agent-passport-system 7.1.0 → 7.2.1

package/dist/src/v2/bounds/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/canonical.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,YAAY,CAAA;AAEnB;;;;;kEAKkE;AAClE,eAAO,MAAM,2CAA2C,2DACE,CAAA;AAC1D,eAAO,MAAM,8BAA8B,8CAA8C,CAAA;AACzF,eAAO,MAAM,qCAAqC,qDACE,CAAA;AAWpD;0CAC0C;AAC1C,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAED;kFACkF;AAClF,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,4BAA4B,EAClC,aAAa,EAAE,MAAM,GACpB,MAAM,CAER;AAED,wBAAgB,uCAAuC,CACrD,MAAM,EAAE,wBAAwB,EAChC,YAAY,EAAE,MAAM,GACnB,OAAO,CAQT;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAEhF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAElF;AAED,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAI1F;AAED;;4FAE4F;AAC5F,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,yCAAyC,CACvD,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAC9C,aAAa,EAAE,MAAM,GACpB,MAAM,CAER;AAED,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,mBAAmB,EAC3B,YAAY,EAAE,MAAM,GACnB,OAAO,CAQT"}

package/dist/src/v2/bounds/canonical.js

@@ -0,0 +1,69 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Content addressing and Ed25519 signing for the two records this module
+// declares. Nothing here reimplements JCS, SHA-256 or Ed25519: each comes from the helper
+// the rest of this package already uses.
+//
+// Not required by draft-pidlisnyi-aps-03. See ./types.ts for the specification position.
+import { createHash } from 'node:crypto';
+import { canonicalizeJCS, canonicalizeJCSForWrite } from '../../core/canonical-jcs.js';
+import { sign, verify } from '../../crypto/keys.js';
+/** Domain tags. Each is a distinct tag followed by one zero byte, the same discipline
+ *  `AuthorityDelegationV1` and `AuthorityRevocationV1` follow, so bytes minted for one
+ *  construction can never be read as bytes minted for another. The `PROPOSED-` prefix is
+ *  part of the tag: if any of this is ever specified, the specified construction will use a
+ *  different tag and records minted under this one will not verify under it. That is the
+ *  intended behaviour, not a migration problem to solve later. */
+export const AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN = 'PROPOSED-APS-AUTHORITY-BOUND-FULFILMENT-SIGNATURE-V0\0';
+export const AUTHORITY_EXHAUSTION_ID_DOMAIN = 'PROPOSED-APS-AUTHORITY-EXHAUSTION-ID-V0\0';
+export const AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN = 'PROPOSED-APS-AUTHORITY-EXHAUSTION-SIGNATURE-V0\0';
+function sha256Hex(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function withoutSignature(record) {
+    const { signature: _signature, ...body } = record;
+    return body;
+}
+/** Exact Ed25519 preimage for a fulfilment attestation: the domain tag plus RFC 8785 JCS of
+ *  the record with `signature` absent. */
+export function authorityBoundFulfilmentSignatureInput(body) {
+    return AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN + canonicalizeJCS(body);
+}
+/** Write-boundary twin. Use when ISSUING. The verification path keeps calling the
+ *  unrestricted form, so a record minted before the write rule still verifies. */
+export function authorityBoundFulfilmentSignatureInputForWrite(body) {
+    return AUTHORITY_BOUND_FULFILMENT_SIGNATURE_DOMAIN + canonicalizeJCSForWrite(body);
+}
+export function signAuthorityBoundFulfilment(body, privateKeyHex) {
+    return sign(authorityBoundFulfilmentSignatureInputForWrite(body), privateKeyHex);
+}
+export function verifyAuthorityBoundFulfilmentSignature(record, publicKeyHex) {
+    return verify(authorityBoundFulfilmentSignatureInput(withoutSignature(record)), record.signature, publicKeyHex);
+}
+/** Exact preimage for `exhaustion_id`: the ID domain tag plus JCS of the body. */
+export function authorityExhaustionIdInput(body) {
+    return AUTHORITY_EXHAUSTION_ID_DOMAIN + canonicalizeJCS(body);
+}
+export function computeAuthorityExhaustionId(body) {
+    return `sha256:${sha256Hex(authorityExhaustionIdInput(body))}`;
+}
+export function computeAuthorityExhaustionIdForWrite(body) {
+    return `sha256:${sha256Hex(AUTHORITY_EXHAUSTION_ID_DOMAIN + canonicalizeJCSForWrite(body))}`;
+}
+/** Exact Ed25519 preimage for the exhaustion record: the signature domain tag plus JCS of
+ *  the record with `signature` absent. `exhaustion_id` IS inside this preimage, so the
+ *  identifier is signed rather than being an unauthenticated label beside the signature. */
+export function authorityExhaustionSignatureInput(record) {
+    return AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN + canonicalizeJCS(record);
+}
+export function authorityExhaustionSignatureInputForWrite(record) {
