@motebit/verifier 1.6.3 → 1.7.0

package/README.md

@@ -49,6 +49,8 @@ It also re-exports **`verifyApprovalDecision`** from `@motebit/crypto` — the "
 
 For the same reason — authority is the scope/chain, not a `motebit_id → key` ladder resolvable from the artifact alone — the **delegation family** is also re-exported as explicit verifiers (not auto-detected): **`verifyDelegation`** (a standalone or per-tick `DelegationToken`), **`verifyStandingDelegation`** (a standing grant: signature, activation, expiry, and an injected revocation seam), **`verifyTokenAgainstGrant`** (a per-tick token IS a valid tick of its grant — scope narrows, TTL bounded, grant not revoked), and **`verifyDelegationRevocation`** (a revocation's signature; the caller binds it to the grant). A standing grant's revocation check is the consumer's responsibility — the verifiers are I/O-free and cannot fetch a feed — so **`findGrantRevocation`** does that check correctly: it returns the revocation that authoritatively revokes a grant from a candidate set, binding on `grant_id` **and** the grant's `delegator_public_key` **and** a valid signature, so matching `grant_id` alone (the foot-gun) cannot spoof a revocation. Build the `verifyStandingDelegation` `isRevoked` seam from it. This lets a consumer validate a standing monitor's authorization root, every tick token, and revocation through this package alone. See [`standing-delegation@1.0`](https://github.com/motebit/motebit/blob/main/spec/standing-delegation-v1.md).
 
+`standing-delegation@1.1` adds an optional, generic **`subject_binding`** on the grant (**`SubjectBindingV1`**): the delegator's signature reaches the EXACT resolved subjects the authority covers, by digest-binding a detached, vertically-typed scope artifact — closing the gap where an interpreter (not the delegator) chose the identities the agent acts on. **`subjectBindingDigest`** computes the canonical digest of that detached artifact (`hex(SHA-256(canonicalJson))`), and **`verifySubjectBinding`** checks, fail-closed, that a presented artifact matches the grant's signed binding (digest method, declared `artifact_schema`, digest). Authority only — subject _completeness_ ("every signed subject was attempted") is a monitor receipt-profile rule on top, never a property of the generic binding.
+
 On the same principle, the **signed-request-envelope family** is re-exported as explicit signer/verifier — **`signRequestEnvelope`** and **`verifyRequestEnvelope`** ([`signed-request-envelope@1.0`](https://github.com/motebit/motebit/blob/main/spec/signed-request-envelope-v1.md)): stateless per-request identity authentication where the signature is verified against the identity's **registered** public key (resolved by the caller from `motebit_id`, never carried by the request), the payload travels detached behind a `payload_digest`, and `aud` binding kills cross-service replay. Not auto-detected — the key comes from the registry, not the envelope.
 
 ## Guarantees

package/dist/index.d.ts

@@ -34,8 +34,8 @@
 export { verifyFile, verifyArtifact, verifySkillDirectory, formatHuman } from "./lib.js";
 export type { VerifyFileOptions, VerifyResultWithBinding } from "./lib.js";
 export { verifyApprovalDecision } from "@motebit/crypto";
-export { verifyDelegation, verifyStandingDelegation, verifyTokenAgainstGrant, verifyDelegationRevocation, findGrantRevocation, } from "@motebit/crypto";
+export { verifyDelegation, verifyStandingDelegation, verifyTokenAgainstGrant, verifyDelegationRevocation, findGrantRevocation, subjectBindingDigest, verifySubjectBinding, } from "@motebit/crypto";
 export { signRequestEnvelope, verifyRequestEnvelope } from "@motebit/crypto";
 export type { SignedRequestEnvelope } from "@motebit/crypto";
-export type { VerifyResult, ArtifactType, SkillVerifyResult, SkillFileVerifyResult, ApprovalDecision, DelegationToken, StandingDelegation, DelegationRevocation, } from "@motebit/crypto";
+export type { VerifyResult, ArtifactType, SkillVerifyResult, SkillFileVerifyResult, ApprovalDecision, DelegationToken, StandingDelegation, DelegationRevocation, SubjectBindingV1, } from "@motebit/crypto";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAO3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAczD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAO3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAgBzD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -52,7 +52,9 @@ export { verifyApprovalDecision } from "@motebit/crypto";
 //   - verifyTokenAgainstGrant   — a per-tick token IS a valid tick of its grant
 //   - verifyDelegationRevocation — a revocation's signature (caller binds it to the grant)
 //   - findGrantRevocation       — the consumer-side revocation check done right (binds revocation→grant; build `isRevoked` from it)
-export { verifyDelegation, verifyStandingDelegation, verifyTokenAgainstGrant, verifyDelegationRevocation, findGrantRevocation, } from "@motebit/crypto";
+//   - subjectBindingDigest      — canonical digest of a detached subject-scope artifact (standing-delegation@1.1)
+//   - verifySubjectBinding      — the presented scope artifact matches the grant's signed `subject_binding`, fail-closed
+export { verifyDelegation, verifyStandingDelegation, verifyTokenAgainstGrant, verifyDelegationRevocation, findGrantRevocation, subjectBindingDigest, verifySubjectBinding, } from "@motebit/crypto";
 // Signed request envelope (signed-request-envelope@1.0). Explicitly re-exported
 // like the delegation family — verified against the identity's REGISTERED key
 // (resolved by the caller from `motebit_id`), never a key the request carries.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEzF,6EAA6E;AAC7E,6EAA6E;AAC7E,oFAAoF;AACpF,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAC9E,wEAAwE;AACxE,0FAA0F;AAC1F,sGAAsG;AACtG,gFAAgF;AAChF,2FAA2F;AAC3F,oIAAoI;AACpI,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEzF,6EAA6E;AAC7E,6EAA6E;AAC7E,oFAAoF;AACpF,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,8EAA8E;AAC9E,wEAAwE;AACxE,0FAA0F;AAC1F,sGAAsG;AACtG,gFAAgF;AAChF,2FAA2F;AAC3F,oIAAoI;AACpI,kHAAkH;AAClH,yHAAyH;AACzH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motebit/verifier",
-  "version": "1.6.3",
+  "version": "1.7.0",
   "description": "Apache-2.0 library for verifying signed Motebit artifacts (identity files, execution receipts, credentials, presentations) — file-reading and human-formatting helpers on top of @motebit/crypto. The canonical `motebit-verify` CLI now lives at @motebit/verify; this package is the Apache-2.0 library it sits on.",
   "type": "module",
   "main": "./dist/index.js",
@@ -54,8 +54,8 @@
     ]
   },
   "dependencies": {
-    "@motebit/crypto": "3.9.0",
-    "@motebit/protocol": "3.4.0"
+    "@motebit/crypto": "3.10.0",
+    "@motebit/protocol": "3.5.0"
   },
   "devDependencies": {
     "@noble/ed25519": "~3.1.0",