@atrib/sdk 0.1.0

package/dist/config.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Client configuration for the consolidated atrib SDK.
+ *
+ * Topology per the SDK session brief: the local primitives runtime (the
+ * daemon) is the default peer; in-process signing via `@atrib/emit` is the
+ * fallback. Anchors are the D138 anchor-plurality surface from `@atrib/mcp`
+ * (spec §2.11.7-§2.11.13): the config takes an anchor SET which is
+ * normalized into an `AnchorSetConfig` and fanned out through
+ * `createAnchorFanout` on the in-process attest path. When no anchors are
+ * configured, the `BUILT_IN_DEFAULT_ANCHOR_SET` (two independent anchors)
+ * applies.
+ */
+import { type AnchorDescriptor, type AnchorSetConfig } from '@atrib/mcp';
+import type { ResolvedKey } from '@atrib/emit';
+export type DaemonMode = 'prefer' | 'require' | 'off';
+export interface DaemonConfig {
+    /**
+     * MCP Streamable HTTP endpoint of the local primitives runtime.
+     * Default: $ATRIB_PRIMITIVES_HTTP_ENDPOINT, then http://127.0.0.1:8796/mcp.
+     */
+    endpoint?: string;
+    /**
+     * 'prefer' (default): try the daemon, fall back in-process.
+     * 'require': daemon only; operational failure degrades to a warning
+     *            result (never a throw) per §5.8.
+     * 'off': in-process only.
+     */
+    mode?: DaemonMode;
+    /** Connect/call timeout in ms. Default 1500 (connect) / 10000 (call). */
+    connectTimeoutMs?: number;
+    callTimeoutMs?: number;
+    /** Cooldown before re-probing an unreachable daemon. Default 30000. */
+    retryCooldownMs?: number;
+}
+/**
+ * One anchor in the anchor set (D138, spec §2.11.12). A bare string is an
+ * atrib-log §2.6.1 endpoint (normalized to `{ url }`). The object form is
+ * `AnchorDescriptor` from `@atrib/mcp`: `anchor_type` absent means
+ * `'atrib-log'`; `url` wins over `endpoint` when both are set; the
+ * registered types are `ANCHOR_TYPES` (§2.11.8 v1 registry).
+ */
+export type AnchorSpec = string | AnchorDescriptor;
+export interface AtribClientConfig {
+    daemon?: DaemonConfig;
+    /**
+     * Anchor set (D138, §2.11.12). When omitted, the two-anchor
+     * `BUILT_IN_DEFAULT_ANCHOR_SET` from `@atrib/mcp` applies and the emit
+     * pipeline keeps its own env/default atrib-log endpoint. Hostile or
+     * malformed entries warn-and-skip, never error (§5.8).
+     */
+    anchors?: AnchorSpec[];
+    /**
+     * Opt-in acknowledgment that a sub-plurality (< 2) anchor set is
+     * deliberate (§2.11.12 rule 3) — the anchor analog of
+     * `allow_unresolved_informed_by` (D113). Maps to
+     * `AnchorSetConfig.allow_single_anchor`.
+     */
+    allowSingleAnchor?: boolean;
+    /**
+     * Opt-in parsing of `dev.atrib/attribution` attestation receipts from
+     * daemon tool results' `_meta` (D141). Default false. Receipts are
+     * advisory; trust still derives from verifying signed records. Parsed
+     * blocks are additionally run through `verifyAttributionReceipt`.
+     */
+    attributionReceipts?: boolean;
+    /**
+     * Pre-resolved signing key for the in-process path. Default: the
+     * `@atrib/emit` `resolveKey()` ladder (ATRIB_PRIVATE_KEY env, key file,
+     * Keychain, 1Password). `null` disables in-process signing (pass-through
+     * per §5.8 rule 5).
+     */
+    key?: ResolvedKey | null;
+    /**
+     * Explicit context_id (32 lowercase hex). Stateless-MCP-native posture:
+     * context identity is an explicit per-request value; this is only the
+     * per-client default. Default: resolveEnvContextId() at call time.