+    return AUTHORITY_EXHAUSTION_SIGNATURE_DOMAIN + canonicalizeJCSForWrite(record);
+}
+export function signAuthorityExhaustion(record, privateKeyHex) {
+    return sign(authorityExhaustionSignatureInputForWrite(record), privateKeyHex);
+}
+export function verifyAuthorityExhaustionSignature(record, publicKeyHex) {
+    return verify(authorityExhaustionSignatureInput(withoutSignature(record)), record.signature, publicKeyHex);
+}
+//# sourceMappingURL=canonical.js.map

package/dist/src/v2/bounds/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/v2/bounds/canonical.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,2FAA2F;AAC3F,0FAA0F;AAC1F,yCAAyC;AACzC,EAAE;AACF,yFAAyF;AAEzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAQnD;;;;;kEAKkE;AAClE,MAAM,CAAC,MAAM,2CAA2C,GACtD,wDAAwD,CAAA;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,2CAA2C,CAAA;AACzF,MAAM,CAAC,MAAM,qCAAqC,GAChD,kDAAkD,CAAA;AAEpD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAkC,MAAS;IAClE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;0CAC0C;AAC1C,MAAM,UAAU,sCAAsC,CACpD,IAAkC;IAElC,OAAO,2CAA2C,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;AAC5E,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,8CAA8C,CAC5D,IAAkC;IAElC,OAAO,2CAA2C,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,aAAqB;IAErB,OAAO,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,MAAgC,EAChC,YAAoB;IAEpB,OAAO,MAAM,CACX,sCAAsC,CACpC,gBAAgB,CAAC,MAAM,CAAiC,CACzD,EACD,MAAM,CAAC,SAAS,EAChB,YAAY,CACb,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,0BAA0B,CAAC,IAA6B;IACtE,OAAO,8BAA8B,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA6B;IACxE,OAAO,UAAU,SAAS,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,IAA6B;IAChF,OAAO,UAAU,SAAS,CACxB,8BAA8B,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAC/D,EAAE,CAAA;AACL,CAAC;AAED;;4FAE4F;AAC5F,MAAM,UAAU,iCAAiC,CAC/C,MAA8C;IAE9C,OAAO,qCAAqC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,MAA8C;IAE9C,OAAO,qCAAqC,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA8C,EAC9C,aAAqB;IAErB,OAAO,IAAI,CAAC,yCAAyC,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAA2B,EAC3B,YAAoB;IAEpB,OAAO,MAAM,CACX,iCAAiC,CAC/B,gBAAgB,CAAC,MAAM,CAA2C,CACnE,EACD,MAAM,CAAC,SAAS,EAChB,YAAY,CACb,CAAA;AACH,CAAC"}

package/dist/src/v2/bounds/evaluate.d.ts

@@ -0,0 +1,107 @@
+import { type AttestorRoleAnswer, type AttestorRoleResolver, type AuthorityBound, type AuthorityBoundFulfilment, type BoundEvaluation, type BoundKind, type BoundVerificationKeyResolver, type FulfilmentAssessment } from './types.js';
+/** Thrown when an input this module cannot read at all is passed. A malformed BOUND is a
+ *  programming error, not a verdict: the module was asked a question about nothing. A
+ *  malformed FULFILMENT RECORD is different and never throws, because a record somebody
+ *  else wrote is data, and the right answer about it is a rejection with a reason code. */
+export declare class AuthorityBoundError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function isBoundKind(value: unknown): value is BoundKind;
+export declare function isAttestorRoleAnswer(value: unknown): value is AttestorRoleAnswer;
+/** Shape check for a bound declaration. Throws, for the reason `AuthorityBoundError`
+ *  documents. */
+export declare function assertAuthorityBound(bound: AuthorityBound): void;
+export interface AssessFulfilmentInput {
+    readonly bound: AuthorityBound;
+    readonly record: AuthorityBoundFulfilment;
+    /** The instant the question is asked at. A record attested later than this is not read:
+     *  a verifier asked about Tuesday does not get to use Wednesday's evidence. */
+    readonly atInstant: string;
+    readonly resolveAttestorRole: AttestorRoleResolver;
+    readonly resolveVerificationKey: BoundVerificationKeyResolver;
+}
+/**
+ * Assess ONE fulfilment record against one bound.
+ *
+ * The order of the checks is the substance of this function, not an implementation detail.
+ * Standing is asked FIRST and authenticity SECOND, and each produces its own code, because
+ * "authenticated by somebody who may not say this" and "not authenticated at all" are
+ * different failures and collapsing them loses the distinction CAND-01 turns on. A valid
+ * signature establishes who signed. It does not establish that the signer was allowed to
+ * make this statement.
+ *
+ * `FULFILMENT_OUTCOME_NOT_FULFILLED` carries no `missing` limbs, and that is deliberate: a
+ * record from a party with standing saying the purpose was NOT met is a conclusion the
+ * verifier reached, not a gap in its evidence. Every other rejection names a limb.
