axis-platform-sdk 0.2.0 → 0.3.0

package/src/index.d.ts

@@ -0,0 +1,288 @@
+// Type declarations for axis-platform-sdk (the package is authored in plain JS).
+// Covers the full main-entry surface. Subpath entry points (./scope, ./gate,
+// ./authorizer, ./ledger, ./blocklist, ./reportback) re-export their slice of
+// this declaration. Keep in sync with src/*.js.
+
+export type Tier = 'email' | 'domain' | 'verified' | 'kyb_individual' | 'kyb_organization';
+
+// --- verify -----------------------------------------------------------------
+
+/** The single structured verdict verifyAgent / SwitchAuthorizer.authorize return. */
+export interface Verdict {
+  accepted: boolean;
+  code?: string;
+  reason?: string;
+  agent_id?: string;
+  operator_id?: string;
+  effective_scope?: string[];
+  delegation_valid?: boolean;
+  tier?: Tier | null;
+  expires_at?: number | null;
+  /** present on an insufficient_scope denial */
+  missing?: string[];
+}
+
+export interface VerifyOptions {
+  audience?: string;
+  requireScopes?: string[];
+  minTier?: Tier;
+  blockedOperators?: string[];
+  approvedOperators?: string[] | null;
+  registryBaseUrl?: string;
+  fetchImpl?: typeof fetch;
+}
+
+export function verifyAgent(token: string, opts?: VerifyOptions): Promise<Verdict>;
+
+// --- authorizer (the pluggable gate engine; SwitchAuthorizer = free tier) ----
+
+export interface GateConfig {
+  enabled?: boolean;
+  minTier?: Tier;
+  requireScopes?: string[];
+  blockedOperators?: string[];
+  approvedOperators?: string[] | null;
+}
+
+/** Exactly what the "Door policy" screen edits + saves (door_policy.policy_json). */
+export interface SwitchPolicy {
+  audience?: string;
+  defaultAllow?: boolean;
+  blockedOperators?: string[];
+  gates?: Record<string, GateConfig>;
+}
+
+export interface AuthorizeContext {
+  registryBaseUrl?: string;
+  fetchImpl?: typeof fetch;
+}
+
+export class SwitchAuthorizer {
+  constructor(policy?: SwitchPolicy);
+  policy: SwitchPolicy;
+  optsForGate(gateId: string): VerifyOptions;
+  authorize(token: string, gateId: string, ctx?: AuthorizeContext): Promise<Verdict>;
+  gate(gateId: string, opts?: AuthorizeContext): (request: Request) => Promise<Verdict>;
+}
+
+// --- scope ------------------------------------------------------------------
+
+export function scopeCovers(granted: string, required: string): boolean;
+/** Returns { ok, missing } — NOT a boolean. */
+export function coversAll(granted: string[], required: string[]): { ok: boolean; missing: string[] };
+
+// --- gate (Worker request middleware) ---------------------------------------
+
+export function aitGate(opts: VerifyOptions): (request: Request) => Promise<Verdict>;
+export function extractToken(request: Request): string | null;
+export function denialResponse(verdict: Verdict): Response;
+
+// --- client (registry-call helpers) -----------------------------------------
+
+export interface EnrichResult {
+  agent_id: string;
+  did?: string | null;
+  display_name?: string | null;
+  tier?: Tier | null;
+  operator_id?: string;
+  status?: string | null;
+  raw?: unknown;
+  [k: string]: unknown;
+}
+export function enrich(
+  agentId: string,
+  token: string | null,
+  opts?: { registryBaseUrl?: string; fetchImpl?: typeof fetch },
+): Promise<EnrichResult>;
+
+export function registryGet(
+  base: string,
+  path: string,
+  opts?: { headers?: Record<string, string>; fetchImpl?: typeof fetch },
+): Promise<{ status: number; body: any }>;
+
+/** Read an operator's verification tier from a resolved agent record. */
+export function pickTier(agentBody: any): Tier | null;
+
+/** Load a platform's published `/.well-known/axis-access` door policy. */
+export function loadAccessPolicy(
+  platformBaseUrl: string,
+  opts?: { fetchImpl?: typeof fetch },
+): Promise<SwitchPolicy & Record<string, unknown>>;
+
+export function decodeAitPayload(token: string): Record<string, unknown> | null;
+export const TIER_RANK: Record<string, number>;
+export const DEFAULT_REGISTRY: string;
+
+// --- ledger (the "who showed up" arrival record) ----------------------------
+
+export type ArrivalDecision = 'auto_allow' | 'denied' | 'held' | 'approved' | 'booted';
+
+/**
+ * One arrival record. Byte-compatible with the cloud-hosted version's `arrivals`
+ * columns / `ArrivalRecord` (minus the adapter's own id/org_id PKs).
