@motebit/state-export-client 0.2.0

package/LICENSE

@@ -0,0 +1,206 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Motebit, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+"Motebit" is a trademark of Motebit, Inc. The Apache License grants rights to
+this software, not to any Motebit trademarks, logos, or branding. You may not
+use Motebit branding in a way that suggests endorsement or affiliation without
+written permission.

package/NOTICE

@@ -0,0 +1,19 @@
+Motebit
+Copyright 2026 Motebit, Inc.
+
+This product includes software developed at Motebit, Inc. (https://motebit.com).
+
+The permissive-floor packages (the protocol, SDK, cryptographic primitives,
+platform-attestation verifier leaves, scaffolding CLI, and GitHub Action) are
+licensed under the Apache License, Version 2.0. See LICENSE files in each
+`packages/*/` subdirectory and in `spec/` for the full license text.
+
+The remaining packages, apps, and services are licensed under the Business
+Source License 1.1 and convert to the Apache License, Version 2.0 four years
+after each version's first public release. See `LICENSE` at the repository
+root and `LICENSING.md` for the full license boundary.
+
+"Motebit" is a trademark of Motebit, Inc. The licenses granted here cover
+this software only, not Motebit trademarks, logos, or branding. Use of
+Motebit branding in a way that suggests endorsement or affiliation requires
+written permission.

package/README.md

@@ -0,0 +1,135 @@
+# @motebit/state-export-client
+
+Browser-safe verifier for motebit state-export responses. Wraps `fetch` with `X-Motebit-Content-Manifest` verification, performs trust-on-first-use bootstrap from `/.well-known/motebit-transparency.json`, and recursively verifies inner agent signatures on v1.1 execution-ledger bundles.
+
+Apache-2.0 (permissive floor). Consumes `@motebit/crypto` + `@motebit/protocol` only. Zero new cryptographic logic; zero implicit network calls; fail-closed on every verification path.
+
+## Why
+
+Every state-export endpoint in `services/relay/src/state-export.ts` emits a relay-signed `ContentArtifactManifest` in the `X-Motebit-Content-Manifest` HTTP header. Producer-side signing is invisible truth unless a consumer demands the signature. This package is that consumer — drop it into any browser app and every state-export read becomes self-attesting.
+
+A v1.1 execution-ledger goes one layer deeper: the outer manifest is signed by the relay (witness-composition "I assembled these bytes"); the inner `signed_receipts[]` field carries byte-identical canonical JSON of each delegated motebit's own signed `ExecutionReceipt`. `verifyInnerSignedReceipts` recursively audits each one. A relay cannot fabricate inner signatures without holding the delegate motebits' private keys.
+
+## Quick start — verified state-export fetch (outer envelope)
+
+```ts
+import { fetchTransparencyAnchor, verifiedStateExportFetch } from "@motebit/state-export-client";
+
+// Once, at app boot — trust-on-first-use bootstrap.
+const anchor = await fetchTransparencyAnchor("https://relay.example.com");
+if (!anchor.ok) throw new Error(`anchor: ${anchor.reason}`);
+
+// Per state-export call — wrap fetch.
+const { body, verification } = await verifiedStateExportFetch(
+  "https://relay.example.com/api/v1/audit/MY_MOTEBIT_ID",
+  {
+    anchor: anchor.anchor,
+    init: { headers: { Authorization: `Bearer ${token}` } },
+  },
+);
+
+if (verification.valid) {
+  console.log("✓", verification.artifactType, verification.producerDid);
+} else {
+  // Banner the panel; log to audit; never silently render unverified state.
