@agentplat/mesh-protocol 0.3.0-alpha.2 → 0.3.0-alpha.4

package/dist/validation.js

@@ -1,4 +1,5 @@
 import { canonicalizeJsonValue } from './canonical-json.js';
+import { normalizeMeshEvidenceAttestationV1, normalizeMeshEvidenceChallengeV1, normalizeMeshEvidenceClaimV1, normalizeMeshEvidenceRetractionV1, normalizeMeshTrustObservationV1, } from '@agentplat/trust/mesh-records';
 import { DEFAULT_MESH_PROTOCOL_LIMITS, MESH_AUDIENCE_TOPICS, MESH_MESSAGE_TYPES, MESH_PROTOCOL, MESH_SIGNATURE_ALGORITHM, MESH_WIRE_VERSION, } from './contracts.js';
 import { parseStrictJsonDocument, } from './strict-json.js';
 const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9._:@-]*$/;
@@ -42,6 +43,13 @@ const maximumCapacityReservationUnits = 1_000_000;
 const maximumWorkBidWindowMs = 60 * 60 * 1_000;
 const maximumWorkDeadlineMs = 30 * 24 * 60 * 60 * 1_000;
 const maximumWorkExecutionLifetimeMs = 5 * 60 * 1_000;
+const maximumEvidenceLifetimeMs = 5 * 60 * 1_000;
+const maximumEvidenceReferences = 32;
+const maximumEvidenceReferenceBytes = 4_096;
+const maximumEvidenceContentBytes = 4_096;
+const maximumEvidenceIdentifierBytes = 256;
+const maximumEvidenceReasonCodes = 32;
+const trustDigestPattern = /^[0-9a-f]{64}$/;
 const knownMessageTypes = new Set(MESH_MESSAGE_TYPES);
 const knownTopics = new Set(MESH_AUDIENCE_TOPICS);
 const utf8Encoder = new TextEncoder();
@@ -288,6 +296,7 @@ function validateEnvelope(input, limits) {
         fail('type_payload_mismatch', '$["payload"]["type"]');
     }
     validateMessageSpecificEnvelope(type, sender, audience, objectiveId, causationId, payload, sentAt, expiresAt);
+    validateEvidenceTrustBinding(tenantId, meshId, objectiveId, sender, causationId, payload);
     return {
         protocol: MESH_PROTOCOL,
         wireVersion: MESH_WIRE_VERSION,
@@ -573,8 +582,367 @@ function validatePayload(type, input, limits) {
     if (type === 'lease.certificate') {
         return validateLeaseCertificate(input, limits);
     }
+    if (type === 'evidence.claim') {
+        return validateEvidenceClaim(input, limits);
+    }
+    if (type === 'evidence.attest') {
+        return validateEvidenceAttestation(input, limits);
+    }
+    if (type === 'evidence.challenge') {
+        return validateEvidenceChallenge(input, limits);
+    }
+    if (type === 'evidence.retract') {
+        return validateEvidenceRetraction(input, limits);
+    }
+    if (type === 'trust.observation') {
+        return validateTrustObservation(input, limits);
+    }
     return fail('unsupported_message_type', '$["type"]');
 }
+function validateEvidenceClaim(input, limits) {
+    const payload = assertClosedRecord(input, [
+        'assertionDigest',
+        'basisReferences',
+        'claimId',
+        'content',
+        'criterionId',
+        'observedAt',
+        'outcome',
+        'scope',
+        'subject',
+        'type',
+    ], [], '$["payload"]', 'invalid_payload');
+    const content = validateEvidenceContent(payload.content, '$["payload"]["content"]', limits);
+    return {
+        type: assertPayloadType(payload.type, 'evidence.claim'),
+        claimId: assertTrustRecordId(payload.claimId, 'claim', '$["payload"]["claimId"]'),
+        subject: validateEvidenceSubject(payload.subject, '$["payload"]["subject"]', limits),
+        scope: validateEvidenceScope(payload.scope, '$["payload"]["scope"]', limits),
+        criterionId: assertBoundedString(payload.criterionId, '$["payload"]["criterionId"]', maximumDomainStringBytes),
+        outcome: assertEnum(payload.outcome, ['satisfied', 'violated', 'inconclusive'], '$["payload"]["outcome"]'),
+        assertionDigest: assertTrustDigest(payload.assertionDigest, '$["payload"]["assertionDigest"]'),
+        content,
+        basisReferences: validateEvidenceReferences(payload.basisReferences, '$["payload"]["basisReferences"]', limits, { allowControlRecords: false, minimum: 0 }),
+        observedAt: validateOptionalEvidenceTimestamp(payload.observedAt, '$["payload"]["observedAt"]'),
+    };
+}
+function validateEvidenceAttestation(input, limits) {
+    const payload = assertClosedRecord(input, [
+        'attestationId',
+        'basisReferences',
+        'claimDigest',
+        'claimId',
