@agentcontextdistributionprotocol/acdp 0.6.0 → 0.8.0

package/README.md

@@ -2,16 +2,27 @@
 
 Thin NAPI-rs binding over the [`acdp`](https://crates.io/crates/acdp)
 Rust library. Implements the producer- and consumer-side crypto for the
-Agent Context Distribution Protocol v0.1.0 (RFC-ACDP-0001/0003/0008).
-HTTP is intentionally left to the caller — pair this with `fetch` /
-`undici` for transport.
+Agent Context Distribution Protocol — v0.1.0 core plus the v0.2.0 Trust &
+Hardening surface (RFC-ACDP-0001 through 0015). HTTP is intentionally left
+to the caller — pair this with `fetch` / `undici` for transport.
+
+Package version tracks the binding release line (currently **0.8.0**).
+
+## Install
+
+```bash
+npm install @agentcontextdistributionprotocol/acdp
+```
+
+Prebuilt native binaries are published for macOS (x64/arm64) and Linux
+(x64/arm64-gnu); the loader package selects the right one at install time.
 
 ## Install (development)
 
 ```bash
 npm install                  # installs @napi-rs/cli
 npm run build:debug          # produces index.js + acdp.<platform>.node
-node --test tests/           # in-process unit tests, no HTTP
+node --test tests/*.mjs      # in-process unit tests, no HTTP
 ```
 
