life-as-api 0.2.0

package/dist/surface/evidence-backed-context-query.js

@@ -0,0 +1,240 @@
+// Slice-12b: Evidence-backed Context Query Surface — Scoped Hydrated Projection.
+//
+// CONTEXT_QUERY_SURFACE_EXISTS_001: single entry point for contract context queries.
+// CONTEXT_QUERY_CONSENT_BEFORE_PROJECTION_001: consent validated and selector restricted
+//   BEFORE any claim read or projection. Never filter post-read.
+// CONTEXT_QUERY_SCOPED_HYDRATED_READ_001: agent flow reads hydrated claims with SystemProjectionContext
+//   ONLY after selector restriction has been applied.
+// CONTEXT_QUERY_NO_BROAD_HYDRATION_001: the broad requested selector is never passed to
+//   readStoredClaims(); only the intersected restrictedSelector is used.
+// CONTEXT_QUERY_ALLOWED_PAYLOAD_VALUES_RETURNED_001: resolved field values for in-scope predicates
+//   are returned to the caller via HydratedContractProjection.fields[f].resolvedValue.
+// CONTEXT_QUERY_OUT_OF_SCOPE_PAYLOAD_REDACTED_001: fields whose winning claim was not in the
+//   restricted selector have resolvedValue absent from the response.
+// CONTEXT_QUERY_AUDIT_NO_PAYLOAD_VALUES_001: audit events never contain payload values.
+// CONTEXT_QUERY_AGENT_SCOPE_BOUND_001: agent sees only intersection of requested + granted scope.
+// CONTEXT_QUERY_AGENT_NO_RAW_BYTES_001: no getDocument() calls; diagnostics are metadata-only.
+// CONTEXT_QUERY_EVIDENCE_DIAGNOSTICS_INCLUDED_001: diagnostics attached when requested.
+// CONTEXT_QUERY_AUDIT_EVERY_REQUEST_001: every attempt (allow or deny) writes an AuditEvent.
+// CONTEXT_QUERY_AUDIT_FAIL_CLOSED_001: audit write failure returns {ok:false} before any data.
+// CONTEXT_QUERY_OWNER_FULL_ALLOWED_001: OwnerContext uses full requested selector, no grant needed.
+// CONTEXT_QUERY_DETERMINISTIC_001: same inputs produce identical output.
+import { ERASURE_TOMBSTONE_PREDICATE } from "../erasure/tombstone.js";
+import { evaluateGrant } from "../consent/consent-guard.js";
+import { intersectSelector } from "../consent/intersect-selector.js";
+import { buildAuditEvent, denyReasonToAuditCode } from "../audit/audit-log.js";
+import { asISOTime } from "../types/ids.js";
+import { projectContracts } from "../contract/project-contracts.js";
+import { diagnoseContractProjections } from "../contract/diagnostics.js";
+// Internal SystemProjectionContext used for hydrated reads after consent restriction.
+// MUST only be used with the restrictedSelector — never with the raw requested selector.
+const _INTERNAL_PROJ_CTX = { kind: "system_projection" };
+export class EvidenceBackedContextQueryService {
+    _store;
+    _grantRegistry;
+    _auditLog;
+    _sourceRegistry;
+    _docStore;
+    _trust;
+    _clock;
+    constructor(_store, _grantRegistry, _auditLog, _sourceRegistry, _docStore, _trust, _clock) {
+        this._store = _store;
+        this._grantRegistry = _grantRegistry;
+        this._auditLog = _auditLog;
+        this._sourceRegistry = _sourceRegistry;
+        this._docStore = _docStore;
+        this._trust = _trust;
+        this._clock = _clock;
+    }
+    async queryContracts(ctx, input) {
+        const now = this._clock ? this._clock() : asISOTime(new Date().toISOString());
+        if (ctx.kind === "audit") {
+            return { ok: true, contracts: [] };
+        }
+        // ERASURE_QUERY_SUPPRESSION_DEFINED_001: tombstone check before any query output.
+        // ERASURE_TOMBSTONE_LOOKUP_PERF_DEFERRED_001: O(n) scan acceptable for Slice-21a.
+        const tombstones = await this._store.readClaims(_INTERNAL_PROJ_CTX, {
+            predicates: [ERASURE_TOMBSTONE_PREDICATE],
+        });
+        const erasedSubjects = new Set(tombstones.map(t => t.subject));
+        if (ctx.kind === "agent") {
+            return this._queryAsAgent(ctx, input, now, erasedSubjects);
+        }
+        return this._queryAsPrivileged(ctx, input, now, erasedSubjects);
+    }
+    async _queryAsAgent(ctx, input, now, erasedSubjects) {
+        const fingerprint = selectorFingerprint(input.selector);
+        // 1. Resolve + validate grant — CONTEXT_QUERY_CONSENT_BEFORE_PROJECTION_001