+     */
+    contextId?: string;
+    /** `_local.producer` mirror sidecar label. Default 'atrib-sdk'. */
+    producer?: string;
+}
+export declare const DEFAULT_DAEMON_ENDPOINT = "http://127.0.0.1:8796/mcp";
+export declare const DEFAULT_CONNECT_TIMEOUT_MS = 1500;
+export declare const DEFAULT_CALL_TIMEOUT_MS = 10000;
+export declare const DEFAULT_RETRY_COOLDOWN_MS = 30000;
+export declare const DEFAULT_PRODUCER = "atrib-sdk";
+export declare function resolveDaemonEndpoint(config?: DaemonConfig): string;
+export interface ResolvedAnchorSet {
+    /**
+     * Canonical §2.11.12 anchor-set config for `createAnchorFanout`. `{}`
+     * (no `anchors` key) when the caller configured nothing, so the
+     * built-in default set applies downstream.
+     */
+    config: AnchorSetConfig;
+    /**
+     * First effective `'atrib-log'` descriptor's `url ?? endpoint`, passed
+     * to the emit pipeline as its §2.6.1 log endpoint. Undefined when the
+     * config is empty (the built-in default set applies and emitInProcess
+     * keeps its own env/default endpoint).
+     */
+    primaryLogEndpoint: string | undefined;
+    warnings: string[];
+}
+/**
+ * Normalize the caller's anchor set into a D138 `AnchorSetConfig`
+ * (§2.11.12). Hostile/malformed entries — null, non-object/non-string,
+ * missing string `url`/`endpoint`, unparsable URL, unregistered
+ * `anchor_type` — warn-and-skip, never throw (§5.8). Plurality posture
+ * (warn on < 2 anchors without `allow_single_anchor`) is resolved by the
+ * fan-out via `resolveAnchorPosture`, not here.
+ */
+export declare function resolveAnchorSet(anchors: AnchorSpec[] | undefined, allowSingleAnchor?: boolean): ResolvedAnchorSet;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgB,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAmB,MAAM,YAAY,CAAA;AACvG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAA;AAErD,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,gBAAgB,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;;OAKG;IACH,GAAG,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,uBAAuB,8BAA8B,CAAA;AAClE,eAAO,MAAM,0BAA0B,OAAO,CAAA;AAC9C,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAC7C,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAC/C,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAI3C,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,CAMnE;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,MAAM,EAAE,eAAe,CAAA;IACvB;;;;;OAKG;IACH,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,EACjC,iBAAiB,CAAC,EAAE,OAAO,GAC1B,iBAAiB,CAuDnB"}

package/dist/config.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Client configuration for the consolidated atrib SDK.
+ *
+ * Topology per the SDK session brief: the local primitives runtime (the
+ * daemon) is the default peer; in-process signing via `@atrib/emit` is the
+ * fallback. Anchors are the D138 anchor-plurality surface from `@atrib/mcp`
+ * (spec §2.11.7-§2.11.13): the config takes an anchor SET which is
+ * normalized into an `AnchorSetConfig` and fanned out through
+ * `createAnchorFanout` on the in-process attest path. When no anchors are
+ * configured, the `BUILT_IN_DEFAULT_ANCHOR_SET` (two independent anchors)
+ * applies.
+ */
+import { ANCHOR_TYPES } from '@atrib/mcp';
+export const DEFAULT_DAEMON_ENDPOINT = 'http://127.0.0.1:8796/mcp';
+export const DEFAULT_CONNECT_TIMEOUT_MS = 1500;
+export const DEFAULT_CALL_TIMEOUT_MS = 10_000;
+export const DEFAULT_RETRY_COOLDOWN_MS = 30_000;
+export const DEFAULT_PRODUCER = 'atrib-sdk';
+const ANCHOR_TYPE_SET = new Set(ANCHOR_TYPES);
+export function resolveDaemonEndpoint(config) {
+    return (config?.endpoint ??
+        process.env['ATRIB_PRIMITIVES_HTTP_ENDPOINT'] ??
+        DEFAULT_DAEMON_ENDPOINT);
+}
+/**
+ * Normalize the caller's anchor set into a D138 `AnchorSetConfig`
+ * (§2.11.12). Hostile/malformed entries — null, non-object/non-string,
+ * missing string `url`/`endpoint`, unparsable URL, unregistered
+ * `anchor_type` — warn-and-skip, never throw (§5.8). Plurality posture
+ * (warn on < 2 anchors without `allow_single_anchor`) is resolved by the
+ * fan-out via `resolveAnchorPosture`, not here.
+ */
+export function resolveAnchorSet(anchors, allowSingleAnchor) {
+    const warnings = [];
+    if (anchors === undefined) {
+        // No anchor config at all: the BUILT_IN_DEFAULT_ANCHOR_SET applies
+        // (§2.11.12 rule 1) and the emit pipeline keeps its own env/default
+        // atrib-log endpoint.
