@humanagencyp/hap-core 0.5.1 → 0.6.0

package/dist/index.d.mts

@@ -14,7 +14,7 @@ interface ResolvedDomain {
 }
 interface AttestationPayload {
     attestation_id: string;
-    version: '0.3' | '0.4';
+    version: '0.3' | '0.4' | '0.5';
     profile_id: string;
     /** v0.3 (deprecated) — hash of the authorization frame */
     frame_hash?: string;
@@ -23,8 +23,37 @@ interface AttestationPayload {
     /** v0.4 — hash of the context parameters */
     context_hash?: string;
     execution_context_hash: string;
-    resolved_domains: ResolvedDomain[];
+    /**
+     * v0.4 (deprecated in v0.5) — domain-scoped owners. Optional so v0.5
+     * attestations that carry only `resolved_owners` remain valid. During the
+     * transition the AS emits BOTH `resolved_domains` (internal coverage) and
+     * `resolved_owners` (the v0.5 signed wire field).
+     */
+    resolved_domains?: ResolvedDomain[];
+    /**
+     * v0.5 — the Decision Owner DIDs this attestation covers (person-centric
+     * model; replaces the abstract domain in `resolved_domains`). Carried in the
+     * signed payload so verifiers bind the action to the human(s) who authorized it.
+     */
+    resolved_owners?: string[];
     gate_content_hashes: Record<string, string>;
+    /**
+     * v0.5 (companion spec `intent-disclosure@0.1`) — present iff the attestation
+     * carries an encrypted-intent disclosure object. `sha256:`-prefixed hash that
+     * binds the disclosure's `intent_ciphertext` + `approvers_frozen` into the
+     * signed payload (see {@link computeIntentDisclosureHash}), so a compromised
+     * AS cannot swap the ciphertext/wrapped keys or alter the approver set
+     * without invalidating the attestation signature (companion invariant C2).
+     */
+    intent_disclosure_hash?: string;
+    /**
+     * v0.6 (Identity Assurance) — optional signed overlay carrying the verified
+     * real-world identity of the Decision Owner(s), one entry per owner. Present
+     * only when identity is disclosed; an attestation with no `subjects` renders
+     * as `low` (pseudonymous, no name). See {@link Subject} and
+     * {@link deriveIdentityLine}.
+     */
+    subjects?: Subject[];
     /**
      * v0.4 — commitment mode chosen by the decision owner at attestation time.
      * - 'automatic': agent may invoke bounded tools without per-action review.
@@ -38,6 +67,38 @@ interface AttestationPayload {
     issued_at: number;
     expires_at: number;
 }
+/**
+ * v0.6 Identity Assurance — a signed overlay binding a Decision Owner's verified
+ * real-world identity to the attestation, gated by HOW the identity was verified.
+ *
+ * Two display levels (`assurance`): `low` discloses no name; `high` MAY disclose a
+ * name. At `high`, two trust roots: `as` (the AS operator vouches — valid only
+ * within its own domain) and `external` (an external eID such as EUDI — carries the
+ * owner's own signature, AS-independent). See review.md → "Identity Assurance".
+ */
+interface Subject {
+    /** The Decision Owner DID this subject describes (matches an entry in resolved_owners). */
+    did: string;
+    /** `low` → no name shown; `high` → the name MAY be shown. */
+    assurance: 'low' | 'high';
+    /** How identity was established. */
+    method: 'self_declared' | 'as_vouched' | 'eudi';
+    /** Who vouches: `self` (owner's claim), `as` (operator), `external` (eID scheme). */
+    trust_root: 'self' | 'as' | 'external';
+    /** Verifier id — the AS operator (as_vouched) or the eID scheme (eudi). Required at `high`. */
+    verifier?: string;
+    /** Disclosed attributes. `name` present ONLY at `assurance:"high"` and when disclosure is on. */
+    disclose?: {
+        name: string;
+    };
+    /** When the underlying verification was performed (unix seconds). */
+    verified_at?: number;
+    /**
+     * eudi only (Phase 2) — the owner's per-event wallet signature, making the
+     * identity claim non-repudiable independent of the AS. Null/absent otherwise.
+     */
+    owner_signature?: string | null;
+}
 interface Attestation {
     header: AttestationHeader;
     payload: AttestationPayload;
@@ -518,6 +579,89 @@ declare function contentCanonicalBytes(kind: ContentBinding['kind'], content: Re
  */
 declare function computeContentHash(binding: ContentBinding, content: Record<string, unknown> | string): string;
 
