// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
// Agent Passport System — Public API v2.0
// The Agent Social Contract: Identity · Values · Attribution
//
// HIGH-LEVEL API (start here):
//   joinSocialContract()    — create an agent in the contract
//   verifySocialContract()  — verify another agent
//   delegate()              — grant authority
//   recordWork()            — sign a receipt for work done
//   proveContributions()    — generate Merkle proofs of contributions
//   auditCompliance()       — check agent against the Floor
//
// Everything else below is the implementation these build on.
// ── The Social Contract (high-level) ──
export { joinSocialContract, verifySocialContract, delegate, recordWork, proveContributions, auditCompliance } from './contract.js';
// ── Layer 1: Identity & Accountability ──
export { createPassport, signPassport, updatePassport, isExpired, isPassportValid, countersignPassport, verifyIssuerSignature, isIssuerVerified, isIssuerSigned } from './core/passport.js';
export { canonicalize, canonicalJson, canonicalHash, normalizeTimestamp } from './core/canonical.js';
// ── Scope Version Hash (MCP#1763) — bilateral receipt pre-commitment ──
export { computeScopeVersionHash, verifyScopeVersionMatch } from './core/scope-version.js';
// ── action_ref (A2A#1672) — Content-Addressed Request Identity ──
export { computeActionRef, actionRefsMatch } from './core/action-ref.js';
// External cross-ecosystem correlation key (action-ref-v1-jcs-sha256).
// Distinct primitive from the APS-native action_ref above.
export { computeExternalActionRefV1 } from './core/external-action-ref.js';
export { computeIdempotencyKey } from './core/idempotency.js';
// ── Attestation Freshness (A2A#1712) ──
export { computeEvidenceAge, isEvidenceFresh, createSnapshotFreshness, createRotatingFreshness } from './core/freshness.js';
// ── Agent Attestation Architecture (Phase 1 — Review Build) ──
export { createIssuanceChallenge, verifyRuntimeAttestation, computePassportGrade, computeAttestationFlags, computeAttestationBundleHash, createIssuanceContext, bindAttestation, createWorkspaceManifest, createEmptyEvidenceRecord, isChallengeFresh, isGradeAtLeast, importProviderAttestation, addIdentityBoundary, classifyEvidenceQuality, evidenceQualityToGrade, } from './core/attestation.js';
export { PASSPORT_GRADE_LABELS } from './types/attestation.js';
// ── JCS Canonicalization (RFC 8785) ──
export { canonicalizeJCS, detectCanonicalVariant, getTestVectors } from './core/canonical-jcs.js';
export { generateKeyPair, sign, verify, publicKeyFromPrivate } from './crypto/keys.js';
export { InMemoryKeyStorage, EncryptedFileKeyStorage } from './crypto/key-storage.js';
export { verifyPassport, createChallenge, verifyChallenge } from './verification/verify.js';
export { applyReputationEvent, calculateOverallScore } from './verification/reputation.js';
// v1.1 — Delegation, Receipts, Revocation
// v1.4 — Cascade Revocation, Chain Validation, Batch Revocation
export { createDelegation, subDelegate, verifyDelegation, revokeDelegation, verifyRevocation, cascadeRevoke, revokeByAgent, validateChain, getDescendants, getChainEntry, onRevocation, createReceipt, verifyReceipt, getReceipts, getRevocation, clearStores, scopeCovers, scopeAuthorizes } from './core/delegation.js';
// ── Bilateral Completion Receipts ──
export { createCompletionReceipt, verifyCompletionReceipt, linkPermitAndCompletion } from './core/completion.js';
// ── Layer 2: Human Values Floor ──
export { loadFloor, loadFloorFromFile, attestFloor, verifyAttestation, evaluateCompliance, negotiateCommonGround, resolveEnforcementMode, effectiveEnforcementMode } from './core/values.js';
export { ENFORCEMENT_ESCALATION_ORDER } from './types/passport.js';
// ── Layer 3: Beneficiary Attribution ──
// Primitives only. Weight-based report generators
// (computeAttribution, computeCollaborationAttribution,
// DEFAULT_SCOPE_WEIGHTS) moved to @aeoess/gateway.
// See MIGRATION.md#attribution-reports.
