agent-passport-system 7.0.0 → 7.2.0

package/dist/src/v2/authority-state/types.js

@@ -0,0 +1,103 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Authority state markers, write fencing, and withdrawal of a recorded
+// revocation.
+//
+// NOT REQUIRED BY draft-pidlisnyi-aps-03. The published text contains no occurrence of
+// `epoch`, `fencing`, `snapshot`, `replica` or `restore`, and defines no record for
+// withdrawing a revocation. What it does fix, and what this module is careful not to
+// disturb, is section 3.3: "Verification returns one of valid, invalid, indeterminate, or
+// unsupported with a stable failure code", and section 3.5: "Revocation is irreversible."
+// `AuthorityValidationState`, `AuthorityValidationResult`, `AuthorityRevocationStore` and
+// everything `verifyAuthorityDelegationChain` returns are unchanged, and a caller that does
+// not import this module sees exactly today's behaviour.
+//
+// Concept source: the aeoess/agent-authority-lifecycle concept document
+// (AUTHORITY-LIFECYCLE.md, the `Authority epoch` concept and invariants L3, L7 and L11;
+// OPEN-QUESTIONS.md, `Authority rollback`) and its invariant candidates CAND-08 (no silent
+// restoration from rollback or stale state) and CAND-02 (later evidence does not rewrite
+// earlier evidence). Every one of those is proposed, not specified. Nothing here claims
+// otherwise, and `OPEN-QUESTIONS.md` keeps open both the mechanism and what a verifier
+// should return after a restore.
+//
+// Three deliberate non-decisions are encoded as types rather than as behaviour:
+//
+//  1. The proposed text says an authority epoch is "where a system uses generations" and
+//     stops. It does not say who advances one, whether it is global or per delegation,
+//     whether it is signed, or what evidence carries it. `StateMarker` is therefore an
+//     opaque comparable supplied by the caller, and this module defines only the comparison.
+//  2. A verifier with no prior observation has nothing to compare against. That is
+//     `unplaceable`, and it is not a verdict. The caller says what to do with it.
+//  3. Who may withdraw a revocation is not stated anywhere. Standing is resolved through an
+//     injected callback and never read from the record asserting it.
+/** What a marker is counted within. Comparing two markers from different scopes orders
+ *  nothing, so the comparison reports `unplaceable` rather than inventing an order.
+ *
+ *  The proposed text names none of these. They exist because the fixture that forced this
+ *  module had to pick one (it picked a global integer on a state view) and recorded that
+ *  the choice was not read from the text. Carrying the scope makes that choice visible in
+ *  the record instead of implicit in the deployment. Proposed. */
+export const STATE_MARKER_SCOPES = ['global', 'per_delegation', 'per_principal', 'per_store'];
+/** The result of placing a presented marker against what a verifier has established.
+ *
+ *  - `forward`      the presented marker advanced, or held equal. Read the view normally.
+ *  - `regressed`    the presented marker went backwards against an established high-water
+ *                   mark. CAND-08's refusal case.
+ *  - `unplaceable`  there is nothing to compare against, or the two markers are counted in
+ *                   different scopes. **Deliberately not a verdict.** A high-water mark has
+ *                   to start somewhere and neither the proposed text nor draft-03 says
+ *                   whether a first read is trusted or refused. Both are defensible and the
+ *                   outcomes differ, so this module reports the fact and the caller
+ *                   decides. See `UnplaceableDisposition`. */
+export const MONOTONICITY_OUTCOMES = ['forward', 'regressed', 'unplaceable'];
+/** What a caller wants done with an `unplaceable` presented view. Required, with no
+ *  default, because the SDK picking one would be the SDK deciding a question its own
+ *  concept source records as undecided. */
+export const UNPLACEABLE_DISPOSITIONS = ['read_presented', 'refuse'];
+/** Why a fenced write was refused.
+ *
+ *  - `stale_fencing_token`     the token went backwards against the highest already seen.
+ *                              The only one of the three the source states.
+ *  - `fencing_scope_mismatch`  the token is counted in a different scope from the log's, so
+ *                              it cannot be ordered against what the log holds.
+ *  - `fencing_token_unreadable` the token is absent or not a well-formed `StateMarker`.
+ *
+ *  A write path that cannot order a token is not fenced, so the second and third refuse
+ *  rather than guess. Neither is in any source; both are this module's choice. */
+export const FENCED_WRITE_REFUSAL_CODES = [
+    'stale_fencing_token',
+    'fencing_scope_mismatch',
+    'fencing_token_unreadable',
+];
+/** The record type a withdrawal carries.
+ *
+ *  `proposed:` is load-bearing. Record fields, failure-class names and verifier semantics
+ *  are conformance vocabulary reserved to the maintainer, and neither draft-03 nor the
+ *  proposed text defines a record for withdrawing a recorded revocation or says what a
+ *  verifier should do with one. This is a placeholder to argue about, not APS vocabulary. */
+export const REVOCATION_WITHDRAWAL_RECORD_TYPE = 'proposed:aps:revocation-withdrawal:v0';
+export const REVOCATION_WITHDRAWAL_VERSION = '0';
+/** What an injected standing resolver may answer.
+ *
+ *  `unknown` is a first-class answer and is not `no_standing`. A verifier that cannot
+ *  establish whether the withdrawer had standing has not established that they lacked it,
+ *  and the refusal reason says which of the two happened. */
+export const WITHDRAWAL_STANDINGS = ['has_standing', 'no_standing', 'unknown'];
+/** Why a withdrawal was accepted or refused. Stable, module-local codes. */
+export const WITHDRAWAL_OUTCOME_CODES = [
+    /** Accepted as a record. Accepted never means the revocation is gone. */
+    'WITHDRAWAL_ACCEPTED',
+    /** The record is not a well-formed `RevocationWithdrawalV0`. */
+    'WITHDRAWAL_SCHEMA_INVALID',
+    /** No revocation in the held set carries the `revocation_id` this record names. */
+    'WITHDRAWAL_NAMES_NO_HELD_REVOCATION',
+    /** The named revocation exists but is a revocation of a different delegation. */
+    'WITHDRAWAL_TARGET_MISMATCH',
+    /** The resolver established that this party may not withdraw this revocation. */
+    'WITHDRAWAL_SIGNER_WITHOUT_STANDING',
+    /** The resolver could not establish standing either way. Not the same finding as the
+     *  one above, and reported as `not_established` rather than as a denial. */
+    'WITHDRAWAL_STANDING_NOT_ESTABLISHED',
+];
+//# sourceMappingURL=types.js.map