+        const grant = this._grantRegistry.lookup(ctx.grantId);
+        const decision = evaluateGrant(grant, ctx, "query", now);
+        if (!decision.allowed) {
+            const event = buildAuditEvent({
+                actor: ctx.agentId,
+                grantId: ctx.grantId,
+                purpose: ctx.purpose,
+                decision: "deny",
+                reasonCode: denyReasonToAuditCode(decision.reason),
+                selectorFingerprint: fingerprint,
+                resultCount: 0,
+                resultClaimIds: [],
+                now,
+            });
+            try {
+                await this._auditLog.write(event);
+            }
+            catch {
+                return { ok: false, reason: "audit-write-failed" };
+            }
+            return { ok: true, contracts: [] };
+        }
+        // 2. Restrict selector BEFORE any read — CONTEXT_QUERY_CONSENT_BEFORE_PROJECTION_001
+        const restrictedSelector = intersectSelector(input.selector, grant);
+        // 3. CONTEXT_QUERY_SCOPED_HYDRATED_READ_001: hydrated read with SystemProjectionContext
+        //    and the ALREADY-RESTRICTED selector. The broad requested selector is never used here.
+        let rawClaims = [];
+        if (restrictedSelector !== null) {
+            rawClaims = await this._store.readStoredClaims(_INTERNAL_PROJ_CTX, restrictedSelector);
+        }
+        // ERASURE_QUERY_SUPPRESSION_DEFINED_001: suppress claims for erased subjects.
+        // ERASURE_TOMBSTONE_SELF_SUPPRESSION_CARVEOUT_001: tombstone lookup is separate;
+        //   tombstone predicate is never in restrictedSelector here.
+        const storedClaims = erasedSubjects.size > 0
+            ? rawClaims.filter(c => !erasedSubjects.has(c.subject))
+            : rawClaims;
+        // 4. Project from in-scope claims only. StoredClaim satisfies ClaimMeta structurally.
+        // erasedSubjects passed for defense-in-depth; storedClaims is already pre-filtered.
+        const projections = projectContracts(storedClaims, this._trust, erasedSubjects);
+        // 5. Hydrate projections with payload values for in-scope resolved fields.
+        //    CONTEXT_QUERY_OUT_OF_SCOPE_PAYLOAD_REDACTED_001: storedClaimMap only contains
+        //    claims from restrictedSelector — out-of-scope winning claims yield no resolvedValue.
+        const storedClaimMap = new Map(storedClaims.map((c) => [c.id, c]));
+        const hydratedProjections = hydrateProjections(projections, storedClaimMap);
+        // 6. Optionally attach diagnostics — CONTEXT_QUERY_EVIDENCE_DIAGNOSTICS_INCLUDED_001
+        const claimMap = new Map(storedClaims.map((c) => [c.id, c]));
+        const diagnostics = input.includeDiagnostics
+            ? diagnoseContractProjections(projections, claimMap, this._sourceRegistry, this._docStore, ctx)
+            : undefined;
+        // 7. Build + write allow audit — CONTEXT_QUERY_AUDIT_NO_PAYLOAD_VALUES_001
+        //    Audit stores only contractIds (metadata), never payload values.
+        const contractIds = projections.map((p) => p.contractId);
+        const auditEvent = buildAuditEvent({
+            actor: ctx.agentId,
+            grantId: ctx.grantId,
+            purpose: ctx.purpose,
+            decision: "allow",
+            reasonCode: restrictedSelector === null ? "SCOPE_INTERSECTION_EMPTY" : "ALLOWED",
+            selectorFingerprint: fingerprint,
+            resultCount: projections.length,
+            resultClaimIds: storedClaims.map((c) => c.id),
+            contractIds,
+            now,
+        });
+        // CONTEXT_QUERY_AUDIT_FAIL_CLOSED_001: write BEFORE returning contract data
+        try {
+            await this._auditLog.write(auditEvent);
+        }
+        catch {
+            return { ok: false, reason: "audit-write-failed" };
+        }
+        return {
+            ok: true,
+            contracts: hydratedProjections,
+            auditId: auditEvent.id,
+            ...(diagnostics !== undefined ? { diagnostics } : {}),
+        };
+    }
+    async _queryAsPrivileged(ctx, input, now, erasedSubjects) {
+        const fingerprint = selectorFingerprint(input.selector);
