@atrib/verify 0.8.1 → 0.8.3

package/README.md

@@ -483,7 +483,7 @@ This is what makes verification possible: the merchant's local recalculation is
 
 Per the absolute invariant (also enforced in `@atrib/mcp` and `@atrib/agent`), atrib failures never break the host:
 
-- Missing or invalid `merchantKey` → constructor logs `atrib: ...` warning, `merchantPrivateKey = null`, no throw.
+- Missing or invalid `merchantKey` → constructor logs an `atrib: ...` warning, sets `merchantPrivateKey = null`, and does not throw.
 - `verify()` errors during signature resolution, graph fetch, or calculation are caught and surfaced as `warnings: string[]` with `valid = false`.
 - `calculate({ signWith: 'merchant' })` with a missing key returns an unsigned document plus a warning, rather than throwing.
 

package/dist/authority.d.ts

@@ -0,0 +1,32 @@
+/** Ordered authority lattice. Lower ordinal is less authority. */
+export type AuthorityLevel = 'untrusted' | 'agent' | 'trusted';
+export interface AuthorityPolicy {
+    /** Authority granted to a record based on its own signer/origin. Called for each record. */
+    originAuthority: (record: AuthorityRecord) => AuthorityLevel;
+    /** Max lineage hops to walk. Default 16. Guards against pathological graphs. */
+    maxDepth?: number;
+}
+/** The minimal shape this module needs. */
+export interface AuthorityRecord {
+    record_hash: string;
+    informed_by?: string[];
+}
+export interface AuthorityResult {
+    /** Effective authority after non-malleable propagation. */
+    authority: AuthorityLevel;
+    /** Authority this record would have had from its own origin alone. */
+    ownAuthority: AuthorityLevel;
+    /** True when lineage lowered the authority below ownAuthority. */
+    loweredByLineage: boolean;
+    /** record_hash of the least-authoritative ancestor that set the result. Self if none lower. */
+    limitingRecord: string;
+    /** Hashes walked, in visit order. Useful for explaining a verdict. */
+    visited: string[];
+    /** informed_by refs that could not be resolved in the supplied graph. */
+    unresolved: string[];
+    /** True when maxDepth stopped the walk before exhausting lineage. */
+    truncated: boolean;
+}
+export declare function minAuthority(a: AuthorityLevel, b: AuthorityLevel): AuthorityLevel;
+export declare function evaluateAuthority(record: AuthorityRecord, graph: ReadonlyMap<string, AuthorityRecord>, policy: AuthorityPolicy): AuthorityResult;
+//# sourceMappingURL=authority.d.ts.map

package/dist/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAEA,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,CAAA;AAE9D,MAAM,WAAW,eAAe;IAC9B,4FAA4F;IAC5F,eAAe,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,cAAc,CAAA;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,SAAS,EAAE,cAAc,CAAA;IACzB,sEAAsE;IACtE,YAAY,EAAE,cAAc,CAAA;IAC5B,kEAAkE;IAClE,gBAAgB,EAAE,OAAO,CAAA;IACzB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAA;CACnB;AAQD,wBAAgB,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,GAAG,cAAc,CAEjF;AAOD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,EAC3C,MAAM,EAAE,eAAe,GACtB,eAAe,CA4EjB"}

