# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-to-mint-a-federated-capability-token-when-peer-trust-attestations-are-transitively-satisfiable-but-local.md
# Remnant Warrant:    https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-to-mint-a-federated-capability-token-when-peer-trust-attestations-are-transitively-satisfiable-but-local.warrant.json
# Markdown SHA-256:   b9b7ac271ab205307b4715ac066cb1cffa93c263c0a35d98cb0982eee8816b70
# Code AST SHA-256:   3516a655767fd2b0a439b958d0cf6d882772267961f4f9258d94b867ea635274
# Verified Classes:   FederationMintRefused, Edge
# Defensive Guards:   5 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from typing import Optional


class FederationMintRefused(RuntimeError):
    """Raised when a federated capability token cannot be minted because the
    trust path is transitively satisfiable but not locally verifiable."""
    pass


@dataclass
class Edge:
    issuer: str
    subject: str
    signature_valid: bool
    delegation_scope: frozenset
    root_anchored: bool
    revocation_fresh: bool


def mint_federated_token(
    path: list,
    requested_scope: frozenset,
    anchored_roots: frozenset,
    freshness_window_ok: bool,
) -> str:
    if not path:
        raise FederationMintRefused("empty trust path: nothing to verify")

    for i, edge in enumerate(path):
        if not edge.signature_valid:
            raise FederationMintRefused(
                f"edge {i} ({edge.issuer}->{edge.subject}) signature invalid"
            )
        if not requested_scope.issubset(edge.delegation_scope):
            raise FederationMintRefused(
                f"edge {i} ({edge.issuer}->{edge.subject}) scope restriction "
                f"{sorted(edge.delegation_scope)} does not cover requested "
                f"{sorted(requested_scope)}; transitive signature validity "
                f"does not imply delegation authority"
            )
        if not edge.root_anchored or edge.issuer not in anchored_roots:
            raise FederationMintRefused(
                f"edge {i} ({edge.issuer}->{edge.subject}) issuer root not in "
                f"anchored root set at mint time; path is satisfiable but not "
                f"locally verifiable"
            )
        if not edge.revocation_fresh or not freshness_window_ok:
            raise FederationMintRefused(
                f"edge {i} ({edge.issuer}->{edge.subject}) revocation state "
                f"stale or unobservable; unverifiable edge is not valid-by-default"
            )

    return f"token(scope={sorted(requested_scope)}, path_len={len(path)})"