@atlasauth/pca-verified-core 0.0.0-stage → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,27 @@
-# Temporary Holding Version
+# @atlasauth/pca-verified-core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The **decision logic** of the Proof-Carrying Authority (PCA) verifier, written in [Dafny](https://dafny.org), machine-proved
+for all inputs (no bounds on chain length, share count or operation sequence), and compiled to JavaScript.
+
+It does not do cryptography. You (the glue) evaluate signatures, hashes and parsing with your primitives and hand the
+**results** (booleans, small enums, integers, opaque messages, lazy pure closures) to this package, which decides:
+
+| area | function | proved (see `docs/pca/security/verified-core.md`) |
+|---|---|---|
+| capability chain | `decideChain` | order + first failure, depth bound (16), append-only caveats (attenuation), soundness + completeness |
+| threshold | `decideThreshold` | one key per role / one role per key, count of **distinct** roles, `ok` iff count >= t, t in {1,2,3} |
+| replay guard | `replayPre`, `replayNonceStage`, `replayDecide`, `VerifiedReplayStoreModel` | deny order, accept implies every precondition and store answer, nonce replay freedom, strictly increasing counters |
+| check fold | `CoreState`, `VerdictState`, `enforceRequired`, `withDeniedFallback` | allow iff no check failed, first reason wins, reasons append-only, required checks all `pass` |
+| per-check rules | `audienceStatus`, `validityDecision`, `grantRefBoundStatus`, `counterStatus`, `suitePolicy`, `pqBinding`, `leafDecision`, `thresholdRule`, `reversibilityDecision`, ... | audience fail-closed, expiry/skew window, suite policy, F-2 PQ binding, F-1 hook-enforced t |
+
+```ts
+import { decideChain, decideThreshold, CoreState, validityDecision } from '@atlasauth/pca-verified-core';
+
+validityDecision(true, iat, exp, now); // 'pass' | 'expired' | 'future' | ...
+```
+
+No Dafny runtime type appears in the API. The generated JavaScript is committed in `generated/pca_core.js`; regenerate and
+re-verify with `formal/dafny/build.sh`, and check that the committed file is byte-identical to a fresh compile with
+`formal/dafny/build.sh --check` (script `check:generated`). Requires Dafny 4.11.0 (z3 4.12.1), run on a cloud box if not local.
+
+The only runtime dependency is `bignumber.js` (Dafny's integer representation).

package/dist/bridge.d.ts

@@ -0,0 +1,43 @@
+import BigNumber from 'bignumber.js';
+export declare const D: {
+    _dafny: any;
+    Common: any;
+    Chain: any;
+    Caveats: any;
+    Threshold: any;
+    Replay: any;
+    Verdict: any;
+};
+export declare const Common: any;
+export declare const Chain: any;
+export declare const Threshold: any;
+export declare const Replay: any;
+export declare const Verdict: any;
+export declare const Caveats: any;
+/** A Dafny `int` from a JS number. Only safe integers are representable; anything else is a caller bug. */
+export declare function bn(n: number): BigNumber;
+export declare const num: (b: BigNumber) => number;
+export declare const some: <T>(v: T) => any;
+export declare const none: () => any;
+export declare const opt: <T>(v: T | undefined) => any;
+export declare const fromOpt: <T>(o: any) => T | undefined;
+/** Dafny seq from a JS array (no spread: safe for very long arrays). */
+export declare function seq<T>(a: readonly T[]): any;
+export declare const fromSeq: <T>(s: any) => T[];
+/** Result of a lazily evaluated primitive: ok, or an opaque diagnostic carried through untouched. */
+export type Res<M> = {
+    ok: true;
+} | {
+    ok: false;
+    m: M;
+};
+export declare const resOk: () => any;
+export declare const wrapRes: <M>(f: () => Res<M>) => () => any;
+export type Status = 'pass' | 'fail' | 'not-enforced';
+export declare function toStatus(s: any): Status;
+export declare function fromStatus(s: Status): any;
+/** Dafny string (sequence of code points) from a JS string - only the replay-store model needs it. */
+/** An empty Dafny `Map` (the fresh state for a verified store). */
+export declare const emptyDafnyMap: () => any;
+export declare const dstr: (s: string) => any;
+export declare const jstr: (d: any) => string;

package/dist/bridge.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jstr = exports.dstr = exports.emptyDafnyMap = exports.wrapRes = exports.resOk = exports.fromSeq = exports.fromOpt = exports.opt = exports.none = exports.some = exports.num = exports.Caveats = exports.Verdict = exports.Replay = exports.Threshold = exports.Chain = exports.Common = exports.D = void 0;
+exports.bn = bn;
+exports.seq = seq;
+exports.toStatus = toStatus;
+exports.fromStatus = fromStatus;
+/* eslint-disable @typescript-eslint/no-explicit-any */
+// bridge.ts - the ONLY file that touches the Dafny-generated runtime types. Everything exported from the package
+// is plain JSON-like data / closures; Dafny datatypes (BigNumber ints, Seq, Option, Res, tuples) never leak.