package/dist/src/v2/authority-state/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/types.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,yFAAyF;AACzF,cAAc;AACd,EAAE;AACF,uFAAuF;AACvF,oFAAoF;AACpF,qFAAqF;AACrF,0FAA0F;AAC1F,0FAA0F;AAC1F,0FAA0F;AAC1F,4FAA4F;AAC5F,yDAAyD;AACzD,EAAE;AACF,wEAAwE;AACxE,wFAAwF;AACxF,2FAA2F;AAC3F,yFAAyF;AACzF,wFAAwF;AACxF,uFAAuF;AACvF,iCAAiC;AACjC,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,yFAAyF;AACzF,uFAAuF;AACvF,uFAAuF;AACvF,6FAA6F;AAC7F,mFAAmF;AACnF,kFAAkF;AAClF,4FAA4F;AAC5F,qEAAqE;AAIrE;;;;;;kEAMkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,CAAU,CAAA;AAsBtG;;;;;;;;;;8DAU8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAU,CAAA;AAIrF;;2CAE2C;AAC3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAU,CAAA;AA6B7E;;;;;;;;;kFASkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,qBAAqB;IACrB,wBAAwB;IACxB,0BAA0B;CAClB,CAAA;AAoBV;;;;;6FAK6F;AAC7F,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAgD,CAAA;AACjG,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAY,CAAA;AAkCzD;;;;6DAI6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,SAAS,CAAU,CAAA;AAgBvF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,yEAAyE;IACzE,qBAAqB;IACrB,gEAAgE;IAChE,2BAA2B;IAC3B,mFAAmF;IACnF,qCAAqC;IACrC,iFAAiF;IACjF,4BAA4B;IAC5B,iFAAiF;IACjF,oCAAoC;IACpC;gFAC4E;IAC5E,qCAAqC;CAC7B,CAAA"}

package/dist/src/v2/authority-state/withdrawal.d.ts

@@ -0,0 +1,80 @@
+import type { AuthorityRevocationV1 } from '../authority-revocation/types.js';
+import { type CorrectedRevocationView, type RevocationWithdrawalV0, type WithdrawalEvaluation, type WithdrawalStanding, type WithdrawalStandingResolver } from './types.js';
+export declare function isWithdrawalStanding(value: unknown): value is WithdrawalStanding;
+export interface RevocationWithdrawalInput {
+    readonly revocation_id: string;
+    readonly delegation_id: string;
+    readonly withdrawn_by: string;
+    readonly withdrawn_at: string;
+    readonly reason_code: string;
+    readonly detail?: string;
+}
+/**
+ * Build a `RevocationWithdrawalV0`.
+ *
+ * A shape constructor and nothing more. It does not sign, does not canonicalize, and does
+ * not compute an identifier, because minting the signed form of a record type is a
+ * conformance-vocabulary decision reserved to the maintainer and this module is not making
+ * it. `record_type` carries the `proposed:` namespace for the same reason.
+ *
+ * An absent `detail` is absent, never `null`: the key is not present at all, matching how
+ * the revocation record treats its own optional detail.
+ */
+export declare function revocationWithdrawal(input: RevocationWithdrawalInput): RevocationWithdrawalV0;
+/** A standing resolver that accepts a withdrawal only from the party the revocation itself
+ *  names as revoker.
+ *
+ *  Supplied because it is the rule the forcing fixture chose and it needs to be runnable.
+ *  IT IS A CHOICE, NOT A RULE READ FROM ANY TEXT. Draft-03 section 3.5 names the issuer as
+ *  the party who may revoke; nothing in draft-03 or in the proposed text says who may
+ *  withdraw a revocation, and the concept document's own `Lifecycle standing` entry says
+ *  the party who may change an artifact "is not always the issuer". A deployment whose
+ *  authority model gives a security function, a successor or a quorum standing to correct a
+ *  publication error should pass its own resolver instead of this one. */
+export declare const withdrawalSignerIsRevoker: WithdrawalStandingResolver;
+/**
+ * Decide whether one withdrawal record is accepted against a set of held revocations.
+ *
+ * Four questions, kept separate on purpose, each with its own code:
+ *
+ *  1. Is the record a well-formed withdrawal? `WITHDRAWAL_SCHEMA_INVALID`.
+ *  2. Does it name a revocation the held set actually contains?
+ *     `WITHDRAWAL_NAMES_NO_HELD_REVOCATION`.
+ *  3. Does that revocation revoke the delegation this record names?
+ *     `WITHDRAWAL_TARGET_MISMATCH`.
+ *  4. May this party withdraw it? Asked of the injected resolver, never of the record.
+ *     `WITHDRAWAL_SIGNER_WITHOUT_STANDING` when the resolver establishes they may not, and
+ *     `WITHDRAWAL_STANDING_NOT_ESTABLISHED` when it cannot establish either way.
+ *
+ * The last split is the wording rule, executable: a standing question the verifier could
+ * not answer is not established, and that is not the same finding as a party established to
+ * lack standing. Both refuse the withdrawal, and a caller reporting the refusal has to be
+ * able to say which one happened.
+ *
+ * AUTHENTICATION IS THE CALLER'S. This function never checks a signature, because a
+ * withdrawal has no signed form in this SDK, on purpose; see `RevocationWithdrawalV0`.
+ * Whoever calls it is the party asserting the record is genuine, exactly as whoever calls
+ * `insertVerifiedRevocation` asserts the revocation was verified.
+ *
+ * NOTHING HERE REMOVES A REVOCATION, on any path. An accepted withdrawal is a record about
+ * a record. The held set handed in is not mutated and no store is touched.
+ */
+export declare function evaluateRevocationWithdrawal(withdrawal: RevocationWithdrawalV0, heldRevocations: readonly AuthorityRevocationV1[], resolveStanding: WithdrawalStandingResolver): WithdrawalEvaluation;
+/**
+ * The current position of one revocation together with every withdrawal referencing it.
+ *
+ * This is the field that did not exist. A verifier that must report "revoked, and the
+ * revoker later said this was recorded in error" had nowhere to put the second half, in
+ * either reference SDK or in the proposed text, so it could only report the first half and
+ * drop the rest.
+ *
+ * `revocation` is present and unchanged whether or not anything was accepted. Accepted
+ * withdrawals are listed, refused ones are listed with their codes, and neither list makes
+ * the revocation ineffective: a later finding is a new record that references the earlier
+ * one and states its own effect, never an edit of it and never its removal.
+ *
+ * Withdrawals naming a different revocation are not silently dropped. They are evaluated,
+ * refused `WITHDRAWAL_NAMES_NO_HELD_REVOCATION`, and appear in `refused`.
+ */
+export declare function correctedRevocationView(revocation: AuthorityRevocationV1, withdrawals: readonly RevocationWithdrawalV0[], resolveStanding: WithdrawalStandingResolver): CorrectedRevocationView;
+//# sourceMappingURL=withdrawal.d.ts.map

