@mikeargento/bitgraph-player 0.2.1 → 0.3.0

package/dist/index.js

@@ -1,7 +1,8 @@
 // Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
 export { basisTier, meetsFloor } from "./types.js";
-export { parseRule, normalizeDigest, RuleError } from "./rule.js";
-export { play, playAudit, PlayError } from "./play.js";
+export { parseRule, normalizeDigest, decodeDigestBytes, RuleError } from "./rule.js";
+export { play, playAudit, claimUsesSignatures, SIG_EVIDENCE_MAX_BYTES, PlayError } from "./play.js";
+export { parseSigFile, verifySigFile, keyObjectFor, sigMessage } from "./sig.js";
 export { scaffoldRule, roleNameForFile, ORDERING_PLACEHOLDER } from "./init.js";
 export { resolveCast, resolveRole } from "./cast.js";
 export { compare } from "./order.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qFAAqF;AA6BrF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEhF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qFAAqF;AA8BrF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEpG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGjF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEhF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/play.d.ts

@@ -1,5 +1,6 @@
 import type { AuditResult } from "@mikeargento/bitgraph-audit";
-import type { Rule, Verdict } from "./types.js";
+import type { SigEvidence } from "./evaluate.js";
+import type { Claim, Rule, Verdict } from "./types.js";
 export type PlayStage = "rule-read" | "audit";
 export declare class PlayError extends Error {
     readonly stage: PlayStage;
@@ -14,8 +15,17 @@ export interface PlayResult {
     /** The audit the verdict was evaluated over, for callers that want the evidence. */
     audit: AuditResult;
 }
+/** True when the claim tree contains a signedBy claim anywhere. */
+export declare function claimUsesSignatures(claim: Claim): boolean;
+/**
+ * Ceiling on candidate signature-file bytes retained for signedBy
+ * evaluation. Signature files are a few hundred bytes; the cap only
+ * exists so a bundle full of large artifacts never inflates memory.
+ * A file above the cap is simply not signature evidence.
+ */
+export declare const SIG_EVIDENCE_MAX_BYTES = 1048576;
 /** The pure tail of the pipeline: no filesystem, no network. */
-export declare function playAudit(rule: Rule, ruleSha256Hex: string, audit: AuditResult): PlayResult;
+export declare function playAudit(rule: Rule, ruleSha256Hex: string, audit: AuditResult, sigEvidence?: SigEvidence): PlayResult;
 /**
  * Evaluate a rule file against a bundle (directory, .tar, .tar.gz, or
  * .tgz). Offline past the filesystem reads; throws RuleError or PlayError.

package/dist/play.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"play.d.ts","sourceRoot":"","sources":["../src/play.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGhD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE9C,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;gBACd,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK9D;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,CAM3F;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBpF"}
+{"version":3,"file":"play.d.ts","sourceRoot":"","sources":["../src/play.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAG/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGvD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE9C,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;gBACd,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK9D;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAMzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,IAAI,EAAE,IAAI,EACV,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,WAAW,EAClB,WAAW,GAAE,WAAuB,GACnC,UAAU,CAMZ;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgCpF"}