+        // CONTEXT_QUERY_OWNER_FULL_ALLOWED_001: no grant needed; full hydrated read
+        const rawClaims = await this._store.readStoredClaims(ctx, input.selector);
+        // ERASURE_QUERY_SUPPRESSION_DEFINED_001: suppress claims for erased subjects.
+        const storedClaims = erasedSubjects.size > 0
+            ? rawClaims.filter(c => !erasedSubjects.has(c.subject))
+            : rawClaims;
+        // erasedSubjects passed for defense-in-depth; storedClaims is already pre-filtered.
+        const projections = projectContracts(storedClaims, this._trust, erasedSubjects);
+        const storedClaimMap = new Map(storedClaims.map((c) => [c.id, c]));
+        const hydratedProjections = hydrateProjections(projections, storedClaimMap);
+        const claimMap = new Map(storedClaims.map((c) => [c.id, c]));
+        const diagnostics = input.includeDiagnostics
+            ? diagnoseContractProjections(projections, claimMap, this._sourceRegistry, this._docStore, ctx)
+            : undefined;
+        const contractIds = projections.map((p) => p.contractId);
+        const auditEvent = buildAuditEvent({
+            actor: actorLabel(ctx),
+            decision: "allow",
+            reasonCode: "ALLOWED",
+            selectorFingerprint: fingerprint,
+            resultCount: projections.length,
+            resultClaimIds: storedClaims.map((c) => c.id),
+            contractIds,
+            now,
+        });
+        // CONTEXT_QUERY_AUDIT_FAIL_CLOSED_001
+        try {
+            await this._auditLog.write(auditEvent);
+        }
+        catch {
+            return { ok: false, reason: "audit-write-failed" };
+        }
+        return {
+            ok: true,
+            contracts: hydratedProjections,
+            auditId: auditEvent.id,
+            ...(diagnostics !== undefined ? { diagnostics } : {}),
+        };
+    }
+}
+// ─── Hydration helpers ────────────────────────────────────────────────────────
+function hydrateField(field, storedClaimMap) {
+    const stored = field.winningClaimId !== undefined
+        ? storedClaimMap.get(field.winningClaimId)
+        : undefined;
+    return {
+        status: field.status,
+        competingClaimIds: field.competingClaimIds,
+        reasonCode: field.reasonCode,
+        ...(field.winningClaimId !== undefined ? { winningClaimId: field.winningClaimId } : {}),
+        ...(stored !== undefined ? { resolvedValue: stored.payload } : {}),
+    };
+}
+function hydrateProjection(proj, storedClaimMap) {
+    return {
+        contractId: proj.contractId,
+        status: proj.status,
+        conflicts: proj.conflicts,
+        derivedFrom: proj.derivedFrom,
+        policyId: proj.policyId,
+        policyVersion: proj.policyVersion,
+        fields: {
+            counterparty: hydrateField(proj.fields.counterparty, storedClaimMap),
+            amount: hydrateField(proj.fields.amount, storedClaimMap),
+            cadence: hydrateField(proj.fields.cadence, storedClaimMap),
+            nextDue: hydrateField(proj.fields.nextDue, storedClaimMap),
+            cancellationTerms: hydrateField(proj.fields.cancellationTerms, storedClaimMap),
+            contractStatus: hydrateField(proj.fields.contractStatus, storedClaimMap),
+        },
+    };
+}
+function hydrateProjections(projections, storedClaimMap) {
+    return projections.map((p) => hydrateProjection(p, storedClaimMap));
+}
+// ─── Utilities ────────────────────────────────────────────────────────────────
+function actorLabel(ctx) {
+    if (ctx.kind === "owner")
+        return `owner:${ctx.personId}`;
+    if (ctx.kind === "system_projection")
+        return "system_projection";
+    return `test:${ctx.label}`;
+}
+function selectorFingerprint(selector) {
+    const parts = [];
+    if (selector.subject)
+        parts.push(`subject:${selector.subject}`);
+    if (selector.predicates)
+        parts.push(`preds:[${[...selector.predicates].sort().join(",")}]`);
+    if (selector.sinceRecordedSeq !== undefined)
+        parts.push(`since:${selector.sinceRecordedSeq}`);
+    return parts.join("|") || "no-filter";
+}
+//# sourceMappingURL=evidence-backed-context-query.js.map