+ * `created_at` is epoch ms.
+ */
+export interface ArrivalEntry {
+  agent_id: string | null;
+  operator_id: string | null;
+  created_at: number;
+  tier: Tier | null;
+  delegation_valid: boolean;
+  effective_scope: string[];
+  gate_id: string | null;
+  requested_action: string | null;
+  display_name: string | null;
+  decision: ArrivalDecision;
+  reason: string | null;
+  audience: string | null;
+}
+
+/** Optional fields stamped onto an entry alongside the verdict. */
+export interface RecordFields {
+  audience?: string;
+  gate_id?: string;
+  requested_action?: string;
+  display_name?: string;
+  decision?: ArrivalDecision;
+  created_at?: number;
+}
+
+export function recordEntry(verdict: Verdict, fields?: RecordFields): ArrivalEntry;
+
+/** The pluggable ledger store port (the default is in-memory). */
+export interface LedgerStore {
+  append(entry: ArrivalEntry): Promise<void>;
+  recent(opts?: { limit?: number }): Promise<ArrivalEntry[]>;
+  byOperator(operatorId: string, opts?: { limit?: number }): Promise<ArrivalEntry[]>;
+}
+
+export class MemoryLedgerStore implements LedgerStore {
+  constructor(opts?: { max?: number });
+  append(entry: ArrivalEntry): Promise<void>;
+  recent(opts?: { limit?: number }): Promise<ArrivalEntry[]>;
+  byOperator(operatorId: string, opts?: { limit?: number }): Promise<ArrivalEntry[]>;
+}
+
+export class AccessLedger {
+  constructor(opts?: { store?: LedgerStore });
+  store: LedgerStore;
+  record(verdict: Verdict, fields?: RecordFields): Promise<ArrivalEntry>;
+  recent(opts?: { limit?: number }): Promise<ArrivalEntry[]>;
+  byOperator(operatorId: string, opts?: { limit?: number }): Promise<ArrivalEntry[]>;
+}
+
+export function loggedGate(
+  gate: (request: Request) => Promise<Verdict>,
+  ledger: AccessLedger,
+  fields?: RecordFields,
+): (request: Request) => Promise<Verdict>;
+
+// --- blocklist (runtime block/allow, by operator AND agent) -----------------
+
+export type BlockKind = 'operator' | 'agent';
+export interface BlockMeta { reason?: string; created_at?: number; [k: string]: unknown; }
+export interface BlockEntry { id: string; meta: BlockMeta; }
+
+/** The pluggable block-store port (the default is in-memory). */
+export interface BlocklistStore {
+  add(kind: BlockKind, id: string, meta?: BlockMeta): Promise<void>;
+  remove(kind: BlockKind, id: string): Promise<void>;
+  has(kind: BlockKind, id: string): Promise<boolean>;
+  list(kind: BlockKind): Promise<BlockEntry[]>;
+}
+
+export class MemoryBlocklistStore implements BlocklistStore {
+  add(kind: BlockKind, id: string, meta?: BlockMeta): Promise<void>;
+  remove(kind: BlockKind, id: string): Promise<void>;
+  has(kind: BlockKind, id: string): Promise<boolean>;
+  list(kind: BlockKind): Promise<BlockEntry[]>;
+}
+
+export class Blocklist {
+  constructor(opts?: { store?: BlocklistStore });
+  store: BlocklistStore;
+  blockOperator(operatorId: string, reason?: string): Promise<void>;
+  blockAgent(agentId: string, reason?: string): Promise<void>;
+  unblockOperator(operatorId: string): Promise<void>;
+  unblockAgent(agentId: string): Promise<void>;
+  isOperatorBlocked(operatorId: string): Promise<boolean>;
+  isAgentBlocked(agentId: string): Promise<boolean>;
+  blockedOperatorIds(): Promise<string[]>;
+  listOperators(): Promise<BlockEntry[]>;
+  listAgents(): Promise<BlockEntry[]>;
+  verifyOpts(): Promise<{ blockedOperators: string[] }>;
+  checkVerdict(verdict: Verdict): Promise<Verdict>;
+}
+
