@enbox/gitd 0.0.1

package/dist/types/repo.d.ts

@@ -0,0 +1,450 @@
+/**
+ * Forge Repository Protocol — foundational protocol for repository management.
+ *
+ * Defines repository metadata, collaborator roles (maintainer, triager,
+ * contributor), and repo-level resources (readme, license, topics, settings,
+ * webhooks). Other forge protocols compose with this via `uses` to leverage
+ * role-based authorization.
+ *
+ * @module
+ */
+/** Data shape for a repository record. */
+export type RepoData = {
+    name: string;
+    description?: string;
+    defaultBranch: string;
+    homepage?: string;
+    dwnEndpoints: string[];
+    gitEndpoints?: string[];
+};
+/** Data shape for a collaborator role record (maintainer, triager, contributor). */
+export type CollaboratorData = {
+    did: string;
+    alias?: string;
+};
+/** Data shape for a repository topic tag. */
+export type TopicData = {
+    name: string;
+};
+/** Data shape for repository settings. */
+export type SettingsData = {
+    branchProtection?: Record<string, {
+        requiredReviews?: number;
+        requiredChecks?: string[];
+    }>;
+    mergeStrategies?: ('merge' | 'squash' | 'rebase')[];
+    autoDeleteBranch?: boolean;
+};
+/** Data shape for a webhook configuration. */
+export type WebhookData = {
+    url: string;
+    secret: string;
+    events: string[];
+    active: boolean;
+};
+/**
+ * Data shape for a git bundle record.
+ *
+ * The record payload is the raw git bundle binary (`application/x-git-bundle`).
+ * Queryable metadata (tipCommit, isFull, etc.) is stored in record tags.
+ */
+export type BundleData = Uint8Array;
+/** Maps protocol type names to their TypeScript data shapes. */
+export type ForgeRepoSchemaMap = {
+    repo: RepoData;
+    bundle: BundleData;
+    settings: SettingsData;
+    readme: string;
+    license: string;
+    maintainer: CollaboratorData;
+    triager: CollaboratorData;
+    contributor: CollaboratorData;
+    topic: TopicData;
+    webhook: WebhookData;
+};
+export declare const ForgeRepoDefinition: {
+    readonly protocol: "https://enbox.org/protocols/forge/repo";
+    readonly published: true;
+    readonly types: {
+        readonly repo: {
+            readonly schema: "https://enbox.org/schemas/forge/repo";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly settings: {
+            readonly schema: "https://enbox.org/schemas/forge/settings";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly readme: {
+            readonly dataFormats: ["text/markdown", "text/plain"];
+        };
+        readonly license: {
+            readonly dataFormats: ["text/plain"];
+        };
+        readonly maintainer: {
+            readonly schema: "https://enbox.org/schemas/forge/collaborator";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly triager: {
+            readonly schema: "https://enbox.org/schemas/forge/collaborator";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly contributor: {
+            readonly schema: "https://enbox.org/schemas/forge/collaborator";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly topic: {
+            readonly schema: "https://enbox.org/schemas/forge/topic";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly bundle: {
+            readonly dataFormats: ["application/x-git-bundle"];
+        };
+        readonly webhook: {
+            readonly schema: "https://enbox.org/schemas/forge/webhook";
+            readonly dataFormats: ["application/json"];
+            readonly encryptionRequired: true;
+        };
+    };
+    readonly structure: {
+        readonly repo: {
+            readonly $recordLimit: {
+                readonly max: 1;
+                readonly strategy: "reject";
+            };
+            readonly $actions: [{
+                readonly who: "anyone";
+                readonly can: ["read"];
+            }];
+            readonly $tags: {
+                readonly $requiredTags: ["name", "visibility"];
+                readonly $allowUndefinedTags: false;
+                readonly name: {
+                    readonly type: "string";
+                    readonly maxLength: 100;
+                };
+                readonly visibility: {
+                    readonly type: "string";
+                    readonly enum: ["public", "private"];
+                };
+                readonly defaultBranch: {
+                    readonly type: "string";
+                };
+                readonly language: {
+                    readonly type: "string";
+                };
+                readonly archived: {
+                    readonly type: "boolean";
+                };
+            };
+            readonly maintainer: {
+                readonly $role: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["did"];
+                    readonly $allowUndefinedTags: false;
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                };
+            };
+            readonly triager: {
+                readonly $role: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["did"];
+                    readonly $allowUndefinedTags: false;
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                };
