@githolon/testing 0.8.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -1425,6 +1425,12 @@ export const cryptoKeygen = (eng) => JSON.parse(call(eng.ex, "crypto_keygen", {}
 // on the author call). Returns { ok, secret, public } (both base64). `author_sign` is the lower-level
 // standalone signer; the author DOOR signs internally from the injected secret, so callers use `author`.
 export const authorKeygen = (eng) => JSON.parse(call(eng.ex, "author_keygen", {}, eng.STDERR));
+// THE CROSS-CUSTODY ATTESTATION SIGNER (home_holons §3/§5) — the asserter's client produces a SIGNED QUOTE
+// over the edge it is sharing (`attestation_sign`; the bytes are derived IN-wasm — the `author_sign` parity
+// contract). The device `secret` (base64) is injected for THIS call only. Returns { ok, signature, publicKey }
+// (base64) — the parts a `recordShare` payload carries; the subject's home gate verifies them (§3 gate-arm).
+export const attestationSign = (eng, { secret, asserterWorkspace, object, relation, subject, attestedAt }) =>
+  JSON.parse(call(eng.ex, "attestation_sign", { secret, asserterWorkspace, object, relation, subject, attestedAt }, eng.STDERR));
 export const cryptoWrapKey = (eng, { recipientPub, scopeKey }) => JSON.parse(call(eng.ex, "crypto_wrap_key", { recipientPub, scopeKey }, eng.STDERR));
 export const cryptoUnwrapKey = (eng, { secret, hpkeEpk, ct }) => JSON.parse(call(eng.ex, "crypto_unwrap_key", { secret, hpkeEpk, ct }, eng.STDERR)).scopeKey;
 // THE READ-POSTURE PROBE (slice 5.1): the githolon's own verdict on whether the