+/**
+ * Intent hashing + intent-disclosure binding (HAP v0.5).
+ *
+ * Two shared, environment-independent hashes that the attester (gateway), the
+ * Authority Server, and any approver MUST compute identically:
+ *
+ *  1. {@link computeIntentHash} — `gate_content_hashes.intent`. The intent text
+ *     is canonicalized (Unicode NFC, LF line endings, trailing-whitespace strip
+ *     — the same rule as content-binding's `canonicalizeText`) before hashing,
+ *     so independent multi-owner approvers reproduce an identical hash from the
+ *     same logical statement. See protocol.md → "Intent canonicalization".
+ *
+ *  2. {@link computeIntentDisclosureHash} — `intent_disclosure_hash`, the C2
+ *     binding from companion spec `intent-disclosure@0.1`. It commits the
+ *     encrypted disclosure object (`intent_ciphertext` + `approvers_frozen`)
+ *     into the SIGNED attestation payload, so a compromised AS cannot swap the
+ *     ciphertext/wrapped keys or widen/shrink the approver set without breaking
+ *     the attestation signature.
+ *
+ * Both produce `sha256:<hex>` to match the frame/bounds/context hash format.
+ */
+/**
+ * `gate_content_hashes.intent` for an intent statement.
+ * Canonicalizes the text (NFC / LF / trailing-whitespace strip) before hashing.
+ */
+declare function computeIntentHash(intentText: string): string;
+/**
+ * The exact bytes `intent_disclosure_hash` is taken over, WITHOUT hashing —
+ * exposed so an implementer debugging a mismatch can inspect the serialization
+ * both sides must agree on:
+ *
+ *   intent_ciphertext ‖ "\n" ‖ JCS(sort(approvers_frozen))
+ *
+ * where `intent_ciphertext` is the exact base64url string of the disclosure
+ * object, `sort` orders the approver DIDs by Unicode code point, and `JCS` is
+ * RFC 8785 canonicalization of the sorted array (via {@link canonicalize}).
+ */
+declare function intentDisclosureCanonicalBytes(intentCiphertext: string, approversFrozen: string[]): string;
+/**
+ * `intent_disclosure_hash` — `sha256:<hex>` over
+ * {@link intentDisclosureCanonicalBytes}. Computed by the attester after
+ * encryption and signed into the attestation; recomputed by the AS (at
+ * issuance) and by each approver (on receipt) and compared, fail-closed.
+ */
+declare function computeIntentDisclosureHash(intentCiphertext: string, approversFrozen: string[]): string;
+
+/**
+ * Identity Assurance (HAP v0.6) — validation + footer derivation for the signed
+ * {@link Subject} overlay. See review.md → "Identity Assurance".
+ *
+ * Two pure helpers, the single source of truth for both the gateway footer and
+ * the AS verify page:
+ *  - {@link validateSubject} — enforces the level/method/trust-root invariants.
+ *  - {@link deriveIdentityLine} — the human-readable footer line for a subject.
+ */
+
+interface SubjectValidation {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Enforce the Identity-Assurance invariants on a single subject:
+ *  - `self_declared` ⇒ `low` / `self`, no disclosed name.
+ *  - `as_vouched`    ⇒ `high` / `as`,  `verifier` required.
+ *  - `eudi`          ⇒ `high` / `external`, `verifier` + `owner_signature` required.
+ *  - `disclose.name` only at `assurance:"high"`.
+ */
+declare function validateSubject(subject: Subject): SubjectValidation;
+/**
+ * The footer line for a subject — the ONE place this wording lives.
+ * The name appears only at `high` with a disclosed name; otherwise no name.
+ *
+ *  - low / no disclosure → "Sent by an AI agent via «operator»"
+ *  - high / as_vouched   → "Sent by an AI agent of «name» — verified by «operator»"
+ *  - high / eudi         → "Sent by an AI agent of «name» — identity verified (EUDI)"
+ *
+ * `operatorName` is the rendered AS operator (e.g. "Suveren") — never hardcode it
+ * upstream; a different operator self-vouches under its own name.
+ */
+declare function deriveIdentityLine(subject: Subject | undefined | null, { operatorName }: {
+    operatorName: string;
+}): string;
+
 /**
  * Frame Canonicalization for Agent Profiles
  *
@@ -715,4 +859,4 @@ declare function listProfiles(): string[];
 declare function getAllProfiles(): AgentProfile[];
 declare function clearProfiles(): void;
 
-export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type ContentBinding, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFrameHash, contentCanonicalBytes, decodeAttestationBlob, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };
+export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type ContentBinding, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, type Subject, type SubjectValidation, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFrameHash, computeIntentDisclosureHash, computeIntentHash, contentCanonicalBytes, decodeAttestationBlob, deriveIdentityLine, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, validateSubject, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };

package/dist/index.d.ts

@@ -14,7 +14,7 @@ interface ResolvedDomain {
 }
 interface AttestationPayload {
     attestation_id: string;
-    version: '0.3' | '0.4';
+    version: '0.3' | '0.4' | '0.5';
     profile_id: string;
     /** v0.3 (deprecated) — hash of the authorization frame */
     frame_hash?: string;
@@ -23,8 +23,37 @@ interface AttestationPayload {
     /** v0.4 — hash of the context parameters */
     context_hash?: string;
     execution_context_hash: string;
-    resolved_domains: ResolvedDomain[];
+    /**
+     * v0.4 (deprecated in v0.5) — domain-scoped owners. Optional so v0.5
+     * attestations that carry only `resolved_owners` remain valid. During the
+     * transition the AS emits BOTH `resolved_domains` (internal coverage) and
+     * `resolved_owners` (the v0.5 signed wire field).
+     */
+    resolved_domains?: ResolvedDomain[];
+    /**
+     * v0.5 — the Decision Owner DIDs this attestation covers (person-centric
+     * model; replaces the abstract domain in `resolved_domains`). Carried in the
+     * signed payload so verifiers bind the action to the human(s) who authorized it.
+     */
+    resolved_owners?: string[];
     gate_content_hashes: Record<string, string>;
+    /**
+     * v0.5 (companion spec `intent-disclosure@0.1`) — present iff the attestation
+     * carries an encrypted-intent disclosure object. `sha256:`-prefixed hash that
+     * binds the disclosure's `intent_ciphertext` + `approvers_frozen` into the
+     * signed payload (see {@link computeIntentDisclosureHash}), so a compromised
+     * AS cannot swap the ciphertext/wrapped keys or alter the approver set
+     * without invalidating the attestation signature (companion invariant C2).
+     */
+    intent_disclosure_hash?: string;
+    /**
+     * v0.6 (Identity Assurance) — optional signed overlay carrying the verified
+     * real-world identity of the Decision Owner(s), one entry per owner. Present
+     * only when identity is disclosed; an attestation with no `subjects` renders
+     * as `low` (pseudonymous, no name). See {@link Subject} and
+     * {@link deriveIdentityLine}.
+     */
+    subjects?: Subject[];
     /**
      * v0.4 — commitment mode chosen by the decision owner at attestation time.
      * - 'automatic': agent may invoke bounded tools without per-action review.
@@ -38,6 +67,38 @@ interface AttestationPayload {
     issued_at: number;
     expires_at: number;
 }
+/**
+ * v0.6 Identity Assurance — a signed overlay binding a Decision Owner's verified
+ * real-world identity to the attestation, gated by HOW the identity was verified.
+ *
+ * Two display levels (`assurance`): `low` discloses no name; `high` MAY disclose a
+ * name. At `high`, two trust roots: `as` (the AS operator vouches — valid only
+ * within its own domain) and `external` (an external eID such as EUDI — carries the
+ * owner's own signature, AS-independent). See review.md → "Identity Assurance".
+ */
+interface Subject {
+    /** The Decision Owner DID this subject describes (matches an entry in resolved_owners). */
+    did: string;
+    /** `low` → no name shown; `high` → the name MAY be shown. */
+    assurance: 'low' | 'high';
+    /** How identity was established. */
+    method: 'self_declared' | 'as_vouched' | 'eudi';
+    /** Who vouches: `self` (owner's claim), `as` (operator), `external` (eID scheme). */
+    trust_root: 'self' | 'as' | 'external';
+    /** Verifier id — the AS operator (as_vouched) or the eID scheme (eudi). Required at `high`. */
+    verifier?: string;
+    /** Disclosed attributes. `name` present ONLY at `assurance:"high"` and when disclosure is on. */
+    disclose?: {
+        name: string;
+    };
+    /** When the underlying verification was performed (unix seconds). */
+    verified_at?: number;
+    /**
+     * eudi only (Phase 2) — the owner's per-event wallet signature, making the
+     * identity claim non-repudiable independent of the AS. Null/absent otherwise.
+     */
+    owner_signature?: string | null;
+}
 interface Attestation {
     header: AttestationHeader;
     payload: AttestationPayload;
@@ -518,6 +579,89 @@ declare function contentCanonicalBytes(kind: ContentBinding['kind'], content: Re
  */
 declare function computeContentHash(binding: ContentBinding, content: Record<string, unknown> | string): string;
 