+export function gatedWithBlocklist(
+  gate: (request: Request) => Promise<Verdict>,
+  blocklist: Blocklist,
+): (request: Request) => Promise<Verdict>;
+
+// --- reportback (sign + emit a negative Trust Attestation) ------------------
+
+export interface TrustAttestation {
+  axis_version: string;
+  type: 'TrustAttestation';
+  id: string;
+  issued_by: string;
+  subject: string;
+  issued_at: string;
+  scope: string;
+  statement: string;
+  signature?: string;
+}
+
+export interface KeyStore {
+  load(): Promise<JsonWebKey | null>;
+  save(jwk: JsonWebKey): Promise<void>;
+}
+
+export class MemoryKeyStore implements KeyStore {
+  load(): Promise<JsonWebKey | null>;
+  save(jwk: JsonWebKey): Promise<void>;
+}
+
+export function getPlatformKey(
+  opts?: { keyStore?: KeyStore },
+): Promise<{ privateKey: CryptoKey; publicKeyB64: string; jwk: JsonWebKey }>;
+
+export function buildAttestation(args: {
+  platformId: string;
+  agentId: string;
+  category?: string;
+  reason?: string;
+  issuedAt?: string;
+}): TrustAttestation;
+
+export function signAttestation(attestation: TrustAttestation, privateKey: CryptoKey): Promise<TrustAttestation>;
+export function verifyAttestation(attestation: TrustAttestation, publicKeyB64: string): Promise<boolean>;
+
+export interface ReportArgs {
+  platformId: string;
+  agentId: string;
+  operatorId?: string;
+  category: string;
+  reason: string;
+}
+export interface ReportResult {
+  sent: boolean;
+  status?: number;
+  attestation?: TrustAttestation;
+  reason?: string;
+}
+export interface ReportOptions {
+  reputationUrl?: string | null;
+  keyStore?: KeyStore;
+  fetchImpl?: typeof fetch;
+}
+
+export function reportFlag(args: ReportArgs, opts?: ReportOptions): Promise<ReportResult>;
+export function blockAndReport(
+  blocklist: Blocklist,
+  args: ReportArgs,
+  opts?: ReportOptions,
+): Promise<{ blocked: boolean; agent_id: string; report: ReportResult }>;
+
+export const DEFAULT_REPUTATION_URL: string | null;

package/src/ledger.d.ts

@@ -0,0 +1,10 @@
+export {
+  AccessLedger,
+  MemoryLedgerStore,
+  loggedGate,
+  recordEntry,
+  ArrivalEntry,
+  ArrivalDecision,
+  RecordFields,
+  LedgerStore,
+} from './index.js';

package/src/ledger.js

@@ -1,171 +1,170 @@
-/**
- * Access ledger — the platform's "who showed up at my door" record.
- *
- * Every time an agent presents and the gate reaches a verdict, the platform can
- * log the arrival here. This is the STATEFUL half of the bouncer: verifyAgent /
- * aitGate are stateless verdict machines; the ledger is the platform's own
- * append-only record of what those verdicts were, kept in the platform's OWN
- * store. Zero-infra by default (in-memory); a real platform plugs in D1 /
- * SQLite / Postgres via the adapter shape below.
- *
- * Canonical adapter: Owyhee "The Door" (kipple-governor, governor#27) is the
- * shipped, D1-backed product instance of this port — its `arrivals` table +
- * `recordArrival()` ARE this ledger over D1. This module is the library form
- * (the shape + an in-memory default); The Door is the production adapter. The
- * entry shape below is deliberately byte-compatible with The Door's
- * `ArrivalRecord` / `arrivals` columns so there is ONE arrival record across
- * the SDK and the product, not two.
- *
- * Trust note: the only scope worth recording is `effective_scope` (the
- * registry's chain-walked, trustworthy scope), which is exactly what a verdict
- * carries. We never persist the AIT's self-declared scope.