+  console.error("✗", verification.reason);
+}
+```
+
+## Quick start — inner-receipt recursive verification (v1.1 execution-ledger)
+
+```ts
+import { verifiedStateExportFetch, verifyInnerSignedReceipts } from "@motebit/state-export-client";
+
+const { body, verification } = await verifiedStateExportFetch(
+  `https://relay.example.com/api/v1/execution/${motebitId}/${goalId}`,
+  { anchor: anchor.anchor, init: { headers: { Authorization: `Bearer ${token}` } } },
+);
+if (!verification.valid) throw new Error(`outer: ${verification.reason}`);
+
+const inner = await verifyInnerSignedReceipts(body);
+if (inner.applicable && !inner.allValid) {
+  for (const r of inner.results) {
+    if (!r.valid) console.error(`✗ ${r.taskId} (${r.motebitId}): ${r.reason}`);
+  }
+}
+```
+
+`verifyInnerSignedReceipts` returns `applicable: false` for v1.0 bodies, non-execution-ledger bodies, or bodies with an empty `signed_receipts` field — calm-software default, no flag required. On v1.1 bodies, every entry is parsed, every signature is checked against its embedded public key, and `delegation_receipts` chains are walked recursively.
+
+## Trust-anchor chain
+
+```
+/.well-known/motebit-transparency.json
+  → declaration is self-signed; signature verifies against embedded relay_public_key
+  → cache the key (TOFU)
+  → every X-Motebit-Content-Manifest verifies against the pinned key
+  → every inner signed_receipts[] entry verifies against its own embedded public_key
+```
+
+The operator-transparency declaration is the trust root. The relay's identity key signs the declaration _and_ every state-export manifest, so a single TOFU bootstrap commits the relay to a specific Ed25519 key across every endpoint. Inner receipts carry their own embedded public keys signed by the delegate motebits — the relay cannot rotate those without holding the delegates' private keys.
+
+See [`docs/doctrine/operator-transparency.md`](https://github.com/motebit/motebit/blob/main/docs/doctrine/operator-transparency.md), [`docs/doctrine/nist-alignment.md`](https://github.com/motebit/motebit/blob/main/docs/doctrine/nist-alignment.md) §8, and [`spec/execution-ledger-v1.md`](https://github.com/motebit/motebit/blob/main/spec/execution-ledger-v1.md) §4.3.
+
+## Onchain anchoring (Stage 2)
+
+The transparency declaration is anchored to Solana via a Memo program transaction. `verifyDeclarationOnchainAnchor` and `lookupTransparencyAnchor` together let a verifier confirm the declaration's hash was posted onchain by the relay's identity key, closing the "operator deletes the JSON file" disappearance gap.
+
+```ts
+import {
+  lookupTransparencyAnchor,
+  verifyDeclarationOnchainAnchor,
+} from "@motebit/state-export-client";
+
+const lookup = await lookupTransparencyAnchor({
+  declarationHashHex: anchor.anchor.declarationHashHex,
+  signerAddress: anchor.anchor.relaySolanaAddress, // optional pin
+});
+if (lookup.ok) {
+  const proof = await verifyDeclarationOnchainAnchor(declaration, lookup.anchor);
+  if (!proof.ok) console.error("✗", proof.reason);
+}
+```
+
+## Programmatic surface
+
+| Export                                                     | Kind     | Role                                                                                                                       |
+| ---------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `fetchTransparencyAnchor(baseUrl, opts?)`                  | function | TOFU bootstrap — fetch `/.well-known/motebit-transparency.json`, verify self-signature, return pinned `TransparencyAnchor` |
+| `verifyTransparencyDeclaration(declaration)`               | function | Lower-level: verify a `SignedTransparencyDeclaration` from any source (cached, archived, fixture)                          |
+| `verifiedStateExportFetch(url, opts)`                      | function | Wrap `fetch` — verify outer envelope against body bytes + optional anchor pin                                              |
+| `verifyManifestAgainstBytes(manifest, bodyBytes, anchor?)` | function | Lower-level: verify a parsed `ContentArtifactManifest` against bytes you already have                                      |
+| `verifyInnerSignedReceipts(body)`                          | function | Recursive v1.1 inner-receipt audit — per-receipt verdict with typed failure reasons                                        |
+| `lookupTransparencyAnchor(opts)`                           | function | Onchain — query Solana RPC for a Memo program transaction posting the declaration hash                                     |
+| `verifyDeclarationOnchainAnchor(declaration, anchor)`      | function | Onchain — verify the Memo transaction's signer and content match the declaration                                           |
+| `StateExportFetchError`                                    | class    | Thrown on non-2xx HTTP; verifier never attempts to verify error envelopes                                                  |
+| `MANIFEST_HEADER`                                          | constant | The header name (`"X-Motebit-Content-Manifest"`) — exposed for custom transports                                           |
+
+All result types (`TransparencyAnchorResult`, `StateExportVerification`, `InnerReceiptsVerification`, etc.) and failure-reason unions are also exported — discriminated unions, type-narrowable by the `ok` / `valid` / `applicable` field.