export { hashReceipt, traceBeneficiary, verifyAttributionReport, buildMerkleRoot, generateMerkleProof, verifyMerkleProof, } from './core/attribution.js';
// ── Layer 4: Agent Agora (Communication) ──
export { createAgoraMessage, verifyAgoraMessage, createFeed, appendToFeed, getThread, getByTopic, getByAuthor, getTopics, createRegistry, registerAgent, verifyFeed } from './core/agora.js';
// ── Layer 5: Intent Architecture ──
export { assignRole, createTradeoffRule, evaluateTradeoff, createIntentDocument, createDeliberation, submitConsensusRound, evaluateConsensus, resolveDeliberation, getPrecedentsByTopic, citePrecedent, createIntentPassportExtension, } from './core/intent.js';
// ── Layer 6: Coordination Primitives ──
export { createTaskBrief, verifyTaskBrief, assignTask, acceptTask, submitEvidence, verifyEvidence, reviewEvidence, verifyReview, handoffEvidence, verifyHandoff, submitDeliverable, verifyDeliverable, completeTask, verifyCompletion, createTaskUnit, getTaskStatus, validateTaskUnit, } from './core/coordination.js';
// ── Values Floor Policy Engine ──
export { createActionIntent, verifyActionIntent, evaluateIntent, verifyPolicyDecision, createPolicyReceipt, verifyPolicyReceipt, createPolicyReceiptWithDecisionReceipt, FloorValidatorV1, requestAction, computeCompoundDigest, captureRoutingContext, detectRoutingDivergence, createPolicyChain, appendPolicyChainEntry, verifyPolicyChain, detectConstraintDrift, } from './core/policy.js';
// ── v2.3 — in-toto Decision Receipt v0.1 primitive ──
// Reference implementation of ENFORCEMENT-TRUST-ANCHOR.md Component A
// (bilateral receipts for dumb Web2 sinks). Pure primitive; gateway
// integration lives at the caller (e.g. @aeoess/gateway's ProxyGateway.emit).
export { emitDecisionReceipt, parseDecisionReceiptStatement, computeDelegationChainRoot, DECISION_RECEIPT_PREDICATE_TYPE, INTOTO_STATEMENT_V1, INTOTO_PAYLOAD_TYPE, } from './decisionReceipt.js';
// ── Layer 7: Agentic Commerce (ACP) ──
// Gate predicates + signing primitives stay in SDK. The 6-gate orchestrator
// (commercePreflight) and the four ACP REST wrappers moved to @aeoess/gateway
// as product workflow. Deprecated re-exports throw with a migration message.
export { commercePreflight, createCheckout, updateCheckout, completeCheckout, cancelCheckout, checkPassportGate, checkScopeGate, checkSpendGate, checkHumanApprovalThreshold, checkMerchantGate, checkWalletGate, hasCommerceScope, signCommerceReceipt, extractDelegationChain, requestHumanApproval, createCommerceDelegation, getSpendSummary, verifyCommerceReceipt, } from './core/commerce.js';
// ── Task Routing Protocol ──
export { createTaskRequest, verifyTaskRequest, advertiseCapabilities, verifyAdvertisement, claimTask, verifyClaim, declineTask, verifyDecline, routeTask, verifyRoutingDecision, scoreCandidate, capabilityMatches, capabilityCoverage, checkDelegationScope, isAdvertisementFresh, DEFAULT_ROUTER_CONFIG, DEFAULT_MATCH_WEIGHTS, DEFAULT_PRIORITY_BOOSTS, } from './core/routing.js';
// ── Proxy Gateway: runtime implementation moved to @aeoess/gateway (2026-04-17).
// SDK ships only the gateway interface types in src/types/gateway.ts.
// See MIGRATION.md#gateway.
// ── Fidelity Probe: Substrate Behavioral Drift Measurement ──
export { scoreFidelityResponse, aggregateFidelityScores, createFidelityAttestation, verifyFidelityAttestation, shouldProbe, fidelityDelta, measureCompactionDrift, DEFAULT_PROBE_SCHEDULE, } from './core/fidelity-probe.js';
// ── DID Interop: did:key + did:web ──
export { toDIDKey, fromDIDKey, didWebToUrl, resolveDIDWeb, passportToDIDDocument as passportToDIDKeyDocument, } from './core/did-interop.js';
// ── Key Resolution (M3): KeyResolver interface + did:cycles/JWKS ──
export { CyclesKeyResolver, parseDIDCycles, isDIDCycles, asJWKS, selectKey, decodeBase64Url, bytesToHex as keyResolutionBytesToHex, DEFAULT_TIMEOUT_MS as KEY_RESOLUTION_DEFAULT_TIMEOUT_MS, DEFAULT_CACHE_POLICY as KEY_RESOLUTION_DEFAULT_CACHE_POLICY, } from './v2/key-resolution/index.js';
// ── Identity Bridge: SPIFFE + OAuth → APS ──
export { parseSPIFFEID, importSPIFFESVID, mapOAuthScopes, importOAuthToken, } from './core/identity-bridge.js';
// ── OAuth 2.1 / RFC 8693 Token Exchange delegation-token bridge ──
export { TOKEN_TYPE_URN, TOKEN_EXCHANGE_GRANT_TYPE, JWT_SVID_APPROVED_ALGS, bridgeScopeOfClaim, isNarrowing, assertChainNarrows, effectiveScope, chainToTokenExchangeClaims, tokenExchangeClaimsToChain, parseScope, assertRoundTripNarrows, actorSatisfiesMayAct, currentActor, validateSpiffeId, spiffeIdToDidInput, jwtSvidToDidInput, } from './adapters/oauth-rfc8693/index.js';
// ── VC Wrapper: Interop Bridge (did:key + SPIFFE evidence) ──
export { passportToVerifiableCredential, verifyVerifiableCredential, createVerifiablePresentation, verifyVerifiablePresentation, } from './core/vc-wrapper.js';
// ── Credential Request: Selective Disclosure Protocol ──
export { createCredentialRequest, fulfillCredentialRequest, verifyCredentialResponse, } from './core/credential-request.js';
// ── Gateway Identity: DID + Principal + Entity Verification ──
export { verifyAgentIdentity, verifyAgentIdentitySync, strengthMeetsMinimum, identityStrengthFailure, DEFAULT_IDENTITY_CONFIG, } from './core/gateway-identity.js';
// ── Gateway Wiring: module integration hooks ──
export { checkCommerceConstraint, extractCharterPolicy, } from './core/gateway-wiring.js';
// ── Denial Domains: operator-facing constraint grouping ──
export { getDomain, getDomainLabel, summarizeDenial, groupByDomain, EVALUATION_ORDER, } from './core/denial-domains.js';
// ── Data Narrowing: monotonic narrowing for data influence ──
export { assertDataNarrowsOnly, applyDataConstraints, isValidNarrowing, NARROWING_ORDER, } from './core/data-narrowing.js';
// ── Governance Posture: tier definitions + constraint primitives ──
// State machine (createInitialPosture, recordBehavioralFailure,
// recordBehavioralSuccess, upgradePosture, DEFAULT_DOWNGRADE_POLICY)
// moved to @aeoess/gateway src/sdk-migrated/core/posture-state.ts.