package/dist/play.js

@@ -14,7 +14,7 @@
  */
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
-import { runAudit } from "@mikeargento/bitgraph-audit";
+import { runAudit, streamMatchedArtifacts } from "@mikeargento/bitgraph-audit";
 import { resolveCast } from "./cast.js";
 import { evaluate } from "./evaluate.js";
 import { parseRule } from "./rule.js";
@@ -27,10 +27,29 @@ export class PlayError extends Error {
         this.stage = stage;
     }
 }
+/** True when the claim tree contains a signedBy claim anywhere. */
+export function claimUsesSignatures(claim) {
+    if ("signedBy" in claim)
+        return true;
+    if ("all" in claim)
+        return claim.all.some(claimUsesSignatures);
+    if ("any" in claim)
+        return claim.any.some(claimUsesSignatures);
+    if ("not" in claim)
+        return claimUsesSignatures(claim.not);
+    return false;
+}
+/**
+ * Ceiling on candidate signature-file bytes retained for signedBy
+ * evaluation. Signature files are a few hundred bytes; the cap only
+ * exists so a bundle full of large artifacts never inflates memory.
+ * A file above the cap is simply not signature evidence.
+ */
+export const SIG_EVIDENCE_MAX_BYTES = 1_048_576;
 /** The pure tail of the pipeline: no filesystem, no network. */
-export function playAudit(rule, ruleSha256Hex, audit) {
+export function playAudit(rule, ruleSha256Hex, audit, sigEvidence = new Map()) {
     const resolutions = resolveCast(rule.cast, audit);
-    const evaluation = evaluate(rule, resolutions, audit);
+    const evaluation = evaluate(rule, resolutions, audit, sigEvidence);
     const verdict = buildVerdict(rule, ruleSha256Hex, resolutions, evaluation, audit);
     const exitCode = evaluation.result === "TRUE" ? 0 : evaluation.result === "FALSE" ? 1 : 2;
     return { verdict, bytes: serializeVerdict(verdict), exitCode, audit };
@@ -56,6 +75,22 @@ export async function play(rulePath, bundlePath) {
     catch (err) {
         throw new PlayError("audit", `bundle audit failed: ${err.message}`, err);
     }
-    return playAudit(rule, ruleSha256Hex, audit);
+    // Format 2 with signature claims: candidate evidence is every RECORDED
+    // artifact in the bundle (matched to a proof), size-capped. A signature
+    // that was never recorded can still be supplied to playAudit directly
+    // by an embedder; the reference CLI evaluates recorded evidence, which
+    // is what a Titles thread produces by construction.
+    let sigEvidence;
+    if (rule.rule === "bitgraph-player/2" && claimUsesSignatures(rule.claim)) {
+        const collected = new Map();
+        for await (const matched of streamMatchedArtifacts(audit.ingest)) {
+            if (matched.bytes.length > SIG_EVIDENCE_MAX_BYTES)
+                continue;
+            if (!collected.has(matched.sha256Hex))
+                collected.set(matched.sha256Hex, matched.bytes);
+        }
+        sigEvidence = collected;
+    }
+    return playAudit(rule, ruleSha256Hex, audit, sigEvidence);
 }
 //# sourceMappingURL=play.js.map

package/dist/play.js.map

@@ -1 +1 @@
-{"version":3,"file":"play.js","sourceRoot":"","sources":["../src/play.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI9D,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,KAAK,CAAY;IAC1B,YAAY,KAAgB,EAAE,OAAe,EAAE,KAAc;QAC3D,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAYD,gEAAgE;AAChE,MAAM,UAAU,SAAS,CAAC,IAAU,EAAE,aAAqB,EAAE,KAAkB;IAC7E,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,QAAgB,EAAE,UAAkB;IAC7D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnD,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,wBAAyB,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"play.js","sourceRoot":"","sources":["../src/play.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAI9D,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,KAAK,CAAY;IAC1B,YAAY,KAAgB,EAAE,OAAe,EAAE,KAAc;QAC3D,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAYD,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,KAAY;IAC9C,IAAI,UAAU,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAI,KAAK,IAAI,KAAK;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD,gEAAgE;AAChE,MAAM,UAAU,SAAS,CACvB,IAAU,EACV,aAAqB,EACrB,KAAkB,EAClB,cAA2B,IAAI,GAAG,EAAE;IAEpC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,QAAgB,EAAE,UAAkB;IAC7D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnD,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,wBAAyB,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,WAAoC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAChD,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,sBAAsB;gBAAE,SAAS;YAC5D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC"}