+
+## Failure reasons
+
+Every verification path surfaces a typed reason for audit logging.
+
+**Outer envelope** (`StateExportVerification.reason`):
+
+- `manifest_header_missing` — response had no `X-Motebit-Content-Manifest` header
+- `malformed_manifest_header` — header was not valid base64url-encoded JSON
+- `content_hash_mismatch` — body bytes don't match the manifest's content_hash
+- `signature_invalid` — manifest signature did not verify against the declared key
+- `malformed_public_key` / `malformed_signature` / `unsupported_suite` — manifest internals
+- `producer_key_mismatch` — declared key differs from the anchor's pinned key
+
+**Inner receipts** (`InnerReceiptVerification.reason`, per-receipt):
+
+- `malformed_json` — an entry in `signed_receipts[]` was not valid JSON
+- `missing_public_key` — the parsed receipt had no `public_key` field to verify against
+- `signature_invalid` — the receipt's Ed25519 signature did not verify against its embedded key
+- `delegation_failed` — a nested entry in `delegation_receipts[]` failed verification
+- `unknown` — wrapped crypto exception (shouldn't normally fire — surfaces opaque failures from the underlying primitive)
+
+Non-2xx HTTP throws `StateExportFetchError` — the verifier never attempts to verify error envelopes (signing 5xx pages would be misleading provenance for a service outage).
+
+## License
+
+Apache-2.0. See `LICENSE` and `NOTICE`.

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @motebit/state-export-client — verified fetch wrapper for motebit
+ * state-export endpoints. Closes the producer-consumer asymmetry that
+ * the state-export-signing arc opened: every endpoint in
+ * `services/relay/src/state-export.ts` emits a `ContentArtifactManifest`
+ * in the `X-Motebit-Content-Manifest` HTTP header; consumers wrap
+ * `fetch` through this package to verify each manifest against the
+ * response body and (optionally) pin the signer against an anchor from
+ * `/.well-known/motebit-transparency.json`.
+ *
+ * Apache-2.0 permissive floor; browser-safe; consumes `@motebit/crypto`
+ * and `@motebit/protocol` only. No network at module-load time, no
+ * implicit fetches — the caller controls every round-trip.
+ *
+ * Programmatic shape:
+ *
+ * ```ts
+ * import {
+ *   fetchTransparencyAnchor,
+ *   verifiedStateExportFetch,
+ * } from "@motebit/state-export-client";
+ *
+ * // Once, at app boot — TOFU bootstrap.
+ * const result = await fetchTransparencyAnchor("https://relay.example.com");
+ * if (!result.ok) throw new Error(`anchor: ${result.reason}`);
+ *
+ * // Per state-export call — wrap fetch.
+ * const { body, verification } = await verifiedStateExportFetch<AuditResponse>(
+ *   `${baseUrl}/api/v1/audit/${motebitId}`,
+ *   {
+ *     anchor: result.anchor,
+ *     init: { headers: { Authorization: `Bearer ${token}` } },
+ *   },
+ * );
+ *
+ * if (!verification.valid) {
+ *   // Banner the inspector panel; log to audit.
+ *   showTamperBadge(verification.reason);
+ * }
+ * ```
+ *
+ * Doctrine: `docs/doctrine/nist-alignment.md` §8, `docs/doctrine/self-attesting-system.md`,
+ * `docs/doctrine/operator-transparency.md`.
