@atrib/verify 0.7.10 → 0.8.1

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,kCAAkC,EAClC,+BAA+B,EAC/B,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AACtE,YAAY,EACV,eAAe,EACf,aAAa,EACb,+BAA+B,EAC/B,sCAAsC,EACtC,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,6BAA6B,EAC7B,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAKjC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,kCAAkC,EAClC,+BAA+B,EAC/B,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gCAAgC,EAChC,8BAA8B,EAC9B,qCAAqC,EACrC,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AACtE,YAAY,EACV,eAAe,EACf,aAAa,EACb,+BAA+B,EAC/B,sCAAsC,EACtC,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,6BAA6B,EAC7B,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAKjC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAKrB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,sBAAsB,EACtB,sBAAsB,EACtB,SAAS,EACT,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAKvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EACL,mBAAmB,EAAE,+BAA+B,EACpD,mBAAmB,EAAE,qBAAqB,EAAE,wBAAwB,GACrE,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EACvF,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,iBAAiB,EACzF,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,GACxD,MAAM,uBAAuB,CAAA;AAK9B,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,kCAAkC,EAClC,mCAAmC,EACnC,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,yCAAyC,EACzC,iCAAiC,EACjC,qBAAqB,EACrB,qCAAqC,EACrC,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,GACnC,MAAM,yBAAyB,CAAA"}

package/dist/index.js

@@ -8,6 +8,7 @@ export { AtribVerifier } from './verifier.js';
 export { verifyRecord } from './verify-record.js';
 // Generic external authorization evidence checks. Off the atrib record-validity path.
 export { verifyAuthorizationEvidence, verifyOAuthAuthorizationEvidence, } from './authorization-evidence.js';
+export { decodeX401HeaderObject, encodeX401HeaderObject, verifyX401AuthorizationEvidence, } from './x401-evidence.js';
 export { verifyAAuthAuthorizationEvidence } from './aauth-evidence.js';
 export { FetchDpopReplayCache, MemoryDpopReplayCache, createFetchDpopReplayCache, dpopReplayCacheKeyId, } from './dpop-replay-cache.js';
 export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './oauth-introspection.js';
@@ -15,6 +16,10 @@ export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './o
 // record_hash claim plus private body material from another agent and must
 // decide whether to link its next record through informed_by.
 export { handoffClaimsFromEvidencePacket, verifyHandoffClaims } from './handoff.js';
+// Universal evidence envelope (§5.5.7, D137). Verifier-layer attachment model;
+// never touches signed bytes or verifyRecord().valid. The legacy §5.5.6
+// EvidenceVerificationBlock shape stays the mapped compatibility view.
+export { ATRIB_PROFILE_BASE, ATRIB_PROFILE_REGISTRY, ATRIB_PROFILE_URIS, EVIDENCE_CONSTRAINT_STATUSES, EVIDENCE_REF_KINDS, EVIDENCE_TIERS, FROZEN_LEGACY_PROTOCOLS, LEGACY_PROTOCOL_TO_PROFILE, SHA256_REF_PATTERN, assessReproducibility, atribProfileUri, classifyProfile, envelopeFromEvidenceBlock, envelopeIdentityKey, fromLegacyEvidenceBlock, isRelayIdentitySwap, isValidEnvelope, jcsSha256, mapLegacyEvidenceBlock, orderEnvelopeInstances, rawSha256, renderEnvelopeOpaque, tierRank, validateEnvelope, } from './evidence-envelope.js';
 // Calculation algorithm (§4.6). pure function, exported for direct use
 export { calculate, DEFAULT_POLICY, isValidPolicy } from './calculate.js';
 // Recommendation document signing/verification (§4.7)
@@ -30,4 +35,15 @@ export { evaluateAp2ViConstraints, verifyAp2ViEvidence, verifyAp2ViEvidenceAsync
 // Identity resolution (§6.3 9-step verifier consultation)
 export { resolveIdentity } from './resolve-identity.js';
 export { graphLabelFromEventTypeUri } from './types.js';
+// Delegation-certificate evaluation (§1.11 / D140): the §1.11.4 verifier
+// walk and §1.9.2 rule-3 revoker authorization. Signals only (§6.7.3);
+// never affects record validity.