package/dist/rule.d.ts

@@ -1,16 +1,3 @@
-/**
- * Rule parsing and validation for bitgraph-player/1.
- *
- * Strict by design: unknown fields are rejected at every level, because a
- * silently ignored field in a rule is a claim the author believes is being
- * enforced and is not. `requires.ordering` is mandatory — a rule that does
- * not declare its trust floor does not parse.
- *
- * One deliberate looseness: a claim may reference a role the cast does not
- * declare. That is NOT a parse error; it evaluates to UNDETERMINED. The
- * rule file stays parseable so the verdict can say exactly which reference
- * was undeclared.
- */
 import type { Rule } from "./types.js";
 export declare class RuleError extends Error {
     readonly issues: readonly string[];

package/dist/rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../src/rule.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAA2C,IAAI,EAAE,MAAM,YAAY,CAAC;AAEhF,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;gBACvB,MAAM,EAAE,SAAS,MAAM,EAAE;CAKtC;AAMD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBjE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYnE;AAkKD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CA+FhD"}
+{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../src/rule.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA2C,IAAI,EAAc,MAAM,YAAY,CAAC;AAE5F,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;gBACvB,MAAM,EAAE,SAAS,MAAM,EAAE;CAKtC;AAMD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBjE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYnE;AAmLD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiKhD"}