+        'confidenceBasisPoints',
+        'disposition',
+        'observedAt',
+        'scope',
+        'type',
+    ], [], '$["payload"]', 'invalid_payload');
+    return {
+        type: assertPayloadType(payload.type, 'evidence.attest'),
+        attestationId: assertTrustRecordId(payload.attestationId, 'attestation', '$["payload"]["attestationId"]'),
+        scope: validateEvidenceScope(payload.scope, '$["payload"]["scope"]', limits),
+        claimId: assertTrustRecordId(payload.claimId, 'claim', '$["payload"]["claimId"]'),
+        claimDigest: assertTrustDigest(payload.claimDigest, '$["payload"]["claimDigest"]'),
+        disposition: assertEnum(payload.disposition, ['support', 'contradict', 'inconclusive'], '$["payload"]["disposition"]'),
+        confidenceBasisPoints: assertBoundedSafeInteger(payload.confidenceBasisPoints, '$["payload"]["confidenceBasisPoints"]', 0, 10_000),
+        basisReferences: validateEvidenceReferences(payload.basisReferences, '$["payload"]["basisReferences"]', limits, { allowControlRecords: false, minimum: 0 }),
+        observedAt: validateOptionalEvidenceTimestamp(payload.observedAt, '$["payload"]["observedAt"]'),
+    };
+}
+function validateEvidenceChallenge(input, limits) {
+    const payload = assertClosedRecord(input, [
+        'basisReferences',
+        'challengeId',
+        'observedAt',
+        'reasonCode',
+        'scope',
+        'targetDigest',
+        'targetId',
+        'targetKind',
+        'type',
+    ], [], '$["payload"]', 'invalid_payload');
+    const targetKind = assertEnum(payload.targetKind, ['claim', 'attestation'], '$["payload"]["targetKind"]');
+    return {
+        type: assertPayloadType(payload.type, 'evidence.challenge'),
+        challengeId: assertTrustRecordId(payload.challengeId, 'challenge', '$["payload"]["challengeId"]'),
+        scope: validateEvidenceScope(payload.scope, '$["payload"]["scope"]', limits),
+        targetKind,
+        targetId: assertTrustRecordId(payload.targetId, targetKind, '$["payload"]["targetId"]'),
+        targetDigest: assertTrustDigest(payload.targetDigest, '$["payload"]["targetDigest"]'),
+        reasonCode: assertBoundedString(payload.reasonCode, '$["payload"]["reasonCode"]', maximumDomainStringBytes),
+        basisReferences: validateEvidenceReferences(payload.basisReferences, '$["payload"]["basisReferences"]', limits, { allowControlRecords: false, minimum: 1 }),
+        observedAt: validateOptionalEvidenceTimestamp(payload.observedAt, '$["payload"]["observedAt"]'),
+    };
+}
+function validateEvidenceRetraction(input, limits) {
+    const payload = assertClosedRecord(input, [
+        'observedAt',
+        'reasonCode',
+        'retractionId',
+        'scope',
+        'targetDigest',
+        'targetId',
+        'targetKind',
+        'type',
+    ], [], '$["payload"]', 'invalid_payload');
+    const targetKind = assertEnum(payload.targetKind, ['claim', 'attestation'], '$["payload"]["targetKind"]');
+    return {
+        type: assertPayloadType(payload.type, 'evidence.retract'),
+        retractionId: assertTrustRecordId(payload.retractionId, 'retraction', '$["payload"]["retractionId"]'),
+        scope: validateEvidenceScope(payload.scope, '$["payload"]["scope"]', limits),
+        targetKind,
+        targetId: assertTrustRecordId(payload.targetId, targetKind, '$["payload"]["targetId"]'),
+        targetDigest: assertTrustDigest(payload.targetDigest, '$["payload"]["targetDigest"]'),
+        reasonCode: assertBoundedString(payload.reasonCode, '$["payload"]["reasonCode"]', maximumDomainStringBytes),
+        observedAt: validateOptionalEvidenceTimestamp(payload.observedAt, '$["payload"]["observedAt"]'),
+    };
+}
+function validateTrustObservation(input, limits) {
+    const payload = assertClosedRecord(input, [
+        'dimensionId',
+        'disposition',
+        'evidenceIds',
+        'fusionDecisionDigest',
+        'observationId',
+        'observedAt',
+        'policyDigest',
+        'policyId',
+        'policyVersion',
+        'profileDigest',
+        'reasonCodes',
+        'scope',
+        'scoreBand',
+        'subject',
+        'type',
+        'uncertaintyBand',
+        'validUntil',
+    ], [], '$["payload"]', 'invalid_payload');
