@getvda/bundle 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,30 @@
+Verified Digital Agents (VDA) — Agent Control Plane
+Copyright 2026 getvda.ai
+
+This product is licensed under the Apache License, Version 2.0 (the "License");
+you may not use these files except in compliance with the License. A copy of the
+License is in the LICENSE file at the repository root and at:
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied.
+
+---
+
+What these packages do and do NOT carry
+----------------------------------------
+
+The @getvda/* packages VERIFY and ENFORCE governance. They do not carry the
+trust anchors that governance rests on:
+
+  - Bundle-signing keys (#key-3) live only in getvda's Secret Manager. These
+    packages VERIFY a bundle's signature against the public key resolved from
+    did:web:acp.getvda.ai; they cannot mint a bundle that verifies.
+  - Witness account credentials are the customer's own (customer-managed
+    custody). These packages SEAL to a Witness account the caller supplies;
+    they carry no standing credential.
+
+The code is open. The trust anchors are not in the code — and giving away the
+verifier does not give away the ability to forge what it verifies.

package/README.md

@@ -0,0 +1,42 @@
+# @getvda/bundle
+
+> **Status: pre-1.0 (0.x).** Public API may change between minor versions —
+> pin an exact version if you need stability. Part of the [getvda.ai](https://getvda.ai)
+> governance suite. Honesty discipline: nothing documented here is live unless it
+> says so, boundaries (fail-static, condition-assertion) are stated where they apply,
+> and a stub is labelled a stub.
+
+> **What this carries — and what it does not.** This package *verifies and
+> enforces* governance. The trust anchors are not in it: bundle-signing keys
+> (`#key-3`) live only in getvda's Secret Manager, and Witness account
+> credentials are the caller's own (customer-managed custody). It verifies a
+> signature against the public key resolved from `did:web:acp.getvda.ai` and
+> seals to a Witness account you supply — it cannot mint a bundle that verifies,
+> and carries no standing credential. Open code, trust anchors elsewhere.
+
+The signed, versioned, content-hashed **governance bundle** (Phase 5a) — the
+runtime projection of approved git state. Agents fetch, verify, cache, and
+evaluate this locally; they never `git pull`.
+
+## Deterministic
+
+The signed manifest carries `version`, `environment`, `commitSha`, `contentHash`,
+`did`, `keyId`, `files` — and **no timestamp**. Same commit + version → same
+bytes → same signature. (Activation time lives in the Witness attestation's
+`as_of`, not the bundle.) One Ed25519 signature over the canonical manifest binds
+manifest → files (the manifest carries the files' `contentHash`).
+
+## Signed with #key-3, verified against the DID
+
+`Ed25519BundleSigner` signs with ACP's dedicated **bundle-signing key** (`#key-3`
+— separate from the Witness record key `#key-2`: different verifier, different
+lifetime, different blast radius). Agents verify with `verifyBundle(bundle,
+resolver)`:
+
+1. the files still hash to `manifest.contentHash` (no tampering),
+2. the signature keyId matches the manifest,
+3. the signature verifies over the canonical manifest against the resolved key.
+
+`DidWebKeyResolver` resolves `did:web:acp.getvda.ai#key-3` →
+`https://acp.getvda.ai/.well-known/did.json` → the `verificationMethod[]` entry.
+`StaticKeyResolver` is the offline/test counterpart.

package/dist/build.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Build a bundle from approved git state (5a). Deterministic: same commit +
+ * version → same bytes.
+ */
+import { type GovernanceFileName, type GovernanceSet } from '@getvda/governance-schema';
+import type { UnsignedBundle } from './types.js';
+export interface BuildBundleInput {
+    readonly version: string;
+    readonly environment: string;
+    readonly commitSha: string;
+    readonly did: string;
+    readonly keyId: string;
+}
+/** Content hash binding the governance files to the manifest. */
+export declare function contentHashOf(files: Partial<Record<GovernanceFileName, string>>): string;
+export declare function buildBundle(set: GovernanceSet, input: BuildBundleInput): UnsignedBundle;
+//# sourceMappingURL=build.d.ts.map

package/dist/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAeD,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAExF;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,GAAG,cAAc,CAavF"}