package/dist/rule.js

@@ -148,7 +148,7 @@ function parseCastEntry(role, v, issues) {
     }
     return entry;
 }
-function parseClaim(v, where, issues, depth) {
+function parseClaim(v, where, issues, depth, format) {
     if (depth > 32) {
         issues.push(`${where}: claim nesting exceeds the maximum depth of 32`);
         return undefined;
@@ -197,7 +197,7 @@ function parseClaim(v, where, issues, depth) {
             const parsed = [];
             let ok = true;
             body.forEach((child, i) => {
-                const c = parseClaim(child, `${where}.${op}[${i}]`, issues, depth + 1);
+                const c = parseClaim(child, `${where}.${op}[${i}]`, issues, depth + 1, format);
                 if (c === undefined)
                     ok = false;
                 else
@@ -208,11 +208,22 @@ function parseClaim(v, where, issues, depth) {
             return op === "all" ? { all: parsed } : { any: parsed };
         }
         case "not": {
-            const inner = parseClaim(body, `${where}.not`, issues, depth + 1);
+            const inner = parseClaim(body, `${where}.not`, issues, depth + 1, format);
             if (inner === undefined)
                 return undefined;
             return { not: inner };
         }
+        case "signedBy": {
+            if (format !== "bitgraph-player/2") {
+                issues.push(`${where}.signedBy: requires rule format "bitgraph-player/2"`);
+                return undefined;
+            }
+            if (!Array.isArray(body) || body.length !== 2 || body.some((r) => typeof r !== "string")) {
+                issues.push(`${where}.signedBy: must be [roleName, trustedKeyName]`);
+                return undefined;
+            }
+            return { signedBy: body };
+        }
         default:
             issues.push(`${where}: unknown operator "${op}"`);
             return undefined;
@@ -233,9 +244,13 @@ export function parseRule(jsonText) {
     const issues = [];
     if (!isPlainObject(raw))
         throw new RuleError(["rule file must be a JSON object"]);
-    rejectUnknownKeys(raw, ["rule", "id", "cast", "world", "requires", "claim", "then"], "rule", issues);
-    if (raw["rule"] !== "bitgraph-player/1") {
-        issues.push(`"rule" must be exactly "bitgraph-player/1"`);
+    rejectUnknownKeys(raw, ["rule", "id", "cast", "world", "requires", "trustedKeys", "claim", "then"], "rule", issues);
+    let format = "bitgraph-player/1";
+    if (raw["rule"] === "bitgraph-player/1" || raw["rule"] === "bitgraph-player/2") {
+        format = raw["rule"];
+    }
+    else {
+        issues.push(`"rule" must be "bitgraph-player/1" or "bitgraph-player/2"`);
     }
     if (typeof raw["id"] !== "string" || raw["id"].length === 0) {
         issues.push(`"id" is required and must be a non-empty string`);
@@ -283,12 +298,71 @@ export function parseRule(jsonText) {
                 cast[role] = parsed;
         }
     }
+    // trustedKeys: format 2 only. The name-to-key binding is declared, so
+    // parsing only enforces well-formedness, never meaning.
+    let trustedKeys;
+    if ("trustedKeys" in raw) {
+        if (format !== "bitgraph-player/2") {
+            issues.push(`"trustedKeys" requires rule format "bitgraph-player/2"`);
+        }
+        else if (!isPlainObject(raw["trustedKeys"]) || Object.keys(raw["trustedKeys"]).length === 0) {
+            issues.push(`"trustedKeys" must be an object naming at least one key`);
+        }
+        else {
+            trustedKeys = Object.create(null);
+            for (const [name, entry] of Object.entries(raw["trustedKeys"])) {
+                const where = `trustedKeys.${name}`;
+                if (!/^[A-Za-z0-9_.-]+$/.test(name) || /^[0-9]+$/.test(name)) {
+                    issues.push(`trustedKeys: key name "${name}" must match [A-Za-z0-9_.-]+ with at least one non-digit`);
+                    continue;
+                }
+                if (!isPlainObject(entry)) {
+                    issues.push(`${where}: must be an object`);
+                    continue;
+                }
+                rejectUnknownKeys(entry, ["alg", "publicKey"], where, issues);
+                const alg = entry["alg"];
+                const publicKey = entry["publicKey"];
+                if (alg !== "ed25519" && alg !== "es256") {
+                    issues.push(`${where}: "alg" must be "ed25519" or "es256"`);
+                    continue;
+                }
+                if (typeof publicKey !== "string" || publicKey.length === 0) {
+                    issues.push(`${where}: "publicKey" is required and must be a non-empty string`);
+                    continue;
+                }
+                trustedKeys[name] = { alg, publicKey };
+            }
+        }
+    }
     let claim;
     if (!("claim" in raw)) {
         issues.push(`"claim" is required`);
     }
     else {
-        claim = parseClaim(raw["claim"], "claim", issues, 0);
+        claim = parseClaim(raw["claim"], "claim", issues, 0, format);
+    }
+    // Every signedBy claim must reference a declared trusted key: the
+    // reference is statically checkable, and an unresolvable key name is a
+    // rule the author believes is being enforced and is not.
+    if (claim !== undefined) {
+        const referenced = [];
+        const walk = (c) => {
+            if ("signedBy" in c)
+                referenced.push(c.signedBy[1]);
+            else if ("all" in c)
+                c.all.forEach(walk);
+            else if ("any" in c)
+                c.any.forEach(walk);
+            else if ("not" in c)
+                walk(c.not);
+        };
+        walk(claim);
+        for (const name of referenced) {
+            if (trustedKeys === undefined || !(name in trustedKeys)) {
+                issues.push(`claim: signedBy references trusted key "${name}" which trustedKeys does not declare`);
+            }
+        }
     }
     let then;
     if ("then" in raw) {
@@ -310,13 +384,15 @@ export function parseRule(jsonText) {
     if (issues.length > 0)
         throw new RuleError(issues);
     const rule = {
-        rule: "bitgraph-player/1",
+        rule: format,
         id: raw["id"],
         cast,
         world: "closed",
         requires: { ordering: ordering },
         claim: claim,
     };
+    if (trustedKeys !== undefined)
+        rule.trustedKeys = trustedKeys;
     if (then !== undefined)
         rule.then = then;
     return rule;