+const bignumber_js_1 = __importDefault(require("bignumber.js"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const core = require('../generated/pca_core.js');
+exports.D = core;
+exports.Common = core.Common;
+exports.Chain = core.Chain;
+exports.Threshold = core.Threshold;
+exports.Replay = core.Replay;
+exports.Verdict = core.Verdict;
+exports.Caveats = core.Caveats;
+/** A Dafny `int` from a JS number. Only safe integers are representable; anything else is a caller bug. */
+function bn(n) {
+    if (!Number.isSafeInteger(n))
+        throw new RangeError(`pca-verified-core: expected a safe integer, got ${String(n)}`);
+    return new bignumber_js_1.default(n);
+}
+const num = (b) => b.toNumber();
+exports.num = num;
+const some = (v) => exports.Common.Option.create_Some(v);
+exports.some = some;
+const none = () => exports.Common.Option.create_None();
+exports.none = none;
+const opt = (v) => (v === undefined ? (0, exports.none)() : (0, exports.some)(v));
+exports.opt = opt;
+const fromOpt = (o) => (o.is_Some ? o.dtor_v : undefined);
+exports.fromOpt = fromOpt;
+/** Dafny seq from a JS array (no spread: safe for very long arrays). */
+function seq(a) {
+    const s = core._dafny.Seq.of();
+    for (let i = 0; i < a.length; i++)
+        s.push(a[i]);
+    return s;
+}
+const fromSeq = (s) => Array.from(s);
+exports.fromSeq = fromSeq;
+const resOk = () => exports.Common.Res.create_Ok();
+exports.resOk = resOk;
+const wrapRes = (f) => () => {
+    const r = f();
+    return r.ok ? exports.Common.Res.create_Ok() : exports.Common.Res.create_Err(r.m);
+};
+exports.wrapRes = wrapRes;
+function toStatus(s) {
+    if (s.is_Pass)
+        return 'pass';
+    if (s.is_Fail)
+        return 'fail';
+    return 'not-enforced';
+}
+function fromStatus(s) {
+    return s === 'pass' ? exports.Common.Status.create_Pass() : s === 'fail' ? exports.Common.Status.create_Fail() : exports.Common.Status.create_NotEnforced();
+}
+/** Dafny string (sequence of code points) from a JS string - only the replay-store model needs it. */
+/** An empty Dafny `Map` (the fresh state for a verified store). */
+const emptyDafnyMap = () => core._dafny.Map.Empty;
+exports.emptyDafnyMap = emptyDafnyMap;
+const dstr = (s) => core._dafny.Seq.UnicodeFromString(s);
+exports.dstr = dstr;
+const jstr = (d) => d.toVerbatimString(false);
+exports.jstr = jstr;
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":";;;;;;AAwBA,gBAGC;AASD,kBAIC;AAYD,4BAIC;AACD,gCAEC;AA3DD,uDAAuD;AACvD,iHAAiH;AACjH,6GAA6G;AAC7G,gEAAqC;AACrC,iEAAiE;AACjE,MAAM,IAAI,GAAG,OAAO,CAAC,0BAA0B,CAQ9C,CAAC;AAEW,QAAA,CAAC,GAAG,IAAI,CAAC;AACT,QAAA,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;AACrB,QAAA,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;AACnB,QAAA,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;AAC3B,QAAA,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;AACrB,QAAA,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACvB,QAAA,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AAEpC,2GAA2G;AAC3G,SAAgB,EAAE,CAAC,CAAS;IAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,mDAAmD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,OAAO,IAAI,sBAAS,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AACM,MAAM,GAAG,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAA7C,QAAA,GAAG,OAA0C;AAEnD,MAAM,IAAI,GAAG,CAAI,CAAI,EAAO,EAAE,CAAC,cAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAAtD,QAAA,IAAI,QAAkD;AAC5D,MAAM,IAAI,GAAG,GAAQ,EAAE,CAAC,cAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;AAA9C,QAAA,IAAI,QAA0C;AACpD,MAAM,GAAG,GAAG,CAAI,CAAgB,EAAO,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,YAAI,GAAE,CAAC,CAAC,CAAC,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAC;AAAzE,QAAA,GAAG,OAAsE;AAC/E,MAAM,OAAO,GAAG,CAAI,CAAM,EAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,MAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAAlF,QAAA,OAAO,WAA2E;AAE/F,wEAAwE;AACxE,SAAgB,GAAG,CAAI,CAAe;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC;AACX,CAAC;AACM,MAAM,OAAO,GAAG,CAAI,CAAM,EAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAiB,CAAC,CAAC;AAA5D,QAAA,OAAO,WAAqD;AAIlE,MAAM,KAAK,GAAG,GAAQ,EAAE,CAAC,cAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;AAA1C,QAAA,KAAK,SAAqC;AAChD,MAAM,OAAO,GAAG,CAAI,CAAe,EAAE,EAAE,CAAC,GAAQ,EAAE;IACvD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACd,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,cAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC;AAHW,QAAA,OAAO,WAGlB;AAGF,SAAgB,QAAQ,CAAC,CAAM;IAC7B,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC7B,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC7B,OAAO,cAAc,CAAC;AACxB,CAAC;AACD,SAAgB,UAAU,CAAC,CAAS;IAClC,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,cAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,cAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,cAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;AACtI,CAAC;AACD,sGAAsG;AACtG,mEAAmE;AAC5D,MAAM,aAAa,GAAG,GAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;AAAjD,QAAA,aAAa,iBAAoC;AACvD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAAhE,QAAA,IAAI,QAA4D;AACtE,MAAM,IAAI,GAAG,CAAC,CAAM,EAAU,EAAE,CAAE,CAA8C,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAAnG,QAAA,IAAI,QAA+F"}

package/dist/chain.d.ts

@@ -0,0 +1,65 @@
+import { bn, fromOpt, type Res, some, none, D } from './bridge';
+/** Maximum delegation chain length (hops) accepted by the verified walk. Proved: longer chains are always TooLong. */
+export declare const MAX_CHAIN_DEPTH: number;
+/**
+ * Pre-evaluated facts about one hop. Every closure is a PURE function of the artifact: the glue computes it with the
+ * trusted primitives (hashing, suite policy, signature verification) and the verified core decides order,
+ * first-failure, depth and attenuation. Closures are only called when the core needs them (lazily, in order).