package/dist/build.js

@@ -0,0 +1,38 @@
+/**
+ * Build a bundle from approved git state (5a). Deterministic: same commit +
+ * version → same bytes.
+ */
+import { createHash } from 'node:crypto';
+import { GOVERNANCE_FILE_NAMES, } from '@getvda/governance-schema';
+import { canonicalize } from './ed25519.js';
+function sha256Hex(s) {
+    return createHash('sha256').update(s).digest('hex');
+}
+function sourcesOf(set) {
+    const out = {};
+    for (const name of GOVERNANCE_FILE_NAMES) {
+        const entry = set.files[name];
+        if (entry)
+            out[name] = entry.source;
+    }
+    return out;
+}
+/** Content hash binding the governance files to the manifest. */
+export function contentHashOf(files) {
+    return `sha256:${sha256Hex(canonicalize(files))}`;
+}
+export function buildBundle(set, input) {
+    const files = sourcesOf(set);
+    const manifest = {
+        schema: 'acp.bundle/1',
+        version: input.version,
+        environment: input.environment,
+        commitSha: input.commitSha,
+        contentHash: contentHashOf(files),
+        did: input.did,
+        keyId: input.keyId,
+        files: Object.keys(files).sort(),
+    };
+    return { manifest, files };
+}
+//# sourceMappingURL=build.js.map

package/dist/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,qBAAqB,GAGtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAW5C,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB;IACnC,MAAM,GAAG,GAAgD,EAAE,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,KAAkD;IAC9E,OAAO,UAAU,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAkB,EAAE,KAAuB;IACrE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAmB;QAC/B,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;QACjC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAA0B,CAAC,IAAI,EAAE;KAC3D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/ed25519.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Ed25519 glue for BUNDLE signing (#key-3).
+ *
+ * Deliberately self-contained (not shared with @getvda/witness's record signer) —
+ * bundle signing is a different key, a different verifier (agents, offline), and
+ * a different lifetime (years). Keeping the crypto local keeps the packages
+ * decoupled; it is ~20 lines of node:crypto.
+ */
+export interface PublicJwk {
+    readonly kty: 'OKP';
+    readonly crv: 'Ed25519';
+    readonly x: string;
+}
+export declare function publicJwkFromPrivate(privateKeyPemOrJwk: string | object): PublicJwk;
+export declare function ed25519Sign(bytes: string, privateKeyPemOrJwk: string | object): string;
+export declare function ed25519Verify(bytes: string, signatureB64url: string, jwk: PublicJwk): boolean;
+/** Deterministic canonical JSON (sorted keys) — the exact bytes that get hashed
+ *  and signed. Same input → same bytes, always. */
+export declare function canonicalize(value: unknown): string;
+//# sourceMappingURL=ed25519.d.ts.map

package/dist/ed25519.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcnF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAMtF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAO7F;AAED;mDACmD;AACnD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD"}

package/dist/ed25519.js

@@ -0,0 +1,50 @@
+/**
+ * Ed25519 glue for BUNDLE signing (#key-3).
+ *
+ * Deliberately self-contained (not shared with @getvda/witness's record signer) —
+ * bundle signing is a different key, a different verifier (agents, offline), and
+ * a different lifetime (years). Keeping the crypto local keeps the packages
+ * decoupled; it is ~20 lines of node:crypto.
+ */
+import { createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
+export function publicJwkFromPrivate(privateKeyPemOrJwk) {
+    const priv = typeof privateKeyPemOrJwk === 'string'
+        ? createPrivateKey(privateKeyPemOrJwk)
+        : createPrivateKey({ key: privateKeyPemOrJwk, format: 'jwk' });
+    const jwk = createPublicKey(priv).export({ format: 'jwk' });
+    if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519' || !jwk.x) {
+        throw new Error(`bundle signing requires an Ed25519 OKP key (got kty=${jwk.kty})`);
+    }
+    return { kty: 'OKP', crv: 'Ed25519', x: jwk.x };
+}
+export function ed25519Sign(bytes, privateKeyPemOrJwk) {
+    const priv = typeof privateKeyPemOrJwk === 'string'
+        ? createPrivateKey(privateKeyPemOrJwk)
+        : createPrivateKey({ key: privateKeyPemOrJwk, format: 'jwk' });
+    return sign(null, Buffer.from(bytes, 'utf8'), priv).toString('base64url');
+}
+export function ed25519Verify(bytes, signatureB64url, jwk) {
+    try {
+        const pub = createPublicKey({ key: jwk, format: 'jwk' });
+        return verify(null, Buffer.from(bytes, 'utf8'), pub, Buffer.from(signatureB64url, 'base64url'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Deterministic canonical JSON (sorted keys) — the exact bytes that get hashed
+ *  and signed. Same input → same bytes, always. */
+export function canonicalize(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(v) {
+    if (Array.isArray(v))
+        return v.map(sortKeys);
+    if (v && typeof v === 'object') {
+        return Object.fromEntries(Object.keys(v)
+            .sort()
+            .map((k) => [k, sortKeys(v[k])]));
+    }
+    return v;
+}
+//# sourceMappingURL=ed25519.js.map