package/dist/surface/evidence-backed-context-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-backed-context-query.js","sourceRoot":"","sources":["../../src/surface/evidence-backed-context-query.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,qFAAqF;AACrF,yFAAyF;AACzF,iEAAiE;AACjE,wGAAwG;AACxG,sDAAsD;AACtD,wFAAwF;AACxF,yEAAyE;AACzE,mGAAmG;AACnG,uFAAuF;AACvF,6FAA6F;AAC7F,qEAAqE;AACrE,wFAAwF;AACxF,kGAAkG;AAClG,+FAA+F;AAC/F,wFAAwF;AACxF,6FAA6F;AAC7F,+FAA+F;AAC/F,oGAAoG;AACpG,yEAAyE;AAMzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAStE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAEzE,sFAAsF;AACtF,yFAAyF;AACzF,MAAM,kBAAkB,GAA4B,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;AA8ClF,MAAM,OAAO,iCAAiC;IAEzB;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,MAA0B,EAC1B,cAA8B,EAC9B,SAAyB,EACzB,eAA+B,EAC/B,SAAiC,EACjC,MAA6B,EAC7B,MAA8B;QAN9B,WAAM,GAAN,MAAM,CAAoB;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,cAAS,GAAT,SAAS,CAAgB;QACzB,oBAAe,GAAf,eAAe,CAAgB;QAC/B,cAAS,GAAT,SAAS,CAAwB;QACjC,WAAM,GAAN,MAAM,CAAuB;QAC7B,WAAM,GAAN,MAAM,CAAwB;IAC9C,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,GAAkB,EAAE,KAA0B;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAE9E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACrC,CAAC;QAED,kFAAkF;QAClF,kFAAkF;QAClF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE;YAClE,UAAU,EAAE,CAAC,2BAA2B,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,cAAc,GAA0B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAEtF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,GAAmC,EACnC,KAAmC,EACnC,GAAuB,EACvB,cAAqC;QAErC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,4EAA4E;QAC5E,MAAM,KAAK,GAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,eAAe,CAAC;gBAC5B,KAAK,EAAgB,GAAG,CAAC,OAAO;gBAChC,OAAO,EAAc,GAAG,CAAC,OAAO;gBAChC,OAAO,EAAc,GAAG,CAAC,OAAO;gBAChC,QAAQ,EAAa,MAAM;gBAC3B,UAAU,EAAW,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC3D,mBAAmB,EAAE,WAAW;gBAChC,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACrC,CAAC;QAED,qFAAqF;QACrF,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAM,CAAC,CAAC;QAErE,wFAAwF;QACxF,2FAA2F;QAC3F,IAAI,SAAS,GAA+B,EAAE,CAAC;QAC/C,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACzF,CAAC;QAED,8EAA8E;QAC9E,iFAAiF;QACjF,6DAA6D;QAC7D,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,GAAG,CAAC;YAC1C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QAEd,sFAAsF;QACtF,oFAAoF;QACpF,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAEhF,2EAA2E;QAC3E,mFAAmF;QACnF,0FAA0F;QAC1F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAuB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAE5E,qFAAqF;QACrF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAqB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB;YAC1C,CAAC,CAAC,2BAA2B,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YAC/F,CAAC,CAAC,SAAS,CAAC;QAEd,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,WAAW,GAA8B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACpF,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,KAAK,EAAgB,GAAG,CAAC,OAAO;YAChC,OAAO,EAAc,GAAG,CAAC,OAAO;YAChC,OAAO,EAAc,GAAG,CAAC,OAAO;YAChC,QAAQ,EAAa,OAAO;YAC5B,UAAU,EAAW,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS;YACzF,mBAAmB,EAAE,WAAW;YAChC,WAAW,EAAU,WAAW,CAAC,MAAM;YACvC,cAAc,EAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,WAAW;YACX,GAAG;SACJ,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QAED,OAAO;YACL,EAAE,EAAS,IAAI;YACf,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAI,UAAU,CAAC,EAAE;YACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAoE,EACpE,KAAmC,EACnC,GAAuB,EACvB,cAAqC;QAErC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE1E,8EAA8E;QAC9E,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,GAAG,CAAC;YAC1C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC;QAEd,oFAAoF;QACpF,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAEhF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAuB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAqB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB;YAC1C,CAAC,CAAC,2BAA2B,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YAC/F,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,WAAW,GAA8B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACpF,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,KAAK,EAAgB,UAAU,CAAC,GAAG,CAAC;YACpC,QAAQ,EAAa,OAAO;YAC5B,UAAU,EAAW,SAAS;YAC9B,mBAAmB,EAAE,WAAW;YAChC,WAAW,EAAU,WAAW,CAAC,MAAM;YACvC,cAAc,EAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,WAAW;YACX,GAAG;SACJ,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QAED,OAAO;YACL,EAAE,EAAS,IAAI;YACf,SAAS,EAAE,mBAAmB;YAC9B,OAAO,EAAI,UAAU,CAAC,EAAE;YACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;CACF;AAED,iFAAiF;AAEjF,SAAS,YAAY,CACnB,KAAkL,EAClL,cAAiD;IAEjD,MAAM,MAAM,GACV,KAAK,CAAC,cAAc,KAAK,SAAS;QAChC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAa,KAAK,CAAC,MAAM;QAC/B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,UAAU,EAAS,KAAK,CAAC,UAAU;QACnC,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAkC,EAClC,cAAiD;IAEjD,OAAO;QACL,UAAU,EAAK,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAS,IAAI,CAAC,MAAM;QAC1B,SAAS,EAAM,IAAI,CAAC,SAAS;QAC7B,WAAW,EAAI,IAAI,CAAC,WAAW;QAC/B,QAAQ,EAAO,IAAI,CAAC,QAAQ;QAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE;YACN,YAAY,EAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAO,cAAc,CAAC;YAC9E,MAAM,EAAa,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAa,cAAc,CAAC;YAC9E,OAAO,EAAY,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAY,cAAc,CAAC;YAC9E,OAAO,EAAY,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAY,cAAc,CAAC;YAC9E,iBAAiB,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;YAC9E,cAAc,EAAK,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAK,cAAc,CAAC;SAC/E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,WAAiD,EACjD,cAAiD;IAEjD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,iFAAiF;AAEjF,SAAS,UAAU,CAAC,GAAyD;IAC3E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAc,OAAO,SAAS,GAAG,CAAC,QAAQ,EAAE,CAAC;IACrE,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IACjE,OAAO,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAuB;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,OAAO;QAAyB,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,UAAU;QAAsB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChH,IAAI,QAAQ,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;AACxC,CAAC"}