 ## Build a release binary
@@ -46,6 +57,20 @@ AcdpVerifier.verifySignature(
 );
 ```
 
+## Verification surface
+
+`AcdpVerifier` covers the full 0.2.0 surface in addition to the basics
+above: offline `did:key` verification (`verifyBodyOffline`,
+`verifyPublishRequestOffline`), registry receipts (`verifyReceipt`,
+`verifyLineageHeadReceipt`), the transparency log (`verifyLogCheckpoint`,
+`verifyLogInclusion`, `verifyLogConsistency`), lifecycle events
+(`verifyLifecycleEvent`), key revocation (`parseKeyRevocation`,
+`classifyUnderRevocation`), and witness cosigning
+(`buildWitnessCosignature`, `verifyWitnessCosignature`,
+`evaluateWitnessQuorum`). `AcdpP256Producer`, `AcdpDid`,
+`AcdpDidDocument`, `AcdpCanonicalizer`, `AcdpMerkle`, and `AcdpSsrfPolicy`
+are also exported.
+
 ## Design rules
 
 * **JSON across the FFI boundary.** Every method accepts and returns

package/index.d.ts

@@ -857,4 +857,88 @@ export declare class AcdpVerifier {
    * steps 3–4).
    */
   static classifyUnderRevocation(revocationsJson: string, signerFingerprint: string, receiptCreatedAtRfc3339?: string | undefined | null): string
+  /**
+   * Mint a signed transparency-log witness cosignature
+   * (RFC-ACDP-0015 §5) — the MINT surface a host-language witness
+   * service uses. The witness observes a checkpoint and cosigns it
+   * with its OWN Ed25519 key (a witness key, distinct from the
+   * registry receipt key); the returned `log_cosignature` uses the
+   * RFC-ACDP-0010 §5 construction verbatim (the witness signs the
+   * ASCII bytes of the `"sha256:<hex>"` cosignature-hash string).
+   *
+   * * `witnessedCheckpointJson` — the identity-bearing subset of the
+   *   checkpoint the witness observed: `{"log_id", "tree_size",
+   *   "root_hash", "timestamp"}` (closed schema).
+   * * `witnessDid` — the witness's own DID (`did:web` or `did:key`).
+   *   The signing-key DID URL is derived as
+   *   `"<witnessDid>#witness-key-1"` (the §5/§9 witness-key
+   *   convention).
+   * * `witnessSeedHex` — the witness Ed25519 signing seed, hex-
+   *   encoded (64 hex chars → 32 bytes). The same seed produces
+   *   byte-identical cosignatures across bindings.
+   * * `witnessedAtRfc3339` — the witness-clock observation time
+   *   (canonical millisecond RFC 3339 UTC; truncated to ms).
+   *
+   * Returns the signed `log_cosignature` as a JSON string. This is
+   * the RAW mint (no §7 obligation — the checkpoint's own signature
+   * and consistency against a retained head are the host's job).
+   * Throws on malformed input (bad seed / timestamp / witness DID /
+   * witnessed_checkpoint).
+   */
+  static buildWitnessCosignature(witnessedCheckpointJson: string, witnessDid: string, witnessSeedHex: string, witnessedAtRfc3339: string): string
+  /**
+   * Verify one witness cosignature against a checkpoint the consumer
+   * has itself verified, offline per RFC-ACDP-0015 §8 (steps 1–5):
+   * closed parse + witness binding, checkpoint binding, the witness
+   * signature over the RAW wire preimage against the key resolved
+   * from the caller-supplied witness DID document (§9: looked up in
+   * `verificationMethod`, retired keys stay verifiable), and the
+   * `witnessed_at` well-formedness + forward-skew check.
+   *
+   * * `cosigJson` — the `log_cosignature` object as received.
+   * * `witnessDidDocJson` — the WITNESS's resolved DID document
+   *   (resolution stays in JS land). Its `id` MUST equal the
+   *   cosignature's `witness_id`.
+   * * `expectedCheckpointJson` — the RFC-ACDP-0012 checkpoint the
+   *   consumer independently holds and verified; the cosignature's
+   *   `{log_id, tree_size, root_hash}` MUST match it (§8 step 4).
+   * * `nowRfc3339` — the consumer clock (defaults to now).
+   * * `maxClockSkewSecs` — §8 step 5 forward allowance (default 120).
+   *
+   * Returns a JSON verdict: `{"valid": true, "witness_id": ...,
+   * "age_secs": int, "stale": bool}` — staleness (§8.1) is policy,
+   * not a verification failure — or `{"valid": false, "code":
+   * "invalid_witness_cosignature"|..., "error": ...}`. Throws only
+   * on malformed host input.
+   */
+  static verifyWitnessCosignature(cosigJson: string, witnessDidDocJson: string, expectedCheckpointJson: string, nowRfc3339?: string | undefined | null, maxClockSkewSecs?: number | undefined | null): string
+  /**
+   * Compute the RFC-ACDP-0015 §8 N-witnessed report over a set of
+   * cosignatures for a checkpoint the consumer has itself verified.
+   * A cosignature counts toward N iff it names a TRUSTED witness,
+   * covers the checkpoint's `(log_id, tree_size, root_hash)` tuple,
+   * and passes every §8 step; DISTINCT `witness_id` values are
+   * counted. A cosignature that fails a step does not fail the
+   * checkpoint — it is recorded in `failures` and simply does not
+   * count.
+   *
+   * * `cosignaturesJson` — a JSON array of `log_cosignature` objects.
+   * * `expectedCheckpointJson` — the verified checkpoint the quorum
+   *   is over.
+   * * `trustedWitnessDidsJson` — a JSON array of the witness DIDs the
+   *   consumer trusts; only these can count.
+   * * `witnessDidDocsJson` — a JSON object mapping each `witness_id`
+   *   to its resolved DID document.
+   * * `policyJson` — `{"min_witnesses"?, "max_age_secs"?,
+   *   "max_clock_skew_secs"?}`. Defaults mirror the Rust
+   *   `WitnessPolicy`: `min_witnesses=1`, `max_age_secs=300` (an
+   *   explicit `null` disables the freshness split),
+   *   `max_clock_skew_secs=120`.
+   * * `nowRfc3339` — the consumer clock (defaults to now).
+   *
+   * Returns a JSON report: `{"witnessed_count", "witnesses",
+   * "meets_quorum", "fresh_witnessed_count", "meets_fresh_quorum",
+   * "failures"}`. Throws on malformed host input.
+   */
+  static evaluateWitnessQuorum(cosignaturesJson: string, expectedCheckpointJson: string, trustedWitnessDidsJson: string, witnessDidDocsJson: string, policyJson: string, nowRfc3339?: string | undefined | null): string
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcontextdistributionprotocol/acdp",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Agent Context Distribution Protocol — Node.js SDK",
   "license": "MIT OR Apache-2.0",
   "repository": {
@@ -47,9 +47,9 @@
     "registry": "https://registry.npmjs.org/"
   },
   "optionalDependencies": {
-    "@agentcontextdistributionprotocol/acdp-darwin-x64": "0.6.0",
-    "@agentcontextdistributionprotocol/acdp-darwin-arm64": "0.6.0",
-    "@agentcontextdistributionprotocol/acdp-linux-x64-gnu": "0.6.0",
-    "@agentcontextdistributionprotocol/acdp-linux-arm64-gnu": "0.6.0"
+    "@agentcontextdistributionprotocol/acdp-darwin-x64": "0.8.0",
+    "@agentcontextdistributionprotocol/acdp-darwin-arm64": "0.8.0",
+    "@agentcontextdistributionprotocol/acdp-linux-x64-gnu": "0.8.0",
+    "@agentcontextdistributionprotocol/acdp-linux-arm64-gnu": "0.8.0"
   }
 }