package/dist/src/v2/authority-state/withdrawal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/withdrawal.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,YAAY,CAAA;AAInB,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAEhF;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CA8C7F;AAED;;;;;;;;;0EAS0E;AAC1E,eAAO,MAAM,yBAAyB,EAAE,0BACyC,CAAA;AAgBjF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,sBAAsB,EAClC,eAAe,EAAE,SAAS,qBAAqB,EAAE,EACjD,eAAe,EAAE,0BAA0B,GAC1C,oBAAoB,CAqDtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,qBAAqB,EACjC,WAAW,EAAE,SAAS,sBAAsB,EAAE,EAC9C,eAAe,EAAE,0BAA0B,GAC1C,uBAAuB,CAUzB"}

package/dist/src/v2/authority-state/withdrawal.js

@@ -0,0 +1,199 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Withdrawal, or correction, of a recorded revocation.
+// See ./types.ts for the specification position. Concept source:
+// aeoess/agent-authority-lifecycle, invariant candidate CAND-02 (later evidence does not
+// rewrite earlier evidence) and invariant L3 (reauthorization creates new authority).
+// Proposed.
+//
+// THE ONE SENTENCE THIS FILE EXISTS FOR. A corrected false revocation is a separate record,
+// not a resurrection. Draft-03 section 3.5 states "Revocation is irreversible", and nothing
+// below relaxes that: an accepted withdrawal leaves the revocation held, leaves it
+// verifying byte for byte, and leaves every chain verdict exactly where it was. What the
+// withdrawal changes is what a verifier can REPORT, which had no representation at all.
+//
+// Continuity after a correction still needs a fresh grant from a principal who currently
+// holds authority. This module mints no grant and no authority of any kind.
+import { AuthorityStateError } from './marker.js';
+import { REVOCATION_WITHDRAWAL_RECORD_TYPE, REVOCATION_WITHDRAWAL_VERSION, WITHDRAWAL_STANDINGS, } from './types.js';
+const ID = /^sha256:[0-9a-f]{64}$/;
+export function isWithdrawalStanding(value) {
+    return typeof value === 'string' && WITHDRAWAL_STANDINGS.includes(value);
+}
+/**
+ * Build a `RevocationWithdrawalV0`.
+ *
+ * A shape constructor and nothing more. It does not sign, does not canonicalize, and does
+ * not compute an identifier, because minting the signed form of a record type is a
+ * conformance-vocabulary decision reserved to the maintainer and this module is not making
+ * it. `record_type` carries the `proposed:` namespace for the same reason.
+ *
+ * An absent `detail` is absent, never `null`: the key is not present at all, matching how
+ * the revocation record treats its own optional detail.
+ */
+export function revocationWithdrawal(input) {
+    if (input === null || typeof input !== 'object') {
+        throw new AuthorityStateError('WITHDRAWAL_MALFORMED', 'a withdrawal input must be an object');
+    }
+    for (const field of ['revocation_id', 'delegation_id']) {
+        if (typeof input[field] !== 'string' || !ID.test(input[field])) {
+            throw new AuthorityStateError('WITHDRAWAL_ID_NONCANONICAL', `${field} must be sha256:<64 lowercase hex>`);
+        }
+    }
+    for (const field of ['withdrawn_by', 'withdrawn_at', 'reason_code']) {
+        if (typeof input[field] !== 'string' || input[field].length === 0) {
+            throw new AuthorityStateError('WITHDRAWAL_FIELD_REQUIRED', `${field} must be a non-empty string`);
+        }
+    }
+    if (input.detail !== undefined && (typeof input.detail !== 'string' || input.detail.length === 0)) {
+        throw new AuthorityStateError('WITHDRAWAL_DETAIL_INVALID', 'detail must be a non-empty string when present');
+    }
+    const record = {
+        record_type: REVOCATION_WITHDRAWAL_RECORD_TYPE,
+        version: REVOCATION_WITHDRAWAL_VERSION,
+        revocation_id: input.revocation_id,
+        delegation_id: input.delegation_id,
+        withdrawn_by: input.withdrawn_by,
+        withdrawn_at: input.withdrawn_at,
+        reason_code: input.reason_code,
+    };
+    if (input.detail !== undefined)
+        record.detail = input.detail;
+    return Object.freeze(record);
+}
+/** A standing resolver that accepts a withdrawal only from the party the revocation itself
+ *  names as revoker.
+ *
+ *  Supplied because it is the rule the forcing fixture chose and it needs to be runnable.
+ *  IT IS A CHOICE, NOT A RULE READ FROM ANY TEXT. Draft-03 section 3.5 names the issuer as
+ *  the party who may revoke; nothing in draft-03 or in the proposed text says who may
+ *  withdraw a revocation, and the concept document's own `Lifecycle standing` entry says
+ *  the party who may change an artifact "is not always the issuer". A deployment whose
+ *  authority model gives a security function, a successor or a quorum standing to correct a
+ *  publication error should pass its own resolver instead of this one. */
+export const withdrawalSignerIsRevoker = (withdrawal, revocation) => withdrawal.withdrawn_by === revocation.revoker ? 'has_standing' : 'no_standing';
+function malformed(withdrawal) {
+    const w = withdrawal;
+    if (w === null || typeof w !== 'object')
+        return true;