+/**
+ * Intent hashing + intent-disclosure binding (HAP v0.5).
+ *
+ * Two shared, environment-independent hashes that the attester (gateway), the
+ * Authority Server, and any approver MUST compute identically:
+ *
+ *  1. {@link computeIntentHash} — `gate_content_hashes.intent`. The intent text
+ *     is canonicalized (Unicode NFC, LF line endings, trailing-whitespace strip
+ *     — the same rule as content-binding's `canonicalizeText`) before hashing,
+ *     so independent multi-owner approvers reproduce an identical hash from the
+ *     same logical statement. See protocol.md → "Intent canonicalization".
+ *
+ *  2. {@link computeIntentDisclosureHash} — `intent_disclosure_hash`, the C2
+ *     binding from companion spec `intent-disclosure@0.1`. It commits the
+ *     encrypted disclosure object (`intent_ciphertext` + `approvers_frozen`)
+ *     into the SIGNED attestation payload, so a compromised AS cannot swap the
+ *     ciphertext/wrapped keys or widen/shrink the approver set without breaking
+ *     the attestation signature.
+ *
+ * Both produce `sha256:<hex>` to match the frame/bounds/context hash format.
+ */
+/**
+ * `gate_content_hashes.intent` for an intent statement.
+ * Canonicalizes the text (NFC / LF / trailing-whitespace strip) before hashing.
+ */
+declare function computeIntentHash(intentText: string): string;
+/**
+ * The exact bytes `intent_disclosure_hash` is taken over, WITHOUT hashing —
+ * exposed so an implementer debugging a mismatch can inspect the serialization
+ * both sides must agree on:
+ *
+ *   intent_ciphertext ‖ "\n" ‖ JCS(sort(approvers_frozen))
+ *
+ * where `intent_ciphertext` is the exact base64url string of the disclosure
+ * object, `sort` orders the approver DIDs by Unicode code point, and `JCS` is
+ * RFC 8785 canonicalization of the sorted array (via {@link canonicalize}).
+ */
+declare function intentDisclosureCanonicalBytes(intentCiphertext: string, approversFrozen: string[]): string;
+/**
+ * `intent_disclosure_hash` — `sha256:<hex>` over
+ * {@link intentDisclosureCanonicalBytes}. Computed by the attester after
+ * encryption and signed into the attestation; recomputed by the AS (at
+ * issuance) and by each approver (on receipt) and compared, fail-closed.
+ */
+declare function computeIntentDisclosureHash(intentCiphertext: string, approversFrozen: string[]): string;
+
+/**
+ * Identity Assurance (HAP v0.6) — validation + footer derivation for the signed
+ * {@link Subject} overlay. See review.md → "Identity Assurance".
+ *
+ * Two pure helpers, the single source of truth for both the gateway footer and
+ * the AS verify page:
+ *  - {@link validateSubject} — enforces the level/method/trust-root invariants.
+ *  - {@link deriveIdentityLine} — the human-readable footer line for a subject.
+ */
+
+interface SubjectValidation {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Enforce the Identity-Assurance invariants on a single subject:
+ *  - `self_declared` ⇒ `low` / `self`, no disclosed name.
+ *  - `as_vouched`    ⇒ `high` / `as`,  `verifier` required.
+ *  - `eudi`          ⇒ `high` / `external`, `verifier` + `owner_signature` required.
+ *  - `disclose.name` only at `assurance:"high"`.
+ */
+declare function validateSubject(subject: Subject): SubjectValidation;
+/**
+ * The footer line for a subject — the ONE place this wording lives.
+ * The name appears only at `high` with a disclosed name; otherwise no name.
+ *
+ *  - low / no disclosure → "Sent by an AI agent via «operator»"
+ *  - high / as_vouched   → "Sent by an AI agent of «name» — verified by «operator»"
+ *  - high / eudi         → "Sent by an AI agent of «name» — identity verified (EUDI)"
+ *
+ * `operatorName` is the rendered AS operator (e.g. "Suveren") — never hardcode it
+ * upstream; a different operator self-vouches under its own name.
+ */
+declare function deriveIdentityLine(subject: Subject | undefined | null, { operatorName }: {
+    operatorName: string;
+}): string;
+
 /**
  * Frame Canonicalization for Agent Profiles
  *
@@ -715,4 +859,4 @@ declare function listProfiles(): string[];
 declare function getAllProfiles(): AgentProfile[];
 declare function clearProfiles(): void;
 