+    const observedAt = assertRfc3339PayloadTimestamp(payload.observedAt, '$["payload"]["observedAt"]');
+    const validUntil = assertRfc3339PayloadTimestamp(payload.validUntil, '$["payload"]["validUntil"]');
+    if (validUntil.instant <= observedAt.instant ||
+        validUntil.instant - observedAt.instant > 24n * 60n * 60n * 1000000000n) {
+        fail('invalid_payload', '$["payload"]["validUntil"]');
+    }
+    return {
+        type: assertPayloadType(payload.type, 'trust.observation'),
+        observationId: assertTrustRecordId(payload.observationId, 'observation', '$["payload"]["observationId"]'),
+        subject: validateEvidenceSubject(payload.subject, '$["payload"]["subject"]', limits),
+        scope: validateEvidenceScope(payload.scope, '$["payload"]["scope"]', limits),
+        policyId: assertBoundedString(payload.policyId, '$["payload"]["policyId"]', maximumDomainStringBytes),
+        policyVersion: assertPositiveSafeInteger(payload.policyVersion, '$["payload"]["policyVersion"]', 'invalid_payload'),
+        policyDigest: assertTrustDigest(payload.policyDigest, '$["payload"]["policyDigest"]'),
+        profileDigest: assertTrustDigest(payload.profileDigest, '$["payload"]["profileDigest"]'),
+        fusionDecisionDigest: assertTrustDigest(payload.fusionDecisionDigest, '$["payload"]["fusionDecisionDigest"]'),
+        dimensionId: assertBoundedString(payload.dimensionId, '$["payload"]["dimensionId"]', maximumDomainStringBytes),
+        scoreBand: assertEnum(payload.scoreBand, ['unknown', 'low', 'medium', 'high'], '$["payload"]["scoreBand"]'),
+        uncertaintyBand: assertEnum(payload.uncertaintyBand, ['low', 'medium', 'high'], '$["payload"]["uncertaintyBand"]'),
+        disposition: assertEnum(payload.disposition, ['eligible', 'restricted', 'quarantined', 'unavailable'], '$["payload"]["disposition"]'),
+        evidenceIds: validateTrustRecordIdArray(payload.evidenceIds, '$["payload"]["evidenceIds"]'),
+        observedAt: observedAt.text,
+        validUntil: validUntil.text,
+        reasonCodes: validateBoundedStringArray(payload.reasonCodes, '$["payload"]["reasonCodes"]', maximumEvidenceReasonCodes, maximumDomainStringBytes, undefined, true),
+    };
+}
+function validateEvidenceSubject(input, path, limits) {
+    const subject = assertRecord(input, path, 'invalid_payload');
+    if (subject.kind === 'peer') {
+        assertExactKeys(subject, ['kind', 'peerId'], path, 'invalid_payload');
+        return {
+            kind: 'peer',
+            peerId: assertIdentifier(subject.peerId, `${path}["peerId"]`, limits),
+        };
+    }
+    if (subject.kind === 'peer_capability') {
+        assertExactKeys(subject, [
+            'capabilityKey',
+            'capabilityRevision',
+            'capabilityVersion',
+            'kind',
+            'peerId',
+        ], path, 'invalid_payload');
+        return {
+            kind: 'peer_capability',
+            peerId: assertIdentifier(subject.peerId, `${path}["peerId"]`, limits),
+            capabilityKey: assertBoundedString(subject.capabilityKey, `${path}["capabilityKey"]`, maximumDomainStringBytes),
+            capabilityVersion: assertBoundedString(subject.capabilityVersion, `${path}["capabilityVersion"]`, maximumVersionBytes),
+            capabilityRevision: assertPositiveSafeInteger(subject.capabilityRevision, `${path}["capabilityRevision"]`, 'invalid_payload'),
+        };
+    }
+    return fail('invalid_payload', `${path}["kind"]`);
+}
+function validateEvidenceScope(input, path, limits) {
+    const scope = assertRecord(input, path, 'invalid_payload');
+    if (scope.kind === 'mesh') {
+        assertExactKeys(scope, ['kind'], path, 'invalid_payload');
+        return { kind: 'mesh' };
+    }
+    if (scope.kind === 'objective') {
+        assertExactKeys(scope, ['kind', 'objectiveRevision'], path, 'invalid_payload');
+        return {
+            kind: 'objective',
+            objectiveRevision: assertPositiveSafeInteger(scope.objectiveRevision, `${path}["objectiveRevision"]`, 'invalid_payload'),
+        };
+    }
+    if (scope.kind === 'work') {
+        assertExactKeys(scope, [
+            'assignmentAuthorityId',
+            'assignmentEpoch',
