@adammcarter/use-cases 0.1.0

package/packages/core/dist/markers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/markers/index.ts"],"names":[],"mappings":"AAGA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAEhC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAE7B,cAAc,0BAA0B,CAAC;AAEzC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AAEpC,cAAc,cAAc,CAAC;AAE7B,cAAc,aAAa,CAAC;AAE5B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,gBAAgB,CAAC"}

package/packages/core/dist/markers/index.js

@@ -0,0 +1,38 @@
+// Public API for the use-case-markers Phase 1 primitives:
+// schema ids/constants, canonical JSON + sha256, the row/policy/binding-set
+// hashes, and the JSON-schema validators.
+export * from "./constants.js";
+export * from "./canonicalJson.js";
+export * from "./rowHash.js";
+export * from "./policyHash.js";
+export * from "./verifierPresets.js";
+export * from "./verifierResolver.js";
+export * from "./verificationContextHash.js";
+export * from "./bindingSetHash.js";
+export * from "./validators.js";
+// Phase 2: marker parser + explicit-span scanner.
+export * from "./commentPrefix.js";
+export * from "./markerLine.js";
+export * from "./spanCanon.js";
+export * from "./physicalLines.js";
+export * from "./scanner.js";
+// Phase 4: Swift function recognizer (inferred-end spans).
+export * from "./swiftFuncRecognizer.js";
+// Phase 3: append-only binding registry + reconciliation.
+export * from "./registry.js";
+export * from "./appendOnly.js";
+export * from "./reconcile.js";
+// Phase 5: evidence ledger validation + trusted-CI proof signatures.
+export * from "./proofSignature.js";
+export * from "./evidenceLedger.js";
+// Public-v1: opt-in multi-key keyring resolver (rotation / revocation).
+export * from "./keyring.js";
+// Public-v1: opt-in signed-tier ed25519 keypair generation (`uc keygen`).
+export * from "./keygen.js";
+// Public-v1: CI-neutral provenance authority detection.
+export * from "./ciAuthority.js";
+// Phase 6: freshness state machine (status derivation + policy gate).
+export * from "./freshness.js";
+// Phase 7: CLI command cores (bind / scan / prove / validate-ledger).
+export * from "./cli/index.js";
+//# sourceMappingURL=index.js.map

package/packages/core/dist/markers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/markers/index.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,4EAA4E;AAC5E,0CAA0C;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,kDAAkD;AAClD,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,2DAA2D;AAC3D,cAAc,0BAA0B,CAAC;AACzC,0DAA0D;AAC1D,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,qEAAqE;AACrE,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,wEAAwE;AACxE,cAAc,cAAc,CAAC;AAC7B,0EAA0E;AAC1E,cAAc,aAAa,CAAC;AAC5B,wDAAwD;AACxD,cAAc,kBAAkB,CAAC;AACjC,sEAAsE;AACtE,cAAc,gBAAgB,CAAC;AAC/B,sEAAsE;AACtE,cAAc,gBAAgB,CAAC"}

package/packages/core/dist/markers/keygen.d.ts

@@ -0,0 +1,6 @@
+export interface SigningKeypair {
+    privatePem: string;
+    publicPem: string;
+}
+export declare function generateSigningKeypair(): SigningKeypair;
+//# sourceMappingURL=keygen.d.ts.map

package/packages/core/dist/markers/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/markers/keygen.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,cAAc;IAG7B,UAAU,EAAE,MAAM,CAAC;IAGnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,wBAAgB,sBAAsB,IAAI,cAAc,CAMvD"}

package/packages/core/dist/markers/keygen.js

@@ -0,0 +1,18 @@
+// ed25519 keypair generation for the OPT-IN signed proof tier (spec 5.2/5.3).
+//
+// This mirrors the recipe in docs/security/key-management.md exactly: the
+// private key is exported as a PKCS8 PEM and the public key as an SPKI PEM —
+// the two formats `prove --signing-key-env` (via createPrivateKey) and
+// `--public-key` (via createPublicKey) already consume. Everything here is pure
+// crypto over in-memory values; no filesystem, git, or process access. The CLI
+// layer owns where (if anywhere) the keys are written and the CI-only warning.
+import { generateKeyPairSync } from "node:crypto";
+// Generate a new ed25519 signing keypair. Each call returns a distinct pair.
+export function generateSigningKeypair() {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    return {
+        privatePem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicPem: publicKey.export({ type: "spki", format: "pem" }).toString()
+    };
+}
+//# sourceMappingURL=keygen.js.map