-export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type ContentBinding, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFrameHash, contentCanonicalBytes, decodeAttestationBlob, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };
+export { type AgentBoundsParams, type AgentContextParams, type AgentFrameParams, type AgentProfile, type Attestation, type AttestationHeader, type AttestationPayload, type BoundType, type ContentBinding, type CumulativeFieldDef, type CumulativeWindow, type DeclaredFieldDef, type ExecutionContextFieldDef, type ExecutionLogEntry, type ExecutionLogQuery, type ExecutionMappingTransform, type ExecutionMappingValue, type ExecutionPath, type FieldConstraint, type FieldUnit, type GateQuestion, type GatekeeperError, type GatekeeperRequest, type GatekeeperResult, type ProfileBoundsField, type ProfileContextField, type ProfileFrameField, type ProfileToolGating, type ProfileToolGatingEntry, type ResolvedDomain, type Subject, type SubjectValidation, attestationId, canonicalBounds, canonicalContext, canonicalFrame, canonicalize, canonicalizeText, checkAttestationExpiry, clearProfiles, computeBoundsHash, computeContentHash, computeContextHash, computeFrameHash, computeIntentDisclosureHash, computeIntentHash, contentCanonicalBytes, decodeAttestationBlob, deriveIdentityLine, encodeAttestationBlob, frameHash, getAllProfiles, getProfile, intentDisclosureCanonicalBytes, isV4Attestation, listProfiles, registerProfile, validateBoundsParams, validateContextParams, validateFrameParams, validateSubject, verify, verifyAttestation, verifyAttestationSignature, verifyAttestationV4, verifyBoundsHash, verifyContextHash, verifyFrameHash };

package/dist/index.js

@@ -42,18 +42,23 @@ __export(index_exports, {
   computeContentHash: () => computeContentHash,
   computeContextHash: () => computeContextHash,
   computeFrameHash: () => computeFrameHash,
+  computeIntentDisclosureHash: () => computeIntentDisclosureHash,
+  computeIntentHash: () => computeIntentHash,
   contentCanonicalBytes: () => contentCanonicalBytes,
   decodeAttestationBlob: () => decodeAttestationBlob,
+  deriveIdentityLine: () => deriveIdentityLine,
   encodeAttestationBlob: () => encodeAttestationBlob,
   frameHash: () => frameHash,
   getAllProfiles: () => getAllProfiles,
   getProfile: () => getProfile,
+  intentDisclosureCanonicalBytes: () => intentDisclosureCanonicalBytes,
   isV4Attestation: () => isV4Attestation,
   listProfiles: () => listProfiles,
   registerProfile: () => registerProfile,
   validateBoundsParams: () => validateBoundsParams,
   validateContextParams: () => validateContextParams,
   validateFrameParams: () => validateFrameParams,
+  validateSubject: () => validateSubject,
   verify: () => verify,
   verifyAttestation: () => verifyAttestation,
   verifyAttestationSignature: () => verifyAttestationSignature,
@@ -116,8 +121,62 @@ function computeContentHash(binding, content) {
   return `sha256:${sha256Hex(contentCanonicalBytes(binding.kind, content))}`;
 }
 