+            'fencingToken',
+            'kind',
+            'objectiveRevision',
+            'workItemId',
+            'workItemRevision',
+        ], path, 'invalid_payload');
+        const assignmentAuthorityId = assertIdentifier(scope.assignmentAuthorityId, `${path}["assignmentAuthorityId"]`, limits);
+        const fencingToken = assertIdentifier(scope.fencingToken, `${path}["fencingToken"]`, limits);
+        return {
+            kind: 'work',
+            objectiveRevision: assertPositiveSafeInteger(scope.objectiveRevision, `${path}["objectiveRevision"]`, 'invalid_payload'),
+            workItemId: assertIdentifier(scope.workItemId, `${path}["workItemId"]`, limits),
+            workItemRevision: assertPositiveSafeInteger(scope.workItemRevision, `${path}["workItemRevision"]`, 'invalid_payload'),
+            assignmentEpoch: assertPositiveSafeInteger(scope.assignmentEpoch, `${path}["assignmentEpoch"]`, 'invalid_payload'),
+            assignmentAuthorityId,
+            fencingToken,
+        };
+    }
+    return fail('invalid_payload', `${path}["kind"]`);
+}
+function validateEvidenceReferences(input, path, limits, { allowControlRecords, minimum, }) {
+    if (!Array.isArray(input) ||
+        input.length < minimum ||
+        input.length > maximumEvidenceReferences) {
+        fail('invalid_payload', path);
+    }
+    const references = input.map((item, index) => validateEvidenceReference(item, `${path}[${index}]`, limits, allowControlRecords));
+    let previous = '';
+    for (const reference of references) {
+        const order = JSON.stringify([
+            reference.kind,
+            reference.referenceType,
+            reference.referenceId,
+            reference.referenceDigest,
+        ]);
+        if (order <= previous)
+            fail('invalid_payload', path);
+        previous = order;
+    }
+    return Object.freeze(references);
+}
+function validateEvidenceReference(input, path, limits, allowControlRecords) {
+    const reference = assertClosedRecord(input, [
+        'kind',
+        'referenceDigest',
+        'referenceId',
+        'referenceType',
+        'schemaVersion',
+    ], [], path, 'invalid_payload');
+    if (reference.schemaVersion !== 1)
+        fail('invalid_payload', `${path}["schemaVersion"]`);
+    const kind = assertEnum(reference.kind, ['evidence', 'mesh_record', 'control_record', 'external'], `${path}["kind"]`);
+    if (!allowControlRecords && kind === 'control_record') {
+        fail('invalid_payload', `${path}["kind"]`);
+    }
+    const referenceDigest = assertEvidenceReferenceDigest(kind, reference.referenceDigest, `${path}["referenceDigest"]`);
+    return {
+        schemaVersion: 1,
+        kind,
+        referenceType: assertBoundedString(reference.referenceType, `${path}["referenceType"]`, maximumEvidenceReferenceBytes),
+        referenceId: assertBoundedString(reference.referenceId, `${path}["referenceId"]`, maximumEvidenceReferenceBytes),
+        referenceDigest,
+    };
+}
+function validateEvidenceContent(input, path, limits) {
+    if (input === null)
+        return null;
+    const content = assertRecord(input, path, 'invalid_payload');
+    if (content.kind === 'inline_summary') {
+        assertExactKeys(content, ['contentDigest', 'encodedBytes', 'kind', 'mediaType', 'summary'], path, 'invalid_payload');
+        const summary = assertBoundedString(content.summary, `${path}["summary"]`, maximumEvidenceContentBytes);
+        const encodedBytes = assertBoundedSafeInteger(content.encodedBytes, `${path}["encodedBytes"]`, 0, maximumEvidenceContentBytes);
+        if (utf8Encoder.encode(summary).byteLength !== encodedBytes) {
+            fail('invalid_payload', `${path}["encodedBytes"]`);
+        }
+        return {
+            kind: 'inline_summary',
+            mediaType: assertBoundedString(content.mediaType, `${path}["mediaType"]`, maximumMediaTypeBytes),
+            summary,
+            contentDigest: assertTrustDigest(content.contentDigest, `${path}["contentDigest"]`),
+            encodedBytes,
+        };
+    }
+    if (content.kind === 'reference') {
+        assertExactKeys(content, ['contentDigest', 'encodedBytes', 'kind', 'mediaType', 'reference'], path, 'invalid_payload');