package/dist/authority.js

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0
+const AUTHORITY_ORDINAL = {
+    untrusted: 0,
+    agent: 1,
+    trusted: 2,
+};
+export function minAuthority(a, b) {
+    return AUTHORITY_ORDINAL[a] <= AUTHORITY_ORDINAL[b] ? a : b;
+}
+export function evaluateAuthority(record, graph, policy) {
+    const ownAuthority = policy.originAuthority(record);
+    const maxDepth = policy.maxDepth ?? 16;
+    const queue = [{ record, depth: 0 }];
+    const seen = new Set([record.record_hash]);
+    const visited = [];
+    const unresolved = [];
+    let authority = ownAuthority;
+    let limitingRecord = record.record_hash;
+    let limitingDepth = 0;
+    let truncated = false;
+    const considerLimit = (level, hash, depth) => {
+        const nextAuthority = minAuthority(authority, level);
+        if (nextAuthority !== authority) {
+            authority = nextAuthority;
+            limitingRecord = hash;
+            limitingDepth = depth;
+            return;
+        }
+        // Self remains limiting whenever its own authority is already the minimum.
+        if (level === authority &&
+            ownAuthority !== authority &&
+            depth > limitingDepth) {
+            limitingRecord = hash;
+            limitingDepth = depth;
+        }
+    };
+    for (let index = 0; index < queue.length; index += 1) {
+        const current = queue[index];
+        visited.push(current.record.record_hash);
+        if (current.depth > 0) {
+            considerLimit(policy.originAuthority(current.record), current.record.record_hash, current.depth);
+        }
+        for (const ancestorHash of current.record.informed_by ?? []) {
+            if (seen.has(ancestorHash))
+                continue;
+            seen.add(ancestorHash);
+            const ancestorDepth = current.depth + 1;
+            if (current.depth >= maxDepth) {
+                truncated = true;
+                considerLimit('untrusted', ancestorHash, ancestorDepth);
+                continue;
+            }
+            const ancestor = graph.get(ancestorHash);
+            if (ancestor === undefined) {
+                unresolved.push(ancestorHash);
+                considerLimit('untrusted', ancestorHash, ancestorDepth);
+                continue;
+            }
+            queue.push({ record: ancestor, depth: ancestorDepth });
+        }
+    }
+    return {
+        authority,
+        ownAuthority,
+        loweredByLineage: AUTHORITY_ORDINAL[authority] < AUTHORITY_ORDINAL[ownAuthority],
+        limitingRecord,
+        visited,
+        unresolved,
+        truncated,
+    };
+}
+//# sourceMappingURL=authority.js.map

