@adammcarter/use-cases 0.1.0

package/packages/core/dist/markers/cli/verify.js

@@ -0,0 +1,245 @@
+// `verify` command core (Phase: verifiers/markers v2).
+//
+// Runs a row's resolved verifier(s) and records the result — WITHOUT any signing
+// key. Unlike `prove`, verify never signs or appends to the trusted evidence
+// ledger; it produces an unsigned `ucase-verification-result-v1` results ledger.
+// The actual verifier process is run through an INJECTED spawn runner (default =
+// node:child_process spawnSync in the repo cwd), so tests inject a fake and never
+// shell out.
+//
+// For each targeted (bound) row it recomputes the same hashes prove/scan do — row
+// hash, binding-set hash, per-binding span hashes, and the verification context
+// hash — so a verify result and a proof for the same row agree byte-for-byte. A
+// row whose verifier cannot be resolved is recorded as `blocked` (never crashes).
+import { spawnSync } from "node:child_process";
+import { sha256 } from "../canonicalJson.js";
+import { computeRowHash } from "../rowHash.js";
+import { computeBindingSetHash } from "../bindingSetHash.js";
+import { computeRowVerificationContextHash } from "../verificationContextHash.js";
+import { resolveRowVerifiers } from "../verifierResolver.js";
+import { nodeMarkerFs } from "./io.js";
+import { prepareScan } from "./scan.js";
+import { registeredBindingsForRow } from "./shared.js";
+// The schema id of one unsigned verification result line.
+export const VERIFICATION_RESULT_SCHEMA_ID = "ucase-verification-result-v1";
+function fail(partial) {
+    return {
+        command: "verify",
+        ok: partial.exit_code === 0,
+        results: partial.results ?? [],
+        out_path: partial.out_path ?? null,
+        errors: partial.errors ?? [],
+        ...partial
+    };
+}
+// Default runner: a real subprocess in the repo cwd. NEVER invoked by tests
+// (they inject a fake), so it is deterministic-by-omission here.
+function nodeSpawnRunner(request) {
+    const [command, ...args] = request.command;
+    const outcome = spawnSync(command, args, {
+        cwd: request.cwd,
+        encoding: "utf8",
+        timeout: request.timeout_seconds !== undefined ? request.timeout_seconds * 1000 : undefined
+    });
+    const timedOut = outcome.error !== undefined &&
+        outcome.error.code === "ETIMEDOUT";
+    const exitCode = typeof outcome.status === "number" ? outcome.status : timedOut ? 124 : 1;
+    return {
+        exit_code: exitCode,
+        timed_out: timedOut,
+        stdout: outcome.stdout ?? "",
+        stderr: outcome.stderr ?? ""
+    };
+}
+export function runVerifyCommand(options) {
+    const fs = options.fs ?? nodeMarkerFs;
+    const spawn = options.spawnRunner ?? nodeSpawnRunner;
+    const contextRoot = options.repoCwd ?? options.productRoot;
+    if (!options.all && !options.rowId) {
+        return fail({
+            exit_code: 2,
+            errors: [{ code: "NO_TARGET", message: "verify requires --all or --row <slug>" }]
+        });
+    }
+    // Run scan first (same pipeline prove uses).
+    const prepared = prepareScan({
+        context: options.context,
+        productRoot: options.productRoot,
+        bindingsPath: options.bindingsPath,
+        evidencePath: options.evidencePath,
+        policyMode: "feature",
+        publicKeyResolver: options.publicKeyResolver,
+        generatedAt: options.generatedAt,
+        fs,
+        commentConfig: options.commentConfig,
+        baseRef: options.baseRef,
+        gitRunner: options.gitRunner,
+        repoCwd: options.repoCwd
+    });
+    if (prepared.registryErrors.length > 0 || prepared.evidenceErrors.length > 0) {
+        // Surface the ACTUAL integrity failures instead of only the opaque top-level
+        // code — the most common one is a signed proof whose key the caller did not
+        // supply, which reads as UNKNOWN_KEY_ID / SIGNATURE_MISSING. Without this the
+        // user sees "LEDGER_INVALID" with no clue that `--public-key` is the fix.
+        const detail = [
+            ...prepared.registryErrors.map((error) => ({
+                code: error.code,
+                message: error.line == null ? error.message : `line ${error.line}: ${error.message}`
+            })),
+            ...prepared.evidenceErrors.map((error) => ({
+                code: error.code,
+                message: error.line == null ? error.message : `line ${error.line}: ${error.message}`
+            }))
+        ];
+        const keyResolutionFailed = prepared.evidenceErrors.some((error) => error.code === "UNKNOWN_KEY_ID" || error.code === "SIGNATURE_MISSING");
+        const hint = keyResolutionFailed
+            ? [
+                {
+                    code: "HINT",
+                    message: "a signed proof could not be verified — pass the trusted public key with " +
+                        "`--public-key <path>` (or `--keyring <path>`); without it signed proofs cannot be checked."
+                }
+            ]
+            : [];
+        return fail({
+            exit_code: 4,
+            errors: [
+                { code: "LEDGER_INVALID", message: "registry or evidence ledger failed validation" },
+                ...detail,
+                ...hint
+            ]
+        });
+    }
+    // Resolve target rows. A target is a BOUND row (status !== UNBOUND); an explicit
+    // --row that does not exist is a hard error.
+    let targetRowIds;
+    if (options.rowId) {
+        const statusRow = prepared.status.rows.find((row) => row.row_id === options.rowId);
+        const loadedRow = prepared.loaded.rows.find((row) => row.row_id === options.rowId);