+    if (w.record_type !== REVOCATION_WITHDRAWAL_RECORD_TYPE)
+        return true;
+    if (w.version !== REVOCATION_WITHDRAWAL_VERSION)
+        return true;
+    if (typeof w.revocation_id !== 'string' || !ID.test(w.revocation_id))
+        return true;
+    if (typeof w.delegation_id !== 'string' || !ID.test(w.delegation_id))
+        return true;
+    for (const field of ['withdrawn_by', 'withdrawn_at', 'reason_code']) {
+        const value = w[field];
+        if (typeof value !== 'string' || value.length === 0)
+            return true;
+    }
+    return false;
+}
+/**
+ * Decide whether one withdrawal record is accepted against a set of held revocations.
+ *
+ * Four questions, kept separate on purpose, each with its own code:
+ *
+ *  1. Is the record a well-formed withdrawal? `WITHDRAWAL_SCHEMA_INVALID`.
+ *  2. Does it name a revocation the held set actually contains?
+ *     `WITHDRAWAL_NAMES_NO_HELD_REVOCATION`.
+ *  3. Does that revocation revoke the delegation this record names?
+ *     `WITHDRAWAL_TARGET_MISMATCH`.
+ *  4. May this party withdraw it? Asked of the injected resolver, never of the record.
+ *     `WITHDRAWAL_SIGNER_WITHOUT_STANDING` when the resolver establishes they may not, and
+ *     `WITHDRAWAL_STANDING_NOT_ESTABLISHED` when it cannot establish either way.
+ *
+ * The last split is the wording rule, executable: a standing question the verifier could
+ * not answer is not established, and that is not the same finding as a party established to
+ * lack standing. Both refuse the withdrawal, and a caller reporting the refusal has to be
+ * able to say which one happened.
+ *
+ * AUTHENTICATION IS THE CALLER'S. This function never checks a signature, because a
+ * withdrawal has no signed form in this SDK, on purpose; see `RevocationWithdrawalV0`.
+ * Whoever calls it is the party asserting the record is genuine, exactly as whoever calls
+ * `insertVerifiedRevocation` asserts the revocation was verified.
+ *
+ * NOTHING HERE REMOVES A REVOCATION, on any path. An accepted withdrawal is a record about
+ * a record. The held set handed in is not mutated and no store is touched.
+ */
+export function evaluateRevocationWithdrawal(withdrawal, heldRevocations, resolveStanding) {
+    if (malformed(withdrawal)) {
+        return Object.freeze({
+            accepted: false,
+            reason_code: 'WITHDRAWAL_SCHEMA_INVALID',
+            standing: null,
+            withdrawal,
+        });
+    }
+    const target = (heldRevocations ?? []).find(r => r?.revocation_id === withdrawal.revocation_id);
+    if (target === undefined) {
+        return Object.freeze({
+            accepted: false,
+            reason_code: 'WITHDRAWAL_NAMES_NO_HELD_REVOCATION',
+            standing: null,
+            withdrawal,
+        });
+    }
+    if (target.delegation_id !== withdrawal.delegation_id) {
+        return Object.freeze({
+            accepted: false,
+            reason_code: 'WITHDRAWAL_TARGET_MISMATCH',
+            standing: null,
+            withdrawal,
+        });
+    }
+    let standing;
+    try {
+        standing = resolveStanding(withdrawal, target);
+    }
+    catch {
+        standing = 'unknown';
+    }
+    if (!isWithdrawalStanding(standing))
+        standing = 'unknown';
+    if (standing === 'has_standing') {
+        return Object.freeze({
+            accepted: true,
+            reason_code: 'WITHDRAWAL_ACCEPTED',
+            standing,
+            withdrawal,
+        });
+    }
+    return Object.freeze({
+        accepted: false,
+        reason_code: standing === 'no_standing'
+            ? 'WITHDRAWAL_SIGNER_WITHOUT_STANDING'
+            : 'WITHDRAWAL_STANDING_NOT_ESTABLISHED',
+        standing,
+        withdrawal,
+    });
+}
+/**
+ * The current position of one revocation together with every withdrawal referencing it.
+ *
+ * This is the field that did not exist. A verifier that must report "revoked, and the
+ * revoker later said this was recorded in error" had nowhere to put the second half, in
+ * either reference SDK or in the proposed text, so it could only report the first half and
+ * drop the rest.
+ *
+ * `revocation` is present and unchanged whether or not anything was accepted. Accepted
+ * withdrawals are listed, refused ones are listed with their codes, and neither list makes
+ * the revocation ineffective: a later finding is a new record that references the earlier
+ * one and states its own effect, never an edit of it and never its removal.
+ *
+ * Withdrawals naming a different revocation are not silently dropped. They are evaluated,
+ * refused `WITHDRAWAL_NAMES_NO_HELD_REVOCATION`, and appear in `refused`.
+ */
+export function correctedRevocationView(revocation, withdrawals, resolveStanding) {
+    const held = [revocation];
+    const evaluations = (withdrawals ?? []).map(w => evaluateRevocationWithdrawal(w, held, resolveStanding));
+    return Object.freeze({
+        revocation,
+        accepted: Object.freeze(evaluations.filter(e => e.accepted)),
+        refused: Object.freeze(evaluations.filter(e => !e.accepted)),
+    });
+}
+//# sourceMappingURL=withdrawal.js.map