+            };
+            readonly contributor: {
+                readonly $role: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["did"];
+                    readonly $allowUndefinedTags: false;
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                };
+            };
+            readonly bundle: {
+                readonly $squash: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }, {
+                    readonly role: "repo/maintainer";
+                    readonly can: ["create", "squash"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["tipCommit", "isFull"];
+                    readonly $allowUndefinedTags: false;
+                    readonly tipCommit: {
+                        readonly type: "string";
+                    };
+                    readonly isFull: {
+                        readonly type: "boolean";
+                    };
+                    readonly refCount: {
+                        readonly type: "integer";
+                    };
+                    readonly size: {
+                        readonly type: "integer";
+                    };
+                };
+            };
+            readonly readme: {
+                readonly $recordLimit: {
+                    readonly max: 1;
+                    readonly strategy: "reject";
+                };
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }, {
+                    readonly role: "repo/maintainer";
+                    readonly can: ["create", "update"];
+                }];
+            };
+            readonly license: {
+                readonly $recordLimit: {
+                    readonly max: 1;
+                    readonly strategy: "reject";
+                };
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+            };
+            readonly topic: {
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }, {
+                    readonly role: "repo/maintainer";
+                    readonly can: ["create", "delete"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["name"];
+                    readonly $allowUndefinedTags: false;
+                    readonly name: {
+                        readonly type: "string";
+                        readonly maxLength: 50;
+                    };
+                };
+            };
+            readonly settings: {
+                readonly $recordLimit: {
+                    readonly max: 1;
+                    readonly strategy: "reject";
+                };
+            };
+            readonly webhook: {};
+        };
+    };
+};
+/** Typed Forge Repo protocol for use with `dwn.using()`. */
+export declare const ForgeRepoProtocol: import("@enbox/api").TypedProtocol<{
+    readonly protocol: "https://enbox.org/protocols/forge/repo";
+    readonly published: true;
+    readonly types: {
+        readonly repo: {
+            readonly schema: "https://enbox.org/schemas/forge/repo";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly settings: {
+            readonly schema: "https://enbox.org/schemas/forge/settings";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly readme: {
+            readonly dataFormats: ["text/markdown", "text/plain"];
+        };
+        readonly license: {
+            readonly dataFormats: ["text/plain"];
+        };
+        readonly maintainer: {
+            readonly schema: "https://enbox.org/schemas/forge/collaborator";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly triager: {
+            readonly schema: "https://enbox.org/schemas/forge/collaborator";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly contributor: {
+            readonly schema: "https://enbox.org/schemas/forge/collaborator";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly topic: {
+            readonly schema: "https://enbox.org/schemas/forge/topic";
+            readonly dataFormats: ["application/json"];
+        };
+        readonly bundle: {
+            readonly dataFormats: ["application/x-git-bundle"];
+        };
+        readonly webhook: {
+            readonly schema: "https://enbox.org/schemas/forge/webhook";
+            readonly dataFormats: ["application/json"];
+            readonly encryptionRequired: true;
+        };
+    };
+    readonly structure: {
+        readonly repo: {
+            readonly $recordLimit: {
+                readonly max: 1;
+                readonly strategy: "reject";
+            };
+            readonly $actions: [{
+                readonly who: "anyone";
+                readonly can: ["read"];
+            }];
+            readonly $tags: {
+                readonly $requiredTags: ["name", "visibility"];
+                readonly $allowUndefinedTags: false;
+                readonly name: {
+                    readonly type: "string";
+                    readonly maxLength: 100;
+                };
+                readonly visibility: {
+                    readonly type: "string";
+                    readonly enum: ["public", "private"];
+                };
+                readonly defaultBranch: {
+                    readonly type: "string";
+                };