+export { checkDelegationScope, delegationCertErrors, delegationCertHash, delegationCertSignatureVerifies, delegationCertSigningInput, evaluateDelegation, evaluateRevokerAuthorization, } from './delegation.js';
+// Anchor plurality (D138, §2.11.7-§2.11.13): anchor_plurality annotation over
+// §2.11.3 log_proofs plus the unchanged §2.11.4 hard conditions.
+export { ANCHOR_CLAIM_PREFIX, REGISTERED_NON_LOG_ANCHOR_TYPES, anchorOperatorGroup, verifyAnchorPlurality, verifyAnchorProofElement, } from './anchor-plurality.js';
+// Session-checkpoint verification (§1.2.10 / D139): structural validation,
+// root recomputation, inclusion/consistency proofs, freshness tiering, and
+// equivocation detection. Signals only; never affects record validity.
+export { DEFAULT_SESSION_CHECKPOINT_STALENESS_BOUND_MS, SESSION_CHECKPOINT_EVENT_TYPE_URI, checkConsecutiveSessionCheckpoints, detectSessionCheckpointEquivocation, recomputeSessionRoot, recomputeSessionRootFromLeafBytes, sessionCheckpointArgsHash, sessionCheckpointFreshness, sessionCheckpointRecordHash, sessionLeafBytes, validateSessionCheckpointStructural, verifySessionCheckpointRecord, verifySessionConsistencyProof, verifySessionInclusionProof, } from './session-checkpoint.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AAmBtE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAQ/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,oBAAoB,CAAA;AAc3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AAmBtE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAQ/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,+EAA+E;AAC/E,wEAAwE;AACxE,uEAAuE;AACvE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,sBAAsB,EACtB,sBAAsB,EACtB,SAAS,EACT,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAmB/B,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAEvD,yEAAyE;AACzE,uEAAuE;AACvE,iCAAiC;AACjC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAA;AAaxB,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EACL,mBAAmB,EAAE,+BAA+B,EACpD,mBAAmB,EAAE,qBAAqB,EAAE,wBAAwB,GACrE,MAAM,uBAAuB,CAAA;AAO9B,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,kCAAkC,EAClC,mCAAmC,EACnC,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAA"}

package/dist/session-checkpoint.d.ts

@@ -0,0 +1,200 @@
+import { type AtribRecord } from '@atrib/mcp';
+/** The session_checkpoint event_type URI (§1.2.10, D139). */
+export declare const SESSION_CHECKPOINT_EVENT_TYPE_URI = "https://atrib.dev/v1/types/session_checkpoint";
+/** Verifier default for the §1.2.10.3 stale-undeclared freshness bound. */
+export declare const DEFAULT_SESSION_CHECKPOINT_STALENESS_BOUND_MS: number;
+/**
+ * The §1.2.10 checkpoint object as a verifier sees it. `retroactive` is
+ * typed `boolean` (not the producer-side `true` literal) because the
+ * verifier's job includes rejecting the `retroactive: false` wire form.
+ */
+export interface SessionCheckpointBody {
+    first_index: number;
+    prior_checkpoint?: string;
+    retroactive?: boolean;
+    session_root: string;
+    tree_size: number;
+}
+/** A record that may carry a checkpoint body (any event_type; presence is validated). */
+export type SessionCheckpointRecord = AtribRecord & {
+    checkpoint?: SessionCheckpointBody;
+};
+/** Categorical freshness fact per §1.2.10.3 (signal, not block). */
+export type SessionCheckpointFreshness = 'contemporaneous' | 'declared-retroactive' | 'stale-undeclared';
+/**
+ * Validate the §1.2.10 structural rules. Returns undefined when the record
+ * passes, or the rejection reason otherwise (reasons are pinned by the
+ * conformance corpus). The signature on a violating record may itself be
+ * valid; rejection is at the policy layer, for validators (§2.6.1) and
+ * verifiers alike.
+ */
+export declare function validateSessionCheckpointStructural(record: SessionCheckpointRecord): string | undefined;
+/** Decode a `"sha256:<64-hex>"` ref to its raw 32 leaf bytes. Throws on malformed refs. */
+export declare function sessionLeafBytes(ref: string): Uint8Array;
+/**
+ * Recompute the §1.2.10.1 session root from ordered `"sha256:<hex>"` leaf
+ * refs (raw-32-byte-leaf rule). Returns the `"sha256:"+hex` form for direct
+ * comparison against `checkpoint.session_root`.