package/packages/core/dist/markers/keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../../src/markers/keygen.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,uEAAuE;AACvE,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAYlD,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC;AACJ,CAAC"}

package/packages/core/dist/markers/keyring.d.ts

@@ -0,0 +1,23 @@
+import type { PublicKeyResolver } from "./proofSignature.js";
+export declare const KEYRING_SCHEMA_ID = "https://use-cases.dev/schemas/v1/keyring.schema.json";
+export interface KeyringKey {
+    key_id: string;
+    algorithm: "ed25519";
+    public_key: string;
+    valid_from: string;
+    valid_until: string | null;
+    status: "active" | "revoked";
+}
+export interface Keyring {
+    keyring_schema_id: "ucase-public-key-registry-v1";
+    keys: KeyringKey[];
+}
+export declare class KeyringError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function parseKeyring(value: unknown, sourcePath?: string | null): Keyring;
+export declare function loadKeyring(filePath: string): Keyring;
+export declare function keyringResolver(keyring: Keyring): PublicKeyResolver;
+export declare function keyringPublicKeyResolverFromFile(filePath: string): PublicKeyResolver;
+//# sourceMappingURL=keyring.d.ts.map

package/packages/core/dist/markers/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../src/markers/keyring.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,eAAO,MAAM,iBAAiB,yDAAyD,CAAC;AAExF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,OAAO;IACtB,iBAAiB,EAAE,8BAA8B,CAAC;IAClD,IAAI,EAAE,UAAU,EAAE,CAAC;CACpB;AAGD,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAGD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAOtF;AAGD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAoBrD;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAiCnE;AAGD,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAEpF"}

package/packages/core/dist/markers/keyring.js

@@ -0,0 +1,93 @@
+// Multi-key public-key registry (keyring) for verifying trusted-CI proof-event
+// signatures (schemas/v1/keyring.schema.json).
+//
+// This is the OPT-IN alternative to the single `--public-key` path. Where
+// singleKeyResolver trusts one explicitly-provided key unconditionally, a
+// keyring carries several keys, each with a validity window and a revocation
+// status, so keys can be rotated and retired without changing code.
+//
+// Resolution is FAIL-CLOSED: a key_id resolves to a public key ONLY when the
+// key exists, its status is "active", and the proof's created_at falls inside
+// [valid_from, valid_until] (valid_until null = open-ended). A revoked, unknown,
+// or out-of-window key_id resolves to undefined, so verifyEvent reports
+// UNKNOWN_KEY_ID and the proof does not verify.
+import { readFileSync } from "node:fs";
+import { validateBySchemaId } from "../schema/index.js";
+export const KEYRING_SCHEMA_ID = "https://use-cases.dev/schemas/v1/keyring.schema.json";
+// A loader/validator error carrying a stable `code` so callers can branch.
+export class KeyringError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "KeyringError";
+        this.code = code;
+    }
+}
+// Parse + schema-validate a keyring object. Throws KeyringError on any failure.
+export function parseKeyring(value, sourcePath = null) {
+    const result = validateBySchemaId(KEYRING_SCHEMA_ID, value, sourcePath);
+    if (!result.ok) {
+        const details = result.diagnostics.map((d) => `${d.json_pointer ?? ""} ${d.message}`.trim()).join("; ");
+        throw new KeyringError("keyring_schema_invalid", `keyring file is not a valid keyring: ${details}`);
+    }
+    return value;
+}
+// Read, JSON-parse, and schema-validate a keyring file from disk.
+export function loadKeyring(filePath) {
+    let text;
+    try {
+        text = readFileSync(filePath, "utf8");
+    }
+    catch (error) {
+        throw new KeyringError("keyring_unreadable", `could not read keyring file ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch (error) {
+        throw new KeyringError("keyring_invalid_json", `keyring file ${filePath} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return parseKeyring(value, filePath);
+}
+// Build a fail-closed resolver over a keyring. A key_id resolves to its PEM only
+// when the key is active and the proof's createdAt is within its window.
+export function keyringResolver(keyring) {
+    const byId = new Map();
+    for (const key of keyring.keys) {
+        // First entry per key_id wins; later duplicates are ignored.
+        if (!byId.has(key.key_id)) {
+            byId.set(key.key_id, key);
+        }
+    }
+    return (keyId, createdAt) => {
+        const key = byId.get(keyId);
+        if (!key || key.status !== "active") {
+            return undefined; // unknown or revoked -> fail closed
+        }
+        // Without a created_at we cannot prove the window holds -> fail closed.
+        if (createdAt === undefined) {
+            return undefined;
+        }
+        const at = Date.parse(createdAt);
+        if (Number.isNaN(at)) {
+            return undefined;
+        }
+        const from = Date.parse(key.valid_from);
+        if (Number.isNaN(from) || at < from) {
+            return undefined;
+        }
+        if (key.valid_until !== null) {
+            const until = Date.parse(key.valid_until);
+            if (Number.isNaN(until) || at > until) {
+                return undefined;
+            }
+        }
+        return key.public_key;
+    };
+}
+// Convenience used by the CLI: load a keyring file and build its resolver.
+export function keyringPublicKeyResolverFromFile(filePath) {
+    return keyringResolver(loadKeyring(filePath));
+}
+//# sourceMappingURL=keyring.js.map