+ *
+ * Concept source: aeoess/agent-authority-lifecycle, invariant candidate CAND-01 and
+ * invariant candidate BROAD-L7. Proposed.
+ */
+export declare function assessFulfilment(input: AssessFulfilmentInput): FulfilmentAssessment;
+export interface EvaluateBoundInput {
+    readonly bound: AuthorityBound;
+    /** Every fulfilment claim the caller holds for this bound. Order is preserved in the
+     *  result and does not change the verdict: see the resolution rule below. Empty for a
+     *  `use_count` or `budget` bound, where no attestation is involved. */
+    readonly fulfilments?: readonly AuthorityBoundFulfilment[];
+    readonly atInstant: string;
+    readonly resolveAttestorRole?: AttestorRoleResolver;
+    readonly resolveVerificationKey?: BoundVerificationKeyResolver;
+    /** kind `use_count` only: admissions already counted against this bound, as a canonical
+     *  unsigned decimal integer string. The caller's ledger owns this number. This module
+     *  does not count admissions, because counting them means holding state across events and
+     *  a pure function has none. */
+    readonly consumed?: string;
+    /** kind `budget` only: the committed and reserved totals, exactly as
+     *  `InMemoryAuthorityBudgetLedger.counter(delegationId)` returns them. The budget kind
+     *  delegates to that ledger and never reimplements it: draft-03 section 3.4 already
+     *  states the rule, and the ledger already enforces it. */
+    readonly budgetCounter?: {
+        readonly committed: string;
+        readonly reserved: string;
+    };
+}
+/**
+ * Evaluate one bound's state at one instant.
+ *
+ * THE RESOLUTION RULE, and why it is this way round. For a purpose bound:
+ *
+ *   1. If any fulfilment record was ACCEPTED, the state is `exhausted`.
+ *   2. Otherwise, if any record was rejected on an EVIDENTIAL ground (signature, standing,
+ *      unresolved role, unresolved key, unreadable shape), the state is `not_established`.
+ *   3. Otherwise the state is `not_reached`.
+ *
+ * Step 1 comes before step 2 on purpose, and it is invariant CAND-02's rule made
+ * executable: an exhaustion that WAS established is never downgraded by a later claim
+ * nobody could authenticate. A later finding is a new record about an earlier one, never a
+ * rewrite of it. Because the rule is a fold over the whole set rather than a running
+ * mutation, the verdict is the same whatever order the records arrive in, which is what
+ * makes it safe for a caller to keep them in an unordered store.
+ *
+ * Step 3 reads `not_reached` from an empty record set, and that is the one reading here
+ * worth arguing with. It is a positive claim: the bound is declared, no evidence reaches
+ * it, and under the applicable authority model a purpose that nobody has recorded as met is
+ * a purpose that is not met. A model whose default runs the other way (absence of a
+ * periodic fulfilment report is itself the trigger) is a model this function cannot
+ * express, and a caller in that position should report `not_established` with a `source`
+ * limb rather than passing an empty set and reading the answer as a finding. CAND-01's
+ * carve-out for a declared default on absence is the reason the disclaimer is here and not
+ * a silent assumption.
+ *
+ * A `use_count` bound needs no records at all: the ADMISSION reaches it, so `consumed`
+ * against `value` is the whole computation. A `budget` bound is answered by the ledger's
+ * counter, per draft-03 section 3.4, verbatim: "Signatures establish static limits; they do
+ * not establish the current cumulative total."
+ *
+ * Reported ALONGSIDE a chain result, never merged into it, and never in place of it. A
+ * grant can be exhausted while its chain still verifies `valid`, which is the whole point:
+ * exhaustion is invisible to chain verification. A grant can also be expired AND exhausted,
+ * and then the chain result says `EXPIRED` and this says `exhaustion` and neither
+ * overwrites the other. Invariant L10.
+ *
+ * Concept source: aeoess/agent-authority-lifecycle, invariant L10 and invariant candidates
+ * CAND-01 and CAND-02. All proposed.
+ */
+export declare function evaluateBound(input: EvaluateBoundInput): BoundEvaluation;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/src/v2/bounds/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/evaluate.ts"],"names":[],"mappings":"AAYA,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAE7B,KAAK,eAAe,EACpB,KAAK,SAAS,EAGd,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAA;AAEnB;;;2FAG2F;AAC3F,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIxC;CACF;AAMD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAIhF;AAED;iBACiB;AACjB,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAgDhE;AA+CD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC;mFAC+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,oBAAoB,CAAA;IAClD,QAAQ,CAAC,sBAAsB,EAAE,4BAA4B,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,oBAAoB,CAiFnF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B;;2EAEuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oBAAoB,CAAA;IACnD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,4BAA4B,CAAA;IAC9D;;;oCAGgC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;+DAG2D;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CACnF;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,eAAe,CA6FxE"}

package/dist/src/v2/bounds/evaluate.js

@@ -0,0 +1,315 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Assessing fulfilment records and evaluating a bound's state.