package/dist/rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule.js","sourceRoot":"","sources":["../src/rule.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAkBrF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAoB;IACnC,YAAY,MAAyB;QACnC,KAAK,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,KAAK,GAAG,mBAAmB,CAAC;AAClC,MAAM,OAAO,GAAG,sBAAsB,CAAC;AACvC,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CACxB,GAA4B,EAC5B,OAA0B,EAC1B,KAAa,EACb,MAAgB;IAEhB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,GAAG,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,KAAa,EAAE,MAAgB;IAC3D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC;IACrD,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,4DAA4D,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,iBAAiB,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,iBAAiB,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;YAC/D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,CAAU,EAAE,MAAgB;IAChE,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,iBAAiB,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,0EAA0E,CAAC,CAAC;QAChG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAc,EAAE,MAAM,EAAE,CAAC;IACpC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS;YAAE,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC;IACxC,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAU,EAAE,KAAa,EAAE,MAAgB,EAAE,KAAa;IAC5E,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,kDAAkD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAoB,CAAC,CAAC;IACrC,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;gBACpD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,6CAA6C,CAAC,CAAC;gBACzE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,IAAwB,CAAC;YACtC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;gBACzE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAgC,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,uCAAuC,CAAC,CAAC;gBACnE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAY,EAAE,CAAC;YAC3B,IAAI,EAAE,GAAG,IAAI,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACxB,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvE,IAAI,CAAC,KAAK,SAAS;oBAAE,EAAE,GAAG,KAAK,CAAC;;oBAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC1B,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC1D,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC1C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,CAAC;QACD;YACE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,uBAAuB,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAElF,iBAAiB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAErG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;IAED,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,sBAAsB,EAAE,CAAC;YACxD,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,IAAI,GAA8B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA8B,CAAC;IACzF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,iEAAiE;YACjE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,iDAAiD,CAAC,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAmC,CAAC;IACxC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,+DAA+D;YAC/D,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,mBAAmB;QACzB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;QACvB,IAAI;QACJ,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAwB,EAAE;QAChD,KAAK,EAAE,KAAc;KACtB,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"rule.js","sourceRoot":"","sources":["../src/rule.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAmBrF,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAoB;IACnC,YAAY,MAAyB;QACnC,KAAK,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,KAAK,GAAG,mBAAmB,CAAC;AAClC,MAAM,OAAO,GAAG,sBAAsB,CAAC;AACvC,MAAM,OAAO,GAAG,uBAAuB,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CACxB,GAA4B,EAC5B,OAA0B,EAC1B,KAAa,EACb,MAAgB;IAEhB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,GAAG,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,KAAa,EAAE,MAAgB;IAC3D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC;IACrD,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,4DAA4D,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,iBAAiB,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,iBAAiB,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;YAC/D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,CAAU,EAAE,MAAgB;IAChE,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,iBAAiB,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,0EAA0E,CAAC,CAAC;QAChG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAc,EAAE,MAAM,EAAE,CAAC;IACpC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS;YAAE,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC;IACxC,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CACjB,CAAU,EACV,KAAa,EACb,MAAgB,EAChB,KAAa,EACb,MAAkB;IAElB,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,kDAAkD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAoB,CAAC,CAAC;IACrC,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;gBACpD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,6CAA6C,CAAC,CAAC;gBACzE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,IAAwB,CAAC;YACtC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;gBACzE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAgC,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,uCAAuC,CAAC,CAAC;gBACnE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAY,EAAE,CAAC;YAC3B,IAAI,EAAE,GAAG,IAAI,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACxB,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC/E,IAAI,CAAC,KAAK,SAAS;oBAAE,EAAE,GAAG,KAAK,CAAC;;oBAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC1B,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC1D,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC1C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qDAAqD,CAAC,CAAC;gBAC3E,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;gBACrE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,IAAwB,EAAE,CAAC;QAChD,CAAC;QACD;YACE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,uBAAuB,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAElF,iBAAiB,CACf,GAAG,EACH,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,EAC3E,MAAM,EACN,MAAM,CACP,CAAC;IAEF,IAAI,MAAM,GAAe,mBAAmB,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;IAED,uEAAuE;IACvE,2CAA2C;IAC3C,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,sBAAsB,EAAE,CAAC;YACxD,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,IAAI,GAA8B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA8B,CAAC;IACzF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,iEAAiE;YACjE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,iDAAiD,CAAC,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QAChD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,WAAmD,CAAC;IACxD,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACxE,CAAC;aAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9F,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,KAAK,GAAG,eAAe,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,IAAI,CACT,0BAA0B,IAAI,0DAA0D,CACzF,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;oBAC3C,SAAS;gBACX,CAAC;gBACD,iBAAiB,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;gBACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;oBACzC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;oBAC5D,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,0DAA0D,CAAC,CAAC;oBAChF,SAAS;gBACX,CAAC;gBACD,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,kEAAkE;IAClE,uEAAuE;IACvE,yDAAyD;IACzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,CAAQ,EAAQ,EAAE;YAC9B,IAAI,UAAU,IAAI,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC/C,IAAI,KAAK,IAAI,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iBACpC,IAAI,KAAK,IAAI,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iBACpC,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC,2CAA2C,IAAI,sCAAsC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAmC,CAAC;IACxC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,+DAA+D;YAC/D,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;QACvB,IAAI;QACJ,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAwB,EAAE;QAChD,KAAK,EAAE,KAAc;KACtB,CAAC;IACF,IAAI,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAC9D,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sig.d.ts