+        return { config: {}, primaryLogEndpoint: undefined, warnings };
+    }
+    const descriptors = [];
+    let primaryLogEndpoint;
+    for (const spec of anchors) {
+        // Hostile/malformed entries warn-and-skip, never throw (§5.8).
+        let descriptor;
+        if (typeof spec === 'string') {
+            descriptor = { url: spec };
+        }
+        else if (typeof spec === 'object' && spec !== null && !Array.isArray(spec)) {
+            descriptor = spec;
+        }
+        else {
+            warnings.push(`atrib: anchor entry ${String(spec)} is not a string or object; skipping`);
+            continue;
+        }
+        const anchorType = descriptor.anchor_type;
+        if (anchorType !== undefined && (typeof anchorType !== 'string' || !ANCHOR_TYPE_SET.has(anchorType))) {
+            const named = (descriptor.url ?? descriptor.endpoint);
+            warnings.push(`atrib: anchor_type '${String(anchorType)}'${typeof named === 'string' ? ` (${named})` : ''} is not in the §2.11.8 registry (${ANCHOR_TYPES.join(', ')}); skipping this anchor`);
+            continue;
+        }
+        const effectiveType = anchorType ?? 'atrib-log';
+        // `url` wins over `endpoint` when both are set (the §2.11.12 sample
+        // config spells the field `url`; both spellings are accepted).
+        const endpoint = descriptor.url ?? descriptor.endpoint;
+        if (effectiveType === 'atrib-log' || endpoint !== undefined) {
+            if (typeof endpoint !== 'string') {
+                warnings.push('atrib: anchor entry without a string url/endpoint; skipping');
+                continue;
+            }
+            try {
+                new URL(endpoint);
+            }
+            catch {
+                warnings.push(`atrib: anchor endpoint '${endpoint}' is not a valid URL; skipping`);
+                continue;
+            }
+            if (effectiveType === 'atrib-log' && primaryLogEndpoint === undefined) {
+                primaryLogEndpoint = endpoint;
+            }
+        }
+        descriptors.push(descriptor);
+    }
+    const config = {
+        anchors: descriptors,
+        ...(allowSingleAnchor === true ? { allow_single_anchor: true } : {}),
+    };
+    return { config, primaryLogEndpoint, warnings };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAgE,MAAM,YAAY,CAAA;AA0EvG,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAA;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAA;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAC7C,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAA;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAE3C,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;AAElE,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,OAAO,CACL,MAAM,EAAE,QAAQ;QAChB,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;QAC7C,uBAAuB,CACxB,CAAA;AACH,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EACjC,iBAA2B;IAE3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,mEAAmE;QACnE,oEAAoE;QACpE,sBAAsB;QACtB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;IAChE,CAAC;IACD,MAAM,WAAW,GAAuB,EAAE,CAAA;IAC1C,IAAI,kBAAsC,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,+DAA+D;QAC/D,IAAI,UAA4B,CAAA;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAC5B,CAAC;aAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;YACxF,SAAQ;QACV,CAAC;QACD,MAAM,UAAU,GAAI,UAAwC,CAAC,WAAW,CAAA;QACxE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACrG,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAY,CAAA;YAChE,QAAQ,CAAC,IAAI,CACX,uBAAuB,MAAM,CAAC,UAAU,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,oCAAoC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAChL,CAAA;YACD,SAAQ;QACV,CAAC;QACD,MAAM,aAAa,GAAgB,UAAqC,IAAI,WAAW,CAAA;QACvF,oEAAoE;QACpE,+DAA+D;QAC/D,MAAM,QAAQ,GAAI,UAAgC,CAAC,GAAG,IAAK,UAAqC,CAAC,QAAQ,CAAA;QACzG,IAAI,aAAa,KAAK,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;gBAC5E,SAAQ;YACV,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,2BAA2B,QAAQ,gCAAgC,CAAC,CAAA;gBAClF,SAAQ;YACV,CAAC;YACD,IAAI,aAAa,KAAK,WAAW,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACtE,kBAAkB,GAAG,QAAQ,CAAA;YAC/B,CAAC;QACH,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC9B,CAAC;IACD,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,WAAW;QACpB,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAA;AACjD,CAAC"}

package/dist/daemon.d.ts

@@ -0,0 +1,32 @@
+import { type VerifiedAttributionReceipt } from './attribution.js';
+import { type DaemonConfig } from './config.js';
+export type DaemonCallOutcome = {
+    ok: true;
+    value: unknown;
+    attribution?: VerifiedAttributionReceipt;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare class DaemonClient {
+    private readonly endpoint;
+    private readonly connectTimeoutMs;
+    private readonly callTimeoutMs;
+    private readonly retryCooldownMs;
+    private readonly parseReceipts;
+    private client;
+    private connecting;
+    private lastFailureAt;
+    constructor(config?: DaemonConfig, options?: {
+        attributionReceipts?: boolean;
+    });
+    /**
+     * Call one MCP tool on the daemon. Tool results carrying a single JSON
+     * text block (the atrib primitive convention) are parsed; other shapes
+     * are returned raw.