package/dist/src/v2/authority-state/withdrawal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"withdrawal.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/withdrawal.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,iEAAiE;AACjE,yFAAyF;AACzF,sFAAsF;AACtF,YAAY;AACZ,EAAE;AACF,4FAA4F;AAC5F,4FAA4F;AAC5F,mFAAmF;AACnF,yFAAyF;AACzF,wFAAwF;AACxF,EAAE;AACF,yFAAyF;AACzF,4EAA4E;AAG5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,GAMrB,MAAM,YAAY,CAAA;AAEnB,MAAM,EAAE,GAAG,uBAAuB,CAAA;AAElC,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACjG,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAA;IAC/F,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,EAAE,eAAe,CAAU,EAAE,CAAC;QAChE,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,GAAG,KAAK,oCAAoC,CAC7C,CAAA;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,EAC3B,GAAG,KAAK,6BAA6B,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,EAC3B,gDAAgD,CACjD,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GASR;QACF,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,6BAA6B;QACtC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAA;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;;;;;0EAS0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAA+B,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAC9F,UAAU,CAAC,YAAY,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAA;AAEjF,SAAS,SAAS,CAAC,UAAmB;IACpC,MAAM,CAAC,GAAG,UAAoD,CAAA;IAC9D,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpD,IAAI,CAAC,CAAC,WAAW,KAAK,iCAAiC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,CAAC,CAAC,OAAO,KAAK,6BAA6B;QAAE,OAAO,IAAI,CAAA;IAC5D,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IACjF,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IACjF,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,CAAU,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAA;QACtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IAClE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAAkC,EAClC,eAAiD,EACjD,eAA2C;IAE3C,IAAI,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,2BAAoC;YACjD,QAAQ,EAAE,IAAI;YACd,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,UAAU,CAAC,aAAa,CAAC,CAAA;IAC/F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,qCAA8C;YAC3D,QAAQ,EAAE,IAAI;YACd,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,4BAAqC;YAClD,QAAQ,EAAE,IAAI;YACd,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAA4B,CAAA;IAChC,IAAI,CAAC;QACH,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,SAAS,CAAA;IACtB,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAAE,QAAQ,GAAG,SAAS,CAAA;IAEzD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,qBAA8B;YAC3C,QAAQ;YACR,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,KAAK;QACf,WAAW,EACT,QAAQ,KAAK,aAAa;YACxB,CAAC,CAAE,oCAA8C;YACjD,CAAC,CAAE,qCAA+C;QACtD,QAAQ;QACR,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAiC,EACjC,WAA8C,EAC9C,eAA2C;IAE3C,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACzB,MAAM,WAAW,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC9C,4BAA4B,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CACvD,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5D,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KAC7D,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/v2/bounds/canonical.d.ts

