@agenticprimitives/witness 0.0.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agentic Trust Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,44 @@
+# @agenticprimitives/witness
+
+**Evidentiary dispute attestation** — the neutral function that answers, from artifacts alone:
+*was this action inside the delegated relationship at the time it happened — and if not, whose
+check failed?*
+
+Spec: [`specs/307-witness.md`](../../specs/307-witness.md) · Consumes:
+[verification receipts (spec 303)](../../specs/303-verification-receipts.md) +
+[relationship records (spec 306)](../../specs/306-relationship-record.md).
+
+## The walk
+
+```ts
+import { evaluateDispute, mintWitnessAttestation } from '@agenticprimitives/witness';
+
+const evaluation = await evaluateDispute({
+  record,            // the spec-306 hash-linked evidence chain
+  receipt,           // the disputed spec-303 public receipt
+  detail,            // optional — released to the witness via releaseMode 'witness_escrow'
+  verifyReceiptSignature,
+});
+// → { outcome: 'in_scope' | 'out_of_scope' | 'revoked_before_execution'
+//              | 'stale_status_used' | 'insufficient_evidence', ... }
+
+const attestation = await mintWitnessAttestation(
+  { witness: witnessSa, relationshipId, evaluation, receipt, checkedDetail: !!detail, attestedAt },
+  { sign: witnessSigner },
+);
+```
+
+The walk is **total and ordered** (evidence integrity → record membership → revocation timeline →
+scope), so two witnesses given the same artifacts produce the same outcome and the same
+attestation hash. Anything unverifiable — a broken chain, an invalid receipt, a receipt that isn't
+an entry of the record, a detail that doesn't open — is `insufficient_evidence`, never a guess.
+
+`stale_status_used` is the load-bearing outcome: a revocation entry precedes the receipt in the
+relationship record, yet the verifier allowed on `revocation: 'active'` — the verifier relied on
+stale status, which is exactly the liability trigger the article's procurement checklist assigns.
+
+## Status
+
+`w1-evaluate-attest` — the walk + attestation mint/verify, 8-test suite (one per outcome,
+determinism, tamper, no-identity-leak). W2: attestation anchoring + the witness-escrow
+DecryptGrant release path. W3: the G-12 liability schema over these outcomes.

package/dist/index.d.ts

@@ -0,0 +1,81 @@
+import { type RelationshipRecordEntryV1 } from '@agenticprimitives/agreements';
+import { type ReceiptSignatureVerifier, type Sha256, type VerificationReceiptDetailV1, type VerificationReceiptV1 } from '@agenticprimitives/verification-receipts';
+export declare const PACKAGE_NAME = "@agenticprimitives/witness";
+export declare const PACKAGE_STATUS = "w1-evaluate-attest";
+export declare const SPEC_REF = "specs/307-witness.md";
+export type Hex = `0x${string}`;
+export type WitnessOutcome = 'in_scope' | 'out_of_scope' | 'revoked_before_execution' | 'stale_status_used' | 'insufficient_evidence';
+export interface WitnessProof {
+    type: string;
+    signature: string;
+    signer?: string;
+}
+export interface WitnessAttestationV1 {
+    type: 'WitnessAttestationV1';
+    /** The witness identity (Mode-1 public service/org SA). */
+    witness: string;
+    relationshipId: Hex;
+    /** The verified chain head the walk was performed against. */
+    recordHead: Hex;
+    /** The disputed receipt. */
+    receiptHash: Sha256;
+    outcome: WitnessOutcome;
+    /** Whether an OPENED detail (witness-escrow release) was part of the walk. */
+    checkedDetail: boolean;
+    /** Exact time — a dispute-grade artifact, deliberately not bucketed. */
+    attestedAt: string;
+    /** sha256 over the canonical body (everything except attestationHash + proof). */
+    attestationHash: Sha256;
+    proof?: WitnessProof;
+}
+export interface DisputeEvaluation {
+    outcome: WitnessOutcome;
+    /** The typed reason trail for `insufficient_evidence`; 'ok' otherwise. */
+    evidenceReason: 'ok' | 'record_invalid' | 'receipt_invalid' | 'receipt_not_in_record' | 'detail_mismatch';
+    /** Set when the chain verified. */
+    recordHead?: Hex;
+    /** The record seq of the receipt's entry, when found. */
+    receiptSeq?: number;
+}
+/** Deterministic JSON (sorted keys, undefined dropped) — the repo canonical form. */
+export declare function canonicalize(v: unknown): string;
+export interface EvaluateDisputeInput {
+    /** The relationship record the parties agree governs the interaction. */
+    record: readonly RelationshipRecordEntryV1[];
+    /** The disputed verification receipt (public part). */
+    receipt: VerificationReceiptV1;
+    /** The opened detail — present ONLY when released to the witness
+     *  (DecryptGrant `releaseMode: 'witness_escrow'`, spec 307 W2). */
+    detail?: VerificationReceiptDetailV1;
+    /** Injected receipt-signature check (same port as verification-receipts). */
+    verifyReceiptSignature?: ReceiptSignatureVerifier;
+}
+/**
+ * The deterministic walk (spec 307 §design). Total + ordered — two witnesses
+ * given identical inputs MUST produce the identical outcome (INV-307-1):
+ * evidence integrity → record membership → revocation timeline → scope.