@@ -0,0 +1,38 @@
+import type { KeyObject } from "node:crypto";
+export type SigAlg = "ed25519" | "es256";
+export interface TrustedKey {
+    alg: SigAlg;
+    /** ed25519: raw 32-byte key, standard base64. es256: SPKI DER, base64. */
+    publicKey: string;
+}
+/** A parsed, well-formed bitgraph-sig/1 object (not yet verified). */
+export interface SigFile {
+    sig: "bitgraph-sig/1";
+    /** Digest of the target bytes, in any accepted canonical spelling. */
+    over: string;
+    alg: SigAlg;
+    publicKey: string;
+    signature: string;
+}
+/** The domain-separated message a bitgraph-sig/1 signature covers. */
+export declare function sigMessage(targetSha256Hex: string): Buffer;
+/**
+ * Parse candidate bytes as a bitgraph-sig/1 file. Returns undefined for
+ * anything malformed: a broken signature file is noise, never evidence,
+ * and never an error that stops evaluation.
+ */
+export declare function parseSigFile(bytes: Uint8Array): SigFile | undefined;
+/**
+ * Build a KeyObject for a trusted key. Returns undefined when the key
+ * material is malformed — a rule declaring an undecodable key can never
+ * make a signedBy claim TRUE, and the verdict's reason says why.
+ */
+export declare function keyObjectFor(key: TrustedKey): KeyObject | undefined;
+/**
+ * Verify one parsed signature file against a trusted key and a target
+ * digest (lowercase hex). TRUE means: the file's `over` names exactly
+ * these bytes, its key material equals the trusted key, and the
+ * signature verifies over the domain-separated message.
+ */
+export declare function verifySigFile(sig: SigFile, key: TrustedKey, keyObject: KeyObject, targetSha256Hex: string, decodeDigestBytes: (s: string) => Buffer | undefined): boolean;
+//# sourceMappingURL=sig.d.ts.map

package/dist/sig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sig.d.ts","sourceRoot":"","sources":["../src/sig.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,gBAAgB,CAAC;IACtB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE1D;AAMD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,CAkBnE;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CA0BnE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACnD,OAAO,CAuBT"}