+ */
+export declare function recomputeSessionRoot(leafRefs: readonly string[]): string;
+/**
+ * Recompute an RFC 6962 root over arbitrary raw leaf byte strings. Exists
+ * for trap-vector checks (a tree over the UTF-8 bytes of the prefixed hex
+ * strings MUST NOT reproduce a session_root) and for the empty-tree
+ * sentinel; conforming session roots always come from `recomputeSessionRoot`.
+ */
+export declare function recomputeSessionRootFromLeafBytes(leaves: readonly Uint8Array[]): string;
+/** `"sha256:" + hex(SHA-256(JCS(signed record)))` — the §1.2.3 record hash. */
+export declare function sessionCheckpointRecordHash(record: AtribRecord): string;
+/**
+ * Recompute the D099 content commitment for a checkpoint:
+ * `sha256(JCS({"leaves": [...refs...]}))`, prefixed. Compare against the
+ * record's `args_hash` to replay-check the disclosed leaf list.
+ */
+export declare function sessionCheckpointArgsHash(leafRefs: readonly string[]): string;
+/**
+ * Assign the categorical freshness fact for a checkpoint given the maximum
+ * covered leaf timestamp. Signal, not block (the D051 / §6.7 posture): a
+ * stale-undeclared checkpoint remains valid and admissible; the fact
+ * travels with the verification result.
+ */
+export declare function sessionCheckpointFreshness(record: SessionCheckpointRecord, maxCoveredLeafTimestamp: number, boundMs?: number): SessionCheckpointFreshness;
+export interface VerifySessionInclusionProofOptions {
+    /** 0-based leaf index the proof claims. */
+    index: number;
+    /** The checkpoint's tree_size. */
+    treeSize: number;
+    /** The covered record's hash: raw 32 bytes or its `"sha256:<hex>"` ref. */
+    recordHash: Uint8Array | string;
+    /** Sibling hashes, leaf to root. */
+    proof: readonly Uint8Array[];
+    /** The checkpoint's session_root (`"sha256:"+hex`). */
+    sessionRoot: string;
+}
+/**
+ * Verify that a record hash sits at `index` in the committed session tree.
+ * This is the §1.2.10 selective-disclosure primitive: it reveals only the
+ * record hash, its position, and ~log2(n) sibling hashes. Never throws;
+ * malformed input (wrong index, wrong root, truncated or padded path,
+ * non-32-byte leaf) returns false.
+ */
+export declare function verifySessionInclusionProof(opts: VerifySessionInclusionProofOptions): boolean;
+export interface VerifySessionConsistencyProofOptions {
+    /** The prior checkpoint's tree_size. */
+    firstTreeSize: number;
+    /** The later checkpoint's tree_size. */
+    secondTreeSize: number;
+    /** The prior checkpoint's session_root (`"sha256:"+hex`). */
+    firstRoot: string;
+    /** The later checkpoint's session_root (`"sha256:"+hex`). */
+    secondRoot: string;
+    /** RFC 6962 §2.1.2 consistency proof nodes. */
+    proof: readonly Uint8Array[];
+}
+/**
+ * RFC 6962 §2.1.4.2 consistency-proof verification: proves the later
+ * session tree is an append-only extension of the earlier one — the same
+ * check the log's witness protocol applies between successive log
+ * checkpoints (§2.9). Never throws; malformed input returns false.
+ */
+export declare function verifySessionConsistencyProof(opts: VerifySessionConsistencyProofOptions): boolean;
+/**
+ * Equivocation evidence per §1.2.10.2: two signed checkpoints from the same
+ * creator_key on one context claiming the same prior_checkpoint (or
+ * overlapping ranges) with inconsistent roots. The session-scale analogue
+ * of log equivocation in §2.11, reported as a categorical verifier fact.
+ */
+export interface SessionCheckpointEquivocationEvidence {
+    creator_key: string;
+    context_id: string;
+    reason: 'divergent-roots-same-claim' | 'append-only-violation';
+    prior_checkpoint?: string;
+    first_record_hash: string;
+    second_record_hash: string;
+    first: {
+        session_root: string;
+        tree_size: number;
+        first_index: number;
+    };
+    second: {
+        session_root: string;
+        tree_size: number;
+        first_index: number;
+    };
+}
+/**
+ * Detect the direct §1.2.10.2 equivocation pair: same creator_key and
+ * context_id, same prior_checkpoint claim (or overlapping covered ranges),
+ * same tree_size, divergent session_root. Both signatures being genuine is
+ * what makes the pair evidence — callers verify signatures separately.