+ * Every unverifiable input maps to `insufficient_evidence` (INV-307-2).
+ */
+export declare function evaluateDispute(input: EvaluateDisputeInput): Promise<DisputeEvaluation>;
+export interface MintWitnessAttestationInput {
+    witness: string;
+    relationshipId: Hex;
+    evaluation: DisputeEvaluation;
+    receipt: VerificationReceiptV1;
+    checkedDetail: boolean;
+    attestedAt: string;
+}
+/** Assemble + hash (+ optionally sign) the attestation over a completed walk. */
+export declare function mintWitnessAttestation(input: MintWitnessAttestationInput, opts?: {
+    sign?: (attestationHash: Sha256) => Promise<WitnessProof>;
+}): Promise<WitnessAttestationV1>;
+export type AttestationVerifyReason = 'ok' | 'wrong_type' | 'hash_mismatch' | 'proof_missing' | 'proof_invalid';
+/** Standalone attestation check (hash recompute + injected proof port). */
+export declare function verifyWitnessAttestation(attestation: WitnessAttestationV1, opts?: {
+    verifySignature?: (attestationHash: Sha256, proof: WitnessProof) => Promise<boolean>;
+    requireProof?: boolean;
+}): Promise<{
+    valid: boolean;
+    reason: AttestationVerifyReason;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,MAAM,EACX,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAElD,eAAO,MAAM,YAAY,+BAA+B,CAAC;AACzD,eAAO,MAAM,cAAc,uBAAuB,CAAC;AACnD,eAAO,MAAM,QAAQ,yBAAyB,CAAC;AAE/C,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAEhC,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,cAAc,GACd,0BAA0B,GAC1B,mBAAmB,GACnB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,GAAG,CAAC;IACpB,8DAA8D;IAC9D,UAAU,EAAE,GAAG,CAAC;IAChB,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,0EAA0E;IAC1E,cAAc,EACV,IAAI,GACJ,gBAAgB,GAChB,iBAAiB,GACjB,uBAAuB,GACvB,iBAAiB,CAAC;IACtB,mCAAmC;IACnC,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAS/C;AAUD,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC7C,uDAAuD;IACvD,OAAO,EAAE,qBAAqB,CAAC;IAC/B;uEACmE;IACnE,MAAM,CAAC,EAAE,2BAA2B,CAAC;IACrC,6EAA6E;IAC7E,sBAAsB,CAAC,EAAE,wBAAwB,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0C7F;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,GAAG,CAAC;IACpB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,EAClC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;CAAE,GACnE,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,GAAG,YAAY,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAEhH,2EAA2E;AAC3E,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,oBAAoB,EACjC,IAAI,CAAC,EAAE;IACL,eAAe,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAU9D"}

package/dist/index.js

@@ -0,0 +1,110 @@
+// @agenticprimitives/witness — spec 307 W1 (G-11).
+// The evidentiary dispute function: given a relationship record (spec 306),
+// a verification receipt (spec 303), and optionally its opened detail, walk
+// the evidence DETERMINISTICALLY and attest one of the article's outcomes.