+                readonly language: {
+                    readonly type: "string";
+                };
+                readonly archived: {
+                    readonly type: "boolean";
+                };
+            };
+            readonly maintainer: {
+                readonly $role: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["did"];
+                    readonly $allowUndefinedTags: false;
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                };
+            };
+            readonly triager: {
+                readonly $role: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["did"];
+                    readonly $allowUndefinedTags: false;
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                };
+            };
+            readonly contributor: {
+                readonly $role: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["did"];
+                    readonly $allowUndefinedTags: false;
+                    readonly did: {
+                        readonly type: "string";
+                    };
+                };
+            };
+            readonly bundle: {
+                readonly $squash: true;
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }, {
+                    readonly role: "repo/maintainer";
+                    readonly can: ["create", "squash"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["tipCommit", "isFull"];
+                    readonly $allowUndefinedTags: false;
+                    readonly tipCommit: {
+                        readonly type: "string";
+                    };
+                    readonly isFull: {
+                        readonly type: "boolean";
+                    };
+                    readonly refCount: {
+                        readonly type: "integer";
+                    };
+                    readonly size: {
+                        readonly type: "integer";
+                    };
+                };
+            };
+            readonly readme: {
+                readonly $recordLimit: {
+                    readonly max: 1;
+                    readonly strategy: "reject";
+                };
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }, {
+                    readonly role: "repo/maintainer";
+                    readonly can: ["create", "update"];
+                }];
+            };
+            readonly license: {
+                readonly $recordLimit: {
+                    readonly max: 1;
+                    readonly strategy: "reject";
+                };
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }];
+            };
+            readonly topic: {
+                readonly $actions: [{
+                    readonly who: "anyone";
+                    readonly can: ["read"];
+                }, {
+                    readonly role: "repo/maintainer";
+                    readonly can: ["create", "delete"];
+                }];
+                readonly $tags: {
+                    readonly $requiredTags: ["name"];
+                    readonly $allowUndefinedTags: false;
+                    readonly name: {
+                        readonly type: "string";
+                        readonly maxLength: 50;
+                    };
+                };
+            };
+            readonly settings: {
+                readonly $recordLimit: {
+                    readonly max: 1;
+                    readonly strategy: "reject";
+                };
+            };
+            readonly webhook: {};
+        };
+    };
+}, ForgeRepoSchemaMap>;
+//# sourceMappingURL=repo.d.ts.map

package/dist/types/repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,0CAA0C;AAC1C,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAG,MAAM,CAAC;IACd,WAAW,CAAC,EAAG,MAAM,CAAC;IACtB,aAAa,EAAG,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAG,MAAM,CAAC;IACnB,YAAY,EAAG,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAG,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAG,MAAM,CAAC;IACb,KAAK,CAAC,EAAG,MAAM,CAAC;CACjB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG;IACzB,gBAAgB,CAAC,EAAG,MAAM,CAAC,MAAM,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5F,eAAe,CAAC,EAAG,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IACrD,gBAAgB,CAAC,EAAG,OAAO,CAAC;CAC7B,CAAC;AAEF,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAG,MAAM,CAAC;IACb,MAAM,EAAG,MAAM,CAAC;IAChB,MAAM,EAAG,MAAM,EAAE,CAAC;IAClB,MAAM,EAAG,OAAO,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC;AAMpC,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAG,QAAQ,CAAC;IAChB,MAAM,EAAG,UAAU,CAAC;IACpB,QAAQ,EAAG,YAAY,CAAC;IACxB,MAAM,EAAG,MAAM,CAAC;IAChB,OAAO,EAAG,MAAM,CAAC;IACjB,UAAU,EAAG,gBAAgB,CAAC;IAC9B,OAAO,EAAG,gBAAgB,CAAC;IAC3B,WAAW,EAAG,gBAAgB,CAAC;IAC/B,KAAK,EAAG,SAAS,CAAC;IAClB,OAAO,EAAG,WAAW,CAAC;CACvB,CAAC;AAMF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0IO,CAAC;AAMxC,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAG7B,CAAC"}

package/dist/types/resolver/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Package resolver module — DID-scoped package resolution, verification,
+ * and dependency trust chain validation.
