@clawbureau/clawverify-core 0.1.0

package/dist/verify-export-bundle.js

@@ -0,0 +1,307 @@
+/**
+ * Export Bundle Verification
+ * POHVN-US-007: Audit-ready export bundles (offline verifiability)
+ */
+import { isValidDidFormat, isValidIsoDate } from './schema-registry.js';
+import { base64UrlDecode, base64UrlEncode, extractPublicKeyFromDidKey, verifySignature, } from './crypto.js';
+import { validateExportBundleV1 } from './schema-validation.js';
+import { verifyProofBundle } from './verify-proof-bundle.js';
+import { verifyExecutionAttestation } from './verify-execution-attestation.js';
+import { verifyDerivationAttestation } from './verify-derivation-attestation.js';
+import { verifyAuditResultAttestation } from './verify-audit-result-attestation.js';
+import { jcsCanonicalize } from './jcs.js';
+function utf8Bytes(input) {
+    return new TextEncoder().encode(input);
+}
+async function sha256B64u(input) {
+    const digest = await crypto.subtle.digest('SHA-256', input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+function manifestPathFor(kind, index) {
+    if (index === undefined)
+        return `artifacts/${kind}.json`;
+    return `artifacts/${kind}/${index}.json`;
+}
+async function manifestEntry(path, value) {
+    const canonical = jcsCanonicalize(value);
+    const bytes = utf8Bytes(canonical);
+    return {
+        path,
+        sha256_b64u: await sha256B64u(bytes),
+        content_type: 'application/json',
+        size_bytes: bytes.byteLength,
+    };
+}
+async function computeExpectedManifestEntries(bundle) {
+    const entries = [];
+    entries.push(await manifestEntry(manifestPathFor('proof_bundle_envelope'), bundle.artifacts.proof_bundle_envelope));
+    const execution = bundle.artifacts.execution_attestation_envelopes ?? [];
+    for (let i = 0; i < execution.length; i++) {
+        entries.push(await manifestEntry(manifestPathFor('execution_attestation_envelopes', i), execution[i]));
+    }
+    const derivation = bundle.artifacts.derivation_attestation_envelopes ?? [];
+    for (let i = 0; i < derivation.length; i++) {
+        entries.push(await manifestEntry(manifestPathFor('derivation_attestation_envelopes', i), derivation[i]));
+    }
+    const audit = bundle.artifacts.audit_result_attestation_envelopes ?? [];
+    for (let i = 0; i < audit.length; i++) {
+        entries.push(await manifestEntry(manifestPathFor('audit_result_attestation_envelopes', i), audit[i]));
+    }
+    return entries.sort((a, b) => a.path.localeCompare(b.path));
+}
+function normalizeManifestEntries(entries) {
+    return [...entries].sort((a, b) => a.path.localeCompare(b.path));
+}
+function firstRunIdFromProofBundle(bundle) {
+    const events = bundle.artifacts.proof_bundle_envelope?.payload?.event_chain;
+    if (!Array.isArray(events) || events.length === 0)
+        return null;
+    const runId = events[0]?.run_id;
+    return typeof runId === 'string' && runId.length > 0 ? runId : null;
+}
+function signableBundleView(bundle) {
+    const out = {
+        export_version: bundle.export_version,
+        export_id: bundle.export_id,
+        created_at: bundle.created_at,
+        issuer_did: bundle.issuer_did,
+        manifest: bundle.manifest,
+        artifacts: bundle.artifacts,
+        issued_at: bundle.issued_at,
+    };
+    if (bundle.metadata !== undefined) {
+        out.metadata = bundle.metadata;
+    }
+    return out;
+}
+function invalid(now, reason, error, extras = {}) {
+    return {
+        result: {
+            status: 'INVALID',
+            reason,
+            envelope_type: 'export_bundle',
+            verified_at: now,
+        },
+        error,
+        ...extras,
+    };
+}
+function valid(now, bundle, extras = {}) {
+    return {
+        result: {
+            status: 'VALID',
+            reason: 'Export bundle verified successfully',
+            envelope_type: 'export_bundle',
+            signer_did: bundle.issuer_did,
+            verified_at: now,
+        },
+        export_id: bundle.export_id,
+        bundle_hash_b64u: bundle.bundle_hash_b64u,
+        ...extras,
+    };
+}
+export async function verifyExportBundle(bundleInput, options = {}) {
+    const now = new Date().toISOString();
+    const schemaResult = validateExportBundleV1(bundleInput);
+    if (!schemaResult.valid) {
+        return invalid(now, schemaResult.message, {
+            code: 'SCHEMA_VALIDATION_FAILED',
+            message: schemaResult.message,
+            field: schemaResult.field,
+        });
+    }
+    const bundle = bundleInput;
+    if (!isValidDidFormat(bundle.issuer_did)) {
+        return invalid(now, 'Invalid issuer DID format', {
+            code: 'INVALID_DID_FORMAT',
+            message: 'issuer_did must be a valid DID string',
+            field: 'issuer_did',
+        });
+    }
+    if (!isValidIsoDate(bundle.created_at) || !isValidIsoDate(bundle.issued_at)) {
+        return invalid(now, 'Invalid date fields', {
+            code: 'MALFORMED_ENVELOPE',
+            message: 'created_at and issued_at must be valid ISO 8601 strings',
+            field: !isValidIsoDate(bundle.created_at) ? 'created_at' : 'issued_at',
+        });
+    }
+    // 1) Verify manifest hashes/content-addressing against included artifacts.