+        const reference = validateEvidenceReference(content.reference, `${path}["reference"]`, limits, false);
+        if (reference.kind !== 'mesh_record' && reference.kind !== 'external') {
+            fail('invalid_payload', `${path}["reference"]["kind"]`);
+        }
+        return {
+            kind: 'reference',
+            mediaType: assertBoundedString(content.mediaType, `${path}["mediaType"]`, maximumMediaTypeBytes),
+            reference,
+            contentDigest: assertTrustDigest(content.contentDigest, `${path}["contentDigest"]`),
+            encodedBytes: assertBoundedSafeInteger(content.encodedBytes, `${path}["encodedBytes"]`, 0, maximumEvidenceContentBytes),
+        };
+    }
+    return fail('invalid_payload', `${path}["kind"]`);
+}
+function validateTrustRecordIdArray(input, path) {
+    if (!Array.isArray(input) || input.length > maximumEvidenceReferences) {
+        fail('invalid_payload', path);
+    }
+    const ids = input.map((value, index) => assertBoundedString(value, `${path}[${index}]`, maximumEvidenceIdentifierBytes));
+    let previous = '';
+    for (const id of ids) {
+        if (id <= previous)
+            fail('invalid_payload', path);
+        previous = id;
+    }
+    return Object.freeze(ids);
+}
+function validateOptionalEvidenceTimestamp(input, path) {
+    if (input === null)
+        return null;
+    return assertRfc3339PayloadTimestamp(input, path).text;
+}
+function assertTrustRecordId(input, prefix, path) {
+    const value = assertBoundedString(input, path, maximumEvidenceIdentifierBytes);
+    if (!new RegExp(`^${prefix}:[0-9a-f]{64}$`).test(value)) {
+        fail('invalid_payload', path);
+    }
+    return value;
+}
+function assertTrustDigest(input, path) {
+    const value = assertString(input, path, 'invalid_payload');
+    if (!trustDigestPattern.test(value))
+        fail('invalid_payload', path);
+    return value;
+}
+function assertEvidenceReferenceDigest(kind, input, path) {
+    if (kind === 'mesh_record')
+        return assertPayloadHash(input, path);
+    if (kind === 'control_record') {
+        const value = assertString(input, path, 'invalid_payload');
+        if (!/^sha256:[0-9a-f]{64}$/.test(value))
+            fail('invalid_payload', path);
+        return value;
+    }
+    return assertTrustDigest(input, path);
+}
+function assertBoundedSafeInteger(input, path, minimum, maximum) {
+    if (!Number.isSafeInteger(input) ||
+        input < minimum ||
+        input > maximum) {
+        fail('invalid_payload', path);
+    }
+    return input;
+}
+function assertEnum(input, values, path) {
+    if (typeof input !== 'string' || !values.includes(input)) {
+        fail('invalid_payload', path);
+    }
+    return input;
+}
 function validateWorkOffer(input, limits) {
     const payload = assertClosedRecord(input, [
         'bidDeadline',
@@ -1578,6 +1946,19 @@ function validateMessageSpecificEnvelope(type, sender, audience, objectiveId, ca
             fail('invalid_audience', '$["audience"]["peerId"]');
         }
     }
+    else if (type === 'evidence.claim' ||
+        type === 'evidence.attest' ||
+        type === 'evidence.challenge' ||
+        type === 'evidence.retract') {
+        if (audience.kind === 'mesh' && audience.topic !== 'evidence') {
+            fail('invalid_audience', '$["audience"]["topic"]');
+        }
+    }
+    else if (type === 'trust.observation') {
+        if (audience.kind !== 'peer') {
+            fail('invalid_audience', '$["audience"]');
+        }
+    }
     else if (type === 'work.award' ||
         type === 'work.accept' ||
         type === 'work.decline' ||
@@ -1658,6 +2039,30 @@ function validateMessageSpecificEnvelope(type, sender, audience, objectiveId, ca
         causationId === undefined) {
         fail('invalid_payload', '$["causationId"]');
     }
+    if (type === 'evidence.claim' ||
+        type === 'evidence.attest' ||
+        type === 'evidence.challenge' ||
+        type === 'evidence.retract') {
+        const evidencePayload = payload;
+        if (evidencePayload.scope.kind === 'mesh') {
+            if (objectiveId !== undefined) {
+                fail('invalid_payload', '$["objectiveId"]');