+     */
+    callTool(name: string, args: Record<string, unknown>): Promise<DaemonCallOutcome>;
+    close(): Promise<void>;
+    private ensureClient;
+}
+//# sourceMappingURL=daemon.d.ts.map

package/dist/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAqBA,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,aAAa,CAAA;AAEpB,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,0BAA0B,CAAA;CAAE,GACtE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAyCjC,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAsC;IACxD,OAAO,CAAC,aAAa,CAAI;gBAEb,MAAM,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9E;;;;OAIG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0CjF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAYd,YAAY;CAuC3B"}

package/dist/daemon.js

@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Daemon transport: MCP Streamable HTTP client for the local primitives
+ * runtime.
+ *
+ * Semantically stateless per the SDK brief: nothing session-scoped carries
+ * meaning — context_id and chain tokens travel as explicit tool arguments
+ * on every call. The MCP protocol session (initialize handshake +
+ * Mcp-Session-Id) is a transport detail of the CURRENT runtime that the
+ * official client manages; when the post-2026-07-28 stateless transport
+ * ships, this class swaps transports without changing the SDK surface.
+ *
+ * Degradation (§5.8): every operational failure is caught, logged with the
+ * `atrib:` prefix, and reported as an unavailable outcome — never thrown.
+ */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { verifyAttributionReceipt } from '@atrib/mcp';
+import { ATTRIBUTION_EXTENSION_KEY, parseAttributionReceiptBlock, } from './attribution.js';
+import { DEFAULT_CALL_TIMEOUT_MS, DEFAULT_CONNECT_TIMEOUT_MS, DEFAULT_RETRY_COOLDOWN_MS, resolveDaemonEndpoint, } from './config.js';
+/**
+ * Parse + verify the `dev.atrib/attribution` block on a tool result's
+ * `_meta`. The lenient parser extracts the block; `verifyAttributionReceipt`
+ * runs over the RAW block (extension spec §6.2). §5.8-safe: any exception
+ * degrades to a `malformed` verification, never a throw.
+ */
+function extractAttribution(meta) {
+    const block = parseAttributionReceiptBlock(meta);
+    if (block === null)
+        return null;
+    let verification;
+    try {
+        const raw = typeof meta === 'object' && meta !== null
+            ? meta[ATTRIBUTION_EXTENSION_KEY]
+            : undefined;
+        verification = verifyAttributionReceipt(raw);
+    }
+    catch (error) {
+        console.warn(`atrib: attribution receipt verification failed: ${String(error)}`);
+        verification = { valid: false, mismatched: ['malformed'] };
+    }
+    return { block, verification };
+}
+const SDK_CLIENT_INFO = { name: 'atrib-sdk', version: '0.1.0' };
+async function withTimeout(promise, ms, label) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`atrib: ${label} timed out after ${ms}ms`)), ms);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+export class DaemonClient {
+    endpoint;
+    connectTimeoutMs;
+    callTimeoutMs;
+    retryCooldownMs;
+    parseReceipts;
+    client = null;
+    connecting = null;
+    lastFailureAt = 0;
+    constructor(config, options) {
+        this.endpoint = resolveDaemonEndpoint(config);
+        this.connectTimeoutMs = config?.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+        this.callTimeoutMs = config?.callTimeoutMs ?? DEFAULT_CALL_TIMEOUT_MS;
+        this.retryCooldownMs = config?.retryCooldownMs ?? DEFAULT_RETRY_COOLDOWN_MS;
+        this.parseReceipts = options?.attributionReceipts === true;
+    }
+    /**
+     * Call one MCP tool on the daemon. Tool results carrying a single JSON
+     * text block (the atrib primitive convention) are parsed; other shapes
+     * are returned raw.