+    const providedEntries = normalizeManifestEntries(bundle.manifest.entries);
+    const expectedEntries = await computeExpectedManifestEntries(bundle);
+    const pathSet = new Set();
+    for (const e of providedEntries) {
+        if (pathSet.has(e.path)) {
+            return invalid(now, 'Manifest contains duplicate path entries', {
+                code: 'MALFORMED_ENVELOPE',
+                message: `Duplicate manifest path: ${e.path}`,
+                field: 'manifest.entries.path',
+            });
+        }
+        pathSet.add(e.path);
+    }
+    if (providedEntries.length !== expectedEntries.length) {
+        return invalid(now, 'Manifest entry count mismatch', {
+            code: 'MISSING_REQUIRED_FIELD',
+            message: `manifest.entries count (${providedEntries.length}) does not match expected artifact count (${expectedEntries.length})`,
+            field: 'manifest.entries',
+        });
+    }
+    const providedMap = new Map(providedEntries.map((e) => [e.path, e]));
+    for (const expected of expectedEntries) {
+        const actual = providedMap.get(expected.path);
+        if (!actual) {
+            return invalid(now, 'Manifest missing expected artifact path', {
+                code: 'MISSING_REQUIRED_FIELD',
+                message: `manifest is missing expected path ${expected.path}`,
+                field: 'manifest.entries.path',
+            });
+        }
+        if (actual.sha256_b64u !== expected.sha256_b64u) {
+            return invalid(now, 'Manifest hash mismatch', {
+                code: 'HASH_MISMATCH',
+                message: `manifest hash mismatch for ${expected.path}`,
+                field: `manifest.entries[${expected.path}].sha256_b64u`,
+            });
+        }
+        if (actual.content_type !== expected.content_type) {
+            return invalid(now, 'Manifest content type mismatch', {
+                code: 'MALFORMED_ENVELOPE',
+                message: `manifest content_type mismatch for ${expected.path}`,
+                field: `manifest.entries[${expected.path}].content_type`,
+            });
+        }
+        if (actual.size_bytes !== expected.size_bytes) {
+            return invalid(now, 'Manifest size mismatch', {
+                code: 'HASH_MISMATCH',
+                message: `manifest size_bytes mismatch for ${expected.path}`,
+                field: `manifest.entries[${expected.path}].size_bytes`,
+            });
+        }
+    }
+    // 2) Verify export bundle hash + signature.