+ *
+ * @module
+ */
+export { fetchTarball, listVersions, parseSpecifier, resolveFullPackage, resolvePackage, resolveVersion, } from './resolve.js';
+export type { ResolvedPackage, ResolvedVersion, ResolutionResult, } from './resolve.js';
+export { fetchAttestations, verifyPackageVersion, } from './verify.js';
+export type { AttestationRecord, VerificationCheck, VerificationResult, } from './verify.js';
+export { buildTrustChain, formatTrustChain, } from './trust-chain.js';
+export type { TrustChainNode, TrustChainResult, } from './trust-chain.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/resolver/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resolver/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/types/resolver/resolve.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Package resolver — resolves DID-scoped packages from remote DWNs.
+ *
+ * Resolution flow:
+ *   1. Resolve DID → DWN endpoints
+ *   2. Query package record by name + ecosystem
+ *   3. Query version record by semver
+ *   4. Fetch tarball binary
+ *
+ * All queries use the `from:` parameter to route to the remote DWN.
+ *
+ * @module
+ */
+import type { AgentContext } from '../cli/agent.js';
+/** Resolved package metadata. */
+export type ResolvedPackage = {
+    name: string;
+    ecosystem: string;
+    description: string;
+    contextId: string;
+    publisherDid: string;
+};
+/** Resolved version metadata. */
+export type ResolvedVersion = {
+    semver: string;
+    contextId: string;
+    dateCreated: string;
+    deprecated: boolean;
+    dependencies: Record<string, string>;
+    author: string;
+};
+/** Full resolution result including tarball bytes. */
+export type ResolutionResult = {
+    package: ResolvedPackage;
+    version: ResolvedVersion;
+    tarball: Uint8Array | null;
+};
+/**
+ * Find a package record on a target DID's DWN.
+ *
+ * @param ctx - Agent context for DWN queries
+ * @param targetDid - DID of the package publisher
+ * @param name - Package name
+ * @param ecosystem - Package ecosystem (default: 'npm')
+ */
+export declare function resolvePackage(ctx: AgentContext, targetDid: string, name: string, ecosystem?: string): Promise<ResolvedPackage | null>;
+/**
+ * Find a specific version of a package.
+ *
+ * @param ctx - Agent context
+ * @param targetDid - Publisher DID
+ * @param pkgContextId - Context ID of the package record
+ * @param semver - Semver string to resolve
+ */
+export declare function resolveVersion(ctx: AgentContext, targetDid: string, pkgContextId: string, semver: string): Promise<ResolvedVersion | null>;
+/**
+ * List all versions of a package.
+ */
+export declare function listVersions(ctx: AgentContext, targetDid: string, pkgContextId: string): Promise<ResolvedVersion[]>;
+/**
+ * Fetch the tarball for a specific version.
+ */
+export declare function fetchTarball(ctx: AgentContext, targetDid: string, versionContextId: string): Promise<Uint8Array | null>;
+/**
+ * Resolve a full package specifier: `did:method:id/name@version`.
+ *
+ * Returns the package metadata, version metadata, and tarball bytes.
+ */
+export declare function resolveFullPackage(ctx: AgentContext, targetDid: string, name: string, semver: string, ecosystem?: string): Promise<ResolutionResult | null>;
+/**
+ * Parse a package specifier like `did:dht:abc123/my-pkg@1.0.0`.
