@clawbureau/clawverify-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clawbureau
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,118 @@
+# @clawbureau/clawverify-cli
+
+Verify any **Clawsig Protocol** proof bundle offline in one command. No network access, no API keys, no trust assumptions — just cryptographic verification.
+
+## Install
+
+```bash
+npm install -g @clawbureau/clawverify-cli
+```
+
+## Usage
+
+### Verify a proof bundle
+
+```bash
+clawverify verify proof-bundle --input run_xxx-bundle.json
+```
+
+Output:
+```json
+{
+  "status": "PASS",
+  "reason_code": "OK",
+  "component_results": {
+    "schema_valid": true,
+    "signature_valid": true,
+    "hash_chain_valid": true,
+    "tool_receipts_valid": true,
+    "tool_receipts_count": 3,
+    "side_effect_receipts_valid": true,
+    "human_approval_receipts_valid": true
+  }
+}
+```
+
+### Verify a commit signature
+
+```bash
+clawverify verify commit-sig --input proofs/.../commit.sig.json
+```
+
+### Verify an export bundle
+
+```bash
+clawverify verify export-bundle --input identity-export.json
+```
+
+## Options
+
+| Flag | Description |
+|------|-------------|
+| `--input <path>` | Path to the artifact to verify (required) |
+| `--config <path>` | Path to verifier config file (optional) |
+| `--urm <path>` | Path to URM file for proof bundle verification (optional, auto-detected) |
+| `--json` | Output raw JSON (default: pretty-printed) |
+
+## Verifier config
+
+The config file controls which signer DIDs are trusted:
+
+```json
+{
+  "version": 1,
+  "trusted_signer_dids": [
+    "did:key:z6Mk..."
+  ],
+  "require_receipt_binding": false,
+  "max_event_chain_gap_ms": 86400000
+}
+```
+
+Without a config file, the CLI performs structural verification only (schema, signatures, hash chains) without enforcing signer allowlists.
+
+## What it verifies
+
+| Artifact | Checks |
+|----------|--------|
+| **Proof bundle** | Schema validation, Ed25519 signature, event chain hash integrity, receipt binding, tool receipt validation, side-effect receipt validation, human approval receipt validation, signer DID allowlist |
+| **Commit signature** | JCS-canonicalized envelope, Ed25519 signature, DID extraction, message format |
+| **Export bundle** | Schema validation, signature chain, identity proofs |
+
+## Fail-closed behavior
+
+The verifier is fail-closed by design:
+- Unknown schema versions → `FAIL` (`UNKNOWN_VERSION`)
+- Unknown hash algorithms → `FAIL` (`UNKNOWN_HASH_ALGORITHM`)
+- Missing required fields → `FAIL` (`SCHEMA_VALIDATION_FAILED`)
+- Unknown envelope format → `FAIL` (`MALFORMED_ENVELOPE`)
+
+This ensures that new artifact types can't bypass verification by exploiting parser leniency.
+
+## Reason codes
+
+All failures include a machine-readable `reason_code`. The full registry is at:
+[`REASON_CODE_REGISTRY.md`](https://github.com/clawbureau/clawbureau/blob/main/docs/specs/clawsig-protocol/REASON_CODE_REGISTRY.md)
+
+## Programmatic API
+
+```ts
+import { verifyProofBundle } from '@clawbureau/clawverify-core';
+
+const result = verifyProofBundle(bundleJson, config);
+if (result.status === 'FAIL') {
+  console.error(`Verification failed: ${result.reason_code}`);
+}
+```
+
+## Conformance
+
+This CLI is tested against the Clawsig Protocol conformance suite (22 vectors). Run it yourself:
+
+```bash
+node scripts/protocol/run-clawsig-protocol-conformance.mjs
+```
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+import { resolveVerifierConfig, CliConfigError } from './config.js';
+import { CliUsageError } from './errors.js';
+import { exitCodeForOutput, kindForSubcommand, verifyCommitSigFromFile, verifyExportBundleFromFile, verifyProofBundleFromFile, } from './verify.js';
+function nowIso() {
+    return new Date().toISOString();
+}
+function usageText() {
+    return [
+        'clawverify (offline verifier CLI)',
+        '',
+        'Usage:',
+        '  clawverify verify proof-bundle --input <path> [--urm <path>] [--config <path>]',
+        '  clawverify verify export-bundle --input <path> [--config <path>]',
+        '  clawverify verify commit-sig   --input <path>',
+        '',
+        'Exit codes:',
+        '  0 = PASS (valid)',
+        '  1 = FAIL (invalid)',
+        '  2 = USAGE/CONFIG error',
+    ].join('\n');
+}
+function readFlag(args, name) {
+    const idx = args.indexOf(name);
+    if (idx === -1)
+        return undefined;
+    const value = args[idx + 1];
+    if (!value || value.startsWith('--'))
+        return undefined;
+    return value;
+}
+function hasFlag(args, name) {
+    return args.includes(name);
+}
+function parseCliArgs(argv) {
+    if (argv.length === 0 || hasFlag(argv, '--help') || hasFlag(argv, '-h')) {
+        throw new CliUsageError(usageText());
+    }
+    if (argv[0] !== 'verify') {
+        throw new CliUsageError(usageText());
+    }
+    const kind = kindForSubcommand(argv[1] ?? '');
+    if (!kind) {
+        throw new CliUsageError(usageText());
+    }
+    const inputPath = readFlag(argv, '--input');
+    if (!inputPath) {
+        throw new CliUsageError('Missing required flag: --input');
+    }
+    const urmPath = readFlag(argv, '--urm');
+    const configPath = readFlag(argv, '--config');
+    return { kind, inputPath, configPath, urmPath };
+}
+function output(out) {
+    process.stdout.write(`${JSON.stringify(out, null, 2)}\n`);
+}
+async function main() {
+    const { kind, inputPath, configPath, urmPath } = parseCliArgs(process.argv.slice(2));
+    const config = await resolveVerifierConfig({ configPath });
+    const out = kind === 'commit_sig'
+        ? await verifyCommitSigFromFile({ inputPath })
+        : kind === 'proof_bundle'