@@ -0,0 +1,30 @@
+import type { AuthorityBoundFulfilment, AuthorityBoundFulfilmentBody, AuthorityExhaustion, AuthorityExhaustionBody } from './types.js';
+/** Domain tags. Each is a distinct tag followed by one zero byte, the same discipline
+ *  `AuthorityDelegationV1` and `AuthorityRevocationV1` follow, so bytes minted for one
+ *  construction can never be read as bytes minted for another. The `PROPOSED-` prefix is
+ *  part of the tag: if any of this is ever specified, the specified construction will use a
+ *  different tag and records minted under this one will not verify under it. That is the
+ *  intended behaviour, not a migration problem to solve later. */
+export declare const AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN = "PROPOSED-APS-AUTHORITY-BOUND-FULFILMENT-SIGNATURE-V0\0";
+export declare const AUTHORITY_EXHAUSTION_ID_DOMAIN = "PROPOSED-APS-AUTHORITY-EXHAUSTION-ID-V0\0";
+export declare const AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN = "PROPOSED-APS-AUTHORITY-EXHAUSTION-SIGNATURE-V0\0";
+/** Exact Ed25519 preimage for a fulfilment attestation: the domain tag plus RFC 8785 JCS of
+ *  the record with `signature` absent. */
+export declare function authorityBoundFulfilmentSignatureInput(body: AuthorityBoundFulfilmentBody): string;
+/** Write-boundary twin. Use when ISSUING. The verification path keeps calling the
+ *  unrestricted form, so a record minted before the write rule still verifies. */
+export declare function authorityBoundFulfilmentSignatureInputForWrite(body: AuthorityBoundFulfilmentBody): string;
+export declare function signAuthorityBoundFulfilment(body: AuthorityBoundFulfilmentBody, privateKeyHex: string): string;
+export declare function verifyAuthorityBoundFulfilmentSignature(record: AuthorityBoundFulfilment, publicKeyHex: string): boolean;
+/** Exact preimage for `exhaustion_id`: the ID domain tag plus JCS of the body. */
+export declare function authorityExhaustionIdInput(body: AuthorityExhaustionBody): string;
+export declare function computeAuthorityExhaustionId(body: AuthorityExhaustionBody): string;
+export declare function computeAuthorityExhaustionIdForWrite(body: AuthorityExhaustionBody): string;
+/** Exact Ed25519 preimage for the exhaustion record: the signature domain tag plus JCS of
+ *  the record with `signature` absent. `exhaustion_id` IS inside this preimage, so the
+ *  identifier is signed rather than being an unauthenticated label beside the signature. */
+export declare function authorityExhaustionSignatureInput(record: Omit<AuthorityExhaustion, 'signature'>): string;
+export declare function authorityExhaustionSignatureInputForWrite(record: Omit<AuthorityExhaustion, 'signature'>): string;
+export declare function signAuthorityExhaustion(record: Omit<AuthorityExhaustion, 'signature'>, privateKeyHex: string): string;
+export declare function verifyAuthorityExhaustionSignature(record: AuthorityExhaustion, publicKeyHex: string): boolean;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/src/v2/bounds/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/canonical.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,YAAY,CAAA;AAEnB;;;;;kEAKkE;AAClE,eAAO,MAAM,2CAA2C,2DACE,CAAA;AAC1D,eAAO,MAAM,8BAA8B,8CAA8C,CAAA;AACzF,eAAO,MAAM,qCAAqC,qDACE,CAAA;AAWpD;0CAC0C;AAC1C,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAED;kFACkF;AAClF,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,4BAA4B,EAClC,aAAa,EAAE,MAAM,GACpB,MAAM,CAER;AAED,wBAAgB,uCAAuC,CACrD,MAAM,EAAE,wBAAwB,EAChC,YAAY,EAAE,MAAM,GACnB,OAAO,CAQT;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAEhF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAElF;AAED,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAI1F;AAED;;4FAE4F;AAC5F,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,yCAAyC,CACvD,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAC9C,aAAa,EAAE,MAAM,GACpB,MAAM,CAER;AAED,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,mBAAmB,EAC3B,YAAY,EAAE,MAAM,GACnB,OAAO,CAQT"}

package/dist/src/v2/bounds/canonical.js

@@ -0,0 +1,69 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Content addressing and Ed25519 signing for the two records this module
+// declares. Nothing here reimplements JCS, SHA-256 or Ed25519: each comes from the helper
+// the rest of this package already uses.
+//
+// Not required by draft-pidlisnyi-aps-03. See ./types.ts for the specification position.
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS, canonicalizeJCSForWrite } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+/** Domain tags. Each is a distinct tag followed by one zero byte, the same discipline
+ *  `AuthorityDelegationV1` and `AuthorityRevocationV1` follow, so bytes minted for one
+ *  construction can never be read as bytes minted for another. The `PROPOSED-` prefix is
+ *  part of the tag: if any of this is ever specified, the specified construction will use a
+ *  different tag and records minted under this one will not verify under it. That is the
+ *  intended behaviour, not a migration problem to solve later. */
+export const AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN = 'PROPOSED-APS-AUTHORITY-BOUND-FULFILMENT-SIGNATURE-V0\0';
+export const AUTHORITY_EXHAUSTION_ID_DOMAIN = 'PROPOSED-APS-AUTHORITY-EXHAUSTION-ID-V0\0';
+export const AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN = 'PROPOSED-APS-AUTHORITY-EXHAUSTION-SIGNATURE-V0\0';
+function sha256Hex(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function withoutSignature(record) {
+    const { signature: _signature, ...body } = record;
+    return body;
+}
+/** Exact Ed25519 preimage for a fulfilment attestation: the domain tag plus RFC 8785 JCS of
+ *  the record with `signature` absent. */
+export function authorityBoundFulfilmentSignatureInput(body) {
+    return AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN + canonicalizeJCS(body);
+}
+/** Write-boundary twin. Use when ISSUING. The verification path keeps calling the
+ *  unrestricted form, so a record minted before the write rule still verifies. */
+export function authorityBoundFulfilmentSignatureInputForWrite(body) {
+    return AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN + canonicalizeJCSForWrite(body);
+}
+export function signAuthorityBoundFulfilment(body, privateKeyHex) {
+    return sign(authorityBoundFulfilmentSignatureInputForWrite(body), privateKeyHex);
+}
+export function verifyAuthorityBoundFulfilmentSignature(record, publicKeyHex) {
+    return verify(authorityBoundFulfilmentSignatureInput(withoutSignature(record)), record.signature, publicKeyHex);
+}
+/** Exact preimage for `exhaustion_id`: the ID domain tag plus JCS of the body. */
+export function authorityExhaustionIdInput(body) {
+    return AUTHORITY_EXHAUSTION_ID_DOMAIN + canonicalizeJCS(body);
+}
+export function computeAuthorityExhaustionId(body) {
+    return `sha256:${sha256Hex(authorityExhaustionIdInput(body))}`;
+}
+export function computeAuthorityExhaustionIdForWrite(body) {
+    return `sha256:${sha256Hex(AUTHORITY_EXHAUSTION_ID_DOMAIN + canonicalizeJCSForWrite(body))}`;
+}
+/** Exact Ed25519 preimage for the exhaustion record: the signature domain tag plus JCS of
+ *  the record with `signature` absent. `exhaustion_id` IS inside this preimage, so the
+ *  identifier is signed rather than being an unauthenticated label beside the signature. */
+export function authorityExhaustionSignatureInput(record) {
+    return AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN + canonicalizeJCS(record);
+}
+export function authorityExhaustionSignatureInputForWrite(record) {
+    return AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN + canonicalizeJCSForWrite(record);
+}
+export function signAuthorityExhaustion(record, privateKeyHex) {
+    return sign(authorityExhaustionSignatureInputForWrite(record), privateKeyHex);
+}
+export function verifyAuthorityExhaustionSignature(record, publicKeyHex) {
+    return verify(authorityExhaustionSignatureInput(withoutSignature(record)), record.signature, publicKeyHex);
+}
+//# sourceMappingURL=canonical.js.map