+            }
+        }
+        else if (objectiveId === undefined) {
+            fail('invalid_payload', '$["objectiveId"]');
+        }
+        const references = evidencePayload.type === 'evidence.claim' ||
+            evidencePayload.type === 'evidence.attest' ||
+            evidencePayload.type === 'evidence.challenge'
+            ? evidencePayload.basisReferences
+            : [];
+        if ((evidencePayload.scope.kind === 'work' ||
+            references.some((reference) => reference.kind === 'mesh_record')) &&
+            causationId === undefined) {
+            fail('invalid_payload', '$["causationId"]');
+        }
+    }
     if (type === 'objective.announce' ||
         type === 'objective.revise' ||
         type === 'objective.cancel' ||
@@ -1705,6 +2110,117 @@ function validateMessageSpecificEnvelope(type, sender, audience, objectiveId, ca
         validateWorkExecutionTimes(payload, sentAt, expiresAt);
     }
 }
+/**
+ * The shared Trust normalizer owns every content-bound Evidence digest. Mesh
+ * only supplies the signed envelope material, then compares the projected ID
+ * (and Claim assertion digest) with the closed wire payload.
+ */
+function validateEvidenceTrustBinding(tenantId, meshId, objectiveId, sender, causationId, payload) {
+    if (payload.type !== 'evidence.claim' &&
+        payload.type !== 'evidence.attest' &&
+        payload.type !== 'evidence.challenge' &&
+        payload.type !== 'evidence.retract' &&
+        payload.type !== 'trust.observation') {
+        return;
+    }
+    const envelope = {
+        schemaVersion: 1,
+        tenantId,
+        meshId,
+        objectiveId: objectiveId ?? null,
+        senderPeerId: sender.peerId,
+        causationId: causationId ?? null,
+    };
+    try {
+        if (payload.type === 'evidence.claim') {
+            const normalized = normalizeMeshEvidenceClaimV1(envelope, {
+                subject: payload.subject,
+                scope: payload.scope,
+                criterionId: payload.criterionId,
+                outcome: payload.outcome,
+                content: payload.content,
+                basisReferences: payload.basisReferences,
+                observedAt: payload.observedAt,
+            });
+            if (normalized.claimId !== payload.claimId) {
+                fail('invalid_payload', '$["payload"]["claimId"]');
+            }
+            if (normalized.assertionDigest !== payload.assertionDigest) {
+                fail('invalid_payload', '$["payload"]["assertionDigest"]');
+            }
+            return;
+        }
+        if (payload.type === 'evidence.attest') {
+            const normalized = normalizeMeshEvidenceAttestationV1(envelope, {
+                scope: payload.scope,
+                claimId: payload.claimId,
+                claimDigest: payload.claimDigest,
+                disposition: payload.disposition,
+                confidenceBasisPoints: payload.confidenceBasisPoints,
+                basisReferences: payload.basisReferences,
+                observedAt: payload.observedAt,
+            });
+            if (normalized.attestationId !== payload.attestationId) {
+                fail('invalid_payload', '$["payload"]["attestationId"]');
+            }
+            return;
+        }
+        if (payload.type === 'evidence.challenge') {
+            const normalized = normalizeMeshEvidenceChallengeV1(envelope, {
+                scope: payload.scope,
+                targetKind: payload.targetKind,
+                targetId: payload.targetId,
+                targetDigest: payload.targetDigest,
+                reasonCode: payload.reasonCode,
+                basisReferences: payload.basisReferences,
+                observedAt: payload.observedAt,
+            });
+            if (normalized.challengeId !== payload.challengeId) {
+                fail('invalid_payload', '$["payload"]["challengeId"]');
+            }
+            return;
+        }
+        if (payload.type === 'trust.observation') {
+            const normalized = normalizeMeshTrustObservationV1(envelope, {
+                subject: payload.subject,
+                scope: payload.scope,
+                policyId: payload.policyId,