package/dist/types/access-context.d.ts

@@ -0,0 +1,25 @@
+import type { PersonId, GrantId } from "./ids.js";
+export type AccessContext = OwnerContext | AgentConsentContext | SystemProjectionContext | AuditContext | TestContext;
+export interface OwnerContext {
+    readonly kind: "owner";
+    readonly personId: PersonId;
+}
+export interface AgentConsentContext {
+    readonly kind: "agent";
+    readonly grantId: GrantId;
+    readonly agentId: string;
+    readonly purpose: PurposeTag;
+    readonly notAfter: string;
+}
+export interface SystemProjectionContext {
+    readonly kind: "system_projection";
+}
+export interface AuditContext {
+    readonly kind: "audit";
+    readonly personId: PersonId;
+}
+export interface TestContext {
+    readonly kind: "test";
+    readonly label: string;
+}
+export type PurposeTag = "obligation_review" | "cancellation_assist" | "budget_analysis" | "b2b_verification" | "proposal_submission" | "erasure_request" | "emergency_access" | "diagnosis" | "treatment" | "emergency" | "tax" | "credit_check" | "insurance_claim" | "account_overview" | "notary" | "contract_review" | "evidence_preservation" | "court_filing";

package/dist/types/access-context.js

@@ -0,0 +1,6 @@
+// ADR-004 + GPT-5.5 correction:
+// "No store read without AccessContext" — not just ConsentContext.
+// Projection rebuilds, audits, owner actions, and tests each get a typed context.
+// External agents ONLY receive AgentConsentContext — never OwnerContext or SystemContext.
+export {};
+//# sourceMappingURL=access-context.js.map

package/dist/types/access-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-context.js","sourceRoot":"","sources":["../../src/types/access-context.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,mEAAmE;AACnE,kFAAkF;AAClF,0FAA0F"}

package/dist/types/claim.d.ts

@@ -0,0 +1,48 @@
+import type { ClaimId, ContractId, SourceId, PersonId, ISOTime } from "./ids.js";
+export interface ClaimMeta {
+    readonly id: ClaimId;
+    readonly sourceId: SourceId;
+    readonly subject: PersonId;
+    readonly predicate: ClaimPredicate;
+    readonly validFrom: ISOTime;
+    readonly validTo?: ISOTime;
+    readonly recordedAt: ISOTime;
+    readonly recordedSeq: number;
+    readonly retracts?: ClaimId;
+    readonly supersedes?: ClaimId;
+    readonly overrides?: ClaimId;
+    readonly contractId?: ContractId;
+    readonly confidence?: number;
+}
+export interface Claim<P extends ClaimPayload = ClaimPayload> extends ClaimMeta {
+    readonly payload: P;
+}
+export type AppendClaimInput = Omit<Claim, "id" | "recordedAt" | "recordedSeq">;
+export type StoredClaim = Readonly<Claim>;
+export type ClaimPredicate = "person.name" | "person.email" | "contract.exists" | "contract.counterparty" | "contract.amount" | "contract.cadence" | "contract.next_due" | "contract.cancellation_terms" | "contract.identity.link" | (string & Record<never, never>);
+export type ClaimPayload = StringPayload | MoneyPayload | CadencePayload | DatePayload | IdentityLinkPayload;
+export interface StringPayload {
+    readonly type: "string";
+    readonly value: string;
+}
+export interface MoneyPayload {
+    readonly type: "money";
+    readonly currency: string;
+    readonly minorUnits: number;
+}
+export interface CadencePayload {
+    readonly type: "cadence";
+    readonly rrule: string;
+}
+export interface DatePayload {
+    readonly type: "date";
+    readonly value: ISOTime;
+}
+export interface IdentityLinkPayload {
+    readonly type: "identity_link";
+    readonly contractId: string;
+    readonly observedAlias: string;
+    readonly normalizedAlias: string;
+    readonly normalizerVersion: string;
+    readonly matchMethod: "manual" | "auto_high_confidence" | "proposal_accepted";
+}

package/dist/types/claim.js

@@ -0,0 +1,5 @@
+// Core Claim types — ADR-001, ADR-003
+// Claims are append-only, bitemporal assertions. Never mutated. Never deleted.
+// Retraction = new Claim. Override = new Claim. Supersede = new Claim.
+export {};
+//# sourceMappingURL=claim.js.map