+     */
+    async callTool(name, args) {
+        const client = await this.ensureClient();
+        if (!client) {
+            return { ok: false, reason: `daemon unreachable at ${this.endpoint}` };
+        }
+        try {
+            const result = await withTimeout(client.callTool({ name, arguments: args }), this.callTimeoutMs, `tools/call ${name}`);
+            const content = result.content;
+            const isError = result.isError === true;
+            const text = Array.isArray(content) && content[0]?.type === 'text' ? content[0].text : undefined;
+            if (isError) {
+                return { ok: false, reason: `daemon tool ${name} errored: ${text ?? 'unknown error'}` };
+            }
+            const attribution = this.parseReceipts
+                ? extractAttribution(result._meta)
+                : null;
+            const withAttribution = (value) => attribution !== null ? { ok: true, value, attribution } : { ok: true, value };
+            if (text === undefined) {
+                return withAttribution(result);
+            }
+            try {
+                return withAttribution(JSON.parse(text));
+            }
+            catch {
+                return withAttribution(text);
+            }
+        }
+        catch (error) {
+            // A failed call may mean the transport session died; drop the client
+            // so the next call reconnects (after cooldown).
+            await this.close();
+            this.lastFailureAt = Date.now();
+            const reason = error instanceof Error ? error.message : String(error);
+            console.warn(`atrib: daemon call ${name} failed: ${reason}`);
+            return { ok: false, reason };
+        }
+    }
+    async close() {
+        const client = this.client;
+        this.client = null;
+        if (client) {
+            try {
+                await client.close();
+            }
+            catch {
+                // Best-effort close per §5.8.
+            }
+        }
+    }
+    async ensureClient() {
+        if (this.client)
+            return this.client;
+        if (this.connecting)
+            return this.connecting;
+        if (this.lastFailureAt > 0 && Date.now() - this.lastFailureAt < this.retryCooldownMs) {
+            return null;
+        }
+        this.connecting = (async () => {
+            let client = null;
+            try {
+                // URL parsing stays INSIDE the try: a garbage endpoint is an
+                // operational failure that must degrade (§5.8), never throw.
+                const url = new URL(this.endpoint);
+                // The SDK's concrete transport declares `sessionId: string | undefined`
+                // while the Transport interface under exactOptionalPropertyTypes wants
+                // an optional property; the runtime shapes are identical.
+                const transport = new StreamableHTTPClientTransport(url);
+                client = new Client(SDK_CLIENT_INFO);
+                await withTimeout(client.connect(transport), this.connectTimeoutMs, 'daemon connect');
+                this.client = client;
+                this.lastFailureAt = 0;
+                return client;
+            }
+            catch (error) {
+                this.lastFailureAt = Date.now();
+                if (client) {
+                    try {
+                        await client.close();
+                    }
+                    catch {
+                        // Ignore close failures on a connection that never established.
+                    }
+                }
+                const reason = error instanceof Error ? error.message : String(error);
+                console.warn(`atrib: daemon connect failed (${this.endpoint}): ${reason}`);
+                return null;
+            }
+            finally {
+                this.connecting = null;
+            }
+        })();
+        return this.connecting;
+    }
+}
+//# sourceMappingURL=daemon.js.map

package/dist/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAA;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAElG,OAAO,EAAE,wBAAwB,EAAuC,MAAM,YAAY,CAAA;AAC1F,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,aAAa,CAAA;AAMpB;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACvC,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,YAA4C,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAAgC,CAAC,yBAAyB,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAA;QACf,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,mDAAmD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAChF,YAAY,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;AAChC,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAE/D,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,KAAa;IAC1E,IAAI,KAAiC,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC5F,CAAC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAY;IACN,QAAQ,CAAQ;IAChB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IACrB,eAAe,CAAQ;IACvB,aAAa,CAAS;IAC/B,MAAM,GAAkB,IAAI,CAAA;IAC5B,UAAU,GAAkC,IAAI,CAAA;IAChD,aAAa,GAAG,CAAC,CAAA;IAEzB,YAAY,MAAqB,EAAE,OAA2C;QAC5E,IAAI,CAAC,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,CAAC,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,IAAI,0BAA0B,CAAA;QAC9E,IAAI,CAAC,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,uBAAuB,CAAA;QACrE,IAAI,CAAC,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,yBAAyB,CAAA;QAC3E,IAAI,CAAC,aAAa,GAAG,