+    const computedBundleHash = await sha256B64u(utf8Bytes(jcsCanonicalize(signableBundleView(bundle))));
+    if (computedBundleHash !== bundle.bundle_hash_b64u) {
+        return invalid(now, 'Export bundle hash mismatch', {
+            code: 'HASH_MISMATCH',
+            message: 'Computed bundle hash does not match bundle_hash_b64u',
+            field: 'bundle_hash_b64u',
+        });
+    }
+    const exportPublicKey = extractPublicKeyFromDidKey(bundle.issuer_did);
+    if (!exportPublicKey) {
+        return invalid(now, 'Could not extract public key from issuer DID', {
+            code: 'INVALID_DID_FORMAT',
+            message: 'issuer_did must be did:key with Ed25519 multicodec key',
+            field: 'issuer_did',
+        });
+    }
+    let bundleSigBytes;
+    try {
+        bundleSigBytes = base64UrlDecode(bundle.signature_b64u);
+    }
+    catch {
+        return invalid(now, 'Invalid export bundle signature encoding', {
+            code: 'MALFORMED_ENVELOPE',
+            message: 'signature_b64u is not valid base64url',
+            field: 'signature_b64u',
+        });
+    }
+    const bundleSigOk = await verifySignature('Ed25519', exportPublicKey, bundleSigBytes, utf8Bytes(bundle.bundle_hash_b64u));
+    if (!bundleSigOk) {
+        return invalid(now, 'Export bundle signature verification failed', {
+            code: 'SIGNATURE_INVALID',
+            message: 'signature_b64u does not verify bundle_hash_b64u using issuer_did key',
+            field: 'signature_b64u',
+        });
+    }
+    // 3) Verify included envelopes with existing verifiers (offline, no network calls).
+    const proofBundleOut = await verifyProofBundle(bundle.artifacts.proof_bundle_envelope, {
+        allowlistedReceiptSignerDids: options.allowlistedReceiptSignerDids,
+        allowlistedAttesterDids: options.allowlistedAttesterDids,
+    });
+    if (proofBundleOut.result.status !== 'VALID') {
+        return invalid(now, `Proof bundle verification failed: ${proofBundleOut.result.reason}`, proofBundleOut.error ?? {
+            code: 'MALFORMED_ENVELOPE',
+            message: 'proof_bundle_envelope failed verification',
+            field: 'artifacts.proof_bundle_envelope',
+        }, {
+            export_id: bundle.export_id,
+            bundle_hash_b64u: bundle.bundle_hash_b64u,
+        });
+    }
+    const expectedProofBundleHash = bundle.artifacts.proof_bundle_envelope.payload_hash_b64u;
+    const expectedRunId = firstRunIdFromProofBundle(bundle);
+    const expectedAgentDid = bundle.artifacts.proof_bundle_envelope.payload.agent_did;
+    const execution = bundle.artifacts.execution_attestation_envelopes ?? [];
+    for (let i = 0; i < execution.length; i++) {
+        const out = await verifyExecutionAttestation(execution[i], {
+            allowlistedSignerDids: options.allowlistedExecutionAttestationSignerDids,
+        });
+        if (out.result.status !== 'VALID') {
+            return invalid(now, `Execution attestation verification failed (index ${i})`, out.error ?? {
+                code: 'MALFORMED_ENVELOPE',
+                message: 'execution_attestation_envelope failed verification',
+                field: `artifacts.execution_attestation_envelopes[${i}]`,
+            });
+        }
+        if (out.proof_bundle_hash_b64u !== expectedProofBundleHash) {
+            return invalid(now, 'Execution attestation proof bundle hash mismatch', {
+                code: 'HASH_MISMATCH',
+                message: `execution_attestation proof_bundle_hash_b64u mismatch at index ${i}`,
+                field: `artifacts.execution_attestation_envelopes[${i}].payload.proof_bundle_hash_b64u`,
+            });
+        }
+        if (expectedRunId && out.run_id !== expectedRunId) {
+            return invalid(now, 'Execution attestation run_id mismatch', {
+                code: 'HASH_MISMATCH',
+                message: `execution_attestation run_id mismatch at index ${i}`,
+                field: `artifacts.execution_attestation_envelopes[${i}].payload.run_id`,
+            });
+        }
+        if (out.agent_did !== expectedAgentDid) {
+            return invalid(now, 'Execution attestation agent_did mismatch', {
+                code: 'HASH_MISMATCH',
+                message: `execution_attestation agent_did mismatch at index ${i}`,
+                field: `artifacts.execution_attestation_envelopes[${i}].payload.agent_did`,
+            });
+        }
+    }
+    const derivations = bundle.artifacts.derivation_attestation_envelopes ?? [];
+    for (let i = 0; i < derivations.length; i++) {
+        const out = await verifyDerivationAttestation(derivations[i], {
+            allowlistedSignerDids: options.allowlistedDerivationAttestationSignerDids,
+        });