+            ? await verifyProofBundleFromFile({
+                inputPath,
+                configPath,
+                urmPath,
+                config,
+            })
+            : await verifyExportBundleFromFile({ inputPath, configPath, config });
+    output(out);
+    process.exitCode = exitCodeForOutput(out);
+}
+main().catch((err) => {
+    const verifiedAt = nowIso();
+    if (err instanceof CliUsageError) {
+        output({
+            status: 'ERROR',
+            verified_at: verifiedAt,
+            reason_code: 'USAGE_ERROR',
+            reason: err.message,
+        });
+        process.exitCode = 2;
+        return;
+    }
+    if (err instanceof CliConfigError) {
+        output({
+            status: 'ERROR',
+            verified_at: verifiedAt,
+            reason_code: 'CONFIG_ERROR',
+            reason: err.message,
+        });
+        process.exitCode = 2;
+        return;
+    }
+    output({
+        status: 'ERROR',
+        verified_at: verifiedAt,
+        reason_code: 'INTERNAL_ERROR',
+        reason: err instanceof Error ? err.message : 'unknown error',
+    });
+    process.exitCode = 2;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAGrB,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO;QACL,mCAAmC;QACnC,EAAE;QACF,QAAQ;QACR,kFAAkF;QAClF,oEAAoE;QACpE,iDAAiD;QACjD,EAAE;QACF,aAAa;QACb,oBAAoB;QACpB,sBAAsB;QACtB,0BAA0B;KAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAc,EAAE,IAAY;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,IAAY;IAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,IAAc;IAMlC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,gCAAgC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,MAAM,CAAC,GAAc;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAErF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3D,MAAM,GAAG,GACP,IAAI,KAAK,YAAY;QACnB,CAAC,CAAC,MAAM,uBAAuB,CAAC,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,KAAK,cAAc;YACvB,CAAC,CAAC,MAAM,yBAAyB,CAAC;gBAC9B,SAAS;gBACT,UAAU;gBACV,OAAO;gBACP,MAAM;aACP,CAAC;YACJ,CAAC,CAAC,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAE5E,MAAM,CAAC,GAAG,CAAC,CAAC;IACZ,OAAO,CAAC,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAE5B,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC;YACL,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,aAAa;YAC1B,MAAM,EAAE,GAAG,CAAC,OAAO;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC;YACL,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,cAAc;YAC3B,MAAM,EAAE,GAAG,CAAC,OAAO;SACpB,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,CAAC;QACL,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KAC7D,CAAC,CAAC;IACH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,10 @@
+import type { ClawverifyConfigV1, ResolvedVerifierConfig } from './types.js';
+export declare class CliConfigError extends Error {
+    readonly code = "CONFIG_ERROR";
+    constructor(message: string);
+}
+export declare function loadClawverifyConfigFile(path: string): Promise<ClawverifyConfigV1>;
+export declare function resolveVerifierConfig(opts: {
+    configPath?: string;
+}): Promise<ResolvedVerifierConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAmB7E,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,kBAAkB;gBAEnB,OAAO,EAAE,MAAM;CAG5B;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,CAAC,CAkD7B;AASD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuDlC"}

package/dist/config.js

@@ -0,0 +1,86 @@
+import * as fs from 'node:fs/promises';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function asStringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === 'string');
+}
+function parseCommaSeparatedAllowlist(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+export class CliConfigError extends Error {
+    code = 'CONFIG_ERROR';
+    constructor(message) {
+        super(message);
+    }
+}
+export async function loadClawverifyConfigFile(path) {
+    let raw;
+    try {
+        raw = await fs.readFile(path, 'utf8');
+    }
+    catch (err) {
+        throw new CliConfigError(`Could not read config file at ${path}: ${err instanceof Error ? err.message : 'unknown error'}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new CliConfigError(`Config file is not valid JSON: ${err instanceof Error ? err.message : 'unknown error'}`);
+    }
+    if (!isRecord(parsed) || parsed.config_version !== '1') {
+        throw new CliConfigError('Config must be an object with {"config_version":"1", ... }');
+    }
+    const allowlists = isRecord(parsed.allowlists) ? parsed.allowlists : {};
+    return {
+        config_version: '1',
+        allowlists: {
+            gateway_receipt_signer_dids: asStringArray(allowlists.gateway_receipt_signer_dids),
+            web_receipt_signer_dids: asStringArray(allowlists.web_receipt_signer_dids),
+            attestation_signer_dids: asStringArray(allowlists.attestation_signer_dids),
+            execution_attestation_signer_dids: asStringArray(allowlists.execution_attestation_signer_dids),
+            derivation_attestation_signer_dids: asStringArray(allowlists.derivation_attestation_signer_dids),
+            audit_result_attestation_signer_dids: asStringArray(allowlists.audit_result_attestation_signer_dids),
+        },
+    };
+}
+function mergeUnique(a, b) {
+    const out = new Set();
+    for (const v of a)
+        out.add(v);
+    for (const v of b)
+        out.add(v);
+    return [...out];
+}
+export async function resolveVerifierConfig(opts) {
+    const fileConfig = opts.configPath
+        ? await loadClawverifyConfigFile(opts.configPath)
+        : null;
+    const fileAllowlists = fileConfig?.allowlists ?? {};
+    // Env var parity with hosted clawverify service.