// Stubs preserve the function symbols so existing imports resolve;
// calling them throws.
export { createInitialPosture, recordBehavioralFailure, recordBehavioralSuccess, upgradePosture, getPostureConstraints, isScopeBlocked, comparePostureTiers, DEFAULT_POSTURE_CONSTRAINTS, } from './core/governance-posture.js';
// ── Anchor States: external verifiability tracking ──
export { createAnchorMetadata, markBatched, markAnchored, shouldAutoBatch, meetsAnchorRequirement, isValidAnchorTransition, DEFAULT_AUTO_BATCH_CONFIG, ANCHOR_STATE_ORDER, } from './core/anchor-state.js';
export { createEscrowHold, verifyEscrowHold, createDisputeArtifact, verifyDisputeArtifact, createWitnessAttestation, verifyWitnessAttestation, evaluateDisputeOverlay, } from './core/transactional.js';
// ── Layer 9: W3C DID & Verifiable Credentials Bridge ──
export { createDID, createDIDHex, publicKeyFromDID, isValidDID, passportToDIDDocument, resolveDID, signWithDID, verifyWithDID, hexToMultibase, multibaseToHex } from './core/did.js';
// ── A2A composition-contract §5 / §6.3 — IdentityCompositionError ──
export { IdentityCompositionError, assertKeyPurpose, } from './errors/identity-composition-error.js';
// ── Key Rotation — DID Document + Identity Continuity ──
export { createDIDDocument, announceKeyRotation, activateKeyRotation, verifyRotationChain, isKeyActive, rotateAndInvalidate, } from './core/key-rotation.js';
export { verifyEntityChain, cacheDIDResolution, getCachedDIDResolution, clearDIDCache, computeSenderId, } from './core/entity-verification.js';
export { passportToVC, delegationToVC, floorAttestationToVC, receiptToVC, createPresentation, verifyVC, verifyPresentation } from './core/vc.js';
// ── Trust Bootstrap Adapters ──
export { bootstrapFromAPIKey, bootstrapFromGitHub, bootstrapFromCIKey, upgradeBootstrappedPassport, } from './core/trust-adapters.js';
// ── Layer 10: A2A Protocol Bridge ──
export { passportToAgentCard, verifyAgentCard, agentCardToCapabilities, hasPassportIdentity, getDIDFromAgentCard } from './core/a2a.js';
// ── Principal Identity ──
export { createPrincipalIdentity, endorseAgent, verifyEndorsement, revokeEndorsement, createDisclosure, verifyDisclosure, createFleet, addToFleet, getFleetStatus, revokeFromFleet, endorsePassport, verifyPassportEndorsement, hasPrincipalEndorsement } from './core/principal.js';
// ── Reputation-Gated Authority ──
export { DEFAULT_K, MAX_SIGMA, MIN_SIGMA, INITIAL_MU, INITIAL_SIGMA, SCARRING_PENALTY, DEFAULT_TIERS, DEFAULT_PROMOTION_REQUIREMENTS, DEFAULT_DECAY_DAYS, DEFAULT_DRIFT_RATE_PER_DAY, RECENT_OBSERVATIONS_CAP, computeEffectiveScore, createScopedReputation, computeConfidence, createEvidenceDiversity, classifyEvidence, resolveAuthorityTier, shouldDemote, effectiveAutonomy, effectiveSpendLimit, effectiveDelegationDepth, classifyRuntimeChange, sigmaAfterRuntimeChange, meetsPromotionRequirements, validatePromotionReview, checkTierForIntent, advisoryTierPrecheck, updateReputationFromResult, applyTemporalDecay, confidenceBreakdown, } from './core/reputation-authority.js';
// Deprecation stubs: reputation analytics moved to @aeoess/gateway on 2026-04-17.
