            }
+            if (compareStateMarker(this.highest, token) !== 'forward') {
+                return { accepted: false, code: 'stale_fencing_token', published: this.highest };
+            }
+        }
+        this.highest = token;
+        this.payload = write.payload;
+        this.written = true;
+        return { accepted: true, published: token, payload: write.payload };
+    }
+}
+//# sourceMappingURL=fencing.js.map

package/dist/src/v2/authority-state/fencing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fencing.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/fencing.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,2FAA2F;AAC3F,0FAA0F;AAC1F,0FAA0F;AAC1F,2FAA2F;AAC3F,sFAAsF;AACtF,0DAA0D;AAC1D,EAAE;AACF,2FAA2F;AAC3F,4FAA4F;AAC5F,yFAAyF;AACzF,mFAAmF;AACnF,uFAAuF;AAEvF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,uBAAuB;IAC1B,OAAO,GAAuB,IAAI,CAAA;IAClC,OAAO,GAAkB,SAAS,CAAA;IAClC,OAAO,GAAG,KAAK,CAAA;IAEvB,oFAAoF;IACpF,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;wFACoF;IACpF,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;;mBAEe;IACf,KAAK,CAAC,KAAqB;QACzB,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAA;QAC1B,qFAAqF;QACrF,oFAAoF;QACpF,IAAI,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QACvF,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;YACrF,CAAC;YACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;YAClF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACrE,CAAC;CACF"}

package/dist/src/v2/authority-state/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './marker.js';
+export * from './retained.js';
+export * from './fencing.js';
+export * from './withdrawal.js';
+export * from './report.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/authority-state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/index.ts"],"names":[],"mappings":"AAQA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA"}

package/dist/src/v2/authority-state/index.js

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN authority state markers, write fencing and revocation withdrawal.
+// Nothing here is required by draft-pidlisnyi-aps-03 and nothing here changes any existing
+// exported behaviour. Concept source: aeoess/agent-authority-lifecycle, invariant candidates
+// CAND-08 and CAND-02.
+export * from './types.js';
+export * from './marker.js';
+export * from './retained.js';
+export * from './fencing.js';
+export * from './withdrawal.js';
+export * from './report.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/authority-state/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,qFAAqF;AACrF,2FAA2F;AAC3F,6FAA6F;AAC7F,uBAAuB;AAEvB,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA"}

package/dist/src/v2/authority-state/marker.d.ts

@@ -0,0 +1,70 @@
+import { type MonotonicityOutcome, type StateMarker, type StateMarkerScope, type UnplaceableDisposition } from './types.js';
+/** Thrown when a caller asks for a marker the vocabulary does not allow. A shape rule
+ *  broken at construction is a programming error, not a verdict. Mirrors
+ *  `LifecycleStateError` in src/v2/lifecycle-state/. */
+export declare class AuthorityStateError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function isStateMarkerScope(value: unknown): value is StateMarkerScope;
+export declare function isMonotonicityOutcome(value: unknown): value is MonotonicityOutcome;
+export declare function isUnplaceableDisposition(value: unknown): value is UnplaceableDisposition;
+export interface StateMarkerInput {
+    readonly value: string;
+    readonly scope: StateMarkerScope;
+    readonly scope_ref?: string;
+}
+/**
+ * Build a `StateMarker`, enforcing its shape rules.
+ *
+ * 1. `value` is a canonical unsigned decimal integer, as a string. A number would lose
+ *    exactness past 2^53 - 1 and would admit `1.0`, `1e3` and `-1`, none of which orders
+ *    the way a generation counter has to.
+ * 2. `scope` is one of the four. There is no fifth and there is no default: which thing a
+ *    generation is counted within is the choice the proposed text does not make, so it has
+ *    to be stated rather than assumed.
+ * 3. `scope_ref` is present and non-empty exactly when `scope` is not `global`. A
+ *    per-delegation marker that does not say which delegation cannot be compared against
+ *    anything.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, `Authority epoch`.
+ */
+export declare function stateMarker(input: StateMarkerInput): StateMarker;
+/** Whether two markers are counted in the same thing and can therefore be ordered. */
+export declare function sameScope(a: StateMarker, b: StateMarker): boolean;
+/**
+ * Place a presented marker against what a verifier has established.
+ *
+ * | established | presented          | outcome       |
+ * |-------------|--------------------|---------------|
+ * | `null`      | any                | `unplaceable` |
+ * | any         | `null`             | `unplaceable` |
+ * | any         | a different scope  | `unplaceable` |
+ * | m           | >= m               | `forward`     |
+ * | m           | < m                | `regressed`   |
+ *
+ * Equal is `forward`, not a third thing: a view that has not moved has not gone backwards.
+ *
+ * `unplaceable` is where the honesty of the whole module sits. It is returned for a first
+ * read and for a cross-scope comparison, it is NOT a verdict, and nothing downstream turns
+ * it into one on its own. The proposed text gives a verifier with no prior observation
+ * nothing to compare against and does not say whether such a read is trusted or refused.
+ *
+ * Comparison is integer, through BigInt, never lexical: "10" is after "9".
+ *
+ * Never throws for a malformed marker. A marker this function cannot read is one it cannot
+ * place, which is `unplaceable`, and throwing on the read path of a state comparison would
+ * turn a data problem into a crash in a verifier.
+ */
+export declare function compareStateMarker(established: StateMarker | null | undefined, presented: StateMarker | null | undefined): MonotonicityOutcome;
+/**
+ * The high-water mark a verifier holds after reading a presented view.
+ *
+ * It only ever moves forward. A regressed view does not lower it, an unplaceable view does
+ * not replace it, and a verifier that had none adopts the presented one. This is the
+ * "monotonicity against what the verifier has established" limb of CAND-08, which is
+ * weaker than a rule against global truth and is the honest strength available: a verifier
+ * that has never seen the newer state cannot detect a regression and is not at fault.
+ */
+export declare function advanceHighWaterMark(established: StateMarker | null | undefined, presented: StateMarker | null | undefined): StateMarker | null;
+//# sourceMappingURL=marker.d.ts.map

package/dist/src/v2/authority-state/marker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marker.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/marker.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,YAAY,CAAA;AAEnB;;wDAEwD;AACxD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIxC;CACF;AAMD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,WAAW,CAgChE;AAED,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EAC3C,SAAS,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,GACxC,mBAAmB,CAMrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EAC3C,SAAS,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,GACxC,WAAW,GAAG,IAAI,CAIpB"}