+    const envAllowlists = {
+        gateway_receipt_signer_dids: parseCommaSeparatedAllowlist(process.env.GATEWAY_RECEIPT_SIGNER_DIDS),
+        web_receipt_signer_dids: parseCommaSeparatedAllowlist(process.env.WEB_RECEIPT_SIGNER_DIDS),
+        attestation_signer_dids: parseCommaSeparatedAllowlist(process.env.ATTESTATION_SIGNER_DIDS),
+        execution_attestation_signer_dids: parseCommaSeparatedAllowlist(process.env.EXECUTION_ATTESTATION_SIGNER_DIDS),
+        derivation_attestation_signer_dids: parseCommaSeparatedAllowlist(process.env.DERIVATION_ATTESTATION_SIGNER_DIDS),
+        audit_result_attestation_signer_dids: parseCommaSeparatedAllowlist(process.env.AUDIT_RESULT_ATTESTATION_SIGNER_DIDS),
+    };
+    return {
+        gatewayReceiptSignerDids: mergeUnique(fileAllowlists.gateway_receipt_signer_dids ?? [], envAllowlists.gateway_receipt_signer_dids),
+        webReceiptSignerDids: mergeUnique(fileAllowlists.web_receipt_signer_dids ?? [], envAllowlists.web_receipt_signer_dids),
+        attestationSignerDids: mergeUnique(fileAllowlists.attestation_signer_dids ?? [], envAllowlists.attestation_signer_dids),
+        executionAttestationSignerDids: mergeUnique(fileAllowlists.execution_attestation_signer_dids ?? [], envAllowlists.execution_attestation_signer_dids),
+        derivationAttestationSignerDids: mergeUnique(fileAllowlists.derivation_attestation_signer_dids ?? [], envAllowlists.derivation_attestation_signer_dids),
+        auditResultAttestationSignerDids: mergeUnique(fileAllowlists.audit_result_attestation_signer_dids ?? [], envAllowlists.audit_result_attestation_signer_dids),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAIvC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAa,CAAC;AAChE,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAyB;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,GAAG,cAAc,CAAC;IAE/B,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY;IAEZ,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CACtB,iCAAiC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CACtB,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,cAAc,CACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,OAAO;QACL,cAAc,EAAE,GAAG;QACnB,UAAU,EAAE;YACV,2BAA2B,EAAE,aAAa,CACvC,UAAsC,CAAC,2BAA2B,CACpE;YACD,uBAAuB,EAAE,aAAa,CACnC,UAAsC,CAAC,uBAAuB,CAChE;YACD,uBAAuB,EAAE,aAAa,CACnC,UAAsC,CAAC,uBAAuB,CAChE;YACD,iCAAiC,EAAE,aAAa,CAC7C,UAAsC,CAAC,iCAAiC,CAC1E;YACD,kCAAkC,EAAE,aAAa,CAC9C,UAAsC,CAAC,kCAAkC,CAC3E;YACD,oCAAoC,EAAE,aAAa,CAChD,UAAsC,CAAC,oCAAoC,CAC7E;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAW,EAAE,CAAW;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAE3C;IACC,MAAM,UAAU,GAA8B,IAAI,CAAC,UAAU;QAC3D,CAAC,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,cAAc,GAAG,UAAU,EAAE,UAAU,IAAI,EAAE,CAAC;IAEpD,iDAAiD;IACjD,MAAM,aAAa,GAAG;QACpB,2BAA2B,EAAE,4BAA4B,CACvD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CACxC;QACD,uBAAuB,EAAE,4BAA4B,CACnD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CACpC;QACD,uBAAuB,EAAE,4BAA4B,CACnD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CACpC;QACD,iCAAiC,EAAE,4BAA4B,CAC7D,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAC9C;QACD,kCAAkC,EAAE,4BAA4B,CAC9D,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAC/C;QACD,oCAAoC,EAAE,4BAA4B,CAChE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CACjD;KACF,CAAC;IAEF,OAAO;QACL,wBAAwB,EAAE,WAAW,CACnC,cAAc,CAAC,2BAA2B,IAAI,EAAE,EAChD,aAAa,CAAC,2BAA2B,CAC1C;QACD,oBAAoB,EAAE,WAAW,CAC/B,cAAc,CAAC,uBAAuB,IAAI,EAAE,EAC5C,aAAa,CAAC,uBAAuB,CACtC;QACD,qBAAqB,EAAE,WAAW,CAChC,cAAc,CAAC,uBAAuB,IAAI,EAAE,EAC5C,aAAa,CAAC,uBAAuB,CACtC;QACD,8BAA8B,EAAE,WAAW,CACzC,cAAc,CAAC,iCAAiC,IAAI,EAAE,EACtD,aAAa,CAAC,iCAAiC,CAChD;QACD,+BAA+B,EAAE,WAAW,CAC1C,cAAc,CAAC,kCAAkC,IAAI,EAAE,EACvD,aAAa,CAAC,kCAAkC,CACjD;QACD,gCAAgC,EAAE,WAAW,CAC3C,cAAc,CAAC,oCAAoC,IAAI,EAAE,EACzD,aAAa,CAAC,oCAAoC,CACnD;KACF,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,5 @@
+export declare class CliUsageError extends Error {
+    readonly code = "USAGE_ERROR";
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,iBAAiB;gBAElB,OAAO,EAAE,MAAM;CAG5B"}

package/dist/errors.js

@@ -0,0 +1,7 @@
+export class CliUsageError extends Error {
+    code = 'USAGE_ERROR';
+    constructor(message) {
+        super(message);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,GAAG,aAAa,CAAC;IAE9B,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { resolveVerifierConfig, loadClawverifyConfigFile, CliConfigError } from './config.js';
+export { verifyProofBundleFromFile, verifyExportBundleFromFile } from './verify.js';
+export type { CliOutput, CliVerifyOutput, ClawverifyConfigV1, ResolvedVerifierConfig } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACpF,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { resolveVerifierConfig, loadClawverifyConfigFile, CliConfigError } from './config.js';
+export { verifyProofBundleFromFile, verifyExportBundleFromFile } from './verify.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,49 @@
+export type CliKind = 'proof_bundle' | 'export_bundle' | 'commit_sig';