package/dist/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAmCtC,MAAM,iBAAiB,GAA6C;IAClE,SAAS,EAAE,CAAC;IACZ,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;CACX,CAAA;AAED,MAAM,UAAU,YAAY,CAAC,CAAiB,EAAE,CAAiB;IAC/D,OAAO,iBAAiB,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAOD,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,KAA2C,EAC3C,MAAuB;IAEvB,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;IACtC,MAAM,KAAK,GAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;IAClD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,UAAU,GAAa,EAAE,CAAA;IAE/B,IAAI,SAAS,GAAG,YAAY,CAAA;IAC5B,IAAI,cAAc,GAAG,MAAM,CAAC,WAAW,CAAA;IACvC,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,MAAM,aAAa,GAAG,CAAC,KAAqB,EAAE,IAAY,EAAE,KAAa,EAAQ,EAAE;QACjF,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACpD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,SAAS,GAAG,aAAa,CAAA;YACzB,cAAc,GAAG,IAAI,CAAA;YACrB,aAAa,GAAG,KAAK,CAAA;YACrB,OAAM;QACR,CAAC;QAED,2EAA2E;QAC3E,IACE,KAAK,KAAK,SAAS;YACnB,YAAY,KAAK,SAAS;YAC1B,KAAK,GAAG,aAAa,EACrB,CAAC;YACD,cAAc,GAAG,IAAI,CAAA;YACrB,aAAa,GAAG,KAAK,CAAA;QACvB,CAAC;IACH,CAAC,CAAA;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAE,CAAA;QAC7B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAExC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACtB,aAAa,CACX,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EACtC,OAAO,CAAC,MAAM,CAAC,WAAW,EAC1B,OAAO,CAAC,KAAK,CACd,CAAA;QACH,CAAC;QAED,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,SAAQ;YACpC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YAEtB,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;YACvC,IAAI,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC9B,SAAS,GAAG,IAAI,CAAA;gBAChB,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;gBACvD,SAAQ;YACV,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;gBAC7B,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;gBACvD,SAAQ;YACV,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,YAAY;QACZ,gBAAgB,EAAE,iBAAiB,CAAC,SAAS,CAAC,GAAG,iBAAiB,CAAC,YAAY,CAAC;QAChF,cAAc;QACd,OAAO;QACP,UAAU;QACV,SAAS;KACV,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -14,6 +14,8 @@ export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './o
 export type { OAuthIntrospectionClientAuthentication, OAuthIntrospectionOptions, OAuthIntrospectionResult, } from './oauth-introspection.js';
 export { handoffClaimsFromEvidencePacket, verifyHandoffClaims } from './handoff.js';
 export type { HandoffBodyVerification, HandoffClaimsFromEvidenceOptions, HandoffClaimInput, HandoffClaimVerification, HandoffEvidenceEntry, HandoffEvidencePacket, HandoffProofVerification, HandoffRejectionReason, HandoffVerificationResult, VerifyHandoffClaimsOptions, } from './handoff.js';
+export { evaluateAuthority, minAuthority } from './authority.js';
+export type { AuthorityLevel, AuthorityPolicy, AuthorityRecord, AuthorityResult, } from './authority.js';
 export { ATRIB_PROFILE_BASE, ATRIB_PROFILE_REGISTRY, ATRIB_PROFILE_URIS, EVIDENCE_CONSTRAINT_STATUSES, EVIDENCE_REF_KINDS, EVIDENCE_TIERS, FROZEN_LEGACY_PROTOCOLS, LEGACY_PROTOCOL_TO_PROFILE, SHA256_REF_PATTERN, assessReproducibility, atribProfileUri, classifyProfile, envelopeFromEvidenceBlock, envelopeIdentityKey, fromLegacyEvidenceBlock, isRelayIdentitySwap, isValidEnvelope, jcsSha256, mapLegacyEvidenceBlock, orderEnvelopeInstances, rawSha256, renderEnvelopeOpaque, tierRank, validateEnvelope, } from './evidence-envelope.js';
 export type { AtribProfileName, EnvelopeReproducibility, EnvelopeValidation, EvidenceEnvelope, EvidenceEnvelopePayload, EvidenceEnvelopeRef, EvidenceEnvelopeResult, EvidenceEnvelopeVerifier, EvidenceConstraintStatus, EvidenceRefKind, EvidenceTier, FrozenLegacyProtocol, LegacyEvidenceBlock, OpaqueEnvelopeRender, ProfileClassification, } from './evidence-envelope.js';
 export { calculate, DEFAULT_POLICY, isValidPolicy } from './calculate.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,kCAAkC,EAClC,+BAA+B,EAC/B,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gCAAgC,EAChC,8BAA8B,EAC9B,qCAAqC,EACrC,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AACtE,YAAY,EACV,eAAe,EACf,aAAa,EACb,+BAA+B,EAC/B,sCAAsC,EACtC,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,6BAA6B,EAC7B,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAKjC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAKrB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,sBAAsB,EACtB,sBAAsB,EACtB,SAAS,EACT,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAKvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EACL,mBAAmB,EAAE,+BAA+B,EACpD,mBAAmB,EAAE,qBAAqB,EAAE,wBAAwB,GACrE,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EACvF,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,iBAAiB,EACzF,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,GACxD,MAAM,uBAAuB,CAAA;AAK9B,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,kCAAkC,EAClC,mCAAmC,EACnC,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,yCAAyC,EACzC,iCAAiC,EACjC,qBAAqB,EACrB,qCAAqC,EACrC,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,GACnC,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,eAAe,CAAA;AAKtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,sBAAsB,EACtB,kCAAkC,EAClC,+BAA+B,EAC/B,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gCAAgC,EAChC,8BAA8B,EAC9B,qCAAqC,EACrC,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AACtE,YAAY,EACV,eAAe,EACf,aAAa,EACb,+BAA+B,EAC/B,sCAAsC,EACtC,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,6BAA6B,EAC7B,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,cAAc,GACf,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAKjC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,YAAY,EACV,uBAAuB,EACvB,gCAAgC,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAChE,YAAY,EACV,cAAc,EACd,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,gBAAgB,CAAA;AAKvB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,sBAAsB,EACtB,sBAAsB,EACtB,SAAS,EACT,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAGzE,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG5F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC3E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAGxF,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,MAAM,GACP,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAG9B,YAAY,EACV,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAKvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EACL,mBAAmB,EAAE,+BAA+B,EACpD,mBAAmB,EAAE,qBAAqB,EAAE,wBAAwB,GACrE,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,sBAAsB,EACvF,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,iBAAiB,EACzF,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,GACxD,MAAM,uBAAuB,CAAA;AAK9B,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,kCAAkC,EAClC,mCAAmC,EACnC,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,yCAAyC,EACzC,iCAAiC,EACjC,qBAAqB,EACrB,qCAAqC,EACrC,0BAA0B,EAC1B,uBAAuB,EACvB,6BAA6B,EAC7B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,GACnC,MAAM,yBAAyB,CAAA"}