+        if (out.result.status !== 'VALID') {
+            return invalid(now, `Derivation attestation verification failed (index ${i})`, out.error ?? {
+                code: 'MALFORMED_ENVELOPE',
+                message: 'derivation_attestation_envelope failed verification',
+                field: `artifacts.derivation_attestation_envelopes[${i}]`,
+            });
+        }
+    }
+    const audits = bundle.artifacts.audit_result_attestation_envelopes ?? [];
+    for (let i = 0; i < audits.length; i++) {
+        const out = await verifyAuditResultAttestation(audits[i], {
+            allowlistedSignerDids: options.allowlistedAuditResultAttestationSignerDids,
+        });
+        if (out.result.status !== 'VALID') {
+            return invalid(now, `Audit-result attestation verification failed (index ${i})`, out.error ?? {
+                code: 'MALFORMED_ENVELOPE',
+                message: 'audit_result_attestation_envelope failed verification',
+                field: `artifacts.audit_result_attestation_envelopes[${i}]`,
+            });
+        }
+    }
+    return valid(now, bundle, {
+        manifest_entries_verified: expectedEntries.length,
+        verified_components: {
+            proof_bundle_valid: true,
+            execution_attestations_verified: execution.length,
+            derivation_attestations_verified: derivations.length,
+            audit_result_attestations_verified: audits.length,
+        },
+        proof_tier: proofBundleOut.result.proof_tier,
+        model_identity_tier: proofBundleOut.result.model_identity_tier,
+    });
+}
+//# sourceMappingURL=verify-export-bundle.js.map

package/dist/verify-export-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-export-bundle.js","sourceRoot":"","sources":["../src/verify-export-bundle.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAU3C,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAiB;IACzC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CACzF,CAAC;IACF,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,aAAa,IAAI,OAAO,CAAC;IACzD,OAAO,aAAa,IAAI,IAAI,KAAK,OAAO,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,KAAc;IACvD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAEnC,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC;QACpC,YAAY,EAAE,kBAAkB;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,MAA2B;IACvE,MAAM,OAAO,GAAgC,EAAE,CAAC;IAEhD,OAAO,CAAC,IAAI,CACV,MAAM,aAAa,CACjB,eAAe,CAAC,uBAAuB,CAAC,EACxC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CACvC,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,+BAA+B,IAAI,EAAE,CAAC;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,eAAe,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,gCAAgC,IAAI,EAAE,CAAC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,eAAe,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,kCAAkC,IAAI,EAAE,CAAC;IACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,eAAe,CAAC,oCAAoC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAoC;IACpE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA2B;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,OAAO,EAAE,WAAW,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA2B;IACrD,MAAM,GAAG,GAA4B;QACnC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CACd,GAAW,EACX,MAAc,EACd,KAAwB,EACxB,SAA8C,EAAE;IAEhD,OAAO;QACL,MAAM,EAAE;YACN,MAAM,EAAE,SAAS;YACjB,MAAM;YACN,aAAa,EAAE,eAAe;YAC9B,WAAW,EAAE,GAAG;SACjB;QACD,KAAK;QACL,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CACZ,GAAW,EACX,MAA2B,EAC3B,SAA8C,EAAE;IAEhD,OAAO;QACL,MAAM,EAAE;YACN,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,qCAAqC;YAC7C,aAAa,EAAE,eAAe;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,GAAG;SACjB;QACD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAoB,EACpB,UAAqC,EAAE;IAEvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,YAAY,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE;YACxC,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,WAAkC,CAAC;IAElD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,GAAG,EAAE,2BAA2B,EAAE;YAC/C,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,uCAAuC;YAChD,KAAK,EAAE,YAAY;SACpB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE;YACzC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,yDAAyD;YAClE,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW;SACvE,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,MAAM,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,GAAG,EAAE,0CAA0C,EAAE;gBAC9D,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,4BAA4B,CAAC,CAAC,IAAI,EAAE;gBAC7C,KAAK,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,GAAG,EAAE,+BAA+B,EAAE;YACnD,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,2BAA2B,eAAe,CAAC,MAAM,6CAA6C,eAAe,CAAC,MAAM,GAAG;YAChI,KAAK,EAAE,kBAAkB;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