+//
+// Pure. No clock, no I/O, no network. Every instant compared here is supplied by the
+// caller, and every resolver is the caller's. Not required by draft-pidlisnyi-aps-03; see
+// ./types.ts for the specification position.
+import { lifecycleState, notEstablished } from '../lifecycle-state/state.js';
+import { verifyAuthorityBoundFulfilmentSignature } from './canonical.js';
+import { AUTHORITY_BOUND_FULFILMENT_TYPE, AUTHORITY_BOUND_TYPE, ATTESTOR_ROLE_ANSWERS, BOUND_KINDS, } from './types.js';
+/** Thrown when an input this module cannot read at all is passed. A malformed BOUND is a
+ *  programming error, not a verdict: the module was asked a question about nothing. A
+ *  malformed FULFILMENT RECORD is different and never throws, because a record somebody
+ *  else wrote is data, and the right answer about it is a rejection with a reason code. */
+export class AuthorityBoundError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AuthorityBoundError';
+        this.code = code;
+    }
+}
+const CANONICAL_UNSIGNED_INTEGER = /^(0|[1-9][0-9]*)$/;
+const DELEGATION_ID = /^sha256:[0-9a-f]{64}$/;
+const SIGNATURE_HEX = /^[0-9a-f]{128}$/;
+export function isBoundKind(value) {
+    return typeof value === 'string' && BOUND_KINDS.includes(value);
+}
+export function isAttestorRoleAnswer(value) {
+    return (typeof value === 'string' && ATTESTOR_ROLE_ANSWERS.includes(value));
+}
+/** Shape check for a bound declaration. Throws, for the reason `AuthorityBoundError`
+ *  documents. */
+export function assertAuthorityBound(bound) {
+    if (bound === null || typeof bound !== 'object') {
+        throw new AuthorityBoundError('BOUND_MALFORMED', 'bound is not an object');
+    }
+    if (bound.record_type !== AUTHORITY_BOUND_TYPE) {
+        throw new AuthorityBoundError('BOUND_RECORD_TYPE_UNSUPPORTED', `record_type must be ${AUTHORITY_BOUND_TYPE}`);
+    }
+    if (typeof bound.bound_id !== 'string' || bound.bound_id.length === 0) {
+        throw new AuthorityBoundError('BOUND_MALFORMED', 'bound_id must be a non-empty string');
+    }
+    if (typeof bound.delegation_id !== 'string' || !DELEGATION_ID.test(bound.delegation_id)) {
+        throw new AuthorityBoundError('BOUND_MALFORMED', 'delegation_id must be sha256:<64 lowercase hex>');
+    }
+    if (!isBoundKind(bound.kind)) {
+        throw new AuthorityBoundError('BOUND_KIND_UNSUPPORTED', `kind must be one of ${BOUND_KINDS.join(', ')}`);
+    }
+    if (typeof bound.value !== 'string' || bound.value.length === 0) {
+        throw new AuthorityBoundError('BOUND_MALFORMED', 'value must be a non-empty string');
+    }
+    if (bound.kind !== 'purpose' && !CANONICAL_UNSIGNED_INTEGER.test(bound.value)) {
+        throw new AuthorityBoundError('BOUND_VALUE_NONCANONICAL', `a ${bound.kind} bound's value must be a canonical unsigned decimal integer`);
+    }
+    if (!Array.isArray(bound.fulfilment_attestor_roles)) {
+        throw new AuthorityBoundError('BOUND_MALFORMED', 'fulfilment_attestor_roles must be an array, empty if nobody but the issuer may attest');
+    }
+    for (const role of bound.fulfilment_attestor_roles) {
+        if (typeof role !== 'string' || role.length === 0) {
+            throw new AuthorityBoundError('BOUND_MALFORMED', 'fulfilment_attestor_roles must contain only non-empty strings');
+        }
+    }
+}
+/** True only for a record this module can read far enough to assess. A record that fails
+ *  here is rejected with `FULFILMENT_SCHEMA_INVALID`, never thrown on. */
+function readableFulfilment(record) {
+    return (record !== null &&
+        typeof record === 'object' &&
+        record.record_type === AUTHORITY_BOUND_FULFILMENT_TYPE &&
+        typeof record.bound_id === 'string' &&
+        record.bound_id.length > 0 &&
+        typeof record.delegation_id === 'string' &&
+        DELEGATION_ID.test(record.delegation_id) &&
+        typeof record.attestor === 'string' &&
+        record.attestor.length > 0 &&
+        typeof record.verification_method === 'string' &&
+        record.verification_method.length > 0 &&
+        typeof record.attested_at === 'string' &&
+        record.attested_at.length > 0 &&
+        (record.outcome === 'fulfilled' || record.outcome === 'not_fulfilled') &&
+        typeof record.reason_code === 'string' &&
+        record.reason_code.length > 0 &&
+        typeof record.signature === 'string' &&
+        SIGNATURE_HEX.test(record.signature));
+}
+function assessment(attestor, attestedAt, accepted, reasonCode, extra = {}) {
+    const out = { attestor, attested_at: attestedAt, accepted, reason_code: reasonCode };
+    if (extra.role_answer !== undefined)
+        out.role_answer = extra.role_answer;
+    if (extra.missing !== undefined)
+        out.missing = Object.freeze([...extra.missing]);
+    return Object.freeze(out);
+}
+/**
+ * Assess ONE fulfilment record against one bound.