package/dist/ed25519.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQ9E,MAAM,UAAU,oBAAoB,CAAC,kBAAmC;IACtE,MAAM,IAAI,GACR,OAAO,kBAAkB,KAAK,QAAQ;QACpC,CAAC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QACtC,CAAC,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,kBAA2B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAIzD,CAAC;IACF,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,uDAAuD,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,kBAAmC;IAC5E,MAAM,IAAI,GACR,OAAO,kBAAkB,KAAK,QAAQ;QACpC,CAAC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QACtC,CAAC,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,kBAA2B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,eAAuB,EAAE,GAAc;IAClF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AACD,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC;aACtC,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAE,CAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @getvda/bundle — the signed, versioned, content-hashed governance bundle.
+ * The runtime projection of approved git state. Deterministic; signed with #key-3;
+ * verified by agents offline against did:web:acp.getvda.ai.
+ */
+export type { BundleManifest, BundleSignature, UnsignedBundle, SignedBundle, BundleVerification, } from './types.js';
+export { buildBundle, contentHashOf, type BuildBundleInput } from './build.js';
+export { signBundle, Ed25519BundleSigner, type BundleSigner } from './sign.js';
+export { verifyBundle } from './verify.js';
+export { StaticKeyResolver, DidWebKeyResolver, didWebToUrl, type KeyResolver } from './resolver.js';
+export { ed25519Sign, ed25519Verify, publicJwkFromPrivate, canonicalize, type PublicJwk, } from './ed25519.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,cAAc,EACd,eAAe,EACf,cAAc,EACd,YAAY,EACZ,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AACpG,OAAO,EACL,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,KAAK,SAAS,GACf,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * @getvda/bundle — the signed, versioned, content-hashed governance bundle.
+ * The runtime projection of approved git state. Deterministic; signed with #key-3;
+ * verified by agents offline against did:web:acp.getvda.ai.
+ */
+export { buildBundle, contentHashOf } from './build.js';
+export { signBundle, Ed25519BundleSigner } from './sign.js';
+export { verifyBundle } from './verify.js';
+export { StaticKeyResolver, DidWebKeyResolver, didWebToUrl } from './resolver.js';
+export { ed25519Sign, ed25519Verify, publicJwkFromPrivate, canonicalize, } from './ed25519.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAyB,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAqB,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAoB,MAAM,eAAe,CAAC;AACpG,OAAO,EACL,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,YAAY,GAEb,MAAM,cAAc,CAAC"}

package/dist/resolver.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Key resolution for bundle verification.
+ *
+ * Agents verify a bundle by resolving its `keyId` to a public key. In production
+ * that means resolving `did:web:acp.getvda.ai` to its DID document and reading
+ * the #key-3 verification method. Tests / the loop use a StaticKeyResolver.
+ */
+import type { PublicJwk } from './ed25519.js';
+export interface KeyResolver {
+    resolve(keyId: string): Promise<PublicJwk | null>;
+}
+/** A fixed keyId → public JWK map (tests, offline caches). */
+export declare class StaticKeyResolver implements KeyResolver {
+    private readonly keys;
+    constructor(keys: Readonly<Record<string, PublicJwk>>);
+    resolve(keyId: string): Promise<PublicJwk | null>;
+}
+/**
+ * Resolve `did:web:<host>[:<path...>]#<frag>` to the verification method's public
+ * JWK. did:web:acp.getvda.ai#key-3 → https://acp.getvda.ai/.well-known/did.json.
+ * Iterates `verificationMethod[]` (the array Witness's resolver also matches on).
+ */
+export declare class DidWebKeyResolver implements KeyResolver {
+    private readonly fetchImpl;
+    private cache;
+    constructor(fetchImpl?: typeof fetch);
+    resolve(keyId: string): Promise<PublicJwk | null>;
+    private fetchDoc;
+}
+export declare function didWebToUrl(did: string): string;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,8DAA8D;AAC9D,qBAAa,iBAAkB,YAAW,WAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;CAGxD;AAMD;;;;GAIG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IAEvC,OAAO,CAAC,QAAQ,CAAC,SAAS;IADtC,OAAO,CAAC,KAAK,CAAkC;gBAClB,SAAS,GAAE,OAAO,KAAa;IAEtD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAQzC,QAAQ;CAUvB;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAY/C"}