,GAAG,EAAE,yCAAyC,EAAE;gBAC7D,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,EAAE;gBAC7D,KAAK,EAAE,uBAAuB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE;gBAC5C,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,8BAA8B,QAAQ,CAAC,IAAI,EAAE;gBACtD,KAAK,EAAE,oBAAoB,QAAQ,CAAC,IAAI,eAAe;aACxD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,GAAG,EAAE,gCAAgC,EAAE;gBACpD,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,sCAAsC,QAAQ,CAAC,IAAI,EAAE;gBAC9D,KAAK,EAAE,oBAAoB,QAAQ,CAAC,IAAI,gBAAgB;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE;gBAC5C,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,oCAAoC,QAAQ,CAAC,IAAI,EAAE;gBAC5D,KAAK,EAAE,oBAAoB,QAAQ,CAAC,IAAI,cAAc;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,MAAM,kBAAkB,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,IAAI,kBAAkB,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,GAAG,EAAE,6BAA6B,EAAE;YACjD,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,sDAAsD;YAC/D,KAAK,EAAE,kBAAkB;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,GAAG,EAAE,8CAA8C,EAAE;YAClE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,wDAAwD;YACjE,KAAK,EAAE,YAAY;SACpB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,GAAG,EAAE,0CAA0C,EAAE;YAC9D,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,uCAAuC;YAChD,KAAK,EAAE,gBAAgB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,eAAe,CACvC,SAAS,EACT,eAAe,EACf,cAAc,EACd,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CACnC,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC,GAAG,EAAE,6CAA6C,EAAE;YACjE,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,sEAAsE;YAC/E,KAAK,EAAE,gBAAgB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE;QACrF,4BAA4B,EAAE,OAAO,CAAC,4BAA4B;QAClE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;KACzD,CAAC,CAAC;IAEH,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,GAAG,EACH,qCAAqC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,EACnE,cAAc,CAAC,KAAK,IAAI;YACtB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,2CAA2C;YACpD,KAAK,EAAE,iCAAiC;SACzC,EACD;YACE,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CACF,CAAC;IACJ,CAAC;IAED,MAAM,uBAAuB,GAAG,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;IACzF,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC;IAElF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,+BAA+B,IAAI,EAAE,CAAC;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACzD,qBAAqB,EAAE,OAAO,CAAC,yCAAyC;SACzE,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,OAAO,CACZ,GAAG,EACH,oDAAoD,CAAC,GAAG,EACxD,GAAG,CAAC,KAAK,IAAI;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,oDAAoD;gBAC7D,KAAK,EAAE,6CAA6C,CAAC,GAAG;aACzD,CACF,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,sBAAsB,KAAK,uBAAuB,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,kDAAkD,EAAE;gBACtE,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,kEAAkE,CAAC,EAAE;gBAC9E,KAAK,EAAE,6CAA6C,CAAC,kCAAkC;aACxF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,GAAG,EAAE,uCAAuC,EAAE;gBAC3D,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,kDAAkD,CAAC,EAAE;gBAC9D,KAAK,EAAE,6CAA6C,CAAC,kBAAkB;aACxE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,GAAG,EAAE,0CAA0C,EAAE;gBAC9D,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,qDAAqD,CAAC,EAAE;gBACjE,KAAK,EAAE,6CAA6C,CAAC,qBAAqB;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,gCAAgC,IAAI,EAAE,CAAC;IAC5E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YAC5D,qBAAqB,EAAE,OAAO,CAAC,0CAA0C;SAC1E,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,OAAO,CACZ,GAAG,EACH,qDAAqD,CAAC,GAAG,EACzD,GAAG,CAAC,KAAK,IAAI;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,qDAAqD;gBAC9D,KAAK,EAAE,8CAA8C,CAAC,GAAG;aAC1D,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,kCAAkC,IAAI,EAAE,CAAC;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACxD,qBAAqB,EAAE,OAAO,CAAC,2CAA2C;SAC3E,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,OAAO,CACZ,GAAG,EACH,uDAAuD,CAAC,GAAG,EAC3D,GAAG,CAAC,KAAK,IAAI;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,uDAAuD;gBAChE,KAAK,EAAE,gDAAgD,CAAC,GAAG;aAC5D,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE;QACxB,yBAAyB,EAAE,eAAe,CAAC,MAAM;QACjD,mBAAmB,EAAE;YACnB,kBAAkB,EAAE,IAAI;YACxB,+BAA+B,EAAE,SAAS,CAAC,MAAM;YACjD,gCAAgC,EAAE,WAAW,CAAC,MAAM;YACpD,kCAAkC,EAAE,MAAM,CAAC,MAAM;SAClD;QACD,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU;QAC5C,mBAAmB,EAAE,cAAc,CAAC,MAAM,CAAC,mBAAmB;KAC/D,CAAC,CAAC;AACL,CAAC"}

package/dist/verify-log-inclusion-proof.d.ts

@@ -0,0 +1,16 @@
+import type { VerificationError } from './types.js';
+export interface InclusionProofVerification {
+    valid: boolean;
+    error?: VerificationError;
+    reason?: string;
+}
+/**
+ * Verify `log_inclusion_proof.v1`.