package/dist/sig.js

@@ -0,0 +1,154 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+/**
+ * bitgraph-sig/1: detached signature evidence over a digest.
+ *
+ * A signature file states that a key signed a domain-separated message
+ * derived from an artifact digest. Verification here is pure math over
+ * supplied bytes: no filesystem, no network, no clock. What a valid
+ * signature MEANS (that the key belongs to a named party) is never
+ * derived; the rule's trustedKeys block is a DECLARED binding and the
+ * verdict says so.
+ *
+ * The signed message is:
+ *
+ *     "bitgraph-sig/1\n" + lowercase hex SHA-256 of the target bytes
+ *
+ * as UTF-8. Domain separation keeps a signature made in any other
+ * protocol from being replayed as a bitgraph-sig, and signing the digest
+ * spelling (not the raw 32 bytes) keeps the message printable and
+ * auditable by eye.
+ *
+ * Algorithms:
+ *   "ed25519"  publicKey is the raw 32-byte key, standard base64 — the
+ *              same spelling bitgraph/1 proofs use for signer keys.
+ *              signature is the raw 64-byte Ed25519 signature, base64.
+ *   "es256"    ECDSA P-256 over SHA-256. publicKey is SPKI DER, base64
+ *              (the export format of every platform keystore, including
+ *              Secure Enclave keys surfaced through WebCrypto).
+ *              signature is DER-encoded ECDSA, base64.
+ *
+ * A signature claim can be TRUE or UNDETERMINED, never FALSE: "this key
+ * never signed these bytes" is a negative over an open world no bundle
+ * can close. A malformed or non-verifying signature file is not evidence
+ * of anything.
+ */
+import { createPublicKey, verify as cryptoVerify } from "node:crypto";
+/** SPKI DER prefix for a raw Ed25519 public key (RFC 8410). */
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+/** The domain-separated message a bitgraph-sig/1 signature covers. */
+export function sigMessage(targetSha256Hex) {
+    return Buffer.from(`bitgraph-sig/1\n${targetSha256Hex.toLowerCase()}`, "utf8");
+}
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Parse candidate bytes as a bitgraph-sig/1 file. Returns undefined for
+ * anything malformed: a broken signature file is noise, never evidence,
+ * and never an error that stops evaluation.
+ */
+export function parseSigFile(bytes) {
+    let raw;
+    try {
+        raw = JSON.parse(Buffer.from(bytes).toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (!isPlainObject(raw))
+        return undefined;
+    if (raw["sig"] !== "bitgraph-sig/1")
+        return undefined;
+    const over = raw["over"];
+    const alg = raw["alg"];
+    const publicKey = raw["publicKey"];
+    const signature = raw["signature"];
+    if (typeof over !== "string" || over.length === 0)
+        return undefined;
+    if (alg !== "ed25519" && alg !== "es256")
+        return undefined;
+    if (typeof publicKey !== "string" || publicKey.length === 0)
+        return undefined;
+    if (typeof signature !== "string" || signature.length === 0)
+        return undefined;
+    return { sig: "bitgraph-sig/1", over, alg, publicKey, signature };
+}
+/** Strict base64 decode: the spelling must round-trip byte-exactly. */
+function decodeB64Strict(s) {
+    if (!/^[A-Za-z0-9+/]+=*$/.test(s))
+        return undefined;
+    const bytes = Buffer.from(s, "base64");
+    return bytes.toString("base64") === s ? bytes : undefined;
+}
+/**
+ * Build a KeyObject for a trusted key. Returns undefined when the key
+ * material is malformed — a rule declaring an undecodable key can never
+ * make a signedBy claim TRUE, and the verdict's reason says why.
+ */
+export function keyObjectFor(key) {
+    const material = decodeB64Strict(key.publicKey);
+    if (material === undefined)
+        return undefined;
+    try {
+        if (key.alg === "ed25519") {
+            if (material.length !== 32)
+                return undefined;
+            return createPublicKey({
+                key: Buffer.concat([ED25519_SPKI_PREFIX, material]),
+                format: "der",
+                type: "spki",
+            });
+        }
+        const keyObject = createPublicKey({ key: material, format: "der", type: "spki" });
+        // es256 means ECDSA over P-256 specifically. SPKI decodes many key
+        // types; anything that is not an EC key on prime256v1 is not es256
+        // key material, and verification against it must never proceed.
+        if (keyObject.asymmetricKeyType !== "ec" ||
+            keyObject.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+            return undefined;
+        }
+        return keyObject;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Verify one parsed signature file against a trusted key and a target
+ * digest (lowercase hex). TRUE means: the file's `over` names exactly
+ * these bytes, its key material equals the trusted key, and the
+ * signature verifies over the domain-separated message.
+ */
+export function verifySigFile(sig, key, keyObject, targetSha256Hex, decodeDigestBytes) {
+    if (sig.alg !== key.alg)
+        return false;
+    if (sig.publicKey !== key.publicKey)
+        return false;
+    // `over` accepts the same spellings as rule digests, including the
+    // "sha256:" prefix, which the byte-level decoder does not strip itself.
+    let over = sig.over.trim();
+    if (over.toLowerCase().startsWith("sha256:"))
+        over = over.slice("sha256:".length);
+    const overBytes = decodeDigestBytes(over);
+    const targetBytes = decodeDigestBytes(targetSha256Hex);
+    if (overBytes === undefined || targetBytes === undefined)
+        return false;
+    if (!overBytes.equals(targetBytes))
+        return false;
+    const signature = decodeB64Strict(sig.signature);
+    if (signature === undefined)
+        return false;
+    if (sig.alg === "ed25519" && signature.length !== 64)
+        return false;
+    const message = sigMessage(targetSha256Hex);
+    try {
+        if (sig.alg === "ed25519") {
+            return cryptoVerify(null, message, keyObject, signature);
+        }
+        return cryptoVerify("sha256", message, keyObject, signature);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=sig.js.map