package/packages/core/dist/markers/keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../../src/markers/keyring.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+CAA+C;AAC/C,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,gDAAgD;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sDAAsD,CAAC;AAgBxF,2EAA2E;AAC3E,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,aAA4B,IAAI;IAC3E,MAAM,MAAM,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,wCAAwC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAgB,CAAC;AAC1B,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,+BAA+B,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,sBAAsB,EACtB,gBAAgB,QAAQ,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,KAAa,EAAE,SAAkB,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,CAAC,oCAAoC;QACxD,CAAC;QACD,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;gBACtC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,UAAU,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gCAAgC,CAAC,QAAgB;IAC/D,OAAO,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/packages/core/dist/markers/markerLine.d.ts

@@ -0,0 +1,35 @@
+export declare const MarkerErrorCode: Readonly<{
+    readonly FORBIDDEN_MARKER_PAYLOAD: "FORBIDDEN_MARKER_PAYLOAD";
+    readonly MALFORMED_MARKER: "MALFORMED_MARKER";
+    readonly MALFORMED_END_MARKER: "MALFORMED_END_MARKER";
+    readonly MISMATCHED_END_MARKER: "MISMATCHED_END_MARKER";
+    readonly END_WITHOUT_START: "END_WITHOUT_START";
+    readonly UNSUPPORTED_INFERENCE: "UNSUPPORTED_INFERENCE";
+    readonly NESTED_SPAN: "NESTED_SPAN";
+    readonly DUPLICATE_BINDING_SLUG: "DUPLICATE_BINDING_SLUG";
+}>;
+export type MarkerErrorCode = (typeof MarkerErrorCode)[keyof typeof MarkerErrorCode];
+export declare function isValidSlug(slug: string): boolean;
+export declare function splitSlug(slug: string): {
+    row_id: string;
+    suffix: string | null;
+} | null;
+export type MarkerLineParse = {
+    kind: "none";
+} | {
+    kind: "start";
+    slug: string;
+    column: number;
+} | {
+    kind: "end";
+    slug: string;
+    column: number;
+} | {
+    kind: "invalid";
+    code: MarkerErrorCode;
+    message: string;
+    column: number;
+    slug?: string;
+};
+export declare function parseMarkerLine(line: string, commentPrefix: string): MarkerLineParse;
+//# sourceMappingURL=markerLine.d.ts.map

package/packages/core/dist/markers/markerLine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markerLine.d.ts","sourceRoot":"","sources":["../../src/markers/markerLine.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,eAAe;;;;;;;;;EAWjB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAYrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAID,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CASxF;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ/F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,CA4EpF"}