+ *
+ * Fail-closed expectations:
+ * - strict schema
+ * - valid did:key root signature over root_hash_b64u
+ * - valid Merkle path (sha256(left||right), duplicate-last at generation time)
+ */
+export declare function verifyLogInclusionProof(proof: unknown): Promise<InclusionProofVerification>;
+//# sourceMappingURL=verify-log-inclusion-proof.d.ts.map

package/dist/verify-log-inclusion-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-log-inclusion-proof.d.ts","sourceRoot":"","sources":["../src/verify-log-inclusion-proof.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6DpD,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,0BAA0B,CAAC,CA2LrC"}

package/dist/verify-log-inclusion-proof.js

@@ -0,0 +1,216 @@
+import { base64UrlDecode, base64UrlEncode, extractPublicKeyFromDidKey, verifySignature, } from './crypto.js';
+import { isValidDidFormat, isValidIsoDate } from './schema-registry.js';
+import { validateLogInclusionProofV1 } from './schema-validation.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function concatBytes(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+async function sha256(bytes) {
+    const digest = await crypto.subtle.digest('SHA-256', bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
+    return new Uint8Array(digest);
+}
+function expectedAuditPathLength(treeSize) {
+    let n = treeSize;
+    let len = 0;
+    while (n > 1) {
+        n = Math.floor((n + 1) / 2);
+        len += 1;
+    }
+    return len;
+}
+function decodeLeafIndex(metadata) {
+    if (!isRecord(metadata))
+        return null;
+    const index = metadata.leaf_index;
+    if (!Number.isInteger(index) || index < 0)
+        return null;
+    return index;
+}
+/**
+ * Verify `log_inclusion_proof.v1`.
+ *
+ * Fail-closed expectations:
+ * - strict schema
+ * - valid did:key root signature over root_hash_b64u
+ * - valid Merkle path (sha256(left||right), duplicate-last at generation time)
+ */
+export async function verifyLogInclusionProof(proof) {
+    const schemaResult = validateLogInclusionProofV1(proof);
+    if (!schemaResult.valid) {
+        return {
+            valid: false,
+            reason: schemaResult.message,
+            error: {
+                code: 'SCHEMA_VALIDATION_FAILED',
+                message: schemaResult.message,
+                field: schemaResult.field,
+            },
+        };
+    }
+    const p = proof;
+    if (!isValidIsoDate(p.root_published_at)) {
+        return {
+            valid: false,
+            reason: 'Invalid root_published_at date format',
+            error: {
+                code: 'INCLUSION_PROOF_INVALID',
+                message: 'root_published_at must be a valid ISO 8601 date',
+                field: 'root_published_at',
+            },
+        };
+    }
+    const leafIndex = decodeLeafIndex(p.metadata);
+    if (leafIndex === null) {
+        return {
+            valid: false,
+            reason: 'Missing metadata.leaf_index required for ordered Merkle verification',
+            error: {
+                code: 'INCLUSION_PROOF_INVALID',
+                message: 'inclusion_proof.metadata.leaf_index (integer) is required for ordered Merkle verification',
+                field: 'metadata.leaf_index',
+            },
+        };
+    }
+    if (!Number.isInteger(p.tree_size) || p.tree_size <= 0) {
+        return {
+            valid: false,
+            reason: 'tree_size must be a positive integer',
+            error: {
+                code: 'INCLUSION_PROOF_INVALID',
+                message: 'tree_size must be a positive integer for inclusion proofs',
+                field: 'tree_size',
+            },
+        };
+    }
+    if (leafIndex >= p.tree_size) {
+        return {
+            valid: false,
+            reason: 'leaf_index out of bounds',
+            error: {
+                code: 'INCLUSION_PROOF_INVALID',
+                message: 'metadata.leaf_index must be less than tree_size',
+                field: 'metadata.leaf_index',
+            },
+        };
+    }
+    const expectedPathLen = expectedAuditPathLength(p.tree_size);
+    if (p.audit_path.length !== expectedPathLen) {
+        return {
+            valid: false,
+            reason: 'audit_path length does not match tree_size',
+            error: {
+                code: 'INCLUSION_PROOF_INVALID',
+                message: `audit_path length must be ${expectedPathLen} for tree_size=${p.tree_size}`,
+                field: 'audit_path',
+            },
+        };
+    }
+    // Verify root signature first.