-// src/frame.ts
+// src/intent-disclosure.ts
 var import_crypto2 = require("crypto");
+function sha256Hex2(bytes) {
+  return (0, import_crypto2.createHash)("sha256").update(bytes, "utf8").digest("hex");
+}
+function computeIntentHash(intentText) {
+  return `sha256:${sha256Hex2(canonicalizeText(intentText))}`;
+}
+function intentDisclosureCanonicalBytes(intentCiphertext, approversFrozen) {
+  const sorted = [...approversFrozen].sort();
+  return `${intentCiphertext}
+${canonicalize(sorted)}`;
+}
+function computeIntentDisclosureHash(intentCiphertext, approversFrozen) {
+  return `sha256:${sha256Hex2(intentDisclosureCanonicalBytes(intentCiphertext, approversFrozen))}`;
+}
+
+// src/identity.ts
+function validateSubject(subject) {
+  const errors = [];
+  const { did, assurance, method, trust_root, verifier, disclose, owner_signature } = subject;
+  if (!did) errors.push("subject.did is required");
+  if (assurance === "low") {
+    if (method !== "self_declared") errors.push(`low assurance requires method "self_declared", got "${method}"`);
+    if (trust_root !== "self") errors.push(`low assurance requires trust_root "self", got "${trust_root}"`);
+    if (disclose) errors.push("low assurance MUST NOT disclose a name");
+  } else if (assurance === "high") {
+    if (method === "as_vouched") {
+      if (trust_root !== "as") errors.push('as_vouched requires trust_root "as"');
+      if (!verifier) errors.push("as_vouched requires a verifier");
+    } else if (method === "eudi") {
+      if (trust_root !== "external") errors.push('eudi requires trust_root "external"');
+      if (!verifier) errors.push("eudi requires a verifier");
+      if (!owner_signature) errors.push("eudi requires an owner_signature");
+    } else {
+      errors.push(`high assurance requires method "as_vouched" or "eudi", got "${method}"`);
+    }
+    if (disclose && typeof disclose.name !== "string") errors.push("disclose.name must be a string");
+  } else {
+    errors.push(`assurance must be "low" or "high", got "${assurance}"`);
+  }
+  return { valid: errors.length === 0, errors };
+}
+function deriveIdentityLine(subject, { operatorName }) {
+  const name = subject?.assurance === "high" ? subject.disclose?.name : void 0;
+  if (!name) {
+    return `Sent by an AI agent via ${operatorName}`;
+  }
+  if (subject.method === "eudi") {
+    return `Sent by an AI agent of ${name} \u2014 identity verified (EUDI)`;
+  }
+  return `Sent by an AI agent of ${name} \u2014 verified by ${operatorName}`;
+}
+
+// src/frame.ts
+var import_crypto3 = require("crypto");
 function validateFrameParams(params, profile) {
   const errors = [];
   if (!profile.frameSchema) {
@@ -154,7 +213,7 @@ function canonicalFrame(params, profile) {
   return lines.join("\n");
 }
 function frameHash(canonicalFrameString) {
-  const hash = (0, import_crypto2.createHash)("sha256").update(canonicalFrameString, "utf8").digest("hex");
+  const hash = (0, import_crypto3.createHash)("sha256").update(canonicalFrameString, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeFrameHash(params, profile) {
@@ -238,17 +297,17 @@ function canonicalContext(params, profile) {
 }
 function computeBoundsHash(params, profile) {
   const canonical = canonicalBounds(params, profile);
-  const hash = (0, import_crypto2.createHash)("sha256").update(canonical, "utf8").digest("hex");
+  const hash = (0, import_crypto3.createHash)("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeContextHash(params, profile) {
   const canonical = canonicalContext(params, profile);
-  const hash = (0, import_crypto2.createHash)("sha256").update(canonical, "utf8").digest("hex");
+  const hash = (0, import_crypto3.createHash)("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 
 // src/attestation.ts
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 var ed = __toESM(require("@noble/ed25519"));
 function decodeAttestationBlob(blob) {
   try {
@@ -266,7 +325,7 @@ function encodeAttestationBlob(attestation) {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function attestationId(blob) {
-  const hash = (0, import_crypto3.createHash)("sha256").update(blob, "utf8").digest("hex");
+  const hash = (0, import_crypto4.createHash)("sha256").update(blob, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 async function verifyAttestationSignature(attestation, publicKeyHex) {
@@ -396,11 +455,11 @@ async function verifyV3(request, profile, publicKeyHex, now, executionLog, error
     try {
       checkAttestationExpiry(attestation.payload, now);
     } catch {
-      const domainNames = attestation.payload.resolved_domains.map((d) => d.domain).join(", ");
+      const domainNames = (attestation.payload.resolved_domains ?? []).map((d) => d.domain).join(", ");
       errors.push({ code: "TTL_EXPIRED", message: `Attestation for domain "${domainNames}" has expired` });
       continue;
     }
-    for (const rd of attestation.payload.resolved_domains) {
+    for (const rd of attestation.payload.resolved_domains ?? []) {
       coveredDomains.add(rd.domain);
     }
   }
@@ -475,11 +534,11 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
     try {
       checkAttestationExpiry(attestation.payload, now);
     } catch {
-      const domainNames = attestation.payload.resolved_domains.map((d) => d.domain).join(", ");
+      const domainNames = (attestation.payload.resolved_domains ?? []).map((d) => d.domain).join(", ");
       errors.push({ code: "TTL_EXPIRED", message: `Attestation for domain "${domainNames}" has expired` });
       continue;
     }
-    for (const rd of attestation.payload.resolved_domains) {
+    for (const rd of attestation.payload.resolved_domains ?? []) {
       coveredDomains.add(rd.domain);
     }
   }
@@ -783,18 +842,23 @@ function resolveCumulativeFields(request, profile, executionLog, now) {
   computeContentHash,
   computeContextHash,
   computeFrameHash,
+  computeIntentDisclosureHash,
+  computeIntentHash,
   contentCanonicalBytes,
   decodeAttestationBlob,
+  deriveIdentityLine,
   encodeAttestationBlob,
   frameHash,
   getAllProfiles,
   getProfile,
+  intentDisclosureCanonicalBytes,
   isV4Attestation,
   listProfiles,
   registerProfile,
   validateBoundsParams,
   validateContextParams,
   validateFrameParams,
+  validateSubject,
   verify,
   verifyAttestation,
   verifyAttestationSignature,

package/dist/index.mjs

@@ -50,8 +50,62 @@ function computeContentHash(binding, content) {
   return `sha256:${sha256Hex(contentCanonicalBytes(binding.kind, content))}`;
 }
 