+// "Evidentiary before adjudicative" — facts, never remedies.
+import { verifyRecordChain, } from '@agenticprimitives/agreements';
+import { openReceipt, verifyVerificationReceipt, } from '@agenticprimitives/verification-receipts';
+export const PACKAGE_NAME = '@agenticprimitives/witness';
+export const PACKAGE_STATUS = 'w1-evaluate-attest';
+export const SPEC_REF = 'specs/307-witness.md';
+const enc = new TextEncoder();
+/** Deterministic JSON (sorted keys, undefined dropped) — the repo canonical form. */
+export function canonicalize(v) {
+    if (v === null || typeof v !== 'object')
+        return JSON.stringify(v) ?? 'null';
+    if (Array.isArray(v))
+        return `[${v.map(canonicalize).join(',')}]`;
+    const o = v;
+    return `{${Object.keys(o)
+        .sort()
+        .filter((k) => o[k] !== undefined)
+        .map((k) => `${JSON.stringify(k)}:${canonicalize(o[k])}`)
+        .join(',')}}`;
+}
+async function sha256Hex(input) {
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', enc.encode(input));
+    const hex = Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+    return `sha256:${hex}`;
+}
+/**
+ * The deterministic walk (spec 307 §design). Total + ordered — two witnesses
+ * given identical inputs MUST produce the identical outcome (INV-307-1):
+ * evidence integrity → record membership → revocation timeline → scope.
+ * Every unverifiable input maps to `insufficient_evidence` (INV-307-2).
+ */
+export async function evaluateDispute(input) {
+    // 1. The record chain must verify end-to-end.
+    const chain = verifyRecordChain(input.record);
+    if (!chain.valid || !chain.head)
+        return { outcome: 'insufficient_evidence', evidenceReason: 'record_invalid' };
+    // 2. The receipt must verify (hash + proof when a verifier is supplied).
+    const receiptOk = await verifyVerificationReceipt(input.receipt, {
+        ...(input.verifyReceiptSignature ? { verifySignature: input.verifyReceiptSignature, requireProof: true } : {}),
+    });
+    if (!receiptOk.valid)
+        return { outcome: 'insufficient_evidence', evidenceReason: 'receipt_invalid', recordHead: chain.head };
+    // 3. The receipt must BE an entry of this record.
+    const entry = input.record.find((e) => e.kind === 'verification_receipt' && e.artifactCommitment === input.receipt.receiptHash);
+    if (!entry)
+        return { outcome: 'insufficient_evidence', evidenceReason: 'receipt_not_in_record', recordHead: chain.head };
+    // 4. A supplied detail must open the receipt — a lying detail is not evidence.
+    if (input.detail) {
+        const opened = await openReceipt(input.receipt, input.detail);
+        if (!opened.valid)
+            return { outcome: 'insufficient_evidence', evidenceReason: 'detail_mismatch', recordHead: chain.head, receiptSeq: entry.seq };
+    }
+    // 5. Revocation timeline: the earliest revocation_assertion BEFORE the
+    //    receipt's entry decides between the two revocation outcomes.
+    const priorRevocation = input.record.some((e) => e.kind === 'revocation_assertion' && e.seq < entry.seq);
+    if (priorRevocation) {
+        const outcome = input.receipt.decision === 'deny' ? 'revoked_before_execution' : 'stale_status_used';
+        return { outcome, evidenceReason: 'ok', recordHead: chain.head, receiptSeq: entry.seq };
+    }
+    // A receipt that itself recorded 'revoked' yet ALLOWED is the stale-status
+    // contradiction even without a record entry.
+    if (input.receipt.status.revocation === 'revoked' && input.receipt.decision === 'allow')
+        return { outcome: 'stale_status_used', evidenceReason: 'ok', recordHead: chain.head, receiptSeq: entry.seq };
+    // 6. Scope: the receipt's own attested verdict.