+    if (!isValidDidFormat(p.root_signature.signer_did)) {
+        return {
+            valid: false,
+            reason: 'Invalid root signature DID format',
+            error: {
+                code: 'INVALID_DID_FORMAT',
+                message: 'root_signature.signer_did must be a valid DID',
+                field: 'root_signature.signer_did',
+            },
+        };
+    }
+    const publicKeyBytes = extractPublicKeyFromDidKey(p.root_signature.signer_did);
+    if (!publicKeyBytes) {
+        return {
+            valid: false,
+            reason: 'Could not extract public key from root signature DID',
+            error: {
+                code: 'INVALID_DID_FORMAT',
+                message: 'root_signature.signer_did must be did:key with Ed25519 multicodec',
+                field: 'root_signature.signer_did',
+            },
+        };
+    }
+    try {
+        const sigBytes = base64UrlDecode(p.root_signature.sig_b64u);
+        const msgBytes = new TextEncoder().encode(p.root_hash_b64u);
+        const ok = await verifySignature('Ed25519', publicKeyBytes, sigBytes, msgBytes);
+        if (!ok) {
+            return {
+                valid: false,
+                reason: 'Root signature verification failed',
+                error: {
+                    code: 'SIGNATURE_INVALID',
+                    message: 'root_signature.sig_b64u does not verify root_hash_b64u',
+                    field: 'root_signature.sig_b64u',
+                },
+            };
+        }
+    }
+    catch {
+        return {
+            valid: false,
+            reason: 'Root signature verification error',
+            error: {
+                code: 'SIGNATURE_INVALID',
+                message: 'Failed to verify root_signature.sig_b64u',
+                field: 'root_signature.sig_b64u',
+            },
+        };
+    }
+    // Verify Merkle inclusion path.
+    let current;
+    try {
+        current = base64UrlDecode(p.leaf_hash_b64u);
+    }
+    catch {
+        return {
+            valid: false,
+            reason: 'Invalid leaf hash encoding',
+            error: {
+                code: 'INCLUSION_PROOF_INVALID',
+                message: 'leaf_hash_b64u is not valid base64url',
+                field: 'leaf_hash_b64u',
+            },
+        };
+    }
+    let index = leafIndex;
+    for (const siblingHash of p.audit_path) {
+        let sibling;
+        try {
+            sibling = base64UrlDecode(siblingHash);
+        }
+        catch {
+            return {
+                valid: false,
+                reason: 'Invalid sibling hash encoding in audit_path',
+                error: {
+                    code: 'INCLUSION_PROOF_INVALID',
+                    message: 'audit_path entries must be valid base64url strings',
+                    field: 'audit_path',
+                },
+            };
+        }
+        current =
+            index % 2 === 0
+                ? await sha256(concatBytes(current, sibling))
+                : await sha256(concatBytes(sibling, current));
+        index = Math.floor(index / 2);
+    }
+    const computedRoot = base64UrlEncode(current);
+    if (computedRoot !== p.root_hash_b64u) {
+        return {
+            valid: false,
+            reason: 'Computed Merkle root does not match proof root',
+            error: {
+                code: 'INCLUSION_PROOF_INVALID',
+                message: 'Merkle audit path does not resolve to root_hash_b64u',
+            },
+        };
+    }
+    return { valid: true, reason: 'Inclusion proof verified successfully' };
+}
+//# sourceMappingURL=verify-log-inclusion-proof.js.map

package/dist/verify-log-inclusion-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-log-inclusion-proof.js","sourceRoot":"","sources":["../src/verify-log-inclusion-proof.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAiBrE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,CAAa,EAAE,CAAa;IAC/C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,KAAiB;IACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CACzF,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,QAAiB;IACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,KAAe,CAAC;AACzB,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAc;IAEd,MAAM,YAAY,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,YAAY,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,YAAY,CAAC,OAAO;gBAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;aAC1B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,KAA8B,CAAC;IAEzC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uCAAuC;YAC/C,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,iDAAiD;gBAC1D,KAAK,EAAE,mBAAmB;aAC3B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sEAAsE;YAC9E,