+ *
+ * Returns `{ did, name, version }` or `null` if the format is invalid.
+ */
+export declare function parseSpecifier(specifier: string): {
+    did: string;
+    name: string;
+    version: string;
+} | null;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/types/resolver/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/resolver/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQpD,iCAAiC;AACjC,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAG,MAAM,CAAC;IACd,SAAS,EAAG,MAAM,CAAC;IACnB,WAAW,EAAG,MAAM,CAAC;IACrB,SAAS,EAAG,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,iCAAiC;AACjC,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAG,MAAM,CAAC;IAChB,SAAS,EAAG,MAAM,CAAC;IACnB,WAAW,EAAG,MAAM,CAAC;IACrB,UAAU,EAAG,OAAO,CAAC;IACrB,YAAY,EAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,EAAG,MAAM,CAAC;CACjB,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAG,eAAe,CAAC;IAC1B,OAAO,EAAG,eAAe,CAAC;IAC1B,OAAO,EAAG,UAAU,GAAG,IAAI,CAAC;CAC7B,CAAC;AAMF;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAc,GACxB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoBjC;AAMD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAyBjC;AAMD;;GAEG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,EAAE,CAAC,CAyB5B;AAMD;;GAEG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAa5B;AAMD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAc,GACxB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAUlC;AAMD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,GAChB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUvD"}

package/dist/types/resolver/trust-chain.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Dependency trust chain — recursive verification of a package's
+ * dependency tree.
+ *
+ * Given a root package specifier like `did:dht:abc/utils@1.0.0`, the
+ * trust chain validator:
+ *
+ *   1. Resolves the package from the publisher's DWN
+ *   2. Verifies the package version (author, tarball, attestations)
+ *   3. Reads the version's `dependencies` field
+ *   4. Recursively resolves and verifies each dependency
+ *   5. Returns a tree of verification results
+ *
+ * The entire chain is verifiable without any central authority — each
+ * DID resolution, signature verification, and attestation check uses
+ * decentralized infrastructure.
+ *
+ * @module
+ */
+import type { AgentContext } from '../cli/agent.js';
+import type { VerificationResult } from './verify.js';
+/** A single node in the dependency trust chain tree. */
+export type TrustChainNode = {
+    specifier: string;
+    did: string;
+    name: string;
+    version: string;
+    verification: VerificationResult;
+    dependencies: TrustChainNode[];
+};
+/** Summary of the trust chain validation. */
+export type TrustChainResult = {
+    root: TrustChainNode;
+    totalChecked: number;
+    allPassed: boolean;
+    failures: string[];
+};
+/**
+ * Build and verify a full dependency trust chain.
+ *
+ * @param ctx - Agent context
+ * @param targetDid - Root package publisher DID
+ * @param name - Root package name
+ * @param semver - Root package version
+ * @param ecosystem - Package ecosystem (default: 'npm')
+ * @param trustedAttestors - DIDs of trusted build services
+ * @param maxDepth - Maximum recursion depth (default: 10)
+ */
+export declare function buildTrustChain(ctx: AgentContext, targetDid: string, name: string, semver: string, ecosystem?: string, trustedAttestors?: string[], maxDepth?: number): Promise<TrustChainResult>;
+/**
+ * Format a trust chain tree as an indented string for CLI output.