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAA;IAC5D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA6B;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAA;QACxE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAC1C,IAAI,CAAC,aAAa,EAClB,cAAc,IAAI,EAAE,CACrB,CAAA;YACD,MAAM,OAAO,GAAI,MAAgE,CAAC,OAAO,CAAA;YACzF,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,KAAK,IAAI,CAAA;YAClE,MAAM,IAAI,GACR,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;YACrF,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,IAAI,aAAa,IAAI,IAAI,eAAe,EAAE,EAAE,CAAA;YACzF,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa;gBACpC,CAAC,CAAC,kBAAkB,CAAE,MAA8B,CAAC,KAAK,CAAC;gBAC3D,CAAC,CAAC,IAAI,CAAA;YACR,MAAM,eAAe,GAAG,CAAC,KAAc,EAAqB,EAAE,CAC5D,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;YAC/E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;YAChC,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YAClB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC/B,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrE,OAAO,CAAC,IAAI,CAAC,sBAAsB,IAAI,YAAY,MAAM,EAAE,CAAC,CAAA;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QACnC,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAA;QAC3C,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACrF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,MAAM,GAAkB,IAAI,CAAA;YAChC,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,6DAA6D;gBAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBAClC,wEAAwE;gBACxE,uEAAuE;gBACvE,0DAA0D;gBAC1D,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,GAAG,CAAyB,CAAA;gBAChF,MAAM,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,CAAA;gBACpC,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBACrF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;gBACpB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAA;gBACtB,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC/B,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;oBACtB,CAAC;oBAAC,MAAM,CAAC;wBACP,gEAAgE;oBAClE,CAAC;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACrE,OAAO,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAA;gBAC1E,OAAO,IAAI,CAAA;YACb,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;YACxB,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF"}

package/dist/evidence-envelope.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Evidence envelope production and validation (D137, spec §5.5.7).
+ *
+ * The real envelope engine lives in `@atrib/verify`, which is an OPTIONAL
+ * peer dependency of the SDK (same pattern as `@atrib/recall` /
+ * `@atrib/verify-mcp` in client.ts): the peer module is loaded lazily and
+ * its absence degrades to a `null` envelope with a warning naming the
+ * package — never a throw (§5.8). The structural envelope TYPES stay in
+ * ./evidence.ts so the emitted .d.ts never references the optional peer.
+ *
+ * Throw-vs-degrade split (the SDK-wide contract): contradictory INPUT
+ * (both `hash` and `material`; `hash_rule` without `material`; neither
+ * commitment source) throws TypeError — programmer error, thrown before
+ * the peer is consulted. Everything operational (peer missing, envelope
+ * failing §5.5.7 validation) degrades into the returned `warnings`.
+ */
+import type { EvidenceConstraint, EvidenceEnvelope, EvidencePayloadRef, EvidenceTier } from './evidence.js';
+interface VerifyEnvelopeModule {
+    validateEnvelope: (envelope: unknown) => {
+        valid: boolean;
+        reasons: string[];
+    };
+    jcsSha256: (value: unknown) => string;
+    rawSha256: (text: string) => string;
+}
+/** Test seam: swap the peer loader. Pass undefined to restore the default. */
+export declare function __setVerifyEnvelopeLoaderForTests(loader: (() => Promise<VerifyEnvelopeModule | null>) | undefined): void;
+/** Payload input for {@link buildEvidenceEnvelope}. */
+export interface BuildEvidenceEnvelopePayloadInput {
+    media_type?: string;
+    /** Retrievability ref. Default: `{ kind: 'inline' }` when `inline` is set, else `{ kind: 'withheld' }`. */
+    ref?: EvidencePayloadRef;
+    /** Raw payload carried inline (local-only, never public). */
+    inline?: unknown;
+    /** Pre-computed `sha256:<64-hex>` commitment. Mutually exclusive with `material`. */
+    hash?: string;
+    /** Evidence material to hash with `hash_rule`. Mutually exclusive with `hash`. */
+    material?: unknown;
+    /** §5.5.7 hash rule: 'jcs' (JSON media types, default) or 'raw' (UTF-8 text). */
+    hash_rule?: 'jcs' | 'raw';
+}
+export interface BuildEvidenceEnvelopeInput {
+    /** Absolute HTTPS profile type URI. */
+    profile: string;
+    /** Semver of the profile document. */
+    profile_version: string;
+    tier: EvidenceTier;
+    payload: BuildEvidenceEnvelopePayloadInput;
+    facts?: Record<string, unknown>;
+    result?: {
+        valid?: boolean;
+        constraints?: EvidenceConstraint[];
+        errors?: string[];
+        warnings?: string[];
+    };
+    verifier?: {
+        name?: string;
+        version?: string;
+        checked_at_ms?: number;
+    };
+}
+export interface BuildEvidenceEnvelopeResult {
+    /** The validated envelope, or null when degraded (see warnings). */
+    envelope: EvidenceEnvelope | null;
+    /** The peer's `validateEnvelope` outcome, or null when the peer is missing. */
+    validation: unknown | null;
+    warnings: string[];
+}
+/**
+ * Build a §5.5.7 evidence envelope and validate it through the optional
+ * `@atrib/verify` peer.