package/dist/sig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sig.js","sourceRoot":"","sources":["../src/sig.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAqBtE,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,eAAuB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,mBAAmB,eAAe,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9E,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,eAAe,CAAC;gBACrB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;gBACnD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,mEAAmE;QACnE,mEAAmE;QACnE,gEAAgE;QAChE,IACE,SAAS,CAAC,iBAAiB,KAAK,IAAI;YACpC,SAAS,CAAC,oBAAoB,EAAE,UAAU,KAAK,YAAY,EAC3D,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAY,EACZ,GAAe,EACf,SAAoB,EACpB,eAAuB,EACvB,iBAAoD;IAEpD,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,mEAAmE;IACnE,wEAAwE;IACxE,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -108,9 +108,19 @@ export type Claim = {
     any: Claim[];
 } | {
     not: Claim;
+}
+/**
+ * Format 2 only: a valid bitgraph-sig/1 by the named trusted key over
+ * the role's digest is present in the supplied evidence. TRUE or
+ * UNDETERMINED, never FALSE — "this key never signed these bytes" is a
+ * negative over an open world no bundle can close.
+ */
+ | {
+    signedBy: [string, string];
 };
+export type RuleFormat = "bitgraph-player/1" | "bitgraph-player/2";
 export interface Rule {
-    rule: "bitgraph-player/1";
+    rule: RuleFormat;
     id: string;
     cast: Record<string, CastEntry>;
     /** The only defined value. Absence is only ever asserted within the declared cast. */
@@ -122,6 +132,13 @@ export interface Rule {
     requires: {
         ordering: EvidenceTier;
     };
+    /**
+     * Format 2 only. Named keys the rule author trusts. The name-to-key
+     * binding is DECLARED — surfaced in the verdict, never derived. What
+     * becomes derived under format 2 is only the math: a signature by the
+     * named key material verifies over the role's digest.
+     */
+    trustedKeys?: Record<string, import("./sig.js").TrustedKey>;
     claim: Claim;
     /**
      * A label and nothing else. No field in this format is capable of
@@ -168,13 +185,14 @@ export interface DerivedStep {
 }
 /** One assertion Player took on somebody's word. */
 export interface DeclaredEntry {
-    assertion: "signedBy" | "means" | "closed-world" | "pinned-occurrence";
+    assertion: "signedBy" | "means" | "closed-world" | "pinned-occurrence" | "trusted-key";
     role?: string;
     verifiedHere: false;
     [k: string]: unknown;
 }
 export interface Verdict {
-    verdict: "bitgraph-player-verdict/1";
+    /** Tracks the rule format: a /1 rule yields a /1 verdict, byte-identical to prior releases. */
+    verdict: "bitgraph-player-verdict/1" | "bitgraph-player-verdict/2";
     result: ThreeValued;
     rule: {
         id: string;