// See MIGRATION.md#reputation-analytics.
const REPUTATION_ANALYTICS_MOVED = 'Moved to @aeoess/gateway (src/sdk-migrated/core/reputation-analytics.ts). ' +
    'See MIGRATION.md#reputation-analytics';
export function createPromotionReview(..._args) { throw new Error('createPromotionReview: ' + REPUTATION_ANALYTICS_MOVED); }
export function triggerDemotion(..._args) { throw new Error('triggerDemotion: ' + REPUTATION_ANALYTICS_MOVED); }
export function computeReputationDrift(..._args) { throw new Error('computeReputationDrift: ' + REPUTATION_ANALYTICS_MOVED); }
export function computeConsistencyScore(..._args) { throw new Error('computeConsistencyScore: ' + REPUTATION_ANALYTICS_MOVED); }
export const DEFAULT_DRIFT_WARNING_THRESHOLD = 0.15;
export const DEFAULT_DRIFT_CRITICAL_THRESHOLD = 0.30;
// ── Behavioral Fingerprint ──
// Three-axis joint measurement envelope: HBB fidelity (axis 1) +
// PDR cross-session reliability (axis 2) + Saebo within-session
// constraint compliance (axis 3). Composes all three into one signed
// artifact. Reference: Nanook PDR v2.19 §2.2 / §8.10, gap audit §5 rank 2.
export { createBehavioralFingerprint, verifyBehavioralFingerprint, composeFingerprintAxes, } from './core/behavioral-fingerprint.js';
// ── Probe Identity ──
// Content-addressable hashing for evaluation probes. Lets a downstream
// scoring system prove that the probe it scored is byte-identical to
// the probe the issuer published, by hashing canonical JSON of the
// probe and binding the hash to scoring observations.
// Reference: Nanook PDR v2.19 §5.9, gap audit §5 rank 7.
export { computeProbeIdentity, verifyProbeIdentity, } from './core/probe-identity.js';
// ── Cross-Chain Data Flow Authorization (Module 18) ──
export { createTaintLabel, mergeTaints, createSAO, verifySAO, isSAOExpired, createExecutionFrame, recordAccess, closeFrame, computeStepHash, verifyFrameChain, isFrameExpired, rotateFrame, verifyEpochChain, createCrossChainPermit, countersignPermit, verifyCrossChainPermit, revokePermit, checkDataFlow, deriveSAO, createExecutionReceipt, verifyExecutionReceipt, createCrossChainViolation } from './core/cross-chain.js';
// ── E2E Encrypted Messaging (Module 19) ──
export { generateEncryptionKeypair, deriveEncryptionKeypair, createKeyAnnouncement, verifyKeyAnnouncement, padToBlock, unpad, encryptPayload, decryptPayload, createEncryptedAgoraMessage, decryptAgoraMessage, verifyOuterSignature } from './core/encrypted-messaging.js';
// ── Cross-Engine Signed Execution Envelope (RFC implementation) ──
export { createExecutionEnvelope, verifyExecutionEnvelope, createMinimalEnvelope } from './core/execution-envelope.js';
// ── Execution Attestation (Checkpoint 3 — what ACTUALLY ran) ──
export { createExecutionAttestation, verifyExecutionAttestation, detectExecutionDrift, } from './core/execution-attestation.js';
export { DEFAULT_DRIFT_RULES } from './types/execution-attestation.js';
// ── Bilateral Receipt + Evidence Commitments + Compromise Window ──
export { createBilateralReceipt, verifyBilateralReceipt, createEvidenceCommitment, verifyEvidenceCommitment, checkCompromiseWindow, } from './core/bilateral-receipt.js';
// ── Feasibility Linting (Module 24, Gap 7) ──
export { lintDelegation, lintTaskFeasibility, lintDelegationForGateway, } from './core/feasibility.js';
// ── Hash-and-Pointer Payloads + Field-Disclosure Profile (W2-B6) ──
export { REDACTED_SENTINEL, buildFieldDisclosureProfile, verifyFieldDisclosureProfile, canonicalProfileBytes, bbsProofToFieldDisclosureRef, fieldDisclosureRefToBbsProof, } from './v2/hash-pointer/index.js';
// ── Governance Artifact Provenance (Module 21) ──
export { hashContent, createGovernanceArtifact, verifyGovernanceArtifact, approveArtifact, verifyApproval, createGovernanceEnvelope, loadGovernanceArtifact, upgradeGovernanceArtifact, classifyGovernanceChange, validateCredentialLifecycle, DEFAULT_LOAD_POLICY, } from './core/governance.js';
// ── Obligations Model (Module 20) ──
export { createObligation, createObligationBundle, acceptObligationBundle, checkFulfillment, resolveObligation, createFulfillmentReceipt, scheduleNextRecurrence, validateObligationConstraints, validatePenaltySeverity } from './core/obligations.js';
// ── Identity & Key Rotation (Module 22) ──
export { createIdentityDocument, rotateKey, emergencyRotate, verifyRotation, verifyRotationLog, resolveCurrentKey, wasKeyActive, } from './core/identity.js';
// ── Receipt Ledger — Merkle-Committed Audit (Module 23) ──
export { createReceiptLedger, addReceipt, commitBatch, proveInclusion, verifyInclusion, verifyBatch, verifyBatchChain, } from './core/receipt-ledger.js';
// ── Precedent Control (Module 25) ──