+export type CliStatus = 'PASS' | 'FAIL' | 'ERROR';
+export interface CliOutputBase {
+    status: CliStatus;
+    verified_at: string;
+    reason_code: string;
+    reason: string;
+}
+export interface CliVerifyOutput extends CliOutputBase {
+    kind: CliKind;
+    input: {
+        path: string;
+        /** Optional config path (if provided explicitly). */
+        config_path?: string;
+        /** Optional URM path (proof bundles may reference a URM stored separately). */
+        urm_path?: string;
+    };
+    /** Raw verifier output (intentionally preserved for offline parity/debugging). */
+    verification?: unknown;
+}
+export interface CliErrorOutput extends CliOutputBase {
+    kind?: CliKind;
+    input?: {
+        path?: string;
+        config_path?: string;
+        urm_path?: string;
+    };
+}
+export type CliOutput = CliVerifyOutput | CliErrorOutput;
+export interface ClawverifyConfigV1 {
+    config_version: '1';
+    allowlists?: {
+        gateway_receipt_signer_dids?: string[];
+        web_receipt_signer_dids?: string[];
+        attestation_signer_dids?: string[];
+        execution_attestation_signer_dids?: string[];
+        derivation_attestation_signer_dids?: string[];
+        audit_result_attestation_signer_dids?: string[];
+    };
+}
+export interface ResolvedVerifierConfig {
+    gatewayReceiptSignerDids: string[];
+    webReceiptSignerDids: string[];
+    attestationSignerDids: string[];
+    executionAttestationSignerDids: string[];
+    derivationAttestationSignerDids: string[];
+    auditResultAttestationSignerDids: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG,cAAc,GAAG,eAAe,GAAG,YAAY,CAAC;AAEtE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,qDAAqD;QACrD,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,+EAA+E;QAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,cAAc,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,GAAG,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;QACvC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;QACnC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;QACnC,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7C,kCAAkC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9C,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC;KACjD,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8BAA8B,EAAE,MAAM,EAAE,CAAC;IACzC,+BAA+B,EAAE,MAAM,EAAE,CAAC;IAC1C,gCAAgC,EAAE,MAAM,EAAE,CAAC;CAC5C"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/verify.d.ts

@@ -0,0 +1,21 @@
+import type { CliKind, CliVerifyOutput, ResolvedVerifierConfig } from './types.js';
+export declare function verifyProofBundleFromFile(opts: {
+    inputPath: string;
+    /** Optional URM path. If not provided, clawverify will try to auto-load a sibling "-urm.json" file for "-bundle.json" inputs. */
+    urmPath?: string;
+    configPath?: string;
+    config: ResolvedVerifierConfig;
+}): Promise<CliVerifyOutput>;
+export declare function verifyExportBundleFromFile(opts: {
+    inputPath: string;
+    configPath?: string;
+    config: ResolvedVerifierConfig;
+}): Promise<CliVerifyOutput>;
+export declare function exitCodeForOutput(out: {
+    status: string;
+}): number;
+export declare function verifyCommitSigFromFile(opts: {
+    inputPath: string;
+}): Promise<CliVerifyOutput>;
+export declare function kindForSubcommand(cmd: string): CliKind | null;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AA8FnF,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,iIAAiI;IACjI,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,sBAAsB,CAAC;CAChC,GAAG,OAAO,CAAC,eAAe,CAAC,CAwE3B;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,sBAAsB,CAAC;CAChC,GAAG,OAAO,CAAC,eAAe,CAAC,CA4F3B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIjE;AAkED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoI3B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAK7D"}

package/dist/verify.js

@@ -0,0 +1,448 @@
+import * as fs from 'node:fs/promises';
+import { verifyExportBundle, verifyProofBundle, } from '@clawbureau/clawverify-core';
+import { CliUsageError } from './errors.js';
+function nowIso() {
+    return new Date().toISOString();
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+async function readJsonFile(path) {
+    let raw;
+    try {
+        raw = await fs.readFile(path, 'utf8');
+    }
+    catch (err) {
+        throw new CliUsageError(`Could not read input file at ${path}: ${err instanceof Error ? err.message : 'unknown error'}`);
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        throw new CliUsageError(`Input file is not valid JSON: ${err instanceof Error ? err.message : 'unknown error'}`);
+    }
+}
+function unwrapProofBundleInput(value) {
+    if (!isRecord(value))
+        return value;
+    const envelope = value.envelope;
+    if (envelope !== undefined)
+        return envelope;
+    return value;
+}
+function unwrapExportBundleInput(value) {
+    if (!isRecord(value))
+        return value;
+    const bundle = value.bundle;
+    if (bundle !== undefined)
+        return bundle;
+    return value;