package/dist/types/claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim.js","sourceRoot":"","sources":["../../src/types/claim.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,+EAA+E;AAC/E,uEAAuE"}

package/dist/types/consent.d.ts

@@ -0,0 +1,41 @@
+import type { GrantId, PersonId, ISOTime } from "./ids.js";
+import type { ClaimPredicate } from "./claim.js";
+import type { PurposeTag } from "./access-context.js";
+export interface ConsentGrant {
+    readonly id: GrantId;
+    readonly grantedTo: AgentIdentity;
+    readonly purpose: PurposeTag;
+    readonly scope: Scope;
+    readonly capabilities: ReadonlyArray<Capability>;
+    readonly notBefore: ISOTime;
+    readonly notAfter: ISOTime;
+    readonly maxFieldDepth?: "summary" | "full";
+    readonly revokedAt?: ISOTime;
+    readonly createdAt: ISOTime;
+}
+export interface AgentIdentity {
+    readonly agentId: string;
+    readonly displayName: string;
+}
+export interface Scope {
+    readonly predicates: ReadonlyArray<ClaimPredicate>;
+    readonly subjects?: ReadonlyArray<PersonId>;
+    readonly contractIds?: ReadonlyArray<string>;
+    readonly excludePredicates?: ReadonlyArray<ClaimPredicate>;
+}
+export type Capability = "query" | "propose";
+export type ConsentDecision = {
+    allowed: true;
+    scopedPredicates: ReadonlyArray<ClaimPredicate>;
+    maxFieldDepth: "summary" | "full";
+} | {
+    allowed: false;
+    reason: ConsentDenyReason;
+};
+export type ConsentDenyReason = "grant_not_found" | "grant_expired" | "grant_not_yet_active" | "grant_revoked" | "purpose_mismatch" | "capability_not_granted" | "scope_empty" | "subject_not_granted";
+export type ScopedQueryResult<T> = {
+    found: true;
+    data: T;
+} | {
+    found: false;
+};

package/dist/types/consent.js

@@ -0,0 +1,3 @@
+// ADR-004 — ConsentGrant and Scope types
+export {};
+//# sourceMappingURL=consent.js.map

package/dist/types/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/types/consent.ts"],"names":[],"mappings":"AAAA,yCAAyC"}

package/dist/types/crypto-boundary.d.ts

@@ -0,0 +1,12 @@
+export interface CryptoBoundary {
+    encryptPayload(plaintext: string): Promise<EncryptedBlob>;
+    decryptPayload(blob: EncryptedBlob): Promise<string>;
+    encryptDocument(plaintext: Uint8Array): Promise<EncryptedBlob>;
+    decryptDocument(blob: EncryptedBlob): Promise<Uint8Array>;
+}
+export interface EncryptedBlob {
+    readonly ciphertext: string;
+    readonly iv: string;
+    readonly authTag: string;
+    readonly keyRef: string;
+}

package/dist/types/crypto-boundary.js

@@ -0,0 +1,15 @@
+// ADR-005 — CryptoBoundary interface
+// Exactly ONE layer between domain (plaintext) and persistence (ciphertext).
+// No domain module may import crypto primitives directly (enforced by architecture tests).
+export {};
+// What is encrypted at rest (ADR-005, field-level list):
+// - Claim.payload (value field)
+// - raw source documents (PDF, email body)
+//
+// What remains plaintext metadata (explicitly accepted risk for MVP):
+// - ContractId, ClaimId, SourceId, predicate names
+// - recordedAt, validFrom/validTo, confidence
+// - Consent scope structure
+// Risk: allows traffic analysis ("user has N contracts")
+// Accepted: no real PII in MVP 0.1. Post-MVP: metadata encryption.
+//# sourceMappingURL=crypto-boundary.js.map

package/dist/types/crypto-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-boundary.js","sourceRoot":"","sources":["../../src/types/crypto-boundary.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,6EAA6E;AAC7E,2FAA2F;;AAuB3F,yDAAyD;AACzD,gCAAgC;AAChC,2CAA2C;AAC3C,EAAE;AACF,sEAAsE;AACtE,mDAAmD;AACnD,8CAA8C;AAC9C,4BAA4B;AAC5B,yDAAyD;AACzD,mEAAmE"}

package/dist/types/evidence.d.ts

@@ -0,0 +1,31 @@
+import type { EvidenceId, ISOTime } from "./ids.js";
+import type { OwnerContext, SystemProjectionContext, TestContext } from "./access-context.js";
+export type EvidenceWriter = OwnerContext | SystemProjectionContext | TestContext;
+export interface EvidenceRef {
+    readonly id: EvidenceId;
+    readonly uri: string;
+    readonly mimeType: string;
+    readonly byteLength: number;
+    readonly encrypted: true;
+    readonly createdAt: ISOTime;
+    readonly label?: string;
+}
+export interface RawDocument {
+    readonly id: EvidenceId;
+    readonly mimeType: string;
+    readonly byteLength: number;
+    readonly createdAt: ISOTime;
+    readonly createdBy: EvidenceWriter;
+    readonly label?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly plainBytes: Uint8Array;
+}
+export interface RawDocumentInput {
+    readonly mimeType: string;
+    readonly bytes: Uint8Array;
+    readonly label?: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface EvidenceFilter {
+    readonly mimeType?: string;
+}