+ *
+ * The order of the checks is the substance of this function, not an implementation detail.
+ * Standing is asked FIRST and authenticity SECOND, and each produces its own code, because
+ * "authenticated by somebody who may not say this" and "not authenticated at all" are
+ * different failures and collapsing them loses the distinction CAND-01 turns on. A valid
+ * signature establishes who signed. It does not establish that the signer was allowed to
+ * make this statement.
+ *
+ * `FULFILMENT_OUTCOME_NOT_FULFILLED` carries no `missing` limbs, and that is deliberate: a
+ * record from a party with standing saying the purpose was NOT met is a conclusion the
+ * verifier reached, not a gap in its evidence. Every other rejection names a limb.
+ *
+ * Concept source: aeoess/agent-authority-lifecycle, invariant candidate CAND-01 and
+ * invariant candidate BROAD-L7. Proposed.
+ */
+export function assessFulfilment(input) {
+    assertAuthorityBound(input.bound);
+    const { bound, record, atInstant } = input;
+    if (bound.kind !== 'purpose') {
+        return assessment('', '', false, 'FULFILMENT_NOT_APPLICABLE_TO_KIND', {
+            missing: ['coverage'],
+        });
+    }
+    if (!readableFulfilment(record)) {
+        return assessment('', '', false, 'FULFILMENT_SCHEMA_INVALID', { missing: ['source'] });
+    }
+    const attestor = record.attestor;
+    const attestedAt = record.attested_at;
+    // The record has to be about THIS bound on THIS delegation. A coverage gap: the claim does
+    // not state that it covers what the verdict needed.
+    if (record.bound_id !== bound.bound_id || record.delegation_id !== bound.delegation_id) {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_NOT_BOUND_TO_BOUND', {
+            missing: ['coverage'],
+        });
+    }
+    if (attestedAt > atInstant) {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_NOT_YET_ATTESTED', {
+            missing: ['coverage'],
+        });
+    }
+    const roleAnswer = input.resolveAttestorRole(attestor, bound.fulfilment_attestor_roles, atInstant);
+    if (!isAttestorRoleAnswer(roleAnswer)) {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_ATTESTOR_ROLE_UNKNOWN', {
+            missing: ['source'],
+        });
+    }
+    if (roleAnswer === 'unknown') {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_ATTESTOR_ROLE_UNKNOWN', {
+            role_answer: roleAnswer,
+            missing: ['source'],
+        });
+    }
+    if (roleAnswer === 'does_not_hold_role') {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_ATTESTOR_WITHOUT_STANDING', {
+            role_answer: roleAnswer,
+            missing: ['source'],
+        });
+    }
+    const publicKey = input.resolveVerificationKey(attestor, record.verification_method, attestedAt);
+    if (typeof publicKey !== 'string' || publicKey.length === 0) {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_KEY_UNRESOLVED', {
+            role_answer: roleAnswer,
+            missing: ['source'],
+        });
+    }
+    if (!verifyAuthorityBoundFulfilmentSignature(record, publicKey)) {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_SIGNATURE_INVALID', {
+            role_answer: roleAnswer,
+            missing: ['source'],
+        });
+    }
+    if (record.outcome !== 'fulfilled') {
+        return assessment(attestor, attestedAt, false, 'FULFILMENT_OUTCOME_NOT_FULFILLED', {
+            role_answer: roleAnswer,
+        });
+    }
+    return assessment(attestor, attestedAt, true, 'FULFILMENT_ACCEPTED', {
+        role_answer: roleAnswer,
+    });
+}
+function decimal(value, fallback) {
+    const raw = value ?? fallback;
+    if (!CANONICAL_UNSIGNED_INTEGER.test(raw)) {
+        throw new AuthorityBoundError('COUNTER_NONCANONICAL', `expected a canonical unsigned decimal integer, got ${JSON.stringify(raw)}`);
+    }
+    return BigInt(raw);
+}
+function lifecycleFor(state, reasonCode, missing) {
+    if (state === 'not_established')
+        return notEstablished(missing, reasonCode);
+    return lifecycleState({
+        verdict: state === 'exhausted' ? 'invalid' : 'valid',
+        reason_code: reasonCode,
+    });
+}
+/**
+ * Evaluate one bound's state at one instant.