+}
+function countReceiptsFromEnvelope(envelope) {
+    if (!isRecord(envelope))
+        return 0;
+    const payload = envelope.payload;
+    if (!isRecord(payload))
+        return 0;
+    const receipts = payload.receipts;
+    if (!Array.isArray(receipts))
+        return 0;
+    return receipts.length;
+}
+function strictProofBundleReceiptVerdict(opts) {
+    const receiptsCount = countReceiptsFromEnvelope(opts.envelope);
+    if (receiptsCount === 0)
+        return { ok: true };
+    // Fail-closed: if receipts are present, a signer allowlist MUST be configured.
+    if (opts.config.gatewayReceiptSignerDids.length === 0) {
+        return {
+            ok: false,
+            reason_code: 'DEPENDENCY_NOT_CONFIGURED',
+            reason: 'Gateway receipt signer allowlist not configured (required to verify receipts)',
+        };
+    }
+    const cr = opts.verification.result.component_results;
+    const verified = cr?.receipts_verified_count ?? 0;
+    const sigVerified = cr?.receipts_signature_verified_count ?? 0;
+    // Conformance mode: all receipts must verify and be bound.
+    if (verified !== receiptsCount) {
+        if (sigVerified === receiptsCount) {
+            return {
+                ok: false,
+                reason_code: 'RECEIPT_BINDING_MISMATCH',
+                reason: 'One or more receipts are not bound to the proof bundle event chain',
+            };
+        }
+        return {
+            ok: false,
+            reason_code: 'RECEIPT_VERIFICATION_FAILED',
+            reason: 'One or more receipts failed cryptographic verification',
+        };
+    }
+    return { ok: true };
+}
+export async function verifyProofBundleFromFile(opts) {
+    const verifiedAt = nowIso();
+    const raw = await readJsonFile(opts.inputPath);
+    const envelope = unwrapProofBundleInput(raw);
+    // Optional: load URM from an explicit flag, or auto-detect a sibling file for canonical PoH evidence packs.
+    let resolvedUrmPath = opts.urmPath;
+    if (!resolvedUrmPath && opts.inputPath.endsWith('-bundle.json')) {
+        const candidate = opts.inputPath.replace(/-bundle\.json$/, '-urm.json');
+        try {
+            await fs.access(candidate);
+            resolvedUrmPath = candidate;
+        }
+        catch {
+            // ignore
+        }
+    }
+    const urm = resolvedUrmPath ? await readJsonFile(resolvedUrmPath) : undefined;
+    const input = {
+        path: opts.inputPath,
+        config_path: opts.configPath,
+        urm_path: resolvedUrmPath,
+    };
+    const verification = await verifyProofBundle(envelope, {
+        allowlistedReceiptSignerDids: opts.config.gatewayReceiptSignerDids,
+        allowlistedAttesterDids: opts.config.attestationSignerDids,
+        urm,
+    });
+    if (verification.result.status !== 'VALID') {
+        return {
+            kind: 'proof_bundle',
+            status: 'FAIL',
+            verified_at: verifiedAt,
+            reason_code: verification.error?.code ?? 'INVALID',
+            reason: verification.error?.message ?? verification.result.reason,
+            input,
+            verification,
+        };
+    }
+    const strict = strictProofBundleReceiptVerdict({
+        envelope,
+        verification,
+        config: opts.config,
+    });
+    if (!strict.ok) {
+        return {
+            kind: 'proof_bundle',
+            status: 'FAIL',
+            verified_at: verifiedAt,
+            reason_code: strict.reason_code,
+            reason: strict.reason,
+            input,
+            verification,
+        };
+    }
+    return {
+        kind: 'proof_bundle',
+        status: 'PASS',
+        verified_at: verifiedAt,
+        reason_code: 'OK',
+        reason: 'Proof bundle verified successfully',
+        input,
+        verification,
+    };
+}
+export async function verifyExportBundleFromFile(opts) {
+    const verifiedAt = nowIso();
+    const raw = await readJsonFile(opts.inputPath);
+    const bundle = unwrapExportBundleInput(raw);
+    const verification = await verifyExportBundle(bundle, {
+        allowlistedReceiptSignerDids: opts.config.gatewayReceiptSignerDids,
+        allowlistedAttesterDids: opts.config.attestationSignerDids,
+        allowlistedExecutionAttestationSignerDids: opts.config.executionAttestationSignerDids,
+        allowlistedDerivationAttestationSignerDids: opts.config.derivationAttestationSignerDids,
+        allowlistedAuditResultAttestationSignerDids: opts.config.auditResultAttestationSignerDids,
+    });
+    if (verification.result.status !== 'VALID') {
+        return {
+            kind: 'export_bundle',
+            status: 'FAIL',
+            verified_at: verifiedAt,
+            reason_code: verification.error?.code ?? 'INVALID',
+            reason: verification.error?.message ?? verification.result.reason,
+            input: {
+                path: opts.inputPath,
+                config_path: opts.configPath,
+            },
+            verification,
+        };
+    }
+    // Optional strict receipt enforcement for nested proof bundle.