+        if (!statusRow || !loadedRow) {
+            return fail({
+                exit_code: 2,
+                errors: [{ code: "ROW_NOT_FOUND", message: `row ${options.rowId} is not a known use-case row` }]
+            });
+        }
+        // UNBOUND is not a target (consistent with scan): nothing to verify.
+        targetRowIds = statusRow.status === "UNBOUND" ? [] : [options.rowId];
+    }
+    else {
+        targetRowIds = prepared.status.rows
+            .filter((row) => row.status !== "UNBOUND")
+            .map((row) => row.row_id)
+            .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+    }
+    const results = [];
+    for (const rowId of targetRowIds) {
+        const statusRow = prepared.status.rows.find((row) => row.row_id === rowId);
+        const loadedRow = prepared.loaded.rows.find((row) => row.row_id === rowId);
+        if (!statusRow || !loadedRow) {
+            continue;
+        }
+        const registeredSlugs = new Set(statusRow.known_binding_slugs);
+        const bindings = registeredBindingsForRow(prepared.scan.bindings, rowId, registeredSlugs);
+        const rowHash = computeRowHash(loadedRow);
+        const bindingSetHash = computeBindingSetHash(rowId, bindings.map((binding) => ({
+            binding_slug: binding.binding_slug,
+            row_id: binding.row_id,
+            file_path: binding.file_path,
+            extent_kind: binding.extent_kind,
+            recognizer_id: binding.recognizer_id,
+            span_canon_id: binding.span_canon_id,
+            span_sha256: binding.span.sha256
+        })));
+        const spanHashes = bindings
+            .map((binding) => binding.span.sha256)
+            .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+        const contextHash = computeRowVerificationContextHash({
+            slug: rowId,
+            verificationPolicy: loadedRow.verification_policy,
+            rootDir: contextRoot,
+            fs,
+            workspaceVerifiers: options.context.verifiers
+        });
+        const base = {
+            schema: VERIFICATION_RESULT_SCHEMA_ID,
+            row_id: rowId,
+            slug: rowId,
+            row_hash: rowHash,
+            binding_set_hash: bindingSetHash,
+            span_sha256s: spanHashes,
+            verification_context_hash: contextHash,
+            created_at: options.generatedAt
+        };
+        // An INVALID row (binding integrity errors) cannot be verified -> fail.
+        if (statusRow.status === "INVALID") {
+            results.push({
+                ...base,
+                status: "fail",
+                evidence_kind: null,
+                verifier_id: null,
+                verifier_kind: null,
+                exit_code: null,
+                stdout_sha256: null,
+                stderr_sha256: null
+            });
+            continue;
+        }
+        // Same workspace verifiers prove/scan use, so the verifier this RUNS is the
+        // one the embedded + recomputed context hashes are derived from.
+        const verifiers = resolveRowVerifiers({ slug: rowId, verification_policy: loadedRow.verification_policy }, options.context.verifiers);
+        // A bound row that demands NO verifier (e.g. mode:none) can't be certified by
+        // verify -> blocked (recorded, surfaced, never crashes).
+        const blocked = verifiers.find((verifier) => verifier.status === "blocked");
+        if (verifiers.length === 0 || blocked) {
+            results.push({
+                ...base,
+                status: "blocked",
+                evidence_kind: null,
+                verifier_id: blocked ? blocked.verifier_id : null,
+                verifier_kind: null,
+                exit_code: null,
+                stdout_sha256: null,
+                stderr_sha256: null
+            });
+            continue;
+        }
+        // Every verifier resolved: run each, aggregate to a pass/fail row verdict.
+        const resolved = verifiers;
+        const runs = resolved.map((verifier) => ({
+            verifier,
+            outcome: spawn({
+                command: verifier.command,
+                cwd: contextRoot,
+                timeout_seconds: verifier.timeout_seconds
+            })
+        }));
+        const firstFailure = runs.find((run) => run.outcome.exit_code !== 0 || run.outcome.timed_out);
+        const decisive = firstFailure ?? runs[0];
+        results.push({
+            ...base,
+            status: firstFailure ? "fail" : "pass",
+            evidence_kind: decisive.verifier.evidence_kind,
+            verifier_id: decisive.verifier.verifier_id,
+            verifier_kind: decisive.verifier.kind,
+            exit_code: decisive.outcome.exit_code,
+            stdout_sha256: sha256(decisive.outcome.stdout),
+            stderr_sha256: sha256(decisive.outcome.stderr)
+        });
+    }
+    // Write the results ledger (one JSONL line per row) if requested. This is an
+    // unsigned per-run snapshot — NOT the append-only trusted evidence ledger.
+    let outPath = null;
+    if (options.outPath) {
+        const body = results.map((record) => JSON.stringify(record)).join("\n");
+        fs.writeText(options.outPath, body === "" ? "" : `${body}\n`);
+        outPath = options.outPath;
+    }
+    // Exit 0 only if every targeted row passed; any fail/blocked is nonzero.
+    const allPass = results.every((record) => record.status === "pass");
+    return fail({
+        exit_code: allPass ? 0 : 1,
+        results,
+        out_path: outPath
+    });
+}
+//# sourceMappingURL=verify.js.map