package/dist/src/v2/bounds/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/v2/bounds/canonical.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,2FAA2F;AAC3F,0FAA0F;AAC1F,yCAAyC;AACzC,EAAE;AACF,yFAAyF;AAEzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAQnD;;;;;kEAKkE;AAClE,MAAM,CAAC,MAAM,2CAA2C,GACtD,wDAAwD,CAAA;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,2CAA2C,CAAA;AACzF,MAAM,CAAC,MAAM,qCAAqC,GAChD,kDAAkD,CAAA;AAEpD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAkC,MAAS;IAClE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;0CAC0C;AAC1C,MAAM,UAAU,sCAAsC,CACpD,IAAkC;IAElC,OAAO,2CAA2C,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;AAC5E,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,8CAA8C,CAC5D,IAAkC;IAElC,OAAO,2CAA2C,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,aAAqB;IAErB,OAAO,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,MAAgC,EAChC,YAAoB;IAEpB,OAAO,MAAM,CACX,sCAAsC,CACpC,gBAAgB,CAAC,MAAM,CAAiC,CACzD,EACD,MAAM,CAAC,SAAS,EAChB,YAAY,CACb,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,0BAA0B,CAAC,IAA6B;IACtE,OAAO,8BAA8B,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA6B;IACxE,OAAO,UAAU,SAAS,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,IAA6B;IAChF,OAAO,UAAU,SAAS,CACxB,8BAA8B,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAC/D,EAAE,CAAA;AACL,CAAC;AAED;;4FAE4F;AAC5F,MAAM,UAAU,iCAAiC,CAC/C,MAA8C;IAE9C,OAAO,qCAAqC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,MAA8C;IAE9C,OAAO,qCAAqC,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA8C,EAC9C,aAAqB;IAErB,OAAO,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA2B,EAC3B,YAAoB;IAEpB,OAAO,MAAM,CACX,iCAAiC,CAC/B,gBAAgB,CAAC,MAAM,CAA2C,CACnE,EACD,MAAM,CAAC,SAAS,EAChB,YAAY,CACb,CAAA;AACH,CAAC"}