export { createPrecedentLibrary, markAsNormative, verifyNormativePrecedent, addToLibrary, checkAlignment, supersedePrecedent, analyzeDrift, } from './core/precedent.js';
// ── Delegation Re-anchoring (Module 26) ──
export { createDelegationRef, resolvePublicKey, reanchorDelegation, verifyReanchoredDelegation, verifyWithRef, didCoversKey, } from './core/reanchor.js';
// ── Bounded Escalation (Module 27 — Fourth Attenuation Invariant) ──
export { createEscalationGrant, verifyEscalationGrant, requestEscalation, activateEscalation, checkEscalatedAction, revokeEscalation, isEscalationActive, } from './core/escalation.js';
// ── Oracle Witness Diversity (Module 28 — Gap 4) ──
export { createWitnessPool, createAttestation, verifyWitnessAttestation as verifyOracleWitnessAttestation, addAttestation, computeDiversityScore, evaluateWitnessConsensus, wouldIncreaseDiversity, } from './core/oracle-witness.js';
// ── Encrypted Messaging Audit Bridge (Module 29) ──
export { createMessageAuditLog, createAuditRecord, verifyAuditRecord, appendToAuditLog, queryBySender, queryCrossChainMessages, totalBytesBySender, } from './core/messaging-audit.js';
// ── Policy Conflict Detection (Module 30) ──
export { detectCycles, detectShadowedRules, detectContradictions, detectUnreachableActions, analyzePolicyRules, } from './core/policy-conflict.js';
// ── Data Source Registration & Access Receipts (Module 36A) ──
export { registerSelfAttestedSource, registerCustodianAttestedSource, registerGatewayObservedSource, verifySourceReceipt, revokeSourceReceipt, recordDataAccess, verifyDataAccessReceipt, checkTermsCompliance, composeTerms, buildDataAccessMerkleRoot, proveDataAccessInclusion, verifyDataAccessInclusionProof, addDataAccessToLedger, } from './core/data-source.js';
// ══════════════════════════════════════
// MODULE 37 — Decision Semantics & Cross-Engine Interop
// ══════════════════════════════════════
export { computeContentHash, verifyContentHash, createContentAddressableIntent, classifyEvaluationMethod, decomposeDecision, createDecisionArtifact, verifyDecisionArtifact, getEffectiveScopeInterpretation, validateIdentityBoundary, MINIMUM_IDENTITY_FIELDS, } from './core/decision-semantics.js';
// ══════════════════════════════════════
// Charter & Approval — Pure Functions
// ══════════════════════════════════════
export { createCharter, signCharter, verifyCharter, createAmendment, signAmendment, verifyAmendment, evaluateThreshold, createOfficeRegistry, createOfficeTransfer, createApprovalRequest, addApprovalSignature, evaluateApprovalRequest, findOffice, findOfficesByHolder, resolveSuccessor, checkIncompatibility, checkQuorum, } from './core/charter.js';
export { DEFAULT_NTP_DRIFT_MS, DEFAULT_SESSION_GAP_MS, createHybridTimestamp, createHybridTimestampAt, createTemporalBound, compareTimestamps, isTemporalBoundExpired, validateTemporalRights, resetLogicalCounter, extractSessions, } from './core/time.js';
export { createReserveAttestation, verifyReserveAttestation, compareAssuranceClass, meetsAssuranceRequirement, } from './core/reserve.js';
export { importReceipt, verifyReceiptEnvelope, vouchReputation, verifyVouchedReputation, applyReputationDowngrade, } from './core/federation.js';
// ══════════════════════════════════════
// v2: Constitutional Governance Extensions
// ══════════════════════════════════════
export * from './v2/index.js';
// ── v2 primitives (explicit re-exports for public API discoverability) ──
// These are protocol primitives — verification and gating logic that
// downstream integrators (including the gateway) compose on top of.
export { verifyOnAccept, evaluateCredentialCheck, resolveCheckMode, } from './v2/credential-check-policy/index.js';
export { createAttributionReceipt, signAttributionConsent, verifyAttributionConsent, checkArtifactCitations, receiptCore, } from './v2/attribution-consent/index.js';
// ══════════════════════════════════════
// Accountability MVP (Wave 1)
// ══════════════════════════════════════
export { createActionReceipt, verifyActionReceipt, createAuthorityBoundaryReceipt, verifyAuthorityBoundaryReceipt, createCustodyReceipt, verifyCustodyReceipt, createContestabilityReceipt, attachControllerResponse, verifyContestabilityReceipt, createAPSBundle, verifyAPSBundle, computeMerkleRoot, } from './v2/accountability/index.js';
// ══════════════════════════════════════
// Claim → Evidence Types (skeleton)
// ══════════════════════════════════════
export { ClaimType, RecordType, EvidenceProfiles, requiredEvidenceFor, } from './v2/claim-evidence-types.js';
// ══════════════════════════════════════
// Claim Verifier (Module 2 + Module 4 hook)
// ══════════════════════════════════════
// Named 'verifyEvidenceClaim' to disambiguate from the task-routing
// 'verifyClaim' re-exported from './core/routing.js' above.