package/dist/resolver.js

@@ -0,0 +1,64 @@
+/**
+ * Key resolution for bundle verification.
+ *
+ * Agents verify a bundle by resolving its `keyId` to a public key. In production
+ * that means resolving `did:web:acp.getvda.ai` to its DID document and reading
+ * the #key-3 verification method. Tests / the loop use a StaticKeyResolver.
+ */
+/** A fixed keyId → public JWK map (tests, offline caches). */
+export class StaticKeyResolver {
+    keys;
+    constructor(keys) {
+        this.keys = keys;
+    }
+    async resolve(keyId) {
+        return this.keys[keyId] ?? null;
+    }
+}
+/**
+ * Resolve `did:web:<host>[:<path...>]#<frag>` to the verification method's public
+ * JWK. did:web:acp.getvda.ai#key-3 → https://acp.getvda.ai/.well-known/did.json.
+ * Iterates `verificationMethod[]` (the array Witness's resolver also matches on).
+ */
+export class DidWebKeyResolver {
+    fetchImpl;
+    cache = new Map();
+    constructor(fetchImpl = fetch) {
+        this.fetchImpl = fetchImpl;
+    }
+    async resolve(keyId) {
+        const [did] = keyId.split('#');
+        if (!did || !did.startsWith('did:web:'))
+            return null;
+        const doc = await this.fetchDoc(did);
+        const vm = doc.verificationMethod?.find((m) => m.id === keyId);
+        return vm?.publicKeyJwk ?? null;
+    }
+    async fetchDoc(did) {
+        const cached = this.cache.get(did);
+        if (cached)
+            return cached;
+        const url = didWebToUrl(did);
+        const res = await this.fetchImpl(url);
+        if (!res.ok)
+            throw new Error(`did:web resolution failed (${res.status}) at ${url}`);
+        const doc = (await res.json());
+        this.cache.set(did, doc);
+        return doc;
+    }
+}
+export function didWebToUrl(did) {
+    // did:web:host  ->  https://host/.well-known/did.json
+    // did:web:host:a:b -> https://host/a/b/did.json
+    const parts = did
+        .replace(/^did:web:/, '')
+        .split(':')
+        .map(decodeURIComponent);
+    const host = parts.shift();
+    if (!host)
+        throw new Error(`invalid did:web: ${did}`);
+    return parts.length === 0
+        ? `https://${host}/.well-known/did.json`
+        : `https://${host}/${parts.join('/')}/did.json`;
+}
+//# sourceMappingURL=resolver.js.map

package/dist/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,8DAA8D;AAC9D,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,IAAyC;QAAzC,SAAI,GAAJ,IAAI,CAAqC;IAAG,CAAC;IAC1E,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAClC,CAAC;CACF;AAMD;;;;GAIG;AACH,MAAM,OAAO,iBAAiB;IAEC;IADrB,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,YAA6B,YAA0B,KAAK;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAEhE,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,YAAY,IAAI,IAAI,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAW;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,sDAAsD;IACtD,gDAAgD;IAChD,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,WAAW,IAAI,uBAAuB;QACxC,CAAC,CAAC,WAAW,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;AACpD,CAAC"}