+ */
+export declare function formatTrustChain(result: TrustChainResult): string;
+//# sourceMappingURL=trust-chain.d.ts.map

package/dist/types/resolver/trust-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-chain.d.ts","sourceRoot":"","sources":["../../../src/resolver/trust-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAUtD,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAG,MAAM,CAAC;IACnB,GAAG,EAAG,MAAM,CAAC;IACb,IAAI,EAAG,MAAM,CAAC;IACd,OAAO,EAAG,MAAM,CAAC;IACjB,YAAY,EAAG,kBAAkB,CAAC;IAClC,YAAY,EAAG,cAAc,EAAE,CAAC;CACjC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAG,cAAc,CAAC;IACtB,YAAY,EAAG,MAAM,CAAC;IACtB,SAAS,EAAG,OAAO,CAAC;IACpB,QAAQ,EAAG,MAAM,EAAE,CAAC;CACrB,CAAC;AAMF;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAc,EACzB,gBAAgB,GAAE,MAAM,EAAO,EAC/B,QAAQ,GAAE,MAAW,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAc3B;AAwFD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAkBjE"}

package/dist/types/resolver/verify.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Package verification — cryptographic verification of DWN package records.
+ *
+ * Verification checks:
+ *   1. **Author verification**: the record's `author` DID matches the publisher
+ *   2. **Attestation verification**: third-party attestation records are present
+ *      and signed by trusted attestors
+ *   3. **Integrity check**: tarball exists and is non-empty
+ *
+ * Since every DWN record is cryptographically signed via JWS in the
+ * `authorization` field, verification relies on the DWN SDK having
+ * already validated signatures during record ingestion.  Our verification
+ * layer adds semantic checks on top of that foundation.
+ *
+ * @module
+ */
+import type { AgentContext } from '../cli/agent.js';
+/** Individual verification check result. */
+export type VerificationCheck = {
+    check: string;
+    passed: boolean;
+    detail: string;
+};
+/** Attestation record as returned by the DWN. */
+export type AttestationRecord = {
+    attestorDid: string;
+    claim: string;
+    sourceCommit: string | undefined;
+    sourceRepo: string | undefined;
+    dateCreated: string;
+};
+/** Full verification result for a package version. */
+export type VerificationResult = {
+    passed: boolean;
+    publisherDid: string;
+    packageName: string;
+    version: string;
+    checks: VerificationCheck[];
+    attestations: AttestationRecord[];
+};
+/**
+ * Fetch attestation records for a specific package version.
+ */
+export declare function fetchAttestations(ctx: AgentContext, targetDid: string, versionContextId: string): Promise<AttestationRecord[]>;
+/**
+ * Verify a package version's integrity and provenance.
+ *
+ * Performs the following checks:
+ *   1. Package record exists and is owned by the expected DID
+ *   2. Version record exists and is authored by the publisher
+ *   3. Tarball exists and is non-empty
+ *   4. Attestations are present (informational — not required to pass)
+ *
+ * @param ctx - Agent context
+ * @param targetDid - Expected publisher DID
+ * @param name - Package name
+ * @param semver - Version string
+ * @param ecosystem - Ecosystem (default: 'npm')
+ * @param trustedAttestors - DIDs of trusted attestors (optional)
+ */
+export declare function verifyPackageVersion(ctx: AgentContext, targetDid: string, name: string, semver: string, ecosystem?: string, trustedAttestors?: string[]): Promise<VerificationResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/types/resolver/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/resolver/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQpD,4CAA4C;AAC5C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAG,MAAM,CAAC;IACf,MAAM,EAAG,OAAO,CAAC;IACjB,MAAM,EAAG,MAAM,CAAC;CACjB,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAG,MAAM,CAAC;IACrB,KAAK,EAAG,MAAM,CAAC;IACf,YAAY,EAAG,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAG,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAG,MAAM,CAAC;CACtB,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAG,OAAO,CAAC;IACjB,YAAY,EAAG,MAAM,CAAC;IACtB,WAAW,EAAG,MAAM,CAAC;IACrB,OAAO,EAAG,MAAM,CAAC;IACjB,MAAM,EAAG,iBAAiB,EAAE,CAAC;IAC7B,YAAY,EAAG,iBAAiB,EAAE,CAAC;CACpC,CAAC;AAMF;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAsB9B;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAc,EACzB,gBAAgB,GAAE,MAAM,EAAO,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA2H7B"}