export { verifyEvidenceClaim } from './v2/claim-verifier.js';
// ══════════════════════════════════════
// Downstream Taint (Module 4) — public cascade primitive
// ══════════════════════════════════════
export { isContestationTainting, computeDownstreamTaint, } from './v2/downstream-taint.js';
// ══════════════════════════════════════
// Offline verifier (W2-C2) - zero-network verify path + descriptor
// ══════════════════════════════════════
// A standalone APS verify path with no network dependency. It composes the
// existing crypto-layer receipt verifier with the promoted context-layer
// verifier and emits the W2-A1 Evidence Descriptor (a verifier OUTPUT, not
// an issuer field). Ships alongside a framework-agnostic relying-party gate
// (Express/Fastify adapters in examples/aps-relying-party-middleware) and a
// conformance runner over the canonicalization vectors.
export { verifyOffline, verifyReceiptContext, CRYPTO_LAYER_REASONS, buildDescriptor, evaluateRequest, runGate, runCanonicalizationConformance, checkCanonicalizationVector, summarize, } from './v2/offline-verifier/index.js';
// ══════════════════════════════════════
// Interop: qntm E2E Encrypted Relay Bridge
// ══════════════════════════════════════
export * from './interop/qntm-bridge.js';
// ══════════════════════════════════════
// Interop: agent.json Commerce Bridge
// ══════════════════════════════════════
export * from './interop/agent-json-bridge.js';
// ══════════════════════════════════════
// Module 38: Data Contribution Ledger
// Module 39: Data Settlement Protocol
// Module 40: Data Source Attribution (the "pixel" primitive)
// ══════════════════════════════════════
// ContributionLedger + SettlementGenerator moved to @aeoess/gateway.
// Primitive types and data-source-attribution (Module 40 Merkle primitive)
// remain in the SDK.
export * from './types/data-contribution.js';
export * from './core/data-source-attribution.js';
export { DataGateway } from './core/data-gateway.js';
export { DataEnforcementGate } from './core/data-enforcement.js';
// ══════════════════════════════════════
// Decision Equivalence (Canonical Boundary Profiles + Comparison)
// ══════════════════════════════════════
export * from './types/decision-equivalence.js';
export * from './core/decision-equivalence.js';
// ══════════════════════════════════════
// Data Lifecycle Governance
// ══════════════════════════════════════
export * from './types/data-lifecycle.js';
export * from './core/data-lifecycle.js';
// ══════════════════════════════════════
// Framework Adapters
// ══════════════════════════════════════
// GovernanceHook, createCrewAIGovernance, createADKGovernancePlugin,
// createLangChainGovernanceHandler, createA2AGovernance, reportReceipt,
// reportEvaluation — moved to @aeoess/gateway (see MIGRATION.md).
export { verifyCrewMember, governCrewTask, crewTaskToScopes } from './adapters/crewai.js';
export { adkContextToAction, adkToolToScope, adkAuthorizes } from './adapters/adk.js';
export { governLangChainTool, createLangGraphGovernance, langchainToolToScope } from './adapters/langchain.js';
export { deriveA2AScopes, passportToA2ACard, a2aCardToPassportMeta, verifyA2AIdentity, a2aSkillsToScope, embedA2ATrustSignal } from './adapters/a2a.js';
export { governMCPToolCall, createMCPGovernanceInterceptor, mcpToolToScope } from './adapters/mcp.js';
export { verifyGonkaHost, governGonkaInference, createDevshardReceipt, delegationToAllowlistEntry, epochToDelegationExpiry, verifyPoCParticipation, } from './adapters/gonka.js';
export { delegationToPolicy, policyToYaml, extractEffectiveScopes } from './adapters/openshell.js';
export { ibacIntentToScope, ibacTuplesToDelegation, evaluateIBACTuples, governIBACIntent, } from './adapters/ibac.js';
export { cedarPolicyToTuples, delegationToCedarPolicy } from './adapters/ibac-cedar.js';
// ══════════════════════════════════════
// Conformance Test Suite
// ══════════════════════════════════════
export { runConformanceSuite } from './conformance/suite.js';
// ══════════════════════════════════════
// Governance Block (HTML-embedded governance)
// ══════════════════════════════════════
export { generateGovernanceBlock, verifyGovernanceBlock, renderGovernanceHTML, renderGovernanceMeta, parseGovernanceBlockFromHTML, embedGovernance, isUsagePermitted, DEFAULT_REVOCATION_POLICY, isGovernanceBlockExpired, createVerifiedGovernanceCredential, verifyGovernanceCredential, bindGovernanceToImplementation, } from './core/governance-block.js';