+ */
+export { fetchTransparencyAnchor, verifyTransparencyDeclaration } from "./transparency-anchor.js";
+export type { TransparencyAnchor, SignedTransparencyDeclaration, TransparencyAnchorResult, TransparencyAnchorFailureReason, FetchTransparencyAnchorOptions, } from "./transparency-anchor.js";
+export { verifiedStateExportFetch, verifyManifestAgainstBytes, StateExportFetchError, MANIFEST_HEADER, } from "./verified-fetch.js";
+export type { StateExportVerification, StateExportVerificationFailureReason, VerifiedFetchOptions, VerifiedStateExportResponse, } from "./verified-fetch.js";
+export { lookupTransparencyAnchor, verifyDeclarationOnchainAnchor } from "./onchain-anchor.js";
+export type { OnchainAnchorLookupOptions, OnchainAnchorResult, OnchainAnchorFailureReason, } from "./onchain-anchor.js";
+export { verifyInnerSignedReceipts } from "./inner-receipts.js";
+export type { InnerReceiptVerification, InnerReceiptVerificationFailureReason, InnerReceiptsVerification, } from "./inner-receipts.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAClG,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,uBAAuB,EACvB,oCAAoC,EACpC,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,wBAAwB,EACxB,qCAAqC,EACrC,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,49 @@
+/**
+ * @motebit/state-export-client — verified fetch wrapper for motebit
+ * state-export endpoints. Closes the producer-consumer asymmetry that
+ * the state-export-signing arc opened: every endpoint in
+ * `services/relay/src/state-export.ts` emits a `ContentArtifactManifest`
+ * in the `X-Motebit-Content-Manifest` HTTP header; consumers wrap
+ * `fetch` through this package to verify each manifest against the
+ * response body and (optionally) pin the signer against an anchor from
+ * `/.well-known/motebit-transparency.json`.
+ *
+ * Apache-2.0 permissive floor; browser-safe; consumes `@motebit/crypto`
+ * and `@motebit/protocol` only. No network at module-load time, no
+ * implicit fetches — the caller controls every round-trip.
+ *
+ * Programmatic shape:
+ *
+ * ```ts
+ * import {
+ *   fetchTransparencyAnchor,
+ *   verifiedStateExportFetch,
+ * } from "@motebit/state-export-client";
+ *
+ * // Once, at app boot — TOFU bootstrap.
+ * const result = await fetchTransparencyAnchor("https://relay.example.com");
+ * if (!result.ok) throw new Error(`anchor: ${result.reason}`);
+ *
+ * // Per state-export call — wrap fetch.
+ * const { body, verification } = await verifiedStateExportFetch<AuditResponse>(
+ *   `${baseUrl}/api/v1/audit/${motebitId}`,
+ *   {
+ *     anchor: result.anchor,
+ *     init: { headers: { Authorization: `Bearer ${token}` } },
+ *   },
+ * );
+ *
+ * if (!verification.valid) {
+ *   // Banner the inspector panel; log to audit.
+ *   showTamperBadge(verification.reason);
+ * }
+ * ```
+ *
+ * Doctrine: `docs/doctrine/nist-alignment.md` §8, `docs/doctrine/self-attesting-system.md`,
+ * `docs/doctrine/operator-transparency.md`.
+ */
+export { fetchTransparencyAnchor, verifyTransparencyDeclaration } from "./transparency-anchor.js";
+export { verifiedStateExportFetch, verifyManifestAgainstBytes, StateExportFetchError, MANIFEST_HEADER, } from "./verified-fetch.js";
+export { lookupTransparencyAnchor, verifyDeclarationOnchainAnchor } from "./onchain-anchor.js";
+export { verifyInnerSignedReceipts } from "./inner-receipts.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AASlG,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAO/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/inner-receipts.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Recursive verification for v1.1 inner signed receipts.