package/packages/core/dist/markers/markerLine.js

@@ -0,0 +1,125 @@
+// Marker-line parser (spec section 1: grammar 1.2, slug rules 1.3).
+//
+// Recognizes one physical source line of the form
+//   <comment-prefix>: @use-case: <payload>
+// and classifies it as a start marker, an end marker, "not a marker", or an
+// INVALID marker with a precise error code. The marker carries identity ONLY:
+// any payload beyond a bare slug (a `fresh=`, `sha256=`, `role=`, `tier1`, ...)
+// or beyond a valid `end <slug>` is rejected as a forbidden payload.
+// Stable error codes for every way a marker / span can be invalid. Marker-line
+// codes are produced here; span-pairing codes are produced by the scanner.
+export const MarkerErrorCode = Object.freeze({
+    // Marker-line level.
+    FORBIDDEN_MARKER_PAYLOAD: "FORBIDDEN_MARKER_PAYLOAD",
+    MALFORMED_MARKER: "MALFORMED_MARKER",
+    MALFORMED_END_MARKER: "MALFORMED_END_MARKER",
+    // Span-pairing level.
+    MISMATCHED_END_MARKER: "MISMATCHED_END_MARKER",
+    END_WITHOUT_START: "END_WITHOUT_START",
+    UNSUPPORTED_INFERENCE: "UNSUPPORTED_INFERENCE",
+    NESTED_SPAN: "NESTED_SPAN",
+    DUPLICATE_BINDING_SLUG: "DUPLICATE_BINDING_SLUG"
+});
+// Full slug grammar (spec 1.2 / 1.3):
+//   slug           = row-id ["#" binding-suffix]
+//   row-id         = ident {"." ident}
+//   binding-suffix = suffix-ident {"." suffix-ident}
+//   ident          = lower-alpha {lower-alpha | digit | "_"}
+//   suffix-ident   = lower-alpha {lower-alpha | digit | "_" | "-"}
+const ROW_ID = "[a-z][a-z0-9_]*(?:\\.[a-z][a-z0-9_]*)*";
+const BINDING_SUFFIX = "[a-z][a-z0-9_-]*(?:\\.[a-z][a-z0-9_-]*)*";
+const SLUG_RE = new RegExp(`^${ROW_ID}(?:#${BINDING_SUFFIX})?$`);
+export function isValidSlug(slug) {
+    return SLUG_RE.test(slug);
+}
+// Split a valid slug into its row id and optional binding suffix.
+// Returns null when the slug is not grammatical.
+export function splitSlug(slug) {
+    if (!isValidSlug(slug)) {
+        return null;
+    }
+    const hash = slug.indexOf("#");
+    if (hash < 0) {
+        return { row_id: slug, suffix: null };
+    }
+    return { row_id: slug.slice(0, hash), suffix: slug.slice(hash + 1) };
+}
+// Parse a single physical line against a known comment prefix.
+//
+// A line is only considered a marker if, after optional leading whitespace, it
+// begins with exactly `<prefix>: @use-case:`. Otherwise it is "none" (an
+// ordinary line/comment that the scanner ignores). Once that token matches, the
+// payload MUST be a bare slug or `end <slug>`; anything else is invalid.
+export function parseMarkerLine(line, commentPrefix) {
+    const indentMatch = /^[ \t]*/.exec(line);
+    const indent = indentMatch ? indentMatch[0] : "";
+    const column = indent.length + 1;
+    const rest = line.slice(indent.length);
+    const token = `${commentPrefix}: @use-case:`;
+    if (!rest.startsWith(token)) {
+        return { kind: "none" };
+    }
+    const payloadRaw = rest.slice(token.length);
+    const payload = payloadRaw.replace(/^[ \t]+/, "").replace(/[ \t]+$/, "");
+    if (payload === "") {
+        return {
+            kind: "invalid",
+            code: MarkerErrorCode.MALFORMED_MARKER,
+            message: "use-case marker has an empty payload",
+            column
+        };
+    }
+    const tokens = payload.split(/[ \t]+/);
+    if (tokens[0] === "end") {
+        if (tokens.length === 1) {
+            return {
+                kind: "invalid",
+                code: MarkerErrorCode.MALFORMED_END_MARKER,
+                message: "end marker has no slug; expected `end <slug>`",
+                column
+            };
+        }
+        if (tokens.length > 2) {
+            return {
+                kind: "invalid",
+                code: MarkerErrorCode.FORBIDDEN_MARKER_PAYLOAD,
+                message: `forbidden payload after end slug: ${tokens.slice(2).join(" ")}`,
+                column,
+                slug: tokens[1]
+            };
+        }
+        const slug = tokens[1];
+        if (!isValidSlug(slug)) {
+            return {
+                kind: "invalid",
+                code: MarkerErrorCode.MALFORMED_MARKER,
+                message: `invalid slug in end marker: ${slug}`,
+                column,
+                slug
+            };
+        }
+        return { kind: "end", slug, column };
+    }
+    // Start marker: payload must be exactly one valid slug.
+    if (tokens.length > 1) {
+        return {
+            kind: "invalid",
+            code: MarkerErrorCode.FORBIDDEN_MARKER_PAYLOAD,
+            message: `forbidden payload after slug: ${tokens.slice(1).join(" ")}`,
+            column,
+            slug: tokens[0]
+        };
+    }
+    const slug = tokens[0];
+    if (!isValidSlug(slug)) {
+        return {
+            kind: "invalid",
+            code: MarkerErrorCode.MALFORMED_MARKER,
+            message: `invalid slug: ${slug}`,
+            column,
+            slug
+        };
+    }
+    return { kind: "start", slug, column };
+}
+//# sourceMappingURL=markerLine.js.map