+ */
+export interface ChainHop<M, C> {
+    wellTyped: boolean;
+    hasParent: boolean;
+    /** hop 0 only: the root issuer is the expected principal (or none is expected). */
+    rootIssuerOk: boolean;
+    /** this hop's caveat list (opaque elements; compared with `ceq`). */
+    caveats: readonly C[];
+    /** hops >= 1: `hop.parent === capHash(parent)`. */
+    parentLinkOk: () => boolean;
+    /** hops >= 1: `hop.issuer === parent.holder`. */
+    issuerIsParentHolder: () => boolean;
+    /** suite policy (allowedSuites) result. */
+    suite: () => Res<M>;
+    /** F-2 holder_pq binding result (hops >= 1). */
+    pq: () => Res<M>;
+    /** body digest + signature result. */
+    sig: () => Res<M>;
+}
+export type ChainError<M> = {
+    kind: 'empty';
+} | {
+    kind: 'too-long';
+} | {
+    kind: 'malformed';
+    hop: number;
+} | {
+    kind: 'root-has-parent';
+} | {
+    kind: 'root-issuer';
+} | {
+    kind: 'suite' | 'pq' | 'sig';
+    hop: number;
+    m: M;
+} | {
+    kind: 'parent-link' | 'issuer-not-holder' | 'drops';
+    hop: number;
+} | {
+    kind: 'altered';
+    hop: number;
+    caveat: number;
+} | {
+    kind: 'alloc';
+    m: M;
+};
+export type ChainDecision<M> = {
+    ok: true;
+} | {
+    ok: false;
+    error: ChainError<M>;
+};
+/**
+ * Verified chain walk (formal/dafny/Chain.dfy: VerifyChain). `hopAt(i)` builds the facts of hop i on demand; only the
+ * first MAX_CHAIN_DEPTH+1 hops are ever materialised, so an absurdly long chain costs O(1) before it is rejected.
+ * `ceq(a, b)` is caveat equality (b must be the parent's element), `alloc()` the budget_alloc monotonicity result.
+ */
+export declare function decideChain<M, C>(length: number, hopAt: (i: number) => ChainHop<M, C>, ceq: (child: C, parent: C) => boolean, alloc: () => Res<M>): ChainDecision<M>;
+export { bn, fromOpt, some, none, D };

package/dist/chain.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.D = exports.none = exports.some = exports.fromOpt = exports.bn = exports.MAX_CHAIN_DEPTH = void 0;
+exports.decideChain = decideChain;
+const bridge_1 = require("./bridge");
+Object.defineProperty(exports, "bn", { enumerable: true, get: function () { return bridge_1.bn; } });
+Object.defineProperty(exports, "fromOpt", { enumerable: true, get: function () { return bridge_1.fromOpt; } });
+Object.defineProperty(exports, "some", { enumerable: true, get: function () { return bridge_1.some; } });
+Object.defineProperty(exports, "none", { enumerable: true, get: function () { return bridge_1.none; } });
+Object.defineProperty(exports, "D", { enumerable: true, get: function () { return bridge_1.D; } });
+/** Maximum delegation chain length (hops) accepted by the verified walk. Proved: longer chains are always TooLong. */
+exports.MAX_CHAIN_DEPTH = (0, bridge_1.num)(bridge_1.Chain.__default.MaxDepth);
+/**
+ * Verified chain walk (formal/dafny/Chain.dfy: VerifyChain). `hopAt(i)` builds the facts of hop i on demand; only the
+ * first MAX_CHAIN_DEPTH+1 hops are ever materialised, so an absurdly long chain costs O(1) before it is rejected.
+ * `ceq(a, b)` is caveat equality (b must be the parent's element), `alloc()` the budget_alloc monotonicity result.
+ */
+function decideChain(length, hopAt, ceq, alloc) {
+    const n = Math.min(length, exports.MAX_CHAIN_DEPTH + 1);
+    const hops = [];
+    for (let i = 0; i < n; i++) {
+        const h = hopAt(i);
+        hops.push(bridge_1.Chain.Hop.create_Hop(h.wellTyped, h.hasParent, h.rootIssuerOk, (0, bridge_1.seq)(h.caveats), h.parentLinkOk, h.issuerIsParentHolder, (0, bridge_1.wrapRes)(h.suite), (0, bridge_1.wrapRes)(h.pq), (0, bridge_1.wrapRes)(h.sig)));
+    }
+    const r = bridge_1.Chain.__default.VerifyChain((0, bridge_1.seq)(hops), ceq, (0, bridge_1.wrapRes)(alloc));
+    if (r.is_ChainOk)
+        return { ok: true };
+    const e = r.dtor_e;
+    const error = (() => {
+        if (e.is_Empty)