-// src/frame.ts
+// src/intent-disclosure.ts
 import { createHash as createHash2 } from "crypto";
+function sha256Hex2(bytes) {
+  return createHash2("sha256").update(bytes, "utf8").digest("hex");
+}
+function computeIntentHash(intentText) {
+  return `sha256:${sha256Hex2(canonicalizeText(intentText))}`;
+}
+function intentDisclosureCanonicalBytes(intentCiphertext, approversFrozen) {
+  const sorted = [...approversFrozen].sort();
+  return `${intentCiphertext}
+${canonicalize(sorted)}`;
+}
+function computeIntentDisclosureHash(intentCiphertext, approversFrozen) {
+  return `sha256:${sha256Hex2(intentDisclosureCanonicalBytes(intentCiphertext, approversFrozen))}`;
+}
+
+// src/identity.ts
+function validateSubject(subject) {
+  const errors = [];
+  const { did, assurance, method, trust_root, verifier, disclose, owner_signature } = subject;
+  if (!did) errors.push("subject.did is required");
+  if (assurance === "low") {
+    if (method !== "self_declared") errors.push(`low assurance requires method "self_declared", got "${method}"`);
+    if (trust_root !== "self") errors.push(`low assurance requires trust_root "self", got "${trust_root}"`);
+    if (disclose) errors.push("low assurance MUST NOT disclose a name");
+  } else if (assurance === "high") {
+    if (method === "as_vouched") {
+      if (trust_root !== "as") errors.push('as_vouched requires trust_root "as"');
+      if (!verifier) errors.push("as_vouched requires a verifier");
+    } else if (method === "eudi") {
+      if (trust_root !== "external") errors.push('eudi requires trust_root "external"');
+      if (!verifier) errors.push("eudi requires a verifier");
+      if (!owner_signature) errors.push("eudi requires an owner_signature");
+    } else {
+      errors.push(`high assurance requires method "as_vouched" or "eudi", got "${method}"`);
+    }
+    if (disclose && typeof disclose.name !== "string") errors.push("disclose.name must be a string");
+  } else {
+    errors.push(`assurance must be "low" or "high", got "${assurance}"`);
+  }
+  return { valid: errors.length === 0, errors };
+}
+function deriveIdentityLine(subject, { operatorName }) {
+  const name = subject?.assurance === "high" ? subject.disclose?.name : void 0;
+  if (!name) {
+    return `Sent by an AI agent via ${operatorName}`;
+  }
+  if (subject.method === "eudi") {
+    return `Sent by an AI agent of ${name} \u2014 identity verified (EUDI)`;
+  }
+  return `Sent by an AI agent of ${name} \u2014 verified by ${operatorName}`;
+}
+
+// src/frame.ts
+import { createHash as createHash3 } from "crypto";
 function validateFrameParams(params, profile) {
   const errors = [];
   if (!profile.frameSchema) {
@@ -88,7 +142,7 @@ function canonicalFrame(params, profile) {
   return lines.join("\n");
 }
 function frameHash(canonicalFrameString) {
-  const hash = createHash2("sha256").update(canonicalFrameString, "utf8").digest("hex");
+  const hash = createHash3("sha256").update(canonicalFrameString, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeFrameHash(params, profile) {
@@ -172,17 +226,17 @@ function canonicalContext(params, profile) {
 }
 function computeBoundsHash(params, profile) {
   const canonical = canonicalBounds(params, profile);
-  const hash = createHash2("sha256").update(canonical, "utf8").digest("hex");
+  const hash = createHash3("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 function computeContextHash(params, profile) {
   const canonical = canonicalContext(params, profile);
-  const hash = createHash2("sha256").update(canonical, "utf8").digest("hex");
+  const hash = createHash3("sha256").update(canonical, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 
 // src/attestation.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import * as ed from "@noble/ed25519";
 function decodeAttestationBlob(blob) {
   try {
@@ -200,7 +254,7 @@ function encodeAttestationBlob(attestation) {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function attestationId(blob) {
-  const hash = createHash3("sha256").update(blob, "utf8").digest("hex");
+  const hash = createHash4("sha256").update(blob, "utf8").digest("hex");
   return `sha256:${hash}`;
 }
 async function verifyAttestationSignature(attestation, publicKeyHex) {
@@ -330,11 +384,11 @@ async function verifyV3(request, profile, publicKeyHex, now, executionLog, error
     try {
       checkAttestationExpiry(attestation.payload, now);
     } catch {
-      const domainNames = attestation.payload.resolved_domains.map((d) => d.domain).join(", ");
+      const domainNames = (attestation.payload.resolved_domains ?? []).map((d) => d.domain).join(", ");
       errors.push({ code: "TTL_EXPIRED", message: `Attestation for domain "${domainNames}" has expired` });
       continue;
     }
-    for (const rd of attestation.payload.resolved_domains) {
+    for (const rd of attestation.payload.resolved_domains ?? []) {
       coveredDomains.add(rd.domain);
     }
   }
@@ -409,11 +463,11 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
     try {
       checkAttestationExpiry(attestation.payload, now);
     } catch {
-      const domainNames = attestation.payload.resolved_domains.map((d) => d.domain).join(", ");
+      const domainNames = (attestation.payload.resolved_domains ?? []).map((d) => d.domain).join(", ");
       errors.push({ code: "TTL_EXPIRED", message: `Attestation for domain "${domainNames}" has expired` });
       continue;
     }
-    for (const rd of attestation.payload.resolved_domains) {
+    for (const rd of attestation.payload.resolved_domains ?? []) {
       coveredDomains.add(rd.domain);
     }
   }
@@ -716,18 +770,23 @@ export {
   computeContentHash,
   computeContextHash,
   computeFrameHash,
+  computeIntentDisclosureHash,
+  computeIntentHash,
   contentCanonicalBytes,
   decodeAttestationBlob,
+  deriveIdentityLine,
   encodeAttestationBlob,
   frameHash,
   getAllProfiles,
   getProfile,
+  intentDisclosureCanonicalBytes,
   isV4Attestation,
   listProfiles,
   registerProfile,
   validateBoundsParams,
   validateContextParams,
   validateFrameParams,
+  validateSubject,
   verify,
   verifyAttestation,
   verifyAttestationSignature,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {

package/src/gatekeeper.ts

@@ -131,12 +131,12 @@ async function verifyV3(
     try {
       checkAttestationExpiry(attestation.payload, now);
     } catch {
-      const domainNames = attestation.payload.resolved_domains.map(d => d.domain).join(', ');
+      const domainNames = (attestation.payload.resolved_domains ?? []).map(d => d.domain).join(', ');
       errors.push({ code: 'TTL_EXPIRED', message: `Attestation for domain "${domainNames}" has expired` });
       continue;
     }
 
-    for (const rd of attestation.payload.resolved_domains) {
+    for (const rd of attestation.payload.resolved_domains ?? []) {
       coveredDomains.add(rd.domain);
     }
   }
@@ -244,12 +244,12 @@ async function verifyV4(
     try {
       checkAttestationExpiry(attestation.payload, now);
     } catch {
-      const domainNames = attestation.payload.resolved_domains.map(d => d.domain).join(', ');
+      const domainNames = (attestation.payload.resolved_domains ?? []).map(d => d.domain).join(', ');
       errors.push({ code: 'TTL_EXPIRED', message: `Attestation for domain "${domainNames}" has expired` });
       continue;
     }
 
