@motebit/verify 0.7.0 → 1.0.0

package/dist/cli.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+/**
+ * `motebit-verify` CLI — the canonical motebit artifact verifier.
+ *
+ * Verifies identity files, execution receipts, credentials, and
+ * presentations against their embedded signatures. When a credential
+ * carries a `hardware_attestation` claim for `device_check` / `tpm` /
+ * `play_integrity` / `webauthn`, the bundled platform adapters verify
+ * the chain, nonce, bundle, and identity binding end-to-end.
+ *
+ * ```
+ *   motebit-verify <file>                 # auto-detect, print human
+ *   motebit-verify <file> --json          # structured output
+ *   motebit-verify <file> --expect credential
+ *   motebit-verify <file> --clock-skew 30
+ *
+ *   # Platform-specific overrides (all optional; defaults match
+ *   # motebit's canonical identifiers).
+ *   motebit-verify <file> \
+ *     --bundle-id com.example.app \
+ *     --android-package com.example.app \
+ *     --rp-id example.com
+ * ```
+ *
+ * Exit codes:
+ *   0  artifact verified (including any hardware-attestation channel)
+ *   1  artifact detected but signature / hardware-channel invalid
+ *   2  usage / I/O error
+ *
+ * Network-free by design. Every adapter pins its own trust anchor
+ * (Apple App Attest Root CA, FIDO roots, TPM vendor roots); Play
+ * Integrity's JWKS is fail-closed by default until an operator lands
+ * real bytes (see `@motebit/crypto-play-integrity`'s CLAUDE.md).
+ *
+ * Three-package lineage — mirrors how tools like `git` / `libgit2` or
+ * `cargo` / `tokio` separate the verb-tool from the library layer:
+ *
+ *   @motebit/verify   — this CLI (Apache-2.0, bundles all 4 adapters)
+ *   @motebit/verifier — Apache-2.0 library (file I/O, human formatting)
+ *   @motebit/crypto   — Apache-2.0 primitives (verify, sign, suite dispatch)
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { formatHuman, verifyFile } from "@motebit/verifier";
+import { buildHardwareVerifiers } from "./adapters.js";
+const EXPECT_VALUES = [
+    "identity",
+    "receipt",
+    "credential",
+    "presentation",
+];
+function parseArgs(argv) {
+    let file;
+    let json = false;
+    let expectedType;
+    let clockSkewSeconds;
+    let bundleId;
+    let androidPackage;
+    let rpId;
+    let help = false;
+    let version = false;
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        switch (arg) {
+            case "-h":
+            case "--help":
+                help = true;
+                i++;
+                break;
+            case "-V":
+            case "--version":
+                version = true;
+                i++;
+                break;
+            case "--json":
+                json = true;
+                i++;
+                break;
+            case "--expect":
+            case "--expected-type": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage(`${arg} requires a value`);
+                if (!EXPECT_VALUES.includes(value)) {
+                    return usage(`unknown --expect value "${value}" (valid: ${EXPECT_VALUES.join(", ")})`);
+                }
+                expectedType = value;
+                i += 2;
+                break;
+            }
+            case "--clock-skew": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage("--clock-skew requires an integer seconds value");
+                const n = Number.parseInt(value, 10);
+                if (!Number.isFinite(n) || n < 0) {
+                    return usage(`--clock-skew must be a non-negative integer (got "${value}")`);
+                }
+                clockSkewSeconds = n;
+                i += 2;
+                break;
+            }
+            case "--bundle-id": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage("--bundle-id requires a value");
+                bundleId = value;
+                i += 2;
+                break;
+            }
+            case "--android-package": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage("--android-package requires a value");
+                androidPackage = value;
+                i += 2;
+                break;
+            }
+            case "--rp-id": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage("--rp-id requires a value");
+                rpId = value;
+                i += 2;
+                break;
+            }
+            default:
+                if (arg.startsWith("-"))
+                    return usage(`unknown flag: ${arg}`);
+                if (file !== undefined) {
+                    return usage(`expected exactly one file argument, got a second: "${arg}" (after "${file}")`);
+                }
+                file = arg;
+                i++;
+                break;
+        }
+    }
+    if (help)
+        return { mode: "help", json };
+    if (version)
+        return { mode: "version", json };
+    if (file === undefined)
+        return usage("missing file argument");
+    return {
+        mode: "verify",
+        file,
+        json,
+        ...(expectedType !== undefined && { expectedType }),
+        ...(clockSkewSeconds !== undefined && { clockSkewSeconds }),
+        ...(bundleId !== undefined && { bundleId }),
+        ...(androidPackage !== undefined && { androidPackage }),
+        ...(rpId !== undefined && { rpId }),
+    };
+}
+function usage(message) {
+    return { mode: "help", json: false, usageError: message };
+}
+function renderHelp() {
+    return [
+        "motebit-verify — hardware-attestation-aware verifier for Motebit credentials",
+        "",
+        "USAGE",
+        "  motebit-verify <file> [options]",
+        "",
+        "OPTIONS",
+        "  --json                    Print structured JSON instead of human-readable.",
+        "  --expect <type>           Require the artifact to be of the named type.",
+        "  --clock-skew <seconds>    Allow N seconds of clock skew.",
+        "  --bundle-id <id>          Override the expected iOS bundle ID for App Attest",
+        "                            (default: com.motebit.mobile).",
+        "  --android-package <name>  Override the expected Android package name for",
+        "                            Play Integrity (default: com.motebit.mobile).",
+        "  --rp-id <id>              Override the expected WebAuthn Relying Party ID",
+        "                            (default: motebit.com).",
+        "  -h, --help                Show this help.",
+        "  -V, --version             Print version.",
+        "",
+        "EXIT CODES",
+        "  0  Artifact verified (including hardware-attestation channel).",
+        "  1  Artifact invalid (signature, expiry, hardware-channel chain / nonce / bundle).",
+        "  2  Usage or I/O error.",
+        "",
+        "PLATFORMS WIRED",
+        "  device_check     Apple App Attest (pinned Apple root)",
+        "  tpm              TPM 2.0 (pinned Infineon / Nuvoton / STMicro / Intel PTT roots)",
+        "  play_integrity   Google Play Integrity (fail-closed; operator pins real JWKS)",
+        "  webauthn         WebAuthn packed attestation (pinned Apple / Yubico / Microsoft)",
+    ].join("\n");
+}
+let cachedVersion;
+function getPackageVersion() {
+    if (cachedVersion !== undefined)
+        return cachedVersion;
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkgPath = join(here, "..", "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        cachedVersion = pkg.version ?? "0.0.0";
+    }
+    catch