package/dist/sign.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Sign a bundle with the dedicated bundle-signing key (#key-3).
+ *
+ * The signature is over the CANONICAL MANIFEST, which itself carries the
+ * contentHash of the files — so the one signature binds manifest → files. A real
+ * signer wraps Mike's #key-3 private key (from Secret Manager); tests use an
+ * ephemeral Ed25519 key + a StaticKeyResolver.
+ */
+import { type PublicJwk } from './ed25519.js';
+import type { SignedBundle, UnsignedBundle } from './types.js';
+export interface BundleSigner {
+    readonly keyId: string;
+    sign(bytes: string): string;
+}
+export declare class Ed25519BundleSigner implements BundleSigner {
+    readonly keyId: string;
+    private readonly privateKey;
+    constructor(privateKeyPemOrJwk: string | object, keyId: string);
+    sign(bytes: string): string;
+    /** The public half — publish this in the DID doc as #key-3. */
+    get publicKeyJwk(): PublicJwk;
+}
+export declare function signBundle(unsigned: UnsignedBundle, signer: BundleSigner): SignedBundle;
+//# sourceMappingURL=sign.d.ts.map

package/dist/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAmD,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CAC7B;AAED,qBAAa,mBAAoB,YAAW,YAAY;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;gBAEjC,kBAAkB,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM;IAK9D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI3B,+DAA+D;IAC/D,IAAI,YAAY,IAAI,SAAS,CAE5B;CACF;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,YAAY,CAQvF"}

package/dist/sign.js

@@ -0,0 +1,32 @@
+/**
+ * Sign a bundle with the dedicated bundle-signing key (#key-3).
+ *
+ * The signature is over the CANONICAL MANIFEST, which itself carries the
+ * contentHash of the files — so the one signature binds manifest → files. A real
+ * signer wraps Mike's #key-3 private key (from Secret Manager); tests use an
+ * ephemeral Ed25519 key + a StaticKeyResolver.
+ */
+import { canonicalize, ed25519Sign, publicJwkFromPrivate } from './ed25519.js';
+export class Ed25519BundleSigner {
+    keyId;
+    privateKey;
+    constructor(privateKeyPemOrJwk, keyId) {
+        this.privateKey = privateKeyPemOrJwk;
+        this.keyId = keyId;
+    }
+    sign(bytes) {
+        return ed25519Sign(bytes, this.privateKey);
+    }
+    /** The public half — publish this in the DID doc as #key-3. */
+    get publicKeyJwk() {
+        return publicJwkFromPrivate(this.privateKey);
+    }
+}
+export function signBundle(unsigned, signer) {
+    if (unsigned.manifest.keyId !== signer.keyId) {
+        throw new Error(`manifest keyId (${unsigned.manifest.keyId}) does not match signer keyId (${signer.keyId})`);
+    }
+    const value = signer.sign(canonicalize(unsigned.manifest));
+    return { ...unsigned, signature: { algorithm: 'Ed25519', value, keyId: signer.keyId } };
+}
+//# sourceMappingURL=sign.js.map

package/dist/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAkB,MAAM,cAAc,CAAC;AAQ/F,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAS;IACN,UAAU,CAAkB;IAE7C,YAAY,kBAAmC,EAAE,KAAa;QAC5D,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,+DAA+D;IAC/D,IAAI,YAAY;QACd,OAAO,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,QAAwB,EAAE,MAAoB;IACvE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,QAAQ,CAAC,KAAK,kCAAkC,MAAM,CAAC,KAAK,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AAC1F,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The signed governance bundle — the runtime projection of approved git state.
+ *
+ * DETERMINISTIC by design: the manifest carries no wall-clock timestamp, so the
+ * SAME commit + version always produces the SAME bytes and the SAME signature.
+ * (The activation time lives in the Witness attestation's `as_of`, not the
+ * bundle.) Agents fetch, verify, cache, and evaluate this locally — they never
+ * `git pull`.
+ */
+import type { GovernanceFileName } from '@getvda/governance-schema';
+export interface BundleManifest {
+    readonly schema: 'acp.bundle/1';
+    /** Monotonic version per environment, assigned by the pipeline (not time). */
+    readonly version: string;
+    readonly environment: string;
+    /** The git commit this bundle was built from — the tie to authoring provenance. */
+    readonly commitSha: string;
+    /** sha256:<hex> of the canonical governance file set. Binds files → manifest. */
+    readonly contentHash: string;
+    /** ACP's DID; agents resolve it to get the bundle-signing key. */
+    readonly did: string;
+    /** The verification method that signs bundles, e.g. did:web:acp.getvda.ai#key-3. */
+    readonly keyId: string;
+    /** File names included, sorted — for a quick manifest read without the bodies. */
+    readonly files: readonly GovernanceFileName[];
+}
+export interface BundleSignature {
+    readonly algorithm: 'Ed25519';
+    /** base64url signature over the canonical manifest bytes. */
+    readonly value: string;
+    /** The key that produced it (== manifest.keyId). */
+    readonly keyId: string;
+}
+/** An unsigned bundle (manifest + the governance sources it hashes). */
+export interface UnsignedBundle {
+    readonly manifest: BundleManifest;
+    readonly files: Readonly<Partial<Record<GovernanceFileName, string>>>;
+}
+/** A signed, distributable bundle. */
+export interface SignedBundle extends UnsignedBundle {
+    readonly signature: BundleSignature;
+}
+export interface BundleVerification {
+    readonly valid: boolean;
+    readonly reasons: readonly string[];
+    readonly commitSha?: string;
+    readonly version?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CACvE;AAED,sCAAsC;AACtC,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/types.js