-    for (const rd of attestation.payload.resolved_domains) {
+    for (const rd of attestation.payload.resolved_domains ?? []) {
       coveredDomains.add(rd.domain);
     }
   }

package/src/identity.ts

@@ -0,0 +1,77 @@
+/**
+ * Identity Assurance (HAP v0.6) — validation + footer derivation for the signed
+ * {@link Subject} overlay. See review.md → "Identity Assurance".
+ *
+ * Two pure helpers, the single source of truth for both the gateway footer and
+ * the AS verify page:
+ *  - {@link validateSubject} — enforces the level/method/trust-root invariants.
+ *  - {@link deriveIdentityLine} — the human-readable footer line for a subject.
+ */
+
+import type { Subject } from './types';
+
+export interface SubjectValidation {
+  valid: boolean;
+  errors: string[];
+}
+
+/**
+ * Enforce the Identity-Assurance invariants on a single subject:
+ *  - `self_declared` ⇒ `low` / `self`, no disclosed name.
+ *  - `as_vouched`    ⇒ `high` / `as`,  `verifier` required.
+ *  - `eudi`          ⇒ `high` / `external`, `verifier` + `owner_signature` required.
+ *  - `disclose.name` only at `assurance:"high"`.
+ */
+export function validateSubject(subject: Subject): SubjectValidation {
+  const errors: string[] = [];
+  const { did, assurance, method, trust_root, verifier, disclose, owner_signature } = subject;
+
+  if (!did) errors.push('subject.did is required');
+
+  if (assurance === 'low') {
+    if (method !== 'self_declared') errors.push(`low assurance requires method "self_declared", got "${method}"`);
+    if (trust_root !== 'self') errors.push(`low assurance requires trust_root "self", got "${trust_root}"`);
+    if (disclose) errors.push('low assurance MUST NOT disclose a name');
+  } else if (assurance === 'high') {
+    if (method === 'as_vouched') {
+      if (trust_root !== 'as') errors.push('as_vouched requires trust_root "as"');
+      if (!verifier) errors.push('as_vouched requires a verifier');
+    } else if (method === 'eudi') {
+      if (trust_root !== 'external') errors.push('eudi requires trust_root "external"');
+      if (!verifier) errors.push('eudi requires a verifier');
+      if (!owner_signature) errors.push('eudi requires an owner_signature');
+    } else {
+      errors.push(`high assurance requires method "as_vouched" or "eudi", got "${method}"`);
+    }
+    if (disclose && typeof disclose.name !== 'string') errors.push('disclose.name must be a string');
+  } else {
+    errors.push(`assurance must be "low" or "high", got "${assurance as string}"`);
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+/**
+ * The footer line for a subject — the ONE place this wording lives.
+ * The name appears only at `high` with a disclosed name; otherwise no name.
+ *
+ *  - low / no disclosure → "Sent by an AI agent via «operator»"
+ *  - high / as_vouched   → "Sent by an AI agent of «name» — verified by «operator»"
+ *  - high / eudi         → "Sent by an AI agent of «name» — identity verified (EUDI)"
+ *
+ * `operatorName` is the rendered AS operator (e.g. "Suveren") — never hardcode it
+ * upstream; a different operator self-vouches under its own name.
+ */
+export function deriveIdentityLine(
+  subject: Subject | undefined | null,
+  { operatorName }: { operatorName: string },
+): string {
+  const name = subject?.assurance === 'high' ? subject.disclose?.name : undefined;
+  if (!name) {
+    return `Sent by an AI agent via ${operatorName}`;
+  }
+  if (subject!.method === 'eudi') {
+    return `Sent by an AI agent of ${name} — identity verified (EUDI)`;
+  }
+  return `Sent by an AI agent of ${name} — verified by ${operatorName}`;
+}

package/src/index.ts

@@ -7,6 +7,8 @@
 export * from './types';
 export * from './canonicalize';
 export * from './content-binding';
+export * from './intent-disclosure';
+export * from './identity';
 export * from './frame';
 export * from './attestation';
 export * from './gatekeeper';