package/packages/core/dist/markers/cli/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/markers/cli/verify.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,aAAa;AACb,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAyB,MAAM,wBAAwB,CAAC;AAIpF,OAAO,EAAE,YAAY,EAAiB,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAwE5E,SAAS,IAAI,CACX,OAA6D;IAE7D,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,EAAE,EAAE,OAAO,CAAC,SAAS,KAAK,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,iEAAiE;AACjE,SAAS,eAAe,CAAC,OAA2B;IAClD,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACvC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KAC5F,CAAC,CAAC;IACH,MAAM,QAAQ,GACZ,OAAO,CAAC,KAAK,KAAK,SAAS;QAC1B,OAAO,CAAC,KAA2B,CAAC,IAAI,KAAK,WAAW,CAAC;IAC5D,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA6B;IAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IACrD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAE3D,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;SAClF,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU,EAAE,SAAS;QACrB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,EAAE;QACF,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,MAAM,GAAG;YACb,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;aACrF,CAAC,CAAC;YACH,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;aACrF,CAAC,CAAC;SACJ,CAAC;QACF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CACtD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACjF,CAAC;QACF,MAAM,IAAI,GAAG,mBAAmB;YAC9B,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EACL,0EAA0E;wBAC1E,4FAA4F;iBAC/F;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,IAAI,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,EAAE;gBACpF,GAAG,MAAM;gBACT,GAAG,IAAI;aACR;SACF,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,6CAA6C;IAC7C,IAAI,YAAsB,CAAC;IAC3B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,OAAO,CAAC,KAAK,8BAA8B,EAAE,CAAC;aACjG,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,YAAY,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI;aAChC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;aACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;aACxB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QAE1F,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,qBAAqB,CAC1C,KAAK,EACL,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;SACjC,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,UAAU,GAAG,QAAQ;aACxB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;aACrC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,iCAAiC,CAAC;YACpD,IAAI,EAAE,KAAK;YACX,kBAAkB,EAAE,SAAS,CAAC,mBAAmB;YACjD,OAAO,EAAE,WAAW;YACpB,EAAE;YACF,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,6BAA6B;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,gBAAgB,EAAE,cAAc;YAChC,YAAY,EAAE,UAAU;YACxB,yBAAyB,EAAE,WAAW;YACtC,UAAU,EAAE,OAAO,CAAC,WAAW;SACvB,CAAC;QAEX,wEAAwE;QACxE,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,SAAS,GAAG,mBAAmB,CACnC,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE,EACnE,OAAO,CAAC,OAAO,CAAC,SAAS,CAC1B,CAAC;QAEF,8EAA8E;QAC9E,yDAAyD;QACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,aAAa,EAAE,IAAI;gBACnB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;gBACjD,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,SAA+B,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACvC,QAAQ;YACR,OAAO,EAAE,KAAK,CAAC;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,GAAG,EAAE,WAAW;gBAChB,eAAe,EAAE,QAAQ,CAAC,eAAe;aAC1C,CAAC;SACH,CAAC,CAAC,CAAC;QACJ,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAC9D,CAAC;QACF,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzC,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,IAAI;YACP,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACtC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa;YAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;YAC1C,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YACrC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;YACrC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;YAC9C,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC9D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;QACV,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO;QACP,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC"}