+ *
+ * THE RESOLUTION RULE, and why it is this way round. For a purpose bound:
+ *
+ *   1. If any fulfilment record was ACCEPTED, the state is `exhausted`.
+ *   2. Otherwise, if any record was rejected on an EVIDENTIAL ground (signature, standing,
+ *      unresolved role, unresolved key, unreadable shape), the state is `not_established`.
+ *   3. Otherwise the state is `not_reached`.
+ *
+ * Step 1 comes before step 2 on purpose, and it is invariant CAND-02's rule made
+ * executable: an exhaustion that WAS established is never downgraded by a later claim
+ * nobody could authenticate. A later finding is a new record about an earlier one, never a
+ * rewrite of it. Because the rule is a fold over the whole set rather than a running
+ * mutation, the verdict is the same whatever order the records arrive in, which is what
+ * makes it safe for a caller to keep them in an unordered store.
+ *
+ * Step 3 reads `not_reached` from an empty record set, and that is the one reading here
+ * worth arguing with. It is a positive claim: the bound is declared, no evidence reaches
+ * it, and under the applicable authority model a purpose that nobody has recorded as met is
+ * a purpose that is not met. A model whose default runs the other way (absence of a
+ * periodic fulfilment report is itself the trigger) is a model this function cannot
+ * express, and a caller in that position should report `not_established` with a `source`
+ * limb rather than passing an empty set and reading the answer as a finding. CAND-01's
+ * carve-out for a declared default on absence is the reason the disclaimer is here and not
+ * a silent assumption.
+ *
+ * A `use_count` bound needs no records at all: the ADMISSION reaches it, so `consumed`
+ * against `value` is the whole computation. A `budget` bound is answered by the ledger's
+ * counter, per draft-03 section 3.4, verbatim: "Signatures establish static limits; they do
+ * not establish the current cumulative total."
+ *
+ * Reported ALONGSIDE a chain result, never merged into it, and never in place of it. A
+ * grant can be exhausted while its chain still verifies `valid`, which is the whole point:
+ * exhaustion is invisible to chain verification. A grant can also be expired AND exhausted,
+ * and then the chain result says `EXPIRED` and this says `exhaustion` and neither
+ * overwrites the other. Invariant L10.
+ *
+ * Concept source: aeoess/agent-authority-lifecycle, invariant L10 and invariant candidates
+ * CAND-01 and CAND-02. All proposed.
+ */
+export function evaluateBound(input) {
+    assertAuthorityBound(input.bound);
+    const { bound } = input;
+    if (typeof input.atInstant !== 'string' || input.atInstant.length === 0) {
+        throw new AuthorityBoundError('INSTANT_MISSING', 'atInstant must be a non-empty string');
+    }
+    const assessments = [];
+    let state;
+    let reasonCode;
+    let remaining;
+    const missing = [];
+    if (bound.kind === 'purpose') {
+        const records = input.fulfilments ?? [];
+        if (records.length > 0) {
+            if (typeof input.resolveAttestorRole !== 'function') {
+                throw new AuthorityBoundError('ROLE_RESOLVER_MISSING', 'a purpose bound with fulfilment records needs resolveAttestorRole');
+            }
+            if (typeof input.resolveVerificationKey !== 'function') {
+                throw new AuthorityBoundError('KEY_RESOLVER_MISSING', 'a purpose bound with fulfilment records needs resolveVerificationKey');
+            }
+        }
+        const resolveAttestorRole = input.resolveAttestorRole ?? (() => 'unknown');
+        const resolveVerificationKey = input.resolveVerificationKey ?? (() => null);
+        for (const record of records) {
+            assessments.push(assessFulfilment({
+                bound,
+                record,
+                atInstant: input.atInstant,
+                resolveAttestorRole,
+                resolveVerificationKey,
+            }));
+        }
+        const accepted = assessments.some(a => a.accepted);
+        const unestablished = assessments.filter(a => !a.accepted && a.missing !== undefined);
+        if (accepted) {
+            state = 'exhausted';
+            reasonCode = 'PURPOSE_EXHAUSTED';
+        }
+        else if (unestablished.length > 0) {
+            state = 'not_established';
+            reasonCode = 'BOUND_STATE_NOT_ESTABLISHED';
+            for (const a of unestablished) {
+                for (const gap of a.missing ?? [])
+                    if (!missing.includes(gap))
+                        missing.push(gap);
+            }
+        }
+        else {
+            state = 'not_reached';
+            reasonCode = 'BOUND_NOT_REACHED';
+        }
+    }
+    else if (bound.kind === 'use_count') {
+        const limit = decimal(bound.value, '0');
+        const consumed = decimal(input.consumed, '0');
+        const left = consumed >= limit ? 0n : limit - consumed;
+        remaining = left.toString(10);
+        state = consumed >= limit ? 'exhausted' : 'not_reached';
+        reasonCode = state === 'exhausted' ? 'USE_COUNT_EXHAUSTED' : 'BOUND_NOT_REACHED';
+    }
+    else {
+        const ceiling = decimal(bound.value, '0');
+        const committed = decimal(input.budgetCounter?.committed, '0');
+        const reserved = decimal(input.budgetCounter?.reserved, '0');