// ══════════════════════════════════════
// aps.txt + HTTP Headers + Chained Blocks
// ══════════════════════════════════════
export { generateApsTxt, verifyApsTxt, serializeApsTxt, parseApsTxt, resolveTermsForPath, governanceHeaders, parseGovernanceHeaders, createChainedGovernanceBlock, verifyChainedBlock, enforceApsTxt, evaluateApsTxtRisk, } from './core/aps-txt.js';
// ══════════════════════════════════════
// Governance Consumer (agent-side 360 loop)
// ══════════════════════════════════════
export { checkHTMLGovernance, checkHeaderGovernance, createAccessReceipt, verifyAccessReceipt, governanceLoop360, } from './core/governance-consumer.js';
// ── Storage Layer ──
export { VolatileBackend } from './storage/volatile-backend.js';
export { createReceiptBundle, verifyReceiptBundle, importReceiptBundle } from './storage/receipt-bundle.js';
export * from './core/proof-namespace.js';
export { createToolRegistryEntry, verifyToolIntegrity, } from './core/tool-integrity.js';
// ── Recovery Policy (Standard Failure Patterns) ──
export { evaluateRecovery, createRecoveryEvent, createDefaultRecoveryPolicy, } from './core/recovery.js';
// ══════════════════════════════════════
// Behavioral Evaluation Context (Issue #9)
// ══════════════════════════════════════
export { createEvaluationContext, createBehavioralAttestationResult, validateAttestationResult, } from './core/evaluation-context.js';
export { createBehavioralMemoryObject, verifyBehavioralMemoryObject, isBMOExpired, exportBehavioralMemory, importBehavioralMemory, } from './core/behavioral-memory.js';
export { createBMOReceipt, verifyBMOReceipt } from './core/behavioral-memory-receipt.js';
export { buildCertificate, signCertificate, certificateId, verifyCertificateSignature, isCertificateTemporallyValid, checkAnchor, buildBundle, signBundle, verifyBundle, newNonce, buildHello, chooseVersion, buildAttest, verifyAttest, deriveSession, isSessionActive, } from './v2/mutual-auth/index.js';
// Adapters for mutual-auth
export { a2aBeginHandshake, a2aRespondHandshake, a2aCounterAttest, a2aFinalizeSession, attachMutualAuthToA2ACard, extractMutualAuthFromA2ACard, } from './adapters/mutual-auth-a2a.js';
export { mcpServerBinding, mcpBeginHandshake, mcpRespondHandshake, mcpCounterAttest, mcpFinalizeSession, mcpIsToolCallPermitted, } from './adapters/mutual-auth-mcp.js';
// ── W2-B1: Trust Root Policy + trust_policy_ref ──
// A signed, anti-rollback trust-root-policy artifact, a verifier that
// derives a relying-party verdict for a receipt's signer, and the
// did:web .well-known/aps-agents.json discovery convention + generator.
// Extends mutual-auth trust anchors and the M3 key resolver; ships the
// artifact + verifier + convention, not a hosted resolution service.
export { TRUST_ROOT_POLICY_SPEC_VERSION, buildTrustRootPolicy, signTrustRootPolicy, verifyTrustRootPolicy, evaluateReceiptAgainstPolicy, WELL_KNOWN_APS_AGENTS_PATH, APS_AGENTS_DOC_SPEC_VERSION, generateApsAgentsDoc, apsAgentsUrl, } from './v2/trust-policy/index.js';
// ── v2.4-alpha — InstructionProvenanceReceipt (Paper 8 candidate) ──
// Spec: ~/aeoess_web/specs/INSTRUCTION-PROVENANCE-RECEIPT-DRAFT-v0.2.md
// Tier scope this version: 'self-asserted' only.
export { createInstructionProvenanceReceipt, verifyInstructionProvenanceReceipt, verifyActionTimeContextRoot, canonicalizePath, canonicalizeEnvelope, computeContextRoot, } from './v2/instruction-provenance/index.js';
// ── v2.6.x payment-rails — public PaymentRail interface, signed
//      PaymentReceipt + PaymentDenial primitives, composable
//      governance hooks (preAuthorize, emitReceipt, emitDenial),
//      Nano reference adapter. Custodial wallet + credential
//      storage stay gateway-private.
export { 
// hooks
createDefaultGovernanceHooks, emitDenial, emitReceipt, preAuthorize, verifyPaymentDenial, verifyPaymentReceipt, 
// canonicalize
canonicalizeDenialForId, canonicalizeDenialForSig, canonicalizeInvoice, canonicalizeReceiptForId, canonicalizeReceiptForSig, invoiceDigest, paymentRailsSha256Hex, 
// nano reference adapter
createNanoRail, NanoPaymentRail, rawToXno, xnoToRaw, 
// conformance harness
HARNESS_FIXED_NOW, HARNESS_ISSUER_PRIV, resolveSpendLimitCents, runConformance, STANDARD_SCENARIOS, } from './v2/payment-rails/index.js';
// ── AP2 v0.2 interop (Google Agent Payments Protocol) ────────────
// Pinned to AP2 v0.2 (April 2026). Crosswalk between APS V2Delegation
// and AP2 mandate dicts. See docs/governance/ap2-interop.md.