package/packages/core/dist/markers/commentPrefix.d.ts

@@ -0,0 +1,7 @@
+export interface CommentPrefixConfig {
+    extensions?: Record<string, string>;
+}
+export declare const DEFAULT_COMMENT_PREFIXES: Readonly<Record<string, string>>;
+export declare function fileExtension(filePath: string): string;
+export declare function resolveCommentPrefix(filePath: string, config?: CommentPrefixConfig, contents?: string): string | null;
+//# sourceMappingURL=commentPrefix.d.ts.map

package/packages/core/dist/markers/commentPrefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commentPrefix.d.ts","sourceRoot":"","sources":["../../src/markers/commentPrefix.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAGlC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAID,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkCpE,CAAC;AAIH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAStD;AAUD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,mBAAmB,EAC5B,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAcf"}

package/packages/core/dist/markers/commentPrefix.js

@@ -0,0 +1,79 @@
+// Comment-prefix resolver (spec section 1.1, Amendment 1).
+//
+// The semantic marker is `<line-comment-prefix>: @use-case: <payload>`. The
+// line-comment prefix is not universal (`//` is invalid in Python/YAML/shell),
+// so it is resolved per file extension from a config-driven map. A default map
+// covers the common `//` and `#` languages so explicit spans work out of the box.
+// Default extension -> line-comment prefix map.
+// Identity-only: this decides *how a marker comment is written*, nothing more.
+export const DEFAULT_COMMENT_PREFIXES = Object.freeze({
+    // `//` languages.
+    ".swift": "//",
+    ".ts": "//",
+    ".tsx": "//",
+    ".js": "//",
+    ".jsx": "//",
+    ".mjs": "//",
+    ".cjs": "//",
+    ".c": "//",
+    ".cc": "//",
+    ".cpp": "//",
+    ".cxx": "//",
+    ".h": "//",
+    ".hpp": "//",
+    ".m": "//",
+    ".mm": "//",
+    ".java": "//",
+    ".kt": "//",
+    ".kts": "//",
+    ".go": "//",
+    ".rs": "//",
+    ".scala": "//",
+    // `#` languages.
+    ".py": "#",
+    ".rb": "#",
+    ".sh": "#",
+    ".bash": "#",
+    ".zsh": "#",
+    ".yaml": "#",
+    ".yml": "#",
+    ".toml": "#",
+    ".pl": "#",
+    ".r": "#"
+});
+// Extract the lower-cased extension (including the leading dot) of a file path.
+// Returns "" when the basename has no extension.
+export function fileExtension(filePath) {
+    const slash = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"));
+    const base = slash >= 0 ? filePath.slice(slash + 1) : filePath;
+    const dot = base.lastIndexOf(".");
+    if (dot <= 0) {
+        // No dot, or a leading-dot dotfile (e.g. ".gitignore") -> no extension.
+        return "";
+    }
+    return base.slice(dot).toLowerCase();
+}
+// Resolve the configured line-comment prefix for a file, or null when the
+// extension is not configured (the file simply cannot carry markers).
+//
+// `contents` is optional. When a file has no extension it can still carry
+// markers if it is a shebang script (e.g. an extensionless `hooks/session-start`
+// bash hook): such scripts are overwhelmingly `#`-comment languages, so a
+// leading `#!` resolves to `#`. Without contents an extensionless file stays
+// null, exactly as before.
+export function resolveCommentPrefix(filePath, config, contents) {
+    const ext = fileExtension(filePath);
+    if (ext === "") {
+        if (contents !== undefined && contents.startsWith("#!")) {
+            return "#";
+        }
+        return null;
+    }
+    const override = config?.extensions?.[ext];
+    if (override !== undefined) {
+        return override;
+    }
+    const fromDefault = DEFAULT_COMMENT_PREFIXES[ext];
+    return fromDefault ?? null;
+}
+//# sourceMappingURL=commentPrefix.js.map