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EACL,2FAA2F;gBAC7F,KAAK,EAAE,qBAAqB;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sCAAsC;YAC9C,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;gBACpE,KAAK,EAAE,WAAW;aACnB;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B;YAClC,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,iDAAiD;gBAC1D,KAAK,EAAE,qBAAqB;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,4CAA4C;YACpD,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,6BAA6B,eAAe,kBAAkB,CAAC,CAAC,SAAS,EAAE;gBACpF,KAAK,EAAE,YAAY;aACpB;SACF,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mCAAmC;YAC3C,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,+CAA+C;gBACxD,KAAK,EAAE,2BAA2B;aACnC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sDAAsD;YAC9D,KAAK,EAAE;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,mEAAmE;gBAC5E,KAAK,EAAE,2BAA2B;aACnC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAE5D,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,oCAAoC;gBAC5C,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,wDAAwD;oBACjE,KAAK,EAAE,yBAAyB;iBACjC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,mCAAmC;YAC3C,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,yBAAyB;aACjC;SACF,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,4BAA4B;YACpC,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,uCAAuC;gBAChD,KAAK,EAAE,gBAAgB;aACxB;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,GAAG,SAAS,CAAC;IACtB,KAAK,MAAM,WAAW,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;gBACrD,KAAK,EAAE;oBACL,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,oDAAoD;oBAC7D,KAAK,EAAE,YAAY;iBACpB;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,GAAG,CAAC,KAAK,CAAC;gBACb,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAElD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gDAAgD;YACxD,KAAK,EAAE;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,sDAAsD;aAChE;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;AAC1E,CAAC"}

package/dist/verify-proof-bundle.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Proof Bundle Verification
+ * CVF-US-007: Verify proof bundles for trust tier computation
+ * POH-US-003: Validate proof bundles against PoH schema, verify receipts
+ *             with clawproxy DID, verify event-chain hash linkage, and
+ *             return trust tier based on validated components.
+ *
+ * Validates:
+ * - Proof bundle payload against PoH schema (proof_bundle.v1)
+ * - URM (Universal Resource Manifest) structure
+ * - Event chain hash linkage and run_id consistency
+ * - Gateway receipt envelopes (cryptographic verification)
+ * - Attestations
+ *
+ * Computes trust tier based on which components are present and valid.
+ * Fail-closed: unknown or malformed payloads always result in 'unknown' tier.
+ */
+import type { ProofBundleVerificationResult, VerificationError } from './types.js';
+export interface ProofBundleVerifierOptions {
+    /** Allowlisted gateway receipt signer DIDs (did:key:...). */
+    allowlistedReceiptSignerDids?: readonly string[];
+    /** Allowlisted attester DIDs for proof bundle attestations (did:key:...). */
+    allowlistedAttesterDids?: readonly string[];
+    /**
+     * Optional materialized URM document (JSON object).
+     *
+     * POH-US-015: If provided, clawverify will:
+     * - validate the URM against the strict schema (urm.v1)
+     * - hash it (SHA-256 over JSON bytes) and compare to payload.urm.resource_hash_b64u
+     *
+     * If the proof bundle contains a URM reference but no `urm` is provided,
+     * verification fails closed (result.status=INVALID).
+     */
+    urm?: unknown;
+}
+/**
+ * Verify a proof bundle envelope
+ *
+ * Acceptance Criteria:
+ * - Validate URM + event chain + receipts + attestations
+ * - Fail closed on unknown schema/version
+ * - Return computed trust tier
+ */
+export declare function verifyProofBundle(envelope: unknown, options?: ProofBundleVerifierOptions): Promise<{
+    result: ProofBundleVerificationResult;
+    error?: VerificationError;
+}>;
+//# sourceMappingURL=verify-proof-bundle.d.ts.map

package/dist/verify-proof-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-proof-bundle.d.ts","sourceRoot":"","sources":["../src/verify-proof-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAGV,6BAA6B,EAC7B,iBAAiB,EAOlB,MAAM,YAAY,CAAC;AA0BpB,MAAM,WAAW,0BAA0B;IACzC,6DAA6D;IAC7D,4BAA4B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEjD,6EAA6E;IAC7E,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE5C;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAimBD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,OAAO,EACjB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,6BAA6B,CAAC;IAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAgyC/E"}