export { AP2_VERSION, ap2MandateToApsDelegation, apsToAp2CartMandate, apsToAp2IntentMandate, apsToAp2OpenPaymentMandate, apsToAp2PaymentMandate, signAp2Mandate, verifyAp2Mandate, } from './v2/payment-rails/index.js';
// ── v2.6.x payment-rails / x402 reference adapter (Base + USDC) ──
// Settles via the x402 v1 protocol against a caller-supplied
// facilitator (Coinbase CDP public endpoint by default). Mocked
// facilitator in tests; on-chain settlement happens via
// EIP-3009 transferWithAuthorization at the facilitator.
export { createX402Rail, USDC_BASE_MAINNET, USDC_BASE_SEPOLIA, X402_DEFAULT_FACILITATOR_URL, X402_VERSION, X402PaymentRail, } from './v2/payment-rails/index.js';
// ── v2.6.x payment-rails / Stripe Issuing protocol primitives ────
// Phase 4.1 boundary split moved the orchestration class
// `StripeIssuingRail` and `createStripeIssuingRail` factory to the
// private gateway repo (live HTTP client + credential handling +
// in-memory card↔delegation registry). The SDK ships protocol
// primitives only: V2Delegation→SpendingControls mapper,
// V2Delegation→DelegationView projection, Stripe webhook signature
// verifier (HMAC-SHA256 over `${t}.${rawBody}` per Stripe scheme=v1),
// the form-urlencoded body encoder pinning the on-the-wire shape,
// and the rail constants. Gateway consumes via this package.
export { defaultMapDelegationToSpendingControls, stripeIssuingDelegationToView, stripeIssuingEncodeForm, verifyStripeSignature, STRIPE_ISSUING_DEFAULT_API_BASE, STRIPE_ISSUING_DEFAULT_REQUIRED_SCOPE, STRIPE_ISSUING_DEFAULT_TOLERANCE_SEC, STRIPE_ISSUING_RAIL_NAME, } from './v2/payment-rails/index.js';
// ── v2.6.x payment-rails / ACP reference adapter (OpenAI + Stripe) ─
// Agentic Commerce Protocol v2025-09-29 binding. Crosswalks APS
// V2Delegation to ACP checkout-session permissions, maps APS denial
// reasons to ACP error type/code envelopes, and mints signed
// AcpReceipt / AcpDenial primitives over RFC 8785 JCS canonical bytes.
// Reference adapter does not transport — gateway product.
export { ACP_API_VERSION, acpSessionToDelegationHints, apsToAcpError, checkAcpSessionUnderBudget, delegationToAcpAllowed, mapAcpDenialToFoundation, preAuthorizeAcpCheckout, signAcpDenial, signAcpReceipt, verifyAcpDenial, verifyAcpReceipt, } from './v2/payment-rails/index.js';
// ── v2.6.x payment-rails / MPP reference adapter (Stripe + Tempo + Visa) ──
// Machine Payments Protocol draft-httpauth-payment-00 binding (March
// 30 2026). Crosswalks APS V2Delegation to MPP method/currency/cap
// permissions, maps APS denial reasons to MPP HTTP error envelopes
// (402/403/410/503 + WWW-Authenticate error= token), and mints
// signed MppApsReceipt / MppDenial primitives over RFC 8785 JCS
// canonical bytes. Reference adapter does not transport — gateway
// product handles live HTTP intercept and on-chain verification.
export { apsToMppHttpError, delegationToMppAllowed, mapMppDenialToFoundation, MPP_VERSION, preAuthorizeMppPayment, signMppDenial, signMppReceipt, verifyMppDenial, verifyMppReceipt, } from './v2/payment-rails/index.js';
// M5 policy-bundle (added at merge time; module omitted its own root export)
export * from './v2/policy-bundle/index.js';
// W2-B2 Remote Signer adapters - pluggable async Signer over the unchanged
// Ed25519 default. Cloud adapters (AWS KMS, Azure Key Vault, Vault Transit,
// PKCS#11) live in the isolated optional package packages/aps-remote-signer and
// are not exported here (core ships no cloud SDK).
export { RemoteSignerError, defaultKeyId, assertRawEd25519SignatureHex, LocalEd25519Signer, createLocalSigner, HandleSigner, createHandleSigner, verifyWithSigner, buildRemoteSignerScopeOfClaim, } from './adapters/remote-signer/index.js';
// ── W2-A1 Evidence Descriptor: canonical builder + advisory layer ──
// The descriptor types and the buildDescriptor alias already reach the
// public surface via the offline verifier (both sourced from
// src/v2/assurance). Here we expose A1's canonical builder name and the
// verifier-derived advisory layer that sits on top of the Belnap
// descriptor. Assurance is verifier-derived OUTPUT only; nothing exported
// here reads an issuer-set grade.
export { buildEvidenceDescriptor, computeAdvisoryScalar, generalizeBilateralVerification, DEFAULT_OBSERVATION_WEIGHTS, } from './v2/assurance/descriptor.js';
//# sourceMappingURL=index.js.map