+ *
+ * - `payload.hash` absent: the commitment is computed from
+ *   `payload.material` via the stated `hash_rule` ('jcs' default; 'raw'
+ *   requires string material) using the peer's `jcsSha256`/`rawSha256` —
+ *   the same functions the conformance corpus pins.
+ * - Contradictory input throws TypeError before the peer loads: both
+ *   `hash` and `material`, `hash_rule` without `material`, or neither
+ *   `hash` nor `material` (no commitment source).
+ * - A structurally invalid RESULT (per the peer's `validateEnvelope`)
+ *   yields `envelope: null` with the reject reasons in `warnings`.
+ * - Peer missing yields `envelope: null` plus a warning naming
+ *   '@atrib/verify' (§5.8 degrade, never a throw).
+ */
+export declare function buildEvidenceEnvelope(input: BuildEvidenceEnvelopeInput): Promise<BuildEvidenceEnvelopeResult>;
+export interface ValidateEvidenceEnvelopeResult {
+    /** The peer's `validateEnvelope` outcome, or null when the peer is missing. */
+    validation: unknown | null;
+    warnings: string[];
+}
+/**
+ * Validate an envelope against the normative §5.5.7 shape rules via the
+ * optional `@atrib/verify` peer. Peer missing degrades to
+ * `validation: null` with a warning (§5.8); never throws.
+ */
+export declare function validateEvidenceEnvelope(envelope: unknown): Promise<ValidateEvidenceEnvelopeResult>;
+export {};
+//# sourceMappingURL=evidence-envelope.d.ts.map

package/dist/evidence-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-envelope.d.ts","sourceRoot":"","sources":["../src/evidence-envelope.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACb,MAAM,eAAe,CAAA;AAItB,UAAU,oBAAoB;IAC5B,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9E,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAA;IACrC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CACpC;AAWD,8EAA8E;AAC9E,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,GAC/D,IAAI,CAEN;AAKD,uDAAuD;AACvD,MAAM,WAAW,iCAAiC;IAChD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2GAA2G;IAC3G,GAAG,CAAC,EAAE,kBAAkB,CAAA;IACxB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iFAAiF;IACjF,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAA;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,sCAAsC;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,iCAAiC,CAAA;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAA;QAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KACpB,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,aAAa,CAAC,EAAE,MAAM,CAAA;KACvB,CAAA;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACjC,+EAA+E;IAC/E,UAAU,EAAE,OAAO,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAwEtC;AAED,MAAM,WAAW,8BAA8B;IAC7C,+EAA+E;IAC/E,UAAU,EAAE,OAAO,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,8BAA8B,CAAC,CAazC"}

package/dist/evidence-envelope.js

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+let verifyEnvelopeModulePromise = null;
+function loadVerifyEnvelopeModule() {
+    verifyEnvelopeModulePromise ??= import('@atrib/verify').then((mod) => mod, () => null);
+    return verifyEnvelopeModulePromise;
+}
+/** Test seam: swap the peer loader. Pass undefined to restore the default. */
+export function __setVerifyEnvelopeLoaderForTests(loader) {
+    verifyEnvelopeModulePromise = loader ? loader() : null;
+}
+const PEER_MISSING_WARNING = "atrib: evidence-envelope support unavailable — install the optional peer '@atrib/verify'";
+/**
+ * Build a §5.5.7 evidence envelope and validate it through the optional
+ * `@atrib/verify` peer.