+            return { kind: 'empty' };
+        if (e.is_TooLong)
+            return { kind: 'too-long' };
+        if (e.is_Malformed)
+            return { kind: 'malformed', hop: (0, bridge_1.num)(e.dtor_hop) };
+        if (e.is_RootHasParent)
+            return { kind: 'root-has-parent' };
+        if (e.is_RootIssuer)
+            return { kind: 'root-issuer' };
+        if (e.is_SuiteErr)
+            return { kind: 'suite', hop: (0, bridge_1.num)(e.dtor_hop), m: e.dtor_m };
+        if (e.is_PqErr)
+            return { kind: 'pq', hop: (0, bridge_1.num)(e.dtor_hop), m: e.dtor_m };
+        if (e.is_SigErr)
+            return { kind: 'sig', hop: (0, bridge_1.num)(e.dtor_hop), m: e.dtor_m };
+        if (e.is_ParentLink)
+            return { kind: 'parent-link', hop: (0, bridge_1.num)(e.dtor_hop) };
+        if (e.is_IssuerNotHolder)
+            return { kind: 'issuer-not-holder', hop: (0, bridge_1.num)(e.dtor_hop) };
+        if (e.is_Drops)
+            return { kind: 'drops', hop: (0, bridge_1.num)(e.dtor_hop) };
+        if (e.is_Altered)
+            return { kind: 'altered', hop: (0, bridge_1.num)(e.dtor_hop), caveat: (0, bridge_1.num)(e.dtor_j) };
+        return { kind: 'alloc', m: e.dtor_m };
+    })();
+    return { ok: false, error };
+}
+//# sourceMappingURL=chain.js.map

package/dist/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":";;;AA+CA,kCA2CC;AA1FD,qCAA0F;AA6FjF,mFA7FO,WAAE,OA6FP;AAAE,wFA7FO,gBAAO,OA6FP;AAAE,qFA7FoC,aAAI,OA6FpC;AAAE,qFA7FoC,aAAI,OA6FpC;AAAE,kFA7FoC,UAAC,OA6FpC;AA3FnC,sHAAsH;AACzG,QAAA,eAAe,GAAW,IAAA,YAAG,EAAC,cAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAuCrE;;;;GAIG;AACH,SAAgB,WAAW,CACzB,MAAc,EACd,KAAoC,EACpC,GAAqC,EACrC,KAAmB;IAEnB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAe,GAAG,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CACP,cAAK,CAAC,GAAG,CAAC,UAAU,CAClB,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,SAAS,EACX,CAAC,CAAC,YAAY,EACd,IAAA,YAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EACd,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,oBAAoB,EACtB,IAAA,gBAAO,EAAC,CAAC,CAAC,KAAK,CAAC,EAChB,IAAA,gBAAO,EAAC,CAAC,CAAC,EAAE,CAAC,EACb,IAAA,gBAAO,EAAC,CAAC,CAAC,GAAG,CAAC,CACf,CACF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,cAAK,CAAC,SAAS,CAAC,WAAW,CAAC,IAAA,YAAG,EAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAA,gBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,KAAK,GAAG,CAAC,GAAkB,EAAE;QACjC,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,CAAC,gBAAgB;YAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC3D,IAAI,CAAC,CAAC,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACpD,IAAI,CAAC,CAAC,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAW,EAAE,CAAC;QACpF,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAW,EAAE,CAAC;QAC9E,IAAI,CAAC,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAW,EAAE,CAAC;QAChF,IAAI,CAAC,CAAC,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,CAAC,kBAAkB;YAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAA,YAAG,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,MAAW,EAAE,CAAC;IAC7C,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC"}

package/dist/ext-attest.d.ts

@@ -0,0 +1,109 @@
+import BigNumber from 'bignumber.js';
+export interface MeasuredIdentity {
+    model_id: string;
+    weights_digest: string;
+    weights_measured?: boolean;
+    runtime_measurement: string;
+    operator: string;
+    system_prompt_digest?: string;
+    tool_manifest_digest?: string;
+}
+export interface HardwareAttestationResult {
+    ok: boolean;
+    reason?: string;
+    measured?: MeasuredIdentity;
+    bound?: boolean;
+    hostAsserted?: Record<string, string>;
+}
+export interface HardwareAttestationVerifier {
+    verify(input: any): Promise<HardwareAttestationResult>;
+}
+export interface MultiRootAttestationPolicy {
+    roots: Array<{
+        id: string;