+    const nestedProofEnvelope = bundle?.artifacts?.proof_bundle_envelope;
+    if (nestedProofEnvelope !== undefined) {
+        const proofOut = await verifyProofBundle(nestedProofEnvelope, {
+            allowlistedReceiptSignerDids: opts.config.gatewayReceiptSignerDids,
+            allowlistedAttesterDids: opts.config.attestationSignerDids,
+        });
+        if (proofOut.result.status !== 'VALID') {
+            return {
+                kind: 'export_bundle',
+                status: 'FAIL',
+                verified_at: verifiedAt,
+                reason_code: proofOut.error?.code ?? 'INVALID',
+                reason: `Nested proof bundle verification failed: ${proofOut.error?.message ?? proofOut.result.reason}`,
+                input: {
+                    path: opts.inputPath,
+                    config_path: opts.configPath,
+                },
+                verification: {
+                    export_bundle: verification,
+                    proof_bundle: proofOut,
+                },
+            };
+        }
+        const strict = strictProofBundleReceiptVerdict({
+            envelope: nestedProofEnvelope,
+            verification: proofOut,
+            config: opts.config,
+        });
+        if (!strict.ok) {
+            return {
+                kind: 'export_bundle',
+                status: 'FAIL',
+                verified_at: verifiedAt,
+                reason_code: strict.reason_code,
+                reason: strict.reason,
+                input: {
+                    path: opts.inputPath,
+                    config_path: opts.configPath,
+                },
+                verification: {
+                    export_bundle: verification,
+                    proof_bundle: proofOut,
+                },
+            };
+        }
+    }
+    return {
+        kind: 'export_bundle',
+        status: 'PASS',
+        verified_at: verifiedAt,
+        reason_code: 'OK',
+        reason: 'Export bundle verified successfully',
+        input: {
+            path: opts.inputPath,
+            config_path: opts.configPath,
+        },
+        verification,
+    };
+}
+export function exitCodeForOutput(out) {
+    if (out.status === 'PASS')
+        return 0;
+    if (out.status === 'FAIL')
+        return 1;
+    return 2;
+}
+// ---------------------------------------------------------------------------
+// commit-sig verification (did-work Protocol M)
+// ---------------------------------------------------------------------------
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+function base58Decode(str) {
+    const bytes = [0];
+    for (const char of str) {
+        const value = BASE58_ALPHABET.indexOf(char);
+        if (value === -1)
+            throw new Error(`Invalid base58 character: ${char}`);
+        for (let i = 0; i < bytes.length; i++)
+            bytes[i] *= 58;
+        bytes[0] += value;
+        let carry = 0;
+        for (let i = 0; i < bytes.length; i++) {
+            bytes[i] += carry;
+            carry = bytes[i] >> 8;
+            bytes[i] &= 0xff;
+        }
+        while (carry) {
+            bytes.push(carry & 0xff);
+            carry >>= 8;
+        }
+    }
+    for (const char of str) {
+        if (char !== '1')
+            break;
+        bytes.push(0);
+    }
+    return new Uint8Array(bytes.reverse());
+}
+function extractEd25519PublicKeyFromDidKey(did) {
+    if (!did.startsWith('did:key:z'))
+        return null;
+    try {
+        const decoded = base58Decode(did.slice(9));
+        if (decoded[0] === 0xed && decoded[1] === 0x01)
+            return decoded.slice(2);
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** RFC 8785 JSON Canonicalization Scheme (JCS) */
+function jcsCanonicalize(value) {
+    if (value === null)
+        return 'null';
+    switch (typeof value) {
+        case 'boolean': return value ? 'true' : 'false';
+        case 'number': {
+            if (!Number.isFinite(value))
+                throw new Error('Non-finite number not allowed in JCS');
+            return JSON.stringify(value);
+        }
+        case 'string': return JSON.stringify(value);
+        case 'object': {
+            if (Array.isArray(value))
+                return `[${value.map(jcsCanonicalize).join(',')}]`;
+            const obj = value;
+            const keys = Object.keys(obj).sort();
+            const parts = [];
+            for (const k of keys)
+                parts.push(`${JSON.stringify(k)}:${jcsCanonicalize(obj[k])}`);
+            return `{${parts.join(',')}}`;
+        }
+        default: throw new Error(`Unsupported value type for JCS: ${typeof value}`);
+    }
+}
+function toArrayBuffer(bytes) {
+    const buf = bytes.buffer;
+    if (buf instanceof ArrayBuffer)
+        return buf.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    const copy = new Uint8Array(bytes.byteLength);
+    copy.set(bytes);
+    return copy.buffer;
+}
+export async function verifyCommitSigFromFile(opts) {
+    const verifiedAt = nowIso();
+    const raw = await readJsonFile(opts.inputPath);
+    if (!isRecord(raw)) {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'MALFORMED_ENVELOPE', reason: 'commit.sig.json must be a JSON object',
+            input: { path: opts.inputPath },
+        };
+    }
+    const { version, type, algo, did, message, signature } = raw;
+    if (version !== 'm1') {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'UNKNOWN_VERSION', reason: `Unsupported version: ${String(version)}`,
+            input: { path: opts.inputPath },
+        };
+    }
+    if (type !== 'message_signature') {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'UNKNOWN_TYPE', reason: `Unsupported type: ${String(type)}`,
+            input: { path: opts.inputPath },
+        };
+    }
+    if (algo !== 'ed25519') {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'UNKNOWN_ALGO', reason: `Unsupported algo: ${String(algo)}`,