package/dist/types/evidence.js

@@ -0,0 +1,8 @@
+// Evidence types — Slice-09 encrypted RawDocument / EvidenceRef store.
+//
+// RAW_DOCUMENT_STORE_EXISTS_001: RawDocumentStore is the only durable home for raw bytes.
+// RAW_DOCUMENT_BYTES_ENCRYPTED_AT_REST_001: only EncryptedBlob is persisted, never plaintext.
+// RAW_DOCUMENT_IMMUTABLE_001: documents have no update/delete path.
+// RAW_DOCUMENT_ACCESS_BOUND_001: only Owner/System/Test may write or read raw bytes.
+export {};
+//# sourceMappingURL=evidence.js.map

package/dist/types/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/types/evidence.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,oEAAoE;AACpE,qFAAqF"}

package/dist/types/fact-store.d.ts

@@ -0,0 +1,24 @@
+import type { ClaimId, PersonId, ISOTime } from "./ids.js";
+import type { AppendClaimInput, ClaimMeta, ClaimPredicate, StoredClaim } from "./claim.js";
+import type { AccessContext } from "./access-context.js";
+export interface FactStore {
+    append(input: AppendClaimInput, ctx: AccessContext): Promise<{
+        claimId: ClaimId;
+        recordedSeq: number;
+    }>;
+    readAll(ctx: AccessContext): Promise<ReadonlyArray<ClaimMeta>>;
+    readSince(seq: number, ctx: AccessContext): Promise<ReadonlyArray<ClaimMeta>>;
+    readAt(params: BitemporalQuery, ctx: AccessContext): Promise<ReadonlyArray<ClaimMeta>>;
+    readClaims(ctx: AccessContext, selector: ClaimSelector): Promise<ReadonlyArray<ClaimMeta>>;
+    readStoredClaims(ctx: AccessContext, selector: ClaimSelector): Promise<ReadonlyArray<StoredClaim>>;
+}
+export interface BitemporalQuery {
+    validAsOf?: ISOTime;
+    knownAsOf?: ISOTime;
+}
+export interface ClaimSelector {
+    readonly subject?: PersonId;
+    readonly predicates?: ReadonlyArray<ClaimPredicate>;
+    readonly sinceRecordedSeq?: number;
+    readonly includeRetracted?: boolean;
+}

package/dist/types/fact-store.js

@@ -0,0 +1,12 @@
+// FactStore interface — the only write+read primitive.
+// ALL reads require an AccessContext. No implicit read-all. (ADR-004, GPT-5.5)
+//
+// Two read tiers (Slice-06b):
+//   Metadata reads  — readAll / readClaims / readSince / readAt → ClaimMeta[]
+//                     Safe for AgentConsentContext and AuditContext.
+//   Hydrated reads  — readStoredClaims → StoredClaim[] (includes decrypted payload)
+//                     FACTSTORE_HYDRATED_READ_ACCESS_BOUND_001:
+//                     Only OwnerContext, SystemProjectionContext, TestContext are allowed.
+//                     AgentConsentContext and AuditContext are denied — fail closed.
+export {};
+//# sourceMappingURL=fact-store.js.map

package/dist/types/fact-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fact-store.js","sourceRoot":"","sources":["../../src/types/fact-store.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,+EAA+E;AAC/E,EAAE;AACF,8BAA8B;AAC9B,8EAA8E;AAC9E,qEAAqE;AACrE,oFAAoF;AACpF,gEAAgE;AAChE,2FAA2F;AAC3F,qFAAqF"}

package/dist/types/ids.d.ts

@@ -0,0 +1,36 @@
+export type PersonId = string & {
+    readonly __brand: "PersonId";
+};
+export type SourceId = string & {
+    readonly __brand: "SourceId";
+};
+export type ClaimId = string & {
+    readonly __brand: "ClaimId";
+};
+export type ContractId = string & {
+    readonly __brand: "ContractId";
+};
+export type GrantId = string & {
+    readonly __brand: "GrantId";
+};
+export type ProposalId = string & {
+    readonly __brand: "ProposalId";
+};
+export type AuditId = string & {
+    readonly __brand: "AuditId";
+};
+export type ISOTime = string & {
+    readonly __brand: "ISOTime";
+};
+export type EvidenceId = string & {
+    readonly __brand: "EvidenceId";
+};
+export declare function asPersonId(s: string): PersonId;
+export declare function asSourceId(s: string): SourceId;
+export declare function asClaimId(s: string): ClaimId;
+export declare function asContractId(s: string): ContractId;
+export declare function asGrantId(s: string): GrantId;
+export declare function asProposalId(s: string): ProposalId;
+export declare function asAuditId(s: string): AuditId;
+export declare function asISOTime(s: string): ISOTime;
+export declare function asEvidenceId(s: string): EvidenceId;