package/packages/core/dist/markers/commentPrefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commentPrefix.js","sourceRoot":"","sources":["../../src/markers/commentPrefix.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,kFAAkF;AAQlF,gDAAgD;AAChD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACtF,kBAAkB;IAClB,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,QAAQ,EAAE,IAAI;IACd,iBAAiB;IACjB,KAAK,EAAE,GAAG;IACV,KAAK,EAAE,GAAG;IACV,KAAK,EAAE,GAAG;IACV,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,GAAG;IACZ,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,GAAG;CACV,CAAC,CAAC;AAEH,gFAAgF;AAChF,iDAAiD;AACjD,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,wEAAwE;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,0EAA0E;AAC1E,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,MAA4B,EAC5B,QAAiB;IAEjB,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,WAAW,IAAI,IAAI,CAAC;AAC7B,CAAC"}

package/packages/core/dist/markers/constants.d.ts

@@ -0,0 +1,10 @@
+export declare const MARKER_SCHEMA_ID = "ucase-marker-v1";
+export declare const BINDING_REGISTRY_SCHEMA_ID = "ucase-binding-registry-event-v1";
+export declare const EVIDENCE_SCHEMA_ID = "ucase-proof-event-v1";
+export declare const STATUS_SCHEMA_ID = "ucase-freshness-status-v1";
+export declare const SPAN_CANON_ID = "ucase-span-lines-v1";
+export declare const EXPLICIT_RECOGNIZER_ID = "explicit-span-v1";
+export declare const SWIFT_FUNC_RECOGNIZER_ID = "swift-func-inferred-v1";
+export declare const BINDING_SET_HASH_ID = "ucase-binding-set-v1";
+export declare const ROW_HASH_ID = "existing-semantic-row-hash";
+//# sourceMappingURL=constants.d.ts.map

package/packages/core/dist/markers/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/markers/constants.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAClD,eAAO,MAAM,0BAA0B,oCAAoC,CAAC;AAC5E,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAE5D,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAG1D,eAAO,MAAM,WAAW,+BAA+B,CAAC"}

package/packages/core/dist/markers/constants.js

@@ -0,0 +1,13 @@
+// Core constants for the use-case-markers system (spec section 0).
+// Identity-only marker schema and the canonicalizer/recognizer/hash ids.
+export const MARKER_SCHEMA_ID = "ucase-marker-v1";
+export const BINDING_REGISTRY_SCHEMA_ID = "ucase-binding-registry-event-v1";
+export const EVIDENCE_SCHEMA_ID = "ucase-proof-event-v1";
+export const STATUS_SCHEMA_ID = "ucase-freshness-status-v1";
+export const SPAN_CANON_ID = "ucase-span-lines-v1";
+export const EXPLICIT_RECOGNIZER_ID = "explicit-span-v1";
+export const SWIFT_FUNC_RECOGNIZER_ID = "swift-func-inferred-v1";
+export const BINDING_SET_HASH_ID = "ucase-binding-set-v1";
+// ROW_HASH_ID names the existing semantic row-hash algorithm this system reuses.
+export const ROW_HASH_ID = "existing-semantic-row-hash";
+//# sourceMappingURL=constants.js.map