package/packages/core/dist/markers/markerLine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markerLine.js","sourceRoot":"","sources":["../../src/markers/markerLine.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kDAAkD;AAClD,2CAA2C;AAC3C,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,qEAAqE;AAErE,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,qBAAqB;IACrB,wBAAwB,EAAE,0BAA0B;IACpD,gBAAgB,EAAE,kBAAkB;IACpC,oBAAoB,EAAE,sBAAsB;IAC5C,sBAAsB;IACtB,qBAAqB,EAAE,uBAAuB;IAC9C,iBAAiB,EAAE,mBAAmB;IACtC,qBAAqB,EAAE,uBAAuB;IAC9C,WAAW,EAAE,aAAa;IAC1B,sBAAsB,EAAE,wBAAwB;CACxC,CAAC,CAAC;AAIZ,sCAAsC;AACtC,iDAAiD;AACjD,uCAAuC;AACvC,qDAAqD;AACrD,6DAA6D;AAC7D,mEAAmE;AACnE,MAAM,MAAM,GAAG,wCAAwC,CAAC;AACxD,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,OAAO,cAAc,KAAK,CAAC,CAAC;AAEjE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,kEAAkE;AAClE,iDAAiD;AACjD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAQD,+DAA+D;AAC/D,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,gFAAgF;AAChF,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,aAAqB;IACjE,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,GAAG,aAAa,cAAc,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,eAAe,CAAC,gBAAgB;YACtC,OAAO,EAAE,sCAAsC;YAC/C,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,eAAe,CAAC,oBAAoB;gBAC1C,OAAO,EAAE,+CAA+C;gBACxD,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,eAAe,CAAC,wBAAwB;gBAC9C,OAAO,EAAE,qCAAqC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACzE,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;aAChB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,eAAe,CAAC,gBAAgB;gBACtC,OAAO,EAAE,+BAA+B,IAAI,EAAE;gBAC9C,MAAM;gBACN,IAAI;aACL,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAED,wDAAwD;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,eAAe,CAAC,wBAAwB;YAC9C,OAAO,EAAE,iCAAiC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACrE,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;SAChB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,eAAe,CAAC,gBAAgB;YACtC,OAAO,EAAE,iBAAiB,IAAI,EAAE;YAChC,MAAM;YACN,IAAI;SACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/packages/core/dist/markers/physicalLines.d.ts

@@ -0,0 +1,10 @@
+export interface PhysicalLine {
+    text: string;
+    charStart: number;
+    charEnd: number;
+    byteStart: number;
+    byteEnd: number;
+}
+export declare function splitPhysicalLines(content: string): PhysicalLine[];
+export declare function lineIndexOfChar(lines: ReadonlyArray<PhysicalLine>, charPos: number): number;
+//# sourceMappingURL=physicalLines.d.ts.map

package/packages/core/dist/markers/physicalLines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"physicalLines.d.ts","sourceRoot":"","sources":["../../src/markers/physicalLines.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAyBlE;AAKD,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAO3F"}