+        state = committed + reserved >= ceiling ? 'exhausted' : 'not_reached';
+        reasonCode = state === 'exhausted' ? 'BUDGET_EXHAUSTED' : 'BOUND_NOT_REACHED';
+    }
+    const ending = state === 'exhausted' ? 'exhaustion' : null;
+    const result = {
+        bound_id: bound.bound_id,
+        kind: bound.kind,
+        bound_state: state,
+        reason_code: reasonCode,
+        ending,
+        lifecycle: lifecycleFor(state, reasonCode, missing.length > 0 ? missing : ['source']),
+        fulfilments: Object.freeze([...assessments]),
+    };
+    if (remaining !== undefined)
+        result.remaining = remaining;
+    return Object.freeze(result);
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/src/v2/bounds/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../../../src/v2/bounds/evaluate.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,iFAAiF;AACjF,EAAE;AACF,qFAAqF;AACrF,0FAA0F;AAC1F,6CAA6C;AAE7C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,EACrB,WAAW,GAYZ,MAAM,YAAY,CAAA;AAEnB;;;2FAG2F;AAC3F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAAQ;IAErB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED,MAAM,0BAA0B,GAAG,mBAAmB,CAAA;AACtD,MAAM,aAAa,GAAG,uBAAuB,CAAA;AAC7C,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAEvC,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC1F,CAAA;AACH,CAAC;AAED;iBACiB;AACjB,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAC/C,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,EAC/B,uBAAuB,oBAAoB,EAAE,CAC9C,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,iDAAiD,CAClD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,EACxB,uBAAuB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChD,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,mBAAmB,CAC3B,0BAA0B,EAC1B,KAAK,KAAK,CAAC,IAAI,6DAA6D,CAC7E,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,uFAAuF,CACxF,CAAA;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,+DAA+D,CAChE,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,SAAS,kBAAkB,CAAC,MAAgC;IAC1D,OAAO,CACL,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,WAAW,KAAK,+BAA+B;QACtD,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC1B,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ;QAC9C,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAC7B,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,CAAC;QACtE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAC7B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CACrC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CACjB,QAAgB,EAChB,UAAkB,EAClB,QAAiB,EACjB,UAA+C,EAC/C,KAAK,GAAgF,EAAE;IAEvF,MAAM,GAAG,GAOL,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;IAC5E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IACxE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAE1C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE;YACpE,OAAO,EAAE,CAAC,UAAU,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAA;IAErC,2FAA2F;IAC3F,oDAAoD;IACpD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACvF,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,+BAA+B,EAAE;YAC9E,OAAO,EAAE,CAAC,UAAU,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,6BAA6B,EAAE;YAC5E,OAAO,EAAE,CAAC,UAAU,CAAC;SACtB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,mBAAmB,CAC1C,QAAQ,EACR,KAAK,CAAC,yBAAyB,EAC/B,SAAS,CACV,CAAA;IACD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,kCAAkC,EAAE;YACjF,OAAO,EAAE,CAAC,QAAQ,CAAC;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,kCAAkC,EAAE;YACjF,WAAW,EAAE,UAAU;YACvB,OAAO,EAAE,CAAC,QAAQ,CAAC;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;QACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,sCAAsC,EAAE;YACrF,WAAW,EAAE,UAAU;YACvB,OAAO,EAAE,CAAC,QAAQ,CAAC;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,sBAAsB,CAC5C,QAAQ,EACR,MAAM,CAAC,mBAAmB,EAC1B,UAAU,CACX,CAAA;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,2BAA2B,EAAE;YAC1E,WAAW,EAAE,UAAU;YACvB,OAAO,EAAE,CAAC,QAAQ,CAAC;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,uCAAuC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,8BAA8B,EAAE;YAC7E,WAAW,EAAE,UAAU;YACvB,OAAO,EAAE,CAAC,QAAQ,CAAC;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,kCAAkC,EAAE;YACjF,WAAW,EAAE,UAAU;SACxB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;QACnE,WAAW,EAAE,UAAU;KACxB,CAAC,CAAA;AACJ,CAAC;AAuBD,SAAS,OAAO,CAAC,KAAyB,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,KAAK,IAAI,QAAQ,CAAA;IAC7B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,sDAAsD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAC5E,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,YAAY,CACnB,KAAiB,EACjB,UAA2B,EAC3B,OAAoC;IAEpC,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC3E,OAAO,cAAc,CAAC;QACpB,OAAO,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QACpD,WAAW,EAAE,UAAU;KACxB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACjC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IACvB,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,WAAW,GAA2B,EAAE,CAAA;IAC9C,IAAI,KAAiB,CAAA;IACrB,IAAI,UAA2B,CAAA;IAC/B,IAAI,SAA6B,CAAA;IACjC,MAAM,OAAO,GAAuB,EAAE,CAAA;IAEtC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAA;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;gBACpD,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,EACvB,mEAAmE,CACpE,CAAA;YACH,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