@@ -0,0 +1,11 @@
+/**
+ * The signed governance bundle — the runtime projection of approved git state.
+ *
+ * DETERMINISTIC by design: the manifest carries no wall-clock timestamp, so the
+ * SAME commit + version always produces the SAME bytes and the SAME signature.
+ * (The activation time lives in the Witness attestation's `as_of`, not the
+ * bundle.) Agents fetch, verify, cache, and evaluate this locally — they never
+ * `git pull`.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/verify.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Verify a signed bundle (agent-side, offline against the resolved key).
+ *
+ * Checks, in order:
+ *   1. the files still hash to the manifest's contentHash (no tampering),
+ *   2. the signature's keyId matches the manifest,
+ *   3. the signature verifies over the canonical manifest against the resolved
+ *      #key-3 public key.
+ * All three must hold for the bundle to be trusted.
+ */
+import type { KeyResolver } from './resolver.js';
+import type { BundleVerification, SignedBundle } from './types.js';
+export declare function verifyBundle(bundle: SignedBundle, resolver: KeyResolver): Promise<BundleVerification>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnE,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAyB7B"}

package/dist/verify.js

@@ -0,0 +1,36 @@
+/**
+ * Verify a signed bundle (agent-side, offline against the resolved key).
+ *
+ * Checks, in order:
+ *   1. the files still hash to the manifest's contentHash (no tampering),
+ *   2. the signature's keyId matches the manifest,
+ *   3. the signature verifies over the canonical manifest against the resolved
+ *      #key-3 public key.
+ * All three must hold for the bundle to be trusted.
+ */
+import { canonicalize, ed25519Verify } from './ed25519.js';
+import { contentHashOf } from './build.js';
+export async function verifyBundle(bundle, resolver) {
+    const reasons = [];
+    const recomputed = contentHashOf(bundle.files);
+    if (recomputed !== bundle.manifest.contentHash) {
+        reasons.push('content hash mismatch — files do not match the manifest (tampered)');
+    }
+    if (bundle.signature.keyId !== bundle.manifest.keyId) {
+        reasons.push('signature keyId does not match the manifest keyId');
+    }
+    const jwk = await resolver.resolve(bundle.manifest.keyId);
+    if (!jwk) {
+        reasons.push(`cannot resolve signing key ${bundle.manifest.keyId}`);
+    }
+    else if (!ed25519Verify(canonicalize(bundle.manifest), bundle.signature.value, jwk)) {
+        reasons.push('signature does not verify against the resolved key');
+    }
+    return {
+        valid: reasons.length === 0,
+        reasons,
+        commitSha: bundle.manifest.commitSha,
+        version: bundle.manifest.version,
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,QAAqB;IAErB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;QACpC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;KACjC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@getvda/bundle",
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "description": "Signed, versioned, content-hashed governance bundle — the runtime projection of approved git state. Deterministic build, Ed25519 signing (#key-3), verification against did:web:acp.getvda.ai.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@getvda/governance-schema": "^0.2.0"
+  },
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getvda-ai/acp-agent.git",
+    "directory": "packages/bundle"
+  },
+  "homepage": "https://getvda.ai"
+}