package/packages/core/dist/markers/physicalLines.js

@@ -0,0 +1,48 @@
+// Physical line splitting with both JS-char and UTF-8 byte offsets.
+//
+// Shared by the explicit-span scanner (which needs UTF-8 byte offsets for span
+// byte ranges, spec 4.4) and the Swift function recognizer (which lexes in
+// JS-char space but must report UTF-8 byte offsets, spec 9.3). Both consumers
+// split lines identically, so line index `i` denotes the same physical line in
+// either coordinate system.
+// Split content into physical lines with char and UTF-8 byte offsets. Handles
+// LF, CR and CRLF terminators; a file ending in a terminator does not yield a
+// trailing empty line, while an interior blank line is preserved.
+export function splitPhysicalLines(content) {
+    const lines = [];
+    const n = content.length;
+    let pos = 0;
+    let byteStart = 0;
+    while (pos < n) {
+        let eol = pos;
+        while (eol < n && content[eol] !== "\n" && content[eol] !== "\r") {
+            eol += 1;
+        }
+        const text = content.slice(pos, eol);
+        let termLen = 0;
+        if (eol < n) {
+            termLen = content[eol] === "\r" && content[eol + 1] === "\n" ? 2 : 1;
+        }
+        const charStart = pos;
+        const charEnd = eol + termLen;
+        const textBytes = Buffer.byteLength(text, "utf8");
+        // CR / LF / CRLF are all ASCII, so terminator bytes == terminator length.
+        const byteEnd = byteStart + textBytes + termLen;
+        lines.push({ text, charStart, charEnd, byteStart, byteEnd });
+        byteStart = byteEnd;
+        pos = charEnd;
+    }
+    return lines;
+}
+// Map a JS-char position to the index of the physical line that contains it.
+// Returns -1 if the position is past the end of the content. A position that
+// falls on a line terminator belongs to the line it terminates.
+export function lineIndexOfChar(lines, charPos) {
+    for (let i = 0; i < lines.length; i += 1) {
+        if (charPos >= lines[i].charStart && charPos < lines[i].charEnd) {
+            return i;
+        }
+    }
+    return -1;
+}
+//# sourceMappingURL=physicalLines.js.map

package/packages/core/dist/markers/physicalLines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"physicalLines.js","sourceRoot":"","sources":["../../src/markers/physicalLines.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,4BAA4B;AAU5B,8EAA8E;AAC9E,8EAA8E;AAC9E,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,OAAO,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACjE,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClD,0EAA0E;QAC1E,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,SAAS,GAAG,OAAO,CAAC;QACpB,GAAG,GAAG,OAAO,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,KAAkC,EAAE,OAAe;IACjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/packages/core/dist/markers/policyHash.d.ts

@@ -0,0 +1,4 @@
+export declare function computePolicyHash(policy: unknown): string;
+export declare function computeVerificationPolicyHash(verificationPolicy: unknown): string;
+export declare function computeApprovalPolicyHash(approvalPolicy: unknown): string;
+//# sourceMappingURL=policyHash.d.ts.map

package/packages/core/dist/markers/policyHash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyHash.d.ts","sourceRoot":"","sources":["../../src/markers/policyHash.ts"],"names":[],"mappings":"AAGA,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAEzD;AAGD,wBAAgB,6BAA6B,CAAC,kBAAkB,EAAE,OAAO,GAAG,MAAM,CAEjF;AAGD,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,OAAO,GAAG,MAAM,CAEzE"}

package/packages/core/dist/markers/policyHash.js

@@ -0,0 +1,14 @@
+import { canonicalJsonSha256 } from "./canonicalJson.js";
+// Hash of an arbitrary policy object via canonical_json + sha256.
+export function computePolicyHash(policy) {
+    return canonicalJsonSha256(policy);
+}
+// verification_policy_hash: hash of the row's verification_policy object.
+export function computeVerificationPolicyHash(verificationPolicy) {
+    return computePolicyHash(verificationPolicy);
+}
+// approval_policy_hash: hash of the row's approval_policy object.
+export function computeApprovalPolicyHash(approvalPolicy) {
+    return computePolicyHash(approvalPolicy);
+}
+//# sourceMappingURL=policyHash.js.map

package/packages/core/dist/markers/policyHash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyHash.js","sourceRoot":"","sources":["../../src/markers/policyHash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,6BAA6B,CAAC,kBAA2B;IACvE,OAAO,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;AAC/C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,yBAAyB,CAAC,cAAuB;IAC/D,OAAO,iBAAiB,CAAC,cAAc,CAAC,CAAC;AAC3C,CAAC"}