package/dist/types/ids.js

@@ -0,0 +1,11 @@
+// Branded IDs — prevent mixing ClaimId where ContractId is expected at compile time
+export function asPersonId(s) { return s; }
+export function asSourceId(s) { return s; }
+export function asClaimId(s) { return s; }
+export function asContractId(s) { return s; }
+export function asGrantId(s) { return s; }
+export function asProposalId(s) { return s; }
+export function asAuditId(s) { return s; }
+export function asISOTime(s) { return s; }
+export function asEvidenceId(s) { return s; }
+//# sourceMappingURL=ids.js.map

package/dist/types/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/types/ids.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAYpF,MAAM,UAAU,UAAU,CAAC,CAAS,IAAkB,OAAO,CAAa,CAAC,CAAC,CAAC;AAC7E,MAAM,UAAU,UAAU,CAAC,CAAS,IAAkB,OAAO,CAAa,CAAC,CAAC,CAAC;AAC7E,MAAM,UAAU,SAAS,CAAC,CAAS,IAAmB,OAAO,CAAY,CAAC,CAAC,CAAC;AAC5E,MAAM,UAAU,YAAY,CAAC,CAAS,IAAgB,OAAO,CAAe,CAAC,CAAC,CAAC;AAC/E,MAAM,UAAU,SAAS,CAAC,CAAS,IAAmB,OAAO,CAAY,CAAC,CAAC,CAAC;AAC5E,MAAM,UAAU,YAAY,CAAC,CAAS,IAAgB,OAAO,CAAe,CAAC,CAAC,CAAC;AAC/E,MAAM,UAAU,SAAS,CAAC,CAAS,IAAmB,OAAO,CAAY,CAAC,CAAC,CAAC;AAC5E,MAAM,UAAU,SAAS,CAAC,CAAS,IAAmB,OAAO,CAAY,CAAC,CAAC,CAAC;AAC5E,MAAM,UAAU,YAAY,CAAC,CAAS,IAAgB,OAAO,CAAe,CAAC,CAAC,CAAC"}

package/dist/types/proposal.d.ts

@@ -0,0 +1,38 @@
+import type { ClaimId, GrantId, ISOTime, ProposalId, SourceId } from "./ids.js";
+import type { OwnerContext, SystemProjectionContext, TestContext } from "./access-context.js";
+import type { AppendClaimInput } from "./claim.js";
+export type ProposalStatus = "pending" | "accepted" | "rejected" | "expired";
+export interface ProposalAuthor {
+    readonly agentId: string;
+    readonly grantId: GrantId;
+    readonly purpose: string;
+}
+export interface Proposal {
+    readonly id: ProposalId;
+    readonly proposedBy: ProposalAuthor;
+    readonly underGrant: GrantId;
+    readonly candidateClaims: ReadonlyArray<AppendClaimInput>;
+    readonly rationale?: string;
+    readonly status: ProposalStatus;
+    readonly createdAt: ISOTime;
+    readonly decidedAt?: ISOTime;
+    readonly decidedBy?: OwnerContext | SystemProjectionContext | TestContext;
+    readonly resultingClaimIds?: ReadonlyArray<ClaimId>;
+    readonly rejectionReason?: string;
+}
+export interface ProposalInput {
+    readonly candidateClaims: ReadonlyArray<AppendClaimInput>;
+    readonly rationale?: string;
+}
+export interface ProposalFilter {
+    readonly status?: ProposalStatus;
+    readonly proposedByAgent?: string;
+    readonly underGrant?: GrantId;
+}
+export interface AcceptOptions {
+    readonly sourceId: SourceId;
+}
+export interface RejectOptions {
+    readonly reason: string;
+}
+export type ProposalDecider = OwnerContext | SystemProjectionContext | TestContext;

package/dist/types/proposal.js

@@ -0,0 +1,7 @@
+// Proposal model — Slice-08.
+//
+// PROPOSAL_QUEUE_EXISTS_001: ProposalQueue is the sole mechanism for agent-authored claim proposals.
+// PROPOSAL_CANDIDATE_CLAIMS_NOT_LOGGED_BEFORE_ACCEPT_001: candidateClaims never reach FactStore until accept.
+// PROPOSAL_STATUS_IMMUTABLE_AFTER_DECISION_001: once accepted/rejected, no further transitions allowed.
+export {};
+//# sourceMappingURL=proposal.js.map

package/dist/types/proposal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal.js","sourceRoot":"","sources":["../../src/types/proposal.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,qGAAqG;AACrG,8GAA8G;AAC9G,wGAAwG"}