+            input: { path: opts.inputPath },
+        };
+    }
+    const commitMatch = String(message ?? '').match(/^commit:([a-f0-9]{7,64})$/i);
+    if (!commitMatch) {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'COMMIT_MESSAGE_INVALID',
+            reason: 'Invalid message format (expected "commit:<sha>")',
+            input: { path: opts.inputPath },
+            verification: { signer_did: typeof did === 'string' ? did : undefined },
+        };
+    }
+    const commitSha = commitMatch[1];
+    const publicKeyBytes = typeof did === 'string' ? extractEd25519PublicKeyFromDidKey(did) : null;
+    if (!publicKeyBytes) {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'INVALID_DID_FORMAT',
+            reason: 'Unsupported DID format (expected did:key with Ed25519 multicodec)',
+            input: { path: opts.inputPath },
+            verification: { commit_sha: commitSha, signer_did: typeof did === 'string' ? did : undefined },
+        };
+    }
+    if (typeof signature !== 'string' || signature.length === 0) {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'MALFORMED_ENVELOPE', reason: 'Missing signature field',
+            input: { path: opts.inputPath },
+            verification: { commit_sha: commitSha, signer_did: did },
+        };
+    }
+    let sigBytes;
+    try {
+        const binary = atob(signature);
+        sigBytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++)
+            sigBytes[i] = binary.charCodeAt(i);
+    }
+    catch {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'MALFORMED_ENVELOPE', reason: 'Invalid base64 signature',
+            input: { path: opts.inputPath },
+            verification: { commit_sha: commitSha, signer_did: did },
+        };
+    }
+    if (sigBytes.length !== 64) {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'MALFORMED_ENVELOPE', reason: 'Signature must be 64 bytes',
+            input: { path: opts.inputPath },
+            verification: { commit_sha: commitSha, signer_did: did },
+        };
+    }
+    // Protocol M: sign JCS-canonicalized envelope with signature=""
+    let canonical;
+    try {
+        canonical = jcsCanonicalize({ ...raw, signature: '' });
+    }
+    catch (err) {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'CANONICALIZATION_ERROR',
+            reason: err instanceof Error ? err.message : 'Canonicalization failed',
+            input: { path: opts.inputPath },
+            verification: { commit_sha: commitSha, signer_did: did },
+        };
+    }
+    const msgBytes = new TextEncoder().encode(canonical);
+    try {
+        const publicKey = await crypto.subtle.importKey('raw', toArrayBuffer(publicKeyBytes), { name: 'Ed25519' }, false, ['verify']);
+        const ok = await crypto.subtle.verify({ name: 'Ed25519' }, publicKey, toArrayBuffer(sigBytes), toArrayBuffer(msgBytes));
+        return {
+            kind: 'commit_sig',
+            status: ok ? 'PASS' : 'FAIL',
+            verified_at: verifiedAt,
+            reason_code: ok ? 'OK' : 'SIGNATURE_INVALID',
+            reason: ok ? 'Commit signature verified' : 'Signature verification failed',
+            input: { path: opts.inputPath },
+            verification: { commit_sha: commitSha, signer_did: did, message: String(message) },
+        };
+    }
+    catch (err) {
+        return {
+            kind: 'commit_sig', status: 'FAIL', verified_at: verifiedAt,
+            reason_code: 'CRYPTO_ERROR',
+            reason: err instanceof Error ? err.message : 'Crypto verification error',
+            input: { path: opts.inputPath },
+            verification: { commit_sha: commitSha, signer_did: did },
+        };
+    }
+}
+export function kindForSubcommand(cmd) {
+    if (cmd === 'proof-bundle' || cmd === 'proof_bundle')
+        return 'proof_bundle';
+    if (cmd === 'export-bundle' || cmd === 'export_bundle')
+        return 'export_bundle';
+    if (cmd === 'commit-sig' || cmd === 'commit_sig')
+        return 'commit_sig';
+    return null;
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAMlB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,gCAAgC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAChG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAiB;IAClD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,SAAS,+BAA+B,CAAC,IAIxC;IACC,MAAM,aAAa,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,aAAa,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE7C,+EAA+E;IAC/E,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,2BAA2B;YACxC,MAAM,EAAE,+EAA+E;SACxF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC;IACtD,MAAM,QAAQ,GAAG,EAAE,EAAE,uBAAuB,IAAI,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,EAAE,EAAE,iCAAiC,IAAI,CAAC,CAAC;IAE/D,2DAA2D;IAC3D,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,WAAW,EAAE,0BAA0B;gBACvC,MAAM,EAAE,oEAAoE;aAC7E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,6BAA6B;YAC1C,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAM/C;IACC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAE5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAuC,CAAC;IAEnF,4GAA4G;IAC5G,IAAI,eAAe,GAAuB,IAAI,CAAC,OAAO,CAAC;IAEvD,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,QAAQ,EAAE,eAAe;KAC1B,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE;QACrD,4BAA4B,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB;QAClE,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAC1D,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,YAAY,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS;YAClD,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM;YACjE,KAAK;YACL,YAAY;SACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,+BAA+B,CAAC;QAC7C,QAAQ;QACR,YAAY;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK;YACL,YAAY;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,oCAAoC;QAC5C,KAAK;QACL,