package/packages/core/dist/markers/proofSignature.d.ts

@@ -0,0 +1,29 @@
+import { type KeyObject } from "node:crypto";
+export interface ProofSignatureBlock {
+    alg: "ed25519";
+    key_id: string;
+    value: string;
+}
+export type PemOrKeyObject = string | KeyObject;
+export type PublicKeyResolver = (keyId: string, createdAt?: string) => PemOrKeyObject | undefined;
+export declare const SignatureFailureCode: Readonly<{
+    readonly SIGNATURE_MISSING: "SIGNATURE_MISSING";
+    readonly SIGNATURE_ALG_UNSUPPORTED: "SIGNATURE_ALG_UNSUPPORTED";
+    readonly UNKNOWN_KEY_ID: "UNKNOWN_KEY_ID";
+    readonly BAD_SIGNATURE: "BAD_SIGNATURE";
+}>;
+export type SignatureFailureCode = (typeof SignatureFailureCode)[keyof typeof SignatureFailureCode];
+export type VerifyEventResult = {
+    ok: true;
+    key_id: string;
+} | {
+    ok: false;
+    code: SignatureFailureCode;
+    message: string;
+};
+export declare function proofSigningPayload(event: Record<string, unknown>): string;
+export declare function signEvent<T extends Record<string, unknown>>(eventWithoutSignature: T, privateKey: PemOrKeyObject, keyId: string): Omit<T, "signature"> & {
+    signature: ProofSignatureBlock;
+};
+export declare function verifyEvent(event: Record<string, unknown>, resolver: PublicKeyResolver): VerifyEventResult;
+//# sourceMappingURL=proofSignature.d.ts.map

package/packages/core/dist/markers/proofSignature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proofSignature.d.ts","sourceRoot":"","sources":["../../src/markers/proofSignature.ts"],"names":[],"mappings":"AASA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,CAAC;AAShD,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,KACf,cAAc,GAAG,SAAS,CAAC;AAIhC,eAAO,MAAM,oBAAoB;;;;;EAKtB,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAEnE,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAkB/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAE1E;AAOD,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzD,qBAAqB,EAAE,CAAC,EACxB,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,MAAM,GACZ,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG;IAAE,SAAS,EAAE,mBAAmB,CAAA;CAAE,CAO3D;AAUD,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,QAAQ,EAAE,iBAAiB,GAC1B,iBAAiB,CAsDnB"}

package/packages/core/dist/markers/proofSignature.js

@@ -0,0 +1,106 @@
+// ed25519 signing + verification for trusted-CI proof events (spec 5.2/5.3,
+// amendment 3).
+//
+// The signing payload is `canonical_json(event without the signature field)`
+// (spec 5.3). The private signing key exists only in trusted CI; the public
+// verification key lives in the repo/config. ed25519 is used through node:crypto
+// with a null algorithm: `crypto.sign(null, data, privateKey)` and
+// `crypto.verify(null, data, publicKey, signature)`. Everything here is pure
+// crypto over in-memory values; no filesystem or git access.
+import { sign, verify } from "node:crypto";
+import { canonicalJson } from "./canonicalJson.js";
+// Stable reasons a signature can fail verification. These line up 1:1 with the
+// signature-related EvidenceErrorCode values so the ledger can forward them.
+export const SignatureFailureCode = Object.freeze({
+    SIGNATURE_MISSING: "SIGNATURE_MISSING",
+    SIGNATURE_ALG_UNSUPPORTED: "SIGNATURE_ALG_UNSUPPORTED",
+    UNKNOWN_KEY_ID: "UNKNOWN_KEY_ID",
+    BAD_SIGNATURE: "BAD_SIGNATURE"
+});
+// Drop the `signature` field (if any) from a shallow copy of an event.
+function stripSignature(event) {
+    const rest = {};
+    for (const [key, value] of Object.entries(event)) {
+        if (key !== "signature") {
+            rest[key] = value;
+        }
+    }
+    return rest;
+}
+// The canonical signing payload: canonical_json(event without signature)
+// (spec 5.3). Defensive: any embedded signature is removed before canonicalizing
+// so signing and verifying always agree on the payload.
+export function proofSigningPayload(event) {
+    return canonicalJson(stripSignature(event));
+}
+// Sign an unsigned proof event with an ed25519 private key, returning the event
+// with its `signature` block attached. The caller passes the event WITHOUT a
+// signature; any pre-existing signature field is ignored and replaced.
+//
+// node:crypto call: sign(null, data, privateKey) -> Buffer (ed25519).
+export function signEvent(eventWithoutSignature, privateKey, keyId) {
+    const payload = proofSigningPayload(eventWithoutSignature);
+    const value = sign(null, Buffer.from(payload, "utf8"), privateKey).toString("base64");
+    return {
+        ...stripSignature(eventWithoutSignature),
+        signature: { alg: "ed25519", key_id: keyId, value }
+    };
+}
+// Verify a proof event's ed25519 signature against the public key resolved from
+// its key_id (spec 5.3). Returns ok, or a precise failure reason:
+//   SIGNATURE_MISSING          - no signature block / missing fields (rule 1)
+//   SIGNATURE_ALG_UNSUPPORTED  - alg is not "ed25519"
+//   UNKNOWN_KEY_ID             - resolver has no key for key_id (rule 2)
+//   BAD_SIGNATURE              - signature does not verify (rule 3)
+//
+// node:crypto call: verify(null, data, publicKey, signature) -> boolean.
+export function verifyEvent(event, resolver) {
+    const signature = event.signature;
+    if (!signature ||
+        typeof signature !== "object" ||
+        typeof signature.key_id !== "string" ||
+        typeof signature.value !== "string") {
+        return {
+            ok: false,
+            code: SignatureFailureCode.SIGNATURE_MISSING,
+            message: "proof event has no usable signature block (unsigned events are invalid)"
+        };
+    }
+    if (signature.alg !== "ed25519") {
+        return {
+            ok: false,
+            code: SignatureFailureCode.SIGNATURE_ALG_UNSUPPORTED,
+            message: `unsupported signature alg: ${String(signature.alg)} (only ed25519 is allowed)`
+        };
+    }
+    // Thread the event's created_at to the resolver so a keyring can enforce
+    // per-key validity windows / revocation against the moment of signing. A
+    // single-key resolver ignores this argument.
+    const createdAt = typeof event.created_at === "string" ? event.created_at : undefined;
+    const publicKey = resolver(signature.key_id, createdAt);
+    if (publicKey === undefined) {
+        return {
+            ok: false,
+            code: SignatureFailureCode.UNKNOWN_KEY_ID,
+            message: `unknown signature key_id: ${signature.key_id}`
+        };
+    }
+    const payload = proofSigningPayload(event);
+    let verified = false;
+    try {
+        verified = verify(null, Buffer.from(payload, "utf8"), publicKey, Buffer.from(signature.value, "base64"));
+    }
+    catch {
+        // A malformed key or signature surfaces as a bad signature, not a throw.
+        verified = false;
+    }
+    if (!verified) {
+        return {
+            ok: false,
+            code: SignatureFailureCode.BAD_SIGNATURE,
+            message: `signature for key_id ${signature.key_id} did not verify`
+        };
+    }
+    return { ok: true, key_id: signature.key_id };
+}
+//# sourceMappingURL=proofSignature.js.map