+    const outcome = input.receipt.scopeDecision === 'in_scope' ? 'in_scope' : 'out_of_scope';
+    return { outcome, evidenceReason: 'ok', recordHead: chain.head, receiptSeq: entry.seq };
+}
+/** Assemble + hash (+ optionally sign) the attestation over a completed walk. */
+export async function mintWitnessAttestation(input, opts) {
+    if (!input.evaluation.recordHead && input.evaluation.evidenceReason !== 'record_invalid') {
+        throw new Error('mintWitnessAttestation: evaluation carries no recordHead');
+    }
+    const body = {
+        type: 'WitnessAttestationV1',
+        witness: input.witness,
+        relationshipId: input.relationshipId,
+        recordHead: input.evaluation.recordHead ?? `0x${'0'.repeat(64)}`,
+        receiptHash: input.receipt.receiptHash,
+        outcome: input.evaluation.outcome,
+        checkedDetail: input.checkedDetail,
+        attestedAt: input.attestedAt,
+    };
+    const attestationHash = await sha256Hex(canonicalize(body));
+    const attestation = { ...body, attestationHash };
+    if (opts?.sign)
+        attestation.proof = await opts.sign(attestationHash);
+    return attestation;
+}
+/** Standalone attestation check (hash recompute + injected proof port). */
+export async function verifyWitnessAttestation(attestation, opts) {
+    if (attestation.type !== 'WitnessAttestationV1')
+        return { valid: false, reason: 'wrong_type' };
+    const { attestationHash, proof, ...body } = attestation;
+    if ((await sha256Hex(canonicalize(body))) !== attestationHash)
+        return { valid: false, reason: 'hash_mismatch' };
+    if (opts?.requireProof || opts?.verifySignature) {
+        if (!proof)
+            return { valid: false, reason: 'proof_missing' };
+        if (opts.verifySignature && !(await opts.verifySignature(attestationHash, proof)))
+            return { valid: false, reason: 'proof_invalid' };
+    }
+    return { valid: true, reason: 'ok' };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,6DAA6D;AAE7D,OAAO,EACL,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,WAAW,EACX,yBAAyB,GAK1B,MAAM,0CAA0C,CAAC;AAElD,MAAM,CAAC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAmD/C,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACtB,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAA2B,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,8CAA8C;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;IAE/G,yEAAyE;IACzE,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE;QAC/D,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,sBAAsB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/G,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,KAAK;QAClB,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAEzG,kDAAkD;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,kBAAkB,KAAM,KAAK,CAAC,OAAO,CAAC,WAA8B,CACnH,CAAC;IACF,IAAI,CAAC,KAAK;QACR,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,uBAAuB,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAE/G,+EAA+E;IAC/E,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,KAAK;YACf,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAClI,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzG,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1F,CAAC;IACD,2EAA2E;IAC3E,6CAA6C;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;QACrF,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAE/G,gDAAgD;IAChD,MAAM,OAAO,GAAmB,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;IACzG,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AAC1F,CAAC;AAWD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkC,EAClC,IAAoE;IAEpE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,KAAK,gBAAgB,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAA4D;QACpE,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,IAAK,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAU;QACzE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAyB,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC;IACvE,IAAI,IAAI,EAAE,IAAI;QAAE,WAAW,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrE,OAAO,WAAW,CAAC;AACrB,CAAC;AAID,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAiC,EACjC,IAGC;IAED,IAAI,WAAW,CAAC,IAAI,KAAK,sBAAsB;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC/F,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,WAAW,CAAC;IACxD,IAAI,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChH,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@agenticprimitives/witness",
+  "version": "0.0.0-alpha.1",
+  "description": "Evidentiary dispute attestation (spec 307 / G-11): deterministically walk a relationship record + verification receipt and attest in_scope / out_of_scope / revoked_before_execution / stale_status_used / insufficient_evidence. Facts, never remedies.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
+    "directory": "packages/witness"
+  },
+  "homepage": "https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/witness",
+  "bugs": {
+    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "LICENSE",
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.8",
+    "@types/node": "^22.7.0"
+  },
+  "keywords": [
+    "agentic",
+    "primitives",
+    "witness",
+    "dispute",
+    "evidence",
+    "attestation"
+  ],
+  "dependencies": {
+    "@agenticprimitives/agreements": "0.0.0-alpha.14",
+    "@agenticprimitives/verification-receipts": "0.0.0-alpha.1"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:unit": "vitest run test/unit --passWithNoTests",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  }
+}