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAIhD;IACC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAE5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAwB,CAAC;IAEnE,MAAM,YAAY,GAA+B,MAAM,kBAAkB,CAAC,MAAM,EAAE;QAChF,4BAA4B,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB;QAClE,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAC1D,yCAAyC,EAAE,IAAI,CAAC,MAAM,CAAC,8BAA8B;QACrF,0CAA0C,EAAE,IAAI,CAAC,MAAM,CAAC,+BAA+B;QACvF,2CAA2C,EAAE,IAAI,CAAC,MAAM,CAAC,gCAAgC;KAC1F,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,YAAY,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS;YAClD,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM;YACjE,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI,CAAC,SAAS;gBACpB,WAAW,EAAE,IAAI,CAAC,UAAU;aAC7B;YACD,YAAY;SACb,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,MAAM,mBAAmB,GAAI,MAAc,EAAE,SAAS,EAAE,qBAAqB,CAAC;IAC9E,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;YAC5D,4BAA4B,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB;YAClE,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;SAC3D,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,UAAU;gBACvB,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS;gBAC9C,MAAM,EAAE,4CAA4C,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;gBACvG,KAAK,EAAE;oBACL,IAAI,EAAE,IAAI,CAAC,SAAS;oBACpB,WAAW,EAAE,IAAI,CAAC,UAAU;iBAC7B;gBACD,YAAY,EAAE;oBACZ,aAAa,EAAE,YAAY;oBAC3B,YAAY,EAAE,QAAQ;iBACvB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,+BAA+B,CAAC;YAC7C,QAAQ,EAAE,mBAAmB;YAC7B,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,UAAU;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE;oBACL,IAAI,EAAE,IAAI,CAAC,SAAS;oBACpB,WAAW,EAAE,IAAI,CAAC,UAAU;iBAC7B;gBACD,YAAY,EAAE;oBACZ,aAAa,EAAE,YAAY;oBAC3B,YAAY,EAAE,QAAQ;iBACvB;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,qCAAqC;QAC7C,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,WAAW,EAAE,IAAI,CAAC,UAAU;SAC7B;QACD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAClB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;YAClB,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtB,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YAAC,KAAK,KAAK,CAAC,CAAC;QAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QAAC,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACnE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iCAAiC,CAAC,GAAW;IACpD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,kDAAkD;AAClD,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAChD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5C,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7E,MAAM,GAAG,GAAG,KAAgC,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,IAAI,GAAG,YAAY,WAAW;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAE7C;IACC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAE5B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,uCAAuC;YAClF,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,GAA8B,CAAC;IAExF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,OAAO,CAAC,EAAE;YACjF,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,EAAE;YACxE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,EAAE;YACxE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,wBAAwB;YACrC,MAAM,EAAE,kDAAkD;YAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAEjC,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,oBAAoB;YACjC,MAAM,EAAE,mEAAmE;YAC3E,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE;SAC/F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,yBAAyB;YACpE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAa,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,0BAA0B;YACrE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAa,EAAE;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,4BAA4B;YACvE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAa,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,wBAAwB;YACrC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB;YACtE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAa,EAAE;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAC7E,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACnC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CACjF,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC5B,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;YAC5C,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,+BAA+B;YAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;YAC3D,WAAW,EAAE,cAAc;YAC3B,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;YACxE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YAC/B,YAAY,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAa,EAAE;SACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IAC5E,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,eAAe;QAAE,OAAO,eAAe,CAAC;IAC/E,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@clawbureau/clawverify-cli",
+  "version": "0.1.0",
+  "description": "Offline verifier CLI for the Clawsig Protocol — verify proof bundles, export bundles, and commit signatures without network access.",
+  "type": "module",
+  "bin": {
+    "clawverify": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map",
+    "dist/**/*.js.map",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "clawsig",
+    "verifier",
+    "proof-bundle",
+    "offline-verification",
+    "Ed25519",
+    "DID",
+    "agent-verification"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/clawbureau/clawbureau",
+    "directory": "packages/clawverify-cli"
+  },
+  "homepage": "https://github.com/clawbureau/clawbureau/tree/main/packages/clawverify-cli",
+  "bugs": "https://github.com/clawbureau/clawbureau/issues",
+  "dependencies": {
+    "@clawbureau/clawverify-core": "file:../clawverify-core"
+  },
+  "devDependencies": {
+    "@types/node": "^25.2.1",
+    "typescript": "^5.7.0",
+    "vitest": "^1.2.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MIT"
+}