+ * Pairs of different tree sizes need leaf material to prove divergence; use
+ * `checkConsecutiveSessionCheckpoints` for those. Returns undefined when
+ * the pair is not (provably) equivocating.
+ */
+export declare function detectSessionCheckpointEquivocation(a: SessionCheckpointRecord, b: SessionCheckpointRecord): SessionCheckpointEquivocationEvidence | undefined;
+export interface CheckConsecutiveSessionCheckpointsOptions {
+    /** Ordered `"sha256:<hex>"` leaf refs of the FIRST checkpoint's tree. */
+    firstLeaves?: readonly string[] | undefined;
+    /** Ordered `"sha256:<hex>"` leaf refs of the SECOND checkpoint's tree. */
+    secondLeaves?: readonly string[] | undefined;
+    /** Pre-generated RFC 6962 §2.1.2 consistency proof nodes. */
+    consistencyProof?: readonly Uint8Array[] | undefined;
+}
+export interface ConsecutiveSessionCheckpointCheck {
+    /** second.prior_checkpoint equals the first checkpoint's record hash. */
+    priorCheckpointMatches: boolean;
+    /** second.first_index equals first.tree_size. */
+    firstIndexMatchesPriorTreeSize: boolean;
+    /** first root recomputes from firstLeaves (undefined when not supplied). */
+    firstRootRecomputes: boolean | undefined;
+    /** second root recomputes from secondLeaves (undefined when not supplied). */
+    secondRootRecomputes: boolean | undefined;
+    /** Leaf prefix 0..first.tree_size-1 identical (undefined without both leaf lists). */
+    appendOnly: boolean | undefined;
+    /** §2.1.4.2 proof result (undefined when no proof was supplied). */
+    consistencyProofVerifies: boolean | undefined;
+    /** Every checkable §1.2.10.2 constraint holds. */
+    consistent: boolean;
+    /** Populated when the pair provably diverges over the same claim. */
+    equivocation?: SessionCheckpointEquivocationEvidence;
+}
+/**
+ * Check the full §1.2.10.2 contract for consecutive checkpoints
+ * K_i → K_{i+1}: prior_checkpoint linkage, first_index continuation, root
+ * recomputation from disclosed leaf lists, leaf-prefix append-only
+ * identity, and the RFC 6962 §2.1.4.2 consistency proof. Constraints whose
+ * material was not supplied report `undefined` (not checkable) rather than
+ * failing. A linked, range-continuing pair whose roots provably diverge is
+ * surfaced as equivocation evidence.
+ */
+export declare function checkConsecutiveSessionCheckpoints(first: SessionCheckpointRecord, second: SessionCheckpointRecord, opts?: CheckConsecutiveSessionCheckpointsOptions): ConsecutiveSessionCheckpointCheck;
+export interface VerifySessionCheckpointRecordOptions {
+    /** Ordered `"sha256:<hex>"` refs of the disclosed leaf list (Tier 2 material). */
+    leaves?: readonly string[] | undefined;
+    /** Max covered leaf timestamp for §1.2.10.3 freshness tiering. */
+    maxCoveredLeafTimestamp?: number | undefined;
+    /** Verifier staleness bound; defaults to 24h. */
+    stalenessBoundMs?: number | undefined;
+}
+export interface SessionCheckpointVerification {
+    /** Ed25519 signature verifies over the canonical bytes (§1.4). */
+    signatureOk: boolean;
+    /** §1.2.3 record hash of the checkpoint record. */
+    recordHash: string;
+    /** §1.2.10 structural rejection reason; undefined when the record passes. */
+    structuralRejection?: string;
+    /** session_root recomputes from the disclosed leaves (undefined when not supplied). */
+    rootMatchesLeaves?: boolean;
+    /** D099 args_hash replays from the disclosed leaves (undefined when not supplied). */
+    argsHashMatchesLeaves?: boolean;
+    /** §1.2.10.3 categorical freshness fact (undefined without a leaf timestamp). */
+    freshness?: SessionCheckpointFreshness;
+}
+/**
+ * Composed verifier entry point for one session_checkpoint record:
+ * signature, structural rules, root recomputation, D099 args_hash replay,
+ * and categorical freshness. Facts whose material was not supplied are
+ * omitted rather than failed. Never throws.