package/packages/core/dist/markers/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/markers/constants.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,yEAAyE;AAEzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAClD,MAAM,CAAC,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC"}

package/packages/core/dist/markers/evidenceLedger.d.ts

@@ -0,0 +1,150 @@
+import type { CiAuthority } from "./ciAuthority.js";
+import { type ReadBaseRefOptions } from "./appendOnly.js";
+import { type PublicKeyResolver } from "./proofSignature.js";
+export interface ProofBindingItem {
+    binding_slug: string;
+    row_id: string;
+    file_path: string;
+    extent_kind: string;
+    recognizer_id: string;
+    span_canon_id: string;
+    span_sha256: string;
+    span_start_line: number;
+    span_end_line: number;
+}
+export interface ProofEvent {
+    schema: string;
+    event_type: string;
+    event_id: string;
+    created_at: string;
+    producer: {
+        kind: string;
+        id: string;
+        version: string;
+        ci_run_id: string;
+        repo: string;
+        commit: string;
+    };
+    row: {
+        row_id: string;
+        row_hash_id: string;
+        row_hash: string;
+        verification_policy_hash: string;
+        approval_policy_hash: string;
+    };
+    bindings: {
+        binding_set_hash_id: string;
+        binding_set_hash: string;
+        span_canon_id: string;
+        items: ProofBindingItem[];
+    };
+    verification: {
+        command_id: string;
+        result: string;
+        started_at: string;
+        completed_at: string;
+        artifacts: Array<{
+            kind: string;
+            path: string;
+            sha256: string;
+        }>;
+        context_hash_id: string;
+        context_hash: string;
+    };
+    signature: {
+        alg: string;
+        key_id: string;
+        value: string;
+    };
+    entry_index?: number;
+    previous_entry_hash?: string;
+    authority?: CiAuthority;
+}
+export declare const GENESIS_ENTRY_HASH: string;
+export declare function computeLedgerEntryHash(entry: unknown): string;
+export declare const LedgerChainErrorCode: Readonly<{
+    readonly CHAIN_BROKEN: "UCM_LEDGER_CHAIN_BROKEN";
+    readonly INDEX_GAP: "UCM_LEDGER_INDEX_GAP";
+    readonly DUPLICATE_INDEX: "UCM_LEDGER_DUPLICATE_INDEX";
+}>;
+export type LedgerChainErrorCode = (typeof LedgerChainErrorCode)[keyof typeof LedgerChainErrorCode];
+export interface LedgerChainError {
+    code: LedgerChainErrorCode;
+    line: number | null;
+    message: string;
+    entry_index?: number;
+}
+export interface LedgerChainResult {
+    ok: boolean;
+    verified_entries: number;
+    legacy_prefix_count: number;
+    errors: LedgerChainError[];
+}
+export declare function verifyLedgerChain(lines: readonly EvidenceLine[]): LedgerChainResult;
+export declare const TRUSTED_CI_PRODUCER_KIND = "trusted-ci-prover";
+export declare const PROOF_PASS_RESULT = "pass";
+export declare const EvidenceErrorCode: Readonly<{
+    readonly JSON_PARSE_ERROR: "JSON_PARSE_ERROR";
+    readonly EVIDENCE_SCHEMA_INVALID: "EVIDENCE_SCHEMA_INVALID";
+    readonly SIGNATURE_MISSING: "SIGNATURE_MISSING";
+    readonly SIGNATURE_ALG_UNSUPPORTED: "SIGNATURE_ALG_UNSUPPORTED";
+    readonly UNKNOWN_KEY_ID: "UNKNOWN_KEY_ID";
+    readonly BAD_SIGNATURE: "BAD_SIGNATURE";
+    readonly PRODUCER_NOT_TRUSTED: "PRODUCER_NOT_TRUSTED";
+    readonly VERIFICATION_NOT_PASS: "VERIFICATION_NOT_PASS";
+    readonly BINDING_SET_HASH_MISMATCH: "BINDING_SET_HASH_MISMATCH";
+    readonly EVIDENCE_ROW_MISSING: "EVIDENCE_ROW_MISSING";
+    readonly APPEND_ONLY_VIOLATION: "APPEND_ONLY_VIOLATION";
+}>;
+export type EvidenceErrorCode = (typeof EvidenceErrorCode)[keyof typeof EvidenceErrorCode];
+export interface EvidenceError {
+    code: EvidenceErrorCode;
+    line: number | null;
+    message: string;
+    event_id?: string;
+    row_id?: string;
+}
+export interface EvidenceLine {
+    line: number;
+    value: unknown;
+}
+export interface ReadEvidenceResult {
+    lines: EvidenceLine[];
+    errors: EvidenceError[];
+}
+export declare function readEvidenceJsonl(text: string): ReadEvidenceResult;
+export interface ValidateProofEventOptions {
+    publicKeyResolver: PublicKeyResolver;
+    yamlRowIds?: ReadonlySet<string>;
+}
+export interface ValidateProofEventResult {
+    ok: boolean;
+    errors: EvidenceError[];
+    event: ProofEvent | null;
+}
+export declare function validateProofEventValue(value: unknown, line: number | null, options: ValidateProofEventOptions): ValidateProofEventResult;
+export interface ValidateEvidenceLedgerOptions {
+    publicKeyResolver: PublicKeyResolver;
+    baseRefOldText?: string;
+    yamlRowIds?: ReadonlySet<string>;
+}
+export interface EvidenceLedgerSummary {
+    proof_events_checked: number;
+    proof_events_valid: number;
+    proof_events_invalid: number;
+    append_only: boolean;
+    errors_by_code: Record<string, number>;
+}
+export interface ValidateEvidenceLedgerResult {
+    ok: boolean;
+    errors: EvidenceError[];
+    events: ProofEvent[];
+    append_only: boolean;
+    summary: EvidenceLedgerSummary;
+}
+export declare function validateEvidenceLedger(text: string, options: ValidateEvidenceLedgerOptions): ValidateEvidenceLedgerResult;
+export declare function validateEvidenceLedgerAgainstBaseRef(text: string, baseRef: string, path: string, options: {
+    publicKeyResolver: PublicKeyResolver;
+    yamlRowIds?: ReadonlySet<string>;
+} & ReadBaseRefOptions): ValidateEvidenceLedgerResult;
+//# sourceMappingURL=evidenceLedger.d.ts.map