package/packages/core/dist/markers/proofSignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proofSignature.js","sourceRoot":"","sources":["../../src/markers/proofSignature.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,gBAAgB;AAChB,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,iFAAiF;AACjF,mEAAmE;AACnE,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAwBnD,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,yBAAyB,EAAE,2BAA2B;IACtD,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;CACtB,CAAC,CAAC;AASZ,uEAAuE;AACvE,SAAS,cAAc,CACrB,KAAQ;IAER,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAA4B,CAAC;AACtC,CAAC;AAED,yEAAyE;AACzE,iFAAiF;AACjF,wDAAwD;AACxD,MAAM,UAAU,mBAAmB,CAAC,KAA8B;IAChE,OAAO,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,MAAM,UAAU,SAAS,CACvB,qBAAwB,EACxB,UAA0B,EAC1B,KAAa;IAEb,MAAM,OAAO,GAAG,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtF,OAAO;QACL,GAAG,cAAc,CAAC,qBAAqB,CAAC;QACxC,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,kEAAkE;AAClE,8EAA8E;AAC9E,sDAAsD;AACtD,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,yEAAyE;AACzE,MAAM,UAAU,WAAW,CACzB,KAA8B,EAC9B,QAA2B;IAE3B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAqD,CAAC;IAC9E,IACE,CAAC,SAAS;QACV,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;QACpC,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EACnC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB,CAAC,iBAAiB;YAC5C,OAAO,EAAE,yEAAyE;SACnF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB,CAAC,yBAAyB;YACpD,OAAO,EAAE,8BAA8B,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,4BAA4B;SACzF,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB,CAAC,cAAc;YACzC,OAAO,EAAE,6BAA6B,SAAS,CAAC,MAAM,EAAE;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CACf,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAC5B,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB,CAAC,aAAa;YACxC,OAAO,EAAE,wBAAwB,SAAS,CAAC,MAAM,iBAAiB;SACnE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AAChD,CAAC"}