- *
- * --- Adapter shape -------------------------------------------------------
- * A store is any object implementing:
- *
- *   async append(entry)                  -> void     // persist one arrival
- *   async recent({ limit })              -> entry[]  // newest first
- *   async byOperator(operatorId, { limit }) -> entry[] // newest first
- *
- * `entry` is the record shape produced by `recordEntry()` — the same fields The
- * Door's `arrivals` table holds (minus the adapter's own PK/org columns):
- *   {
- *     agent_id, operator_id, created_at,          // created_at = epoch ms (Date.now())
- *     tier, delegation_valid, effective_scope: string[],
- *     gate_id, requested_action, display_name,
- *     decision: 'auto_allow'|'denied'|'held'|'approved'|'booted',
- *     reason, audience
- *   }
- *
- * The same adapter shape is shared with blocklist.js (a tiny CRUD port). A
- * platform implements both against whatever it already runs. The defaults here
- * keep the demo and the free tier zero-infra.
- */
-
-/**
- * Default in-memory ledger store. Newest-first iteration. Bounded so a
- * long-running Worker isolate doesn't grow without limit; override `max` (0 =
- * unbounded) when you want the full history and have a real store behind it.
- */
-export class MemoryLedgerStore {
-  constructor({ max = 10000 } = {}) {
-    this._entries = []; // chronological; newest pushed to the end
-    this.max = max;
-  }
-
-  async append(entry) {
-    this._entries.push(entry);
-    if (this.max && this._entries.length > this.max) {
-      this._entries.splice(0, this._entries.length - this.max);
-    }
-  }
-
-  async recent({ limit = 50 } = {}) {
-    const out = this._entries.slice(-limit);
-    out.reverse();
-    return out;
-  }
-
-  async byOperator(operatorId, { limit = 50 } = {}) {
-    const out = [];
-    for (let i = this._entries.length - 1; i >= 0 && out.length < limit; i--) {
-      if (this._entries[i].operator_id === operatorId) out.push(this._entries[i]);
-    }
-    return out;
-  }
-}
-
-/**
- * Normalize a verdict (from verifyAgent) into a ledger entry. The output is
- * byte-compatible with The Door's `ArrivalRecord` (governor#27) so the SDK and
- * the product share one arrival shape.
- *
- * `decision` defaults from the verdict (accepted -> 'auto_allow', else
- * 'denied'); a caller may override it with a manual-review state a real bouncer
- * needs ('held' | 'approved' | 'booted'). `created_at` is epoch ms (Date.now()),
- * matching The Door's column; for an ISO string use
- * `new Date(entry.created_at).toISOString()`.
- *
- * @param {object} verdict             A verifyAgent verdict.
- * @param {object} [fields]
- * @param {string} [fields.audience]          Platform audience (optional metadata; The Door doesn't persist it).
- * @param {string} [fields.gate_id]           Which gate was requested.
- * @param {string} [fields.requested_action]  Human-facing action label.
- * @param {string} [fields.display_name]      Enriched presentation name.
- * @param {string} [fields.decision]          Override decision ('held'|'approved'|'booted').
- * @param {number} [fields.created_at]        Override timestamp (epoch ms).
- */
-export function recordEntry(verdict, { audience, gate_id, requested_action, display_name, decision, created_at } = {}) {
-  const v = verdict || {};
-  return {
-    agent_id: v.agent_id || null,
-    operator_id: v.operator_id || null,
-    created_at: created_at || Date.now(),
-    tier: v.tier || null,
-    delegation_valid: v.delegation_valid === true,
-    effective_scope: Array.isArray(v.effective_scope) ? v.effective_scope : [],
-    gate_id: gate_id || null,
-    requested_action: requested_action || null,
-    display_name: display_name || null,
-    decision: decision || (v.accepted ? 'auto_allow' : 'denied'),
-    reason: v.accepted ? null : v.reason || v.code || 'denied',
-    audience: audience || null,
-  };
-}
-
-/**
- * The platform's access ledger. Wraps a store and gives you the log helpers a
- * "who's using my platform" view needs.
- */
-export class AccessLedger {
-  constructor({ store } = {}) {
-    this.store = store || new MemoryLedgerStore();
-  }
-
-  /**
-   * Log a verdict. Returns the persisted entry. `fields` carries the same
-   * optional arrival fields as `recordEntry` (audience, gate_id,
-   * requested_action, display_name, decision override).