package/packages/core/dist/markers/evidenceLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidenceLedger.d.ts","sourceRoot":"","sources":["../../src/markers/evidenceLedger.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAe,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG1E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE;QACH,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,wBAAwB,EAAE,MAAM,CAAC;QACjC,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,EAAE;QACR,mBAAmB,EAAE,MAAM,CAAC;QAC5B,gBAAgB,EAAE,MAAM,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,gBAAgB,EAAE,CAAC;KAC3B,CAAC;IACF,YAAY,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAIjE,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAY1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAS7B,SAAS,CAAC,EAAE,WAAW,CAAC;CACzB;AAKD,eAAO,MAAM,kBAAkB,QAA6B,CAAC;AAM7D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7D;AASD,eAAO,MAAM,oBAAoB;;;;EAItB,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAGhC,EAAE,EAAE,OAAO,CAAC;IAEZ,gBAAgB,EAAE,MAAM,CAAC;IAEzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAuCD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,iBAAiB,CAqFnF;AAGD,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAIxC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAYnB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAE3F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAQD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAqBlE;AAgBD,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAQD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,OAAO,EAAE,yBAAyB,GACjC,wBAAwB,CAiG1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,iBAAiB,EAAE,iBAAiB,CAAC;IAGrC,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AASD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,4BAA4B,CA2D9B;AAKD,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC,GAAG,kBAAkB,GACrB,4BAA4B,CAU9B"}