package/src/intent-disclosure.ts

@@ -0,0 +1,69 @@
+/**
+ * Intent hashing + intent-disclosure binding (HAP v0.5).
+ *
+ * Two shared, environment-independent hashes that the attester (gateway), the
+ * Authority Server, and any approver MUST compute identically:
+ *
+ *  1. {@link computeIntentHash} — `gate_content_hashes.intent`. The intent text
+ *     is canonicalized (Unicode NFC, LF line endings, trailing-whitespace strip
+ *     — the same rule as content-binding's `canonicalizeText`) before hashing,
+ *     so independent multi-owner approvers reproduce an identical hash from the
+ *     same logical statement. See protocol.md → "Intent canonicalization".
+ *
+ *  2. {@link computeIntentDisclosureHash} — `intent_disclosure_hash`, the C2
+ *     binding from companion spec `intent-disclosure@0.1`. It commits the
+ *     encrypted disclosure object (`intent_ciphertext` + `approvers_frozen`)
+ *     into the SIGNED attestation payload, so a compromised AS cannot swap the
+ *     ciphertext/wrapped keys or widen/shrink the approver set without breaking
+ *     the attestation signature.
+ *
+ * Both produce `sha256:<hex>` to match the frame/bounds/context hash format.
+ */
+
+import { createHash } from 'crypto';
+import { canonicalize } from './canonicalize';
+import { canonicalizeText } from './content-binding';
+
+function sha256Hex(bytes: string): string {
+  return createHash('sha256').update(bytes, 'utf8').digest('hex');
+}
+
+/**
+ * `gate_content_hashes.intent` for an intent statement.
+ * Canonicalizes the text (NFC / LF / trailing-whitespace strip) before hashing.
+ */
+export function computeIntentHash(intentText: string): string {
+  return `sha256:${sha256Hex(canonicalizeText(intentText))}`;
+}
+
+/**
+ * The exact bytes `intent_disclosure_hash` is taken over, WITHOUT hashing —
+ * exposed so an implementer debugging a mismatch can inspect the serialization
+ * both sides must agree on:
+ *
+ *   intent_ciphertext ‖ "\n" ‖ JCS(sort(approvers_frozen))
+ *
+ * where `intent_ciphertext` is the exact base64url string of the disclosure
+ * object, `sort` orders the approver DIDs by Unicode code point, and `JCS` is
+ * RFC 8785 canonicalization of the sorted array (via {@link canonicalize}).
+ */
+export function intentDisclosureCanonicalBytes(
+  intentCiphertext: string,
+  approversFrozen: string[],
+): string {
+  const sorted = [...approversFrozen].sort();
+  return `${intentCiphertext}\n${canonicalize(sorted)}`;
+}
+
+/**
+ * `intent_disclosure_hash` — `sha256:<hex>` over
+ * {@link intentDisclosureCanonicalBytes}. Computed by the attester after
+ * encryption and signed into the attestation; recomputed by the AS (at
+ * issuance) and by each approver (on receipt) and compared, fail-closed.
+ */
+export function computeIntentDisclosureHash(
+  intentCiphertext: string,
+  approversFrozen: string[],
+): string {
+  return `sha256:${sha256Hex(intentDisclosureCanonicalBytes(intentCiphertext, approversFrozen))}`;
+}

package/src/types.ts

@@ -19,7 +19,7 @@ export interface ResolvedDomain {
 
 export interface AttestationPayload {
   attestation_id: string;
-  version: '0.3' | '0.4';
+  version: '0.3' | '0.4' | '0.5';
   profile_id: string;
   /** v0.3 (deprecated) — hash of the authorization frame */
   frame_hash?: string;
@@ -28,8 +28,37 @@ export interface AttestationPayload {
   /** v0.4 — hash of the context parameters */
   context_hash?: string;
   execution_context_hash: string;
-  resolved_domains: ResolvedDomain[];
+  /**
+   * v0.4 (deprecated in v0.5) — domain-scoped owners. Optional so v0.5
+   * attestations that carry only `resolved_owners` remain valid. During the
+   * transition the AS emits BOTH `resolved_domains` (internal coverage) and
+   * `resolved_owners` (the v0.5 signed wire field).
+   */
+  resolved_domains?: ResolvedDomain[];
+  /**
+   * v0.5 — the Decision Owner DIDs this attestation covers (person-centric
+   * model; replaces the abstract domain in `resolved_domains`). Carried in the
+   * signed payload so verifiers bind the action to the human(s) who authorized it.
+   */
+  resolved_owners?: string[];
   gate_content_hashes: Record<string, string>;
+  /**
+   * v0.5 (companion spec `intent-disclosure@0.1`) — present iff the attestation
+   * carries an encrypted-intent disclosure object. `sha256:`-prefixed hash that
+   * binds the disclosure's `intent_ciphertext` + `approvers_frozen` into the
+   * signed payload (see {@link computeIntentDisclosureHash}), so a compromised
+   * AS cannot swap the ciphertext/wrapped keys or alter the approver set
+   * without invalidating the attestation signature (companion invariant C2).
+   */
+  intent_disclosure_hash?: string;
+  /**
+   * v0.6 (Identity Assurance) — optional signed overlay carrying the verified
+   * real-world identity of the Decision Owner(s), one entry per owner. Present
+   * only when identity is disclosed; an attestation with no `subjects` renders
+   * as `low` (pseudonymous, no name). See {@link Subject} and
+   * {@link deriveIdentityLine}.
+   */
+  subjects?: Subject[];
   /**
    * v0.4 — commitment mode chosen by the decision owner at attestation time.
    * - 'automatic': agent may invoke bounded tools without per-action review.
@@ -44,6 +73,37 @@ export interface AttestationPayload {
   expires_at: number;
 }
 
+/**
+ * v0.6 Identity Assurance — a signed overlay binding a Decision Owner's verified
+ * real-world identity to the attestation, gated by HOW the identity was verified.
+ *
+ * Two display levels (`assurance`): `low` discloses no name; `high` MAY disclose a
+ * name. At `high`, two trust roots: `as` (the AS operator vouches — valid only
+ * within its own domain) and `external` (an external eID such as EUDI — carries the
+ * owner's own signature, AS-independent). See review.md → "Identity Assurance".
+ */
+export interface Subject {
+  /** The Decision Owner DID this subject describes (matches an entry in resolved_owners). */
+  did: string;
+  /** `low` → no name shown; `high` → the name MAY be shown. */
+  assurance: 'low' | 'high';
+  /** How identity was established. */
+  method: 'self_declared' | 'as_vouched' | 'eudi';
+  /** Who vouches: `self` (owner's claim), `as` (operator), `external` (eID scheme). */
+  trust_root: 'self' | 'as' | 'external';
+  /** Verifier id — the AS operator (as_vouched) or the eID scheme (eudi). Required at `high`. */
+  verifier?: string;
+  /** Disclosed attributes. `name` present ONLY at `assurance:"high"` and when disclosure is on. */
+  disclose?: { name: string };
+  /** When the underlying verification was performed (unix seconds). */
+  verified_at?: number;
+  /**
+   * eudi only (Phase 2) — the owner's per-event wallet signature, making the
+   * identity claim non-repudiable independent of the AS. Null/absent otherwise.
+   */
+  owner_signature?: string | null;
+}
+
 export interface Attestation {
   header: AttestationHeader;
   payload: AttestationPayload;