;gBACvD,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,sEAAsE,CACvE,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC1E,MAAM,sBAAsB,GAAG,KAAK,CAAC,sBAAsB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QAC3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CACd,gBAAgB,CAAC;gBACf,KAAK;gBACL,MAAM;gBACN,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,mBAAmB;gBACnB,sBAAsB;aACvB,CAAC,CACH,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAClD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAA;QACrF,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG,WAAW,CAAA;YACnB,UAAU,GAAG,mBAAmB,CAAA;QAClC,CAAC;aAAM,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,GAAG,iBAAiB,CAAA;YACzB,UAAU,GAAG,6BAA6B,CAAA;YAC1C,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE;oBAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,aAAa,CAAA;YACrB,UAAU,GAAG,mBAAmB,CAAA;QAClC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAA;QACtD,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC7B,KAAK,GAAG,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;QACvD,UAAU,GAAG,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACzC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC5D,KAAK,GAAG,SAAS,GAAG,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;QACrE,UAAU,GAAG,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IAC/E,CAAC;IAED,MAAM,MAAM,GAAgB,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,MAAM,MAAM,GASR;QACF,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,UAAU;QACvB,MAAM;QACN,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;KAC7C,CAAA;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC"}

package/dist/src/v2/bounds/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types.js';
+export * from './canonical.js';
+export * from './evaluate.js';
+export * from './record.js';
+export * from './purpose.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/bounds/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/index.ts"],"names":[],"mappings":"AAQA,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/dist/src/v2/bounds/index.js

@@ -0,0 +1,13 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Non-time bounds on a grant: purpose, use count and budget.
+// Nothing here is required by draft-pidlisnyi-aps-03 and nothing here changes any existing
+// exported behaviour. Concept source: aeoess/agent-authority-lifecycle, invariant L10 and
+// invariant candidates CAND-01 and CAND-02. See ./types.ts.
+export * from './types.js';
+export * from './canonical.js';
+export * from './evaluate.js';
+export * from './record.js';
+export * from './purpose.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/bounds/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/bounds/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,+EAA+E;AAC/E,2FAA2F;AAC3F,0FAA0F;AAC1F,4DAA4D;AAE5D,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/dist/src/v2/bounds/purpose.d.ts

@@ -0,0 +1,2 @@
+export { isPurposePermitted, purposeCategory } from '../../core/data-lifecycle.js';
+//# sourceMappingURL=purpose.d.ts.map

package/dist/src/v2/bounds/purpose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purpose.d.ts","sourceRoot":"","sources":["../../../../src/v2/bounds/purpose.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/src/v2/bounds/purpose.js

@@ -0,0 +1,23 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED module, but these two functions are NOT new and NOT proposed. They are the
+// hierarchical purpose helpers that have shipped in `src/core/data-lifecycle.ts` since
+// before this module existed, re-exported here so that both reference SDKs agree on where
+// purpose membership lives.
+//
+// WHY THE RE-EXPORT. The Python SDK had no port of either function. Adding them there under
+// a `data_lifecycle` module, to hold two functions, would have put the same primitive at two
+// unrelated paths in the two languages, which becomes a cross-language test annoyance the
+// first time a vector references it. Both SDKs now expose them from the bounds module, and
+// the TypeScript original stays exported from its old path too, so nothing that imports it
+// today changes.
+//
+// PURPOSE MEMBERSHIP IS NOT PURPOSE EXHAUSTION, and the distinction is the reason this file
+// carries a comment at all. `isPurposePermitted` answers whether a requested purpose falls
+// inside a set of allowed purposes. It answers `true` for the second compressor purchase
+// exactly as it does for the first. Membership can therefore never decide exhaustion, and a
+// boundary that checks only membership is the defective implementation the purpose-bound
+// case corpus exists to catch. `evaluateBound` is the exhaustion question.
+export { isPurposePermitted, purposeCategory } from '../../core/data-lifecycle.js';
+//# sourceMappingURL=purpose.js.map

package/dist/src/v2/bounds/purpose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purpose.js","sourceRoot":"","sources":["../../../../src/v2/bounds/purpose.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,sFAAsF;AACtF,uFAAuF;AACvF,0FAA0F;AAC1F,4BAA4B;AAC5B,EAAE;AACF,4FAA4F;AAC5F,6FAA6F;AAC7F,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,iBAAiB;AACjB,EAAE;AACF,4FAA4F;AAC5F,2FAA2F;AAC3F,yFAAyF;AACzF,4FAA4F;AAC5F,yFAAyF;AACzF,2EAA2E;AAE3E,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA"}