// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
/**
 * @fileoverview Audience-binding types: a versioned, additive `aud` profile for
 * delegation and receipt proofs.
 *
 * ── WHAT THIS IS ──────────────────────────────────────────────────────────
 * A passport (delegation or receipt) issued for recipient A must be rejected
 * when presented to recipient B. The `aud` field names the intended
 * recipient(s); a verifier holding its own recipient identity checks
 * membership. This is the proof-object analogue of the OAuth `aud` claim
 * (RFC 7519 §4.1.3 / RFC 8693 token exchange) and reuses the same
 * array-normalize + membership-check algorithm already in
 * src/adapters/oauth-rfc8693.
 *
 * ── WHY VERSIONED AND ADDITIVE ────────────────────────────────────────────
 * The `aud` slot is OPTIONAL on the proof object. A proof that OMITS it signs
 * and serializes byte-for-byte as it did before this module existed; nothing
 * about an audience-free proof changes. The slot is only "required" relative
 * to a verifier POLICY (`requireAudience`) or to a named PROFILE; it is never
 * issuer-asserted assurance. Audience binding is a mechanical fact (which
 * recipient identifier the issuer named), not a verifier-derived assurance
 * scalar.
 *
 * ── RELATION TO cross_chain ───────────────────────────────────────────────
 * cross_chain (src/types/cross-chain.ts) prevents the confused-deputy problem
 * at the DATA-FLOW layer: it stops authority from principal X being combined
 * with a destination governed by principal Y unless a CrossChainPermit
 * authorizes it. Audience binding operates at the PROOF-PRESENTATION layer: it
 * stops a proof minted for recipient A from being replayed at recipient B.
 * They are complementary, not competing. `reconcileAudienceWithCrossChain`
 * (see reconcile.ts) keeps a single denial from being counted twice.
 */
/** Fixed profile identifier for the audience-binding slot. */
export const AUDIENCE_BINDING_PROFILE = 'aps:audience-binding:v1';
//# sourceMappingURL=types.js.map