package/dist/index.js

@@ -16,6 +16,8 @@ export { introspectOAuthToken, oauthEvidenceFromIntrospectionResult, } from './o
 // record_hash claim plus private body material from another agent and must
 // decide whether to link its next record through informed_by.
 export { handoffClaimsFromEvidencePacket, verifyHandoffClaims } from './handoff.js';
+// Verifier-side authority policy over informed_by lineage.
+export { evaluateAuthority, minAuthority } from './authority.js';
 // Universal evidence envelope (§5.5.7, D137). Verifier-layer attachment model;
 // never touches signed bytes or verifyRecord().valid. The legacy §5.5.6
 // EvidenceVerificationBlock shape stays the mapped compatibility view.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,oBAAoB,CAAA;AAc3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AAmBtE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAQ/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,+EAA+E;AAC/E,wEAAwE;AACxE,uEAAuE;AACvE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,sBAAsB,EACtB,sBAAsB,EACtB,SAAS,EACT,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAmB/B,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAEvD,yEAAyE;AACzE,uEAAuE;AACvE,iCAAiC;AACjC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAA;AAaxB,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EACL,mBAAmB,EAAE,+BAA+B,EACpD,mBAAmB,EAAE,qBAAqB,EAAE,wBAAwB,GACrE,MAAM,uBAAuB,CAAA;AAO9B,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,kCAAkC,EAClC,mCAAmC,EACnC,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,+CAA+C;AAE/C,4BAA4B;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAO7C,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AASjD,sFAAsF;AACtF,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,6BAA6B,CAAA;AAmBpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,+BAA+B,GAChC,MAAM,oBAAoB,CAAA;AAc3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAA;AAmBtE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAQ/B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,0BAA0B,CAAA;AAOjC,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAcnF,2DAA2D;AAC3D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAQhE,+EAA+E;AAC/E,wEAAwE;AACxE,uEAAuE;AACvE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,sBAAsB,EACtB,sBAAsB,EACtB,SAAS,EACT,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAmB/B,uEAAuE;AACvE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEzE,sDAAsD;AACtD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,qBAAqB,CAAA;AAE5B,mDAAmD;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE7D,+BAA+B;AAC/B,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE5F,6BAA6B;AAC7B,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAG3E,6EAA6E;AAC7E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,sBAAsB,CAAA;AA6B7B,0DAA0D;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAgCvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAEvD,yEAAyE;AACzE,uEAAuE;AACvE,iCAAiC;AACjC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAA;AAaxB,8EAA8E;AAC9E,iEAAiE;AACjE,OAAO,EACL,mBAAmB,EAAE,+BAA+B,EACpD,mBAAmB,EAAE,qBAAqB,EAAE,wBAAwB,GACrE,MAAM,uBAAuB,CAAA;AAO9B,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,kCAAkC,EAClC,mCAAmC,EACnC,oBAAoB,EACpB,iCAAiC,EACjC,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atrib/verify",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -36,7 +36,7 @@
     "@sd-jwt/sd-jwt-vc": "0.19.0",
     "canonicalize": "^3.0.0",
     "jose": "6.2.3",
-    "@atrib/mcp": "0.19.1"
+    "@atrib/mcp": "0.20.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",