+ *
+ * - `payload.hash` absent: the commitment is computed from
+ *   `payload.material` via the stated `hash_rule` ('jcs' default; 'raw'
+ *   requires string material) using the peer's `jcsSha256`/`rawSha256` —
+ *   the same functions the conformance corpus pins.
+ * - Contradictory input throws TypeError before the peer loads: both
+ *   `hash` and `material`, `hash_rule` without `material`, or neither
+ *   `hash` nor `material` (no commitment source).
+ * - A structurally invalid RESULT (per the peer's `validateEnvelope`)
+ *   yields `envelope: null` with the reject reasons in `warnings`.
+ * - Peer missing yields `envelope: null` plus a warning naming
+ *   '@atrib/verify' (§5.8 degrade, never a throw).
+ */
+export async function buildEvidenceEnvelope(input) {
+    const payload = input.payload;
+    if (payload.hash !== undefined && payload.material !== undefined) {
+        throw new TypeError('atrib: buildEvidenceEnvelope payload carries both hash and material; provide exactly one commitment source');
+    }
+    if (payload.hash_rule !== undefined && payload.material === undefined) {
+        throw new TypeError('atrib: buildEvidenceEnvelope payload has hash_rule without material; hash_rule only applies to material');
+    }
+    if (payload.hash === undefined && payload.material === undefined) {
+        throw new TypeError('atrib: buildEvidenceEnvelope payload needs a hash or material to commit to');
+    }
+    const hashRule = payload.hash_rule ?? 'jcs';
+    if (hashRule === 'raw' && payload.material !== undefined && typeof payload.material !== 'string') {
+        throw new TypeError("atrib: buildEvidenceEnvelope hash_rule 'raw' requires string material (UTF-8 text)");
+    }
+    const warnings = [];
+    const mod = await loadVerifyEnvelopeModule();
+    if (mod === null) {
+        return { envelope: null, validation: null, warnings: [PEER_MISSING_WARNING] };
+    }
+    try {
+        const hash = payload.hash ??
+            (hashRule === 'raw'
+                ? mod.rawSha256(payload.material)
+                : mod.jcsSha256(payload.material));
+        const ref = payload.ref ?? (payload.inline !== undefined ? { kind: 'inline' } : { kind: 'withheld' });
+        const candidate = {
+            envelope: 1,
+            profile: input.profile,
+            profile_version: input.profile_version,
+            tier: input.tier,
+            payload: {
+                hash,
+                ...(payload.media_type !== undefined ? { media_type: payload.media_type } : {}),
+                ref,
+                ...(payload.inline !== undefined ? { inline: payload.inline } : {}),
+            },
+            ...(input.facts !== undefined ? { facts: input.facts } : {}),
+            result: {
+                valid: input.result?.valid ?? true,
+                constraints: input.result?.constraints ?? [],
+                errors: input.result?.errors ?? [],
+                warnings: input.result?.warnings ?? [],
+            },
+            ...(input.verifier !== undefined ? { verifier: input.verifier } : {}),
+        };
+        const validation = mod.validateEnvelope(candidate);
+        if (!validation.valid) {
+            warnings.push(`atrib: built envelope failed §5.5.7 validation (${validation.reasons.join(', ')}); dropping the envelope`);
+            return { envelope: null, validation, warnings };
+        }
+        return { envelope: candidate, validation, warnings };
+    }
+    catch (error) {
+        // Operational failure inside the peer (e.g. canonicalization of an
+        // uncanonicalizable material value): degrade per §5.8, never throw.
+        warnings.push(`atrib: evidence envelope construction failed: ${String(error)}`);
+        return { envelope: null, validation: null, warnings };
+    }
+}
+/**
+ * Validate an envelope against the normative §5.5.7 shape rules via the
+ * optional `@atrib/verify` peer. Peer missing degrades to
+ * `validation: null` with a warning (§5.8); never throws.
+ */
+export async function validateEvidenceEnvelope(envelope) {
+    const mod = await loadVerifyEnvelopeModule();
+    if (mod === null) {
+        return { validation: null, warnings: [PEER_MISSING_WARNING] };
+    }
+    try {
+        return { validation: mod.validateEnvelope(envelope), warnings: [] };
+    }
+    catch (error) {
+        return {
+            validation: null,
+            warnings: [`atrib: evidence envelope validation failed: ${String(error)}`],
+        };
+    }
+}
+//# sourceMappingURL=evidence-envelope.js.map