+ */
+export declare function verifySessionCheckpointRecord(record: SessionCheckpointRecord, opts?: VerifySessionCheckpointRecordOptions): Promise<SessionCheckpointVerification>;
+//# sourceMappingURL=session-checkpoint.d.ts.map

package/dist/session-checkpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-checkpoint.d.ts","sourceRoot":"","sources":["../src/session-checkpoint.ts"],"names":[],"mappings":"AA+BA,OAAO,EASL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAA;AAInB,6DAA6D;AAC7D,eAAO,MAAM,iCAAiC,kDAAkD,CAAA;AAEhG,2EAA2E;AAC3E,eAAO,MAAM,6CAA6C,QAAsB,CAAA;AAIhF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,yFAAyF;AACzF,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG;IAAE,UAAU,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAAA;AAE1F,oEAAoE;AACpE,MAAM,MAAM,0BAA0B,GAClC,iBAAiB,GACjB,sBAAsB,GACtB,kBAAkB,CAAA;AAMtB;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,uBAAuB,GAC9B,MAAM,GAAG,SAAS,CA4BpB;AAyBD,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKxD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAEvF;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAM7E;AAMD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,uBAAuB,EAC/B,uBAAuB,EAAE,MAAM,EAC/B,OAAO,GAAE,MAAsD,GAC9D,0BAA0B,CAI5B;AAMD,MAAM,WAAW,kCAAkC;IACjD,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAA;IACb,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,UAAU,EAAE,UAAU,GAAG,MAAM,CAAA;IAC/B,oCAAoC;IACpC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IAC5B,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,kCAAkC,GAAG,OAAO,CAe7F;AAaD,MAAM,WAAW,oCAAoC;IACnD,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,oCAAoC,GACzC,OAAO,CA2CT;AAED;;;;;GAKG;AACH,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,4BAA4B,GAAG,uBAAuB,CAAA;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;IACvE,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CACzE;AAUD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,CAAC,EAAE,uBAAuB,EAC1B,CAAC,EAAE,uBAAuB,GACzB,qCAAqC,GAAG,SAAS,CAsBnD;AAED,MAAM,WAAW,yCAAyC;IACxD,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IAC3C,0EAA0E;IAC1E,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IAC5C,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,CAAA;CACrD;AAED,MAAM,WAAW,iCAAiC;IAChD,yEAAyE;IACzE,sBAAsB,EAAE,OAAO,CAAA;IAC/B,iDAAiD;IACjD,8BAA8B,EAAE,OAAO,CAAA;IACvC,4EAA4E;IAC5E,mBAAmB,EAAE,OAAO,GAAG,SAAS,CAAA;IACxC,8EAA8E;IAC9E,oBAAoB,EAAE,OAAO,GAAG,SAAS,CAAA;IACzC,sFAAsF;IACtF,UAAU,EAAE,OAAO,GAAG,SAAS,CAAA;IAC/B,oEAAoE;IACpE,wBAAwB,EAAE,OAAO,GAAG,SAAS,CAAA;IAC7C,kDAAkD;IAClD,UAAU,EAAE,OAAO,CAAA;IACnB,qEAAqE;IACrE,YAAY,CAAC,EAAE,qCAAqC,CAAA;CACrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,uBAAuB,EAC9B,MAAM,EAAE,uBAAuB,EAC/B,IAAI,GAAE,yCAA8C,GACnD,iCAAiC,CAqFnC;AAMD,MAAM,WAAW,oCAAoC;IACnD,kFAAkF;IAClF,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;IACtC,kEAAkE;IAClE,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC;AAED,MAAM,WAAW,6BAA6B;IAC5C,kEAAkE;IAClE,WAAW,EAAE,OAAO,CAAA;IACpB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,sFAAsF;IACtF,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,iFAAiF;IACjF,SAAS,CAAC,EAAE,0BAA0B,CAAA;CACvC;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,uBAAuB,EAC/B,IAAI,GAAE,oCAAyC,GAC9C,OAAO,CAAC,6BAA6B,CAAC,CAyCxC"}