package/dist/src/v2/bounds/evaluate.d.ts

@@ -0,0 +1,107 @@
+import { type AttestorRoleAnswer, type AttestorRoleResolver, type AuthorityBound, type AuthorityBoundFulfilment, type BoundEvaluation, type BoundKind, type BoundVerificationKeyResolver, type FulfilmentAssessment } from './types.js';
+/** Thrown when an input this module cannot read at all is passed. A malformed BOUND is a
+ *  programming error, not a verdict: the module was asked a question about nothing. A
+ *  malformed FULFILMENT RECORD is different and never throws, because a record somebody
+ *  else wrote is data, and the right answer about it is a rejection with a reason code. */
+export declare class AuthorityBoundError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function isBoundKind(value: unknown): value is BoundKind;
+export declare function isAttestorRoleAnswer(value: unknown): value is AttestorRoleAnswer;
+/** Shape check for a bound declaration. Throws, for the reason `AuthorityBoundError`
+ *  documents. */
+export declare function assertAuthorityBound(bound: AuthorityBound): void;
+export interface AssessFulfilmentInput {
+    readonly bound: AuthorityBound;
+    readonly record: AuthorityBoundFulfilment;
+    /** The instant the question is asked at. A record attested later than this is not read:
+     *  a verifier asked about Tuesday does not get to use Wednesday's evidence. */
+    readonly atInstant: string;
+    readonly resolveAttestorRole: AttestorRoleResolver;
+    readonly resolveVerificationKey: BoundVerificationKeyResolver;
+}
+/**
+ * Assess ONE fulfilment record against one bound.
+ *
+ * The order of the checks is the substance of this function, not an implementation detail.
+ * Standing is asked FIRST and authenticity SECOND, and each produces its own code, because
+ * "authenticated by somebody who may not say this" and "not authenticated at all" are
+ * different failures and collapsing them loses the distinction CAND-01 turns on. A valid
+ * signature establishes who signed. It does not establish that the signer was allowed to
+ * make this statement.
+ *
+ * `FULFILMENT_OUTCOME_NOT_FULFILLED` carries no `missing` limbs, and that is deliberate: a
+ * record from a party with standing saying the purpose was NOT met is a conclusion the
+ * verifier reached, not a gap in its evidence. Every other rejection names a limb.
+ *
+ * Concept source: aeoess/agent-authority-lifecycle, invariant candidate CAND-01 and
+ * invariant candidate BROAD-L7. Proposed.
+ */
+export declare function assessFulfilment(input: AssessFulfilmentInput): FulfilmentAssessment;
+export interface EvaluateBoundInput {
+    readonly bound: AuthorityBound;
+    /** Every fulfilment claim the caller holds for this bound. Order is preserved in the
+     *  result and does not change the verdict: see the resolution rule below. Empty for a
+     *  `use_count` or `budget` bound, where no attestation is involved. */
+    readonly fulfilments?: readonly AuthorityBoundFulfilment[];
+    readonly atInstant: string;
+    readonly resolveAttestorRole?: AttestorRoleResolver;
+    readonly resolveVerificationKey?: BoundVerificationKeyResolver;
+    /** kind `use_count` only: admissions already counted against this bound, as a canonical
+     *  unsigned decimal integer string. The caller's ledger owns this number. This module
+     *  does not count admissions, because counting them means holding state across events and
+     *  a pure function has none. */
+    readonly consumed?: string;
+    /** kind `budget` only: the committed and reserved totals, exactly as
+     *  `InMemoryAuthorityBudgetLedger.counter(delegationId)` returns them. The budget kind
+     *  delegates to that ledger and never reimplements it: draft-03 section 3.4 already
+     *  states the rule, and the ledger already enforces it. */
+    readonly budgetCounter?: {
+        readonly committed: string;
+        readonly reserved: string;
+    };
+}
+/**
+ * Evaluate one bound's state at one instant.
+ *
+ * THE RESOLUTION RULE, and why it is this way round. For a purpose bound:
+ *
+ *   1. If any fulfilment record was ACCEPTED, the state is `exhausted`.
+ *   2. Otherwise, if any record was rejected on an EVIDENTIAL ground (signature, standing,
+ *      unresolved role, unresolved key, unreadable shape), the state is `not_established`.
+ *   3. Otherwise the state is `not_reached`.
+ *
+ * Step 1 comes before step 2 on purpose, and it is invariant CAND-02's rule made
+ * executable: an exhaustion that WAS established is never downgraded by a later claim
+ * nobody could authenticate. A later finding is a new record about an earlier one, never a
+ * rewrite of it. Because the rule is a fold over the whole set rather than a running
+ * mutation, the verdict is the same whatever order the records arrive in, which is what
+ * makes it safe for a caller to keep them in an unordered store.
+ *
+ * Step 3 reads `not_reached` from an empty record set, and that is the one reading here
+ * worth arguing with. It is a positive claim: the bound is declared, no evidence reaches
+ * it, and under the applicable authority model a purpose that nobody has recorded as met is
+ * a purpose that is not met. A model whose default runs the other way (absence of a
+ * periodic fulfilment report is itself the trigger) is a model this function cannot
+ * express, and a caller in that position should report `not_established` with a `source`
+ * limb rather than passing an empty set and reading the answer as a finding. CAND-01's
+ * carve-out for a declared default on absence is the reason the disclaimer is here and not
+ * a silent assumption.
+ *
+ * A `use_count` bound needs no records at all: the ADMISSION reaches it, so `consumed`
+ * against `value` is the whole computation. A `budget` bound is answered by the ledger's
+ * counter, per draft-03 section 3.4, verbatim: "Signatures establish static limits; they do
+ * not establish the current cumulative total."
+ *
+ * Reported ALONGSIDE a chain result, never merged into it, and never in place of it. A
+ * grant can be exhausted while its chain still verifies `valid`, which is the whole point:
+ * exhaustion is invisible to chain verification. A grant can also be expired AND exhausted,
+ * and then the chain result says `EXPIRED` and this says `exhaustion` and neither
+ * overwrites the other. Invariant L10.
+ *
+ * Concept source: aeoess/agent-authority-lifecycle, invariant L10 and invariant candidates
+ * CAND-01 and CAND-02. All proposed.
+ */
+export declare function evaluateBound(input: EvaluateBoundInput): BoundEvaluation;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/src/v2/bounds/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/evaluate.ts"],"names":[],"mappings":"AAYA,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAE7B,KAAK,eAAe,EACpB,KAAK,SAAS,EAGd,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAA;AAEnB;;;2FAG2F;AAC3F,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIxC;CACF;AAMD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAIhF;AAED;iBACiB;AACjB,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAgDhE;AA+CD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC;mFAC+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,oBAAoB,CAAA;IAClD,QAAQ,CAAC,sBAAsB,EAAE,4BAA4B,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,oBAAoB,CAiFnF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B;;2EAEuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oBAAoB,CAAA;IACnD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAA;IAC9D;;;oCAGgC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;+DAG2D;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CACnF;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,eAAe,CA6FxE"}