-   */
-  async record(verdict, fields = {}) {
-    const entry = recordEntry(verdict, fields);
-    await this.store.append(entry);
-    return entry;
-  }
-
-  /** Most recent arrivals, newest first. */
-  async recent(opts = {}) {
-    return this.store.recent(opts);
-  }
-
-  /** Recent arrivals from a single operator, newest first. */
-  async byOperator(operatorId, opts = {}) {
-    return this.store.byOperator(operatorId, opts);
-  }
-}
-
-/**
- * Wrap a gate (or any `(request) => Promise<verdict>`) so every verdict is
- * logged to a ledger before it's returned. Drop-in around `aitGate(...)` or
- * `authorizer.gate(gateId)`:
- *
- *   const ledger = new AccessLedger();
- *   const gate = loggedGate(aitGate({ audience }), ledger, { audience, gate_id });
- *   const verdict = await gate(request);   // logged as a side effect
- *
- * `fields` are the static arrival fields to stamp on every entry (audience,
- * gate_id, requested_action, display_name). Logging failures never block the
- * request — a store hiccup must not turn an accepted agent away. The verdict is
- * always returned.
- */
-export function loggedGate(gate, ledger, fields = {}) {
-  return async function loggingGate(request) {
-    const verdict = await gate(request);
-    try {
-      await ledger.record(verdict, fields);
-    } catch {
-      /* never let a ledger write failure change the verdict */
-    }
-    return verdict;
-  };
-}
+/**
+ * Access ledger — the platform's "who showed up at my door" record.
+ *
+ * Every time an agent presents and the gate reaches a verdict, the platform can
+ * log the arrival here. This is the STATEFUL half of the bouncer: verifyAgent /
+ * aitGate are stateless verdict machines; the ledger is the platform's own
+ * append-only record of what those verdicts were, kept in the platform's OWN
+ * store. Zero-infra by default (in-memory); a real platform plugs in D1 /
+ * SQLite / Postgres via the adapter shape below.
+ *
+ * Canonical adapter: the cloud-hosted version is the D1-backed product instance
+ * of this port — its `arrivals` table + `recordArrival()` ARE this ledger over
+ * D1. This module is the library form (the shape + an in-memory default); the
+ * cloud-hosted version is the production adapter. The entry shape below is
+ * deliberately byte-compatible with its `ArrivalRecord` / `arrivals` columns so
+ * there is ONE arrival record across the SDK and the cloud product, not two.
+ *
+ * Trust note: the only scope worth recording is `effective_scope` (the
+ * registry's chain-walked, trustworthy scope), which is exactly what a verdict
+ * carries. We never persist the AIT's self-declared scope.
+ *
+ * --- Adapter shape -------------------------------------------------------
+ * A store is any object implementing:
+ *
+ *   async append(entry)                  -> void     // persist one arrival
+ *   async recent({ limit })              -> entry[]  // newest first
+ *   async byOperator(operatorId, { limit }) -> entry[] // newest first
+ *
+ * `entry` is the record shape produced by `recordEntry()` — the same fields The
+ * Door's `arrivals` table holds (minus the adapter's own PK/org columns):
+ *   {
+ *     agent_id, operator_id, created_at,          // created_at = epoch ms (Date.now())
+ *     tier, delegation_valid, effective_scope: string[],
+ *     gate_id, requested_action, display_name,
+ *     decision: 'auto_allow'|'denied'|'held'|'approved'|'booted',
+ *     reason, audience
+ *   }
+ *
+ * The same adapter shape is shared with blocklist.js (a tiny CRUD port). A
+ * platform implements both against whatever it already runs. The defaults here
+ * keep the demo and the free tier zero-infra.
+ */
+
+/**
+ * Default in-memory ledger store. Newest-first iteration. Bounded so a
+ * long-running Worker isolate doesn't grow without limit; override `max` (0 =
+ * unbounded) when you want the full history and have a real store behind it.
+ */
+export class MemoryLedgerStore {
+  constructor({ max = 10000 } = {}) {
+    this._entries = []; // chronological; newest pushed to the end
+    this.max = max;
+  }
+
+  async append(entry) {
+    this._entries.push(entry);
+    if (this.max && this._entries.length > this.max) {
+      this._entries.splice(0, this._entries.length - this.max);
+    }
+  }
+
+  async recent({ limit = 50 } = {}) {
+    const out = this._entries.slice(-limit);
+    out.reverse();
+    return out;
+  }
+
+  async byOperator(operatorId, { limit = 50 } = {}) {
+    const out = [];
+    for (let i = this._entries.length - 1; i >= 0 && out.length < limit; i--) {
+      if (this._entries[i].operator_id === operatorId) out.push(this._entries[i]);
+    }
+    return out;
+  }
+}
+
+/**
+ * Normalize a verdict (from verifyAgent) into a ledger entry. The output is
+ * byte-compatible with the cloud-hosted version's `ArrivalRecord` so the SDK and
+ * the cloud product share one arrival shape.