+ *
+ * The relay-assembled execution-ledger reconstruction at
+ * `/api/v1/execution/:motebitId/:goalId` carries the v1.1 optional
+ * `signed_receipts: string[]` field — byte-identical canonical-JSON of
+ * each delegated motebit's signed `ExecutionReceipt`, sourced from the
+ * relay's `relay_receipts.receipt_json` archive (per
+ * `services/relay/CLAUDE.md` Rule 11). The wire shape and rationale
+ * live in `spec/execution-ledger-v1.md` §4.3 (Inner Signed Receipts —
+ * v1.1 additive).
+ *
+ * Without recursive verification, the v1.1 wire change is invisible
+ * truth: the verifier sees the field but does nothing with it. This
+ * module closes the consumer-side asymmetry. Each receipt is parsed
+ * back into its `ExecutionReceipt` shape, passed to
+ * `verifyReceipt` from `@motebit/crypto`, and its Ed25519 signature
+ * checked against the embedded `public_key` independently of the
+ * relay. Multi-hop delegation chains are walked recursively.
+ *
+ * Doctrine: `docs/doctrine/nist-alignment.md` §8 "Inner-receipt
+ * verification closed"; `docs/doctrine/self-attesting-system.md`.
+ */
+/** Per-receipt verification outcome surfaced to UI / audit logging. */
+export interface InnerReceiptVerification {
+    /** Task identifier of the inner receipt. Pulled from the parsed receipt body. */
+    readonly taskId: string;
+    /** The producing motebit's identifier — what the relay claims; the signature proves it. */
+    readonly motebitId: string;
+    /** `did:key:zXXX` derived from the receipt's embedded public key when verification succeeded. */
+    readonly signerDid?: string;
+    /** Whether the inner receipt's signature verifies against its embedded `public_key`. */
+    readonly valid: boolean;
+    /** Typed failure reason when `valid === false`. */
+    readonly reason?: InnerReceiptVerificationFailureReason;
+    /** Free-form detail (e.g. underlying error message). */
+    readonly detail?: string;
+    /** Nested delegations verified recursively. Present when the receipt carries `delegation_receipts`. */
+    readonly delegations?: InnerReceiptVerification[];
+}
+export type InnerReceiptVerificationFailureReason = "malformed_json" | "missing_public_key" | "signature_invalid" | "delegation_failed" | "unknown";
+/** Aggregate result for the whole `signed_receipts` array on a v1.1 ledger body. */
+export interface InnerReceiptsVerification {
+    /** True only when every entry's outer signature + every nested delegation verifies. */
+    readonly allValid: boolean;
+    /** Number of top-level entries successfully verified. */
+    readonly verifiedCount: number;
+    /** Number of top-level entries inspected (`signed_receipts.length` when the field is present). */
+    readonly totalCount: number;
+    /** Per-receipt outcomes, ordered as `signed_receipts` appeared on the wire. */
+    readonly results: ReadonlyArray<InnerReceiptVerification>;
+    /** True when the body declared a v1.1 spec and carried a non-empty `signed_receipts` array. */
+    readonly applicable: boolean;
+}
+/**
+ * Verify the inner signed receipts inside an execution-ledger response
+ * body. Idempotent + side-effect-free; no network calls beyond what
+ * `verifyReceipt` performs (which itself is offline — every receipt
+ * carries its own `public_key`).
+ *
+ * Returns `{ applicable: false }` for v1.0 bodies, bodies without
+ * `signed_receipts`, or bodies that aren't execution-ledger shape.
+ * Returns `{ applicable: true, allValid, ... }` with per-receipt
+ * outcomes for v1.1 bodies that carry the field.
+ */
+export declare function verifyInnerSignedReceipts(body: unknown): Promise<InnerReceiptsVerification>;
+//# sourceMappingURL=inner-receipts.d.ts.map

package/dist/inner-receipts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inner-receipts.d.ts","sourceRoot":"","sources":["../src/inner-receipts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,uEAAuE;AACvE,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,qCAAqC,CAAC;IACxD,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACnD;AAED,MAAM,MAAM,qCAAqC,GAC7C,gBAAgB,GAChB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,SAAS,CAAC;AAEd,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kGAAkG;IAClG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC1D,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAkCjG"}