+                policyVersion: payload.policyVersion,
+                policyDigest: payload.policyDigest,
+                profileDigest: payload.profileDigest,
+                fusionDecisionDigest: payload.fusionDecisionDigest,
+                dimensionId: payload.dimensionId,
+                scoreBand: payload.scoreBand,
+                uncertaintyBand: payload.uncertaintyBand,
+                disposition: payload.disposition,
+                evidenceIds: payload.evidenceIds,
+                observedAt: payload.observedAt,
+                validUntil: payload.validUntil,
+                reasonCodes: payload.reasonCodes,
+            });
+            if (normalized.observationId !== payload.observationId) {
+                fail('invalid_payload', '$["payload"]["observationId"]');
+            }
+            return;
+        }
+        const normalized = normalizeMeshEvidenceRetractionV1(envelope, {
+            scope: payload.scope,
+            targetKind: payload.targetKind,
+            targetId: payload.targetId,
+            targetDigest: payload.targetDigest,
+            reasonCode: payload.reasonCode,
+            observedAt: payload.observedAt,
+        });
+        if (normalized.retractionId !== payload.retractionId) {
+            fail('invalid_payload', '$["payload"]["retractionId"]');
+        }
+    }
+    catch (error) {
+        if (error instanceof ValidationFailure)
+            throw error;
+        fail('invalid_payload', '$["payload"]');
+    }
+}
 function validateWorkOfferTimes(payload, sentAt, expiresAt) {
     const bidDeadline = parseRfc3339(payload.bidDeadline, '$["payload"]["bidDeadline"]');
     const workDeadline = parseRfc3339(payload.workDeadline, '$["payload"]["workDeadline"]');
@@ -1973,20 +2489,26 @@ function validateLifetime(type, sentAt, expiresAt, limits) {
     }
     const messageMaximum = type === 'peer.ping' || type === 'peer.ping_ack'
         ? 30_000
-        : type === 'peer.goodbye' ||
-            type === 'lease.takeover_proposal' ||
-            type === 'lease.vote' ||
-            type === 'lease.certificate'
-            ? 60_000
-            : type === 'objective.announce' || type === 'objective.revise'
-                ? 5 * 60_000
-                : type === 'work.progress' ||
-                    type === 'work.checkpoint' ||
-                    type === 'work.result'
-                    ? maximumWorkExecutionLifetimeMs
-                    : type === 'lease.renew'
-                        ? 30_000
-                        : 120_000;
+        : type === 'evidence.claim' ||
+            type === 'evidence.attest' ||
+            type === 'evidence.challenge' ||
+            type === 'evidence.retract' ||
+            type === 'trust.observation'
+            ? maximumEvidenceLifetimeMs
+            : type === 'peer.goodbye' ||
+                type === 'lease.takeover_proposal' ||
+                type === 'lease.vote' ||
+                type === 'lease.certificate'
+                ? 60_000
+                : type === 'objective.announce' || type === 'objective.revise'
+                    ? 5 * 60_000
+                    : type === 'work.progress' ||
+                        type === 'work.checkpoint' ||
+                        type === 'work.result'
+                        ? maximumWorkExecutionLifetimeMs
+                        : type === 'lease.renew'
+                            ? 30_000
+                            : 120_000;
     const maximum = Math.min(limits.maximumLifetimeMs, messageMaximum);
     if (expiresAt - sentAt > BigInt(maximum) * 1000000n) {
         fail('invalid_lifetime', '$["expiresAt"]');
@@ -2174,7 +2696,12 @@ function isImplementedMessageType(value) {
         value === 'lease.renew' ||
         value === 'lease.takeover_proposal' ||
         value === 'lease.vote' ||
-        value === 'lease.certificate');
+        value === 'lease.certificate' ||
+        value === 'evidence.claim' ||
+        value === 'evidence.attest' ||
+        value === 'evidence.challenge' ||
+        value === 'evidence.retract' ||
+        value === 'trust.observation');
 }
 function canonicalizeMeshJsonInternal(input, options) {
     const limits = resolveLimits(options.limits);