+ *
+ * `decision` defaults from the verdict (accepted -> 'auto_allow', else
+ * 'denied'); a caller may override it with a manual-review state a real bouncer
+ * needs ('held' | 'approved' | 'booted'). `created_at` is epoch ms (Date.now()),
+ * matching the cloud-hosted version's column; for an ISO string use
+ * `new Date(entry.created_at).toISOString()`.
+ *
+ * @param {object} verdict             A verifyAgent verdict.
+ * @param {object} [fields]
+ * @param {string} [fields.audience]          Platform audience (optional metadata; the cloud-hosted version doesn't persist it).
+ * @param {string} [fields.gate_id]           Which gate was requested.
+ * @param {string} [fields.requested_action]  Human-facing action label.
+ * @param {string} [fields.display_name]      Enriched presentation name.
+ * @param {string} [fields.decision]          Override decision ('held'|'approved'|'booted').
+ * @param {number} [fields.created_at]        Override timestamp (epoch ms).
+ */
+export function recordEntry(verdict, { audience, gate_id, requested_action, display_name, decision, created_at } = {}) {
+  const v = verdict || {};
+  return {
+    agent_id: v.agent_id || null,
+    operator_id: v.operator_id || null,
+    created_at: created_at || Date.now(),
+    tier: v.tier || null,
+    delegation_valid: v.delegation_valid === true,
+    effective_scope: Array.isArray(v.effective_scope) ? v.effective_scope : [],
+    gate_id: gate_id || null,
+    requested_action: requested_action || null,
+    display_name: display_name || null,
+    decision: decision || (v.accepted ? 'auto_allow' : 'denied'),
+    reason: v.accepted ? null : v.reason || v.code || 'denied',
+    audience: audience || null,
+  };
+}
+
+/**
+ * The platform's access ledger. Wraps a store and gives you the log helpers a
+ * "who's using my platform" view needs.
+ */
+export class AccessLedger {
+  constructor({ store } = {}) {
+    this.store = store || new MemoryLedgerStore();
+  }
+
+  /**
+   * Log a verdict. Returns the persisted entry. `fields` carries the same
+   * optional arrival fields as `recordEntry` (audience, gate_id,
+   * requested_action, display_name, decision override).
+   */
+  async record(verdict, fields = {}) {
+    const entry = recordEntry(verdict, fields);
+    await this.store.append(entry);
+    return entry;
+  }
+
+  /** Most recent arrivals, newest first. */
+  async recent(opts = {}) {
+    return this.store.recent(opts);
+  }
+
+  /** Recent arrivals from a single operator, newest first. */
+  async byOperator(operatorId, opts = {}) {
+    return this.store.byOperator(operatorId, opts);
+  }
+}
+
+/**
+ * Wrap a gate (or any `(request) => Promise<verdict>`) so every verdict is
+ * logged to a ledger before it's returned. Drop-in around `aitGate(...)` or
+ * `authorizer.gate(gateId)`:
+ *
+ *   const ledger = new AccessLedger();
+ *   const gate = loggedGate(aitGate({ audience }), ledger, { audience, gate_id });
+ *   const verdict = await gate(request);   // logged as a side effect
+ *
+ * `fields` are the static arrival fields to stamp on every entry (audience,
+ * gate_id, requested_action, display_name). Logging failures never block the
+ * request — a store hiccup must not turn an accepted agent away. The verdict is
+ * always returned.
+ */
+export function loggedGate(gate, ledger, fields = {}) {
+  return async function loggingGate(request) {
+    const verdict = await gate(request);
+    try {
+      await ledger.record(verdict, fields);
+    } catch {
+      /* never let a ledger write failure change the verdict */
+    }
+    return verdict;
+  };
+}

package/src/reportback.d.ts

@@ -0,0 +1,15 @@
+export {
+  reportFlag,
+  blockAndReport,
+  getPlatformKey,
+  buildAttestation,
+  signAttestation,
+  verifyAttestation,
+  MemoryKeyStore,
+  TrustAttestation,
+  KeyStore,
+  ReportArgs,
+  ReportResult,
+  ReportOptions,
+  DEFAULT_REPUTATION_URL,
+} from './index.js';