+        verifier: HardwareAttestationVerifier;
+        required?: boolean;
+        suite?: string;
+    }>;
+    threshold: number;
+}
+export interface AgentBinding {
+    model_allowlist?: unknown[];
+    min_measurement?: string | {
+        svn: number;
+    };
+    operator?: string;
+    weights_allowlist?: unknown[];
+    system_prompt_allowlist?: unknown[];
+    tool_manifest_allowlist?: unknown[];
+    require_hardware?: boolean;
+    require_measured_weights?: boolean;
+}
+/** Intern values to positive integers with SameValueZero equality (exactly `Array.prototype.includes` / `Map` semantics). */
+declare class Interner {
+    private readonly m;
+    readonly vals: unknown[];
+    id(v: unknown): number;
+    /** 0 for anything that is not a non-empty string (the multi-root reconciliation convention). */
+    sid(v: unknown): number;
+}
+export interface AttestationRootLike {
+    id: string;
+    verifier: HardwareAttestationVerifier;
+    required?: boolean;
+    suite?: string;
+}
+/** Build the verified multi-root verifier. Same construction errors, same results, same reason strings as createMultiRootVerifier. */
+export declare function createMultiRootVerifierVerified(policy: MultiRootAttestationPolicy): HardwareAttestationVerifier;
+/** matchAgentBinding with the decision made by the proved MatchBinding. Same reasons as production. */
+export declare function matchAgentBindingVerified(id: MeasuredIdentity, binding: AgentBinding | undefined): string | null;
+/** requiresAttestation via the proved flag combination. */
+export declare function requiresAttestationVerified(binding: AgentBinding | undefined): boolean;
+/**
+ * The proved model of memoryNonceStore (Attest.dfy: MsConsume, SingleUse, LiveNeverEvicted, FullOfLiveRefuses): a consumed nonce is
+ * rejected for `retentionMs`; a full store refuses (never evicts a live entry); only aged-out entries are dropped. Same construction
+ * checks and messages as production. The proved arithmetic is over integers: `retentionMs` and every `now()` value must be safe
+ * integers (Date.now() is); a non-finite clock value is rejected exactly like production, a fractional one throws RangeError.
+ */
+export declare class VerifiedMemoryNonceStore {
+    private s;
+    private readonly it;
+    private readonly clock;
+    constructor(max?: number, opts?: {
+        retentionMs?: number;
+        now?: () => number;
+    });
+    consume(nonce: string): boolean;
+}
+export type AllowlistGateKind = 'shape' | 'options' | 'unknown-issuer' | 'alg-mismatch' | 'issuer-expired' | 'bad-signature' | 'not-yet-valid' | 'expired' | 'lifetime-too-long' | 'below-min-version' | 'rollback' | 'conflict';
+export interface AllowlistGateFacts {
+    shapeOk: boolean;
+    issuerKnown: boolean;
+    algMatches: boolean;
+    issuerLive: boolean;
+    sigOk: boolean;
+    nowMs: number;
+    skew: number;
+    notBefore: number;
+    expiresAt: number;
+    maxLifetimeMs?: number;
+    minVersion?: number;
+    version: number;
+    lastSeenVersion?: number;
+    lastSeenDigest?: string;
+    digest: string;
+}
+/** The ordered decision of verifyAllowlistManifest after the primitive facts are known. `undefined` == accepted. A non-finite skew / lifetime or a non-integer version option is the proved `options` reject (production: `malformed`); otherwise numerics must be safe integers (skew is floored, negative skew clamps to 0). */
+export declare function allowlistGate(f: AllowlistGateFacts): AllowlistGateKind | undefined;
+/** Internal bridge for the production drop-ins in test/support/attest-dropins.ts (not part of the public API). */
+export declare const attestBridge: {
+    A: any;
+    D: any;
+    DF: any;
+    bn: (n: number) => BigNumber;
+    seqOf: (a: readonly any[]) => any;
+    kindName: (k: any) => string;
+    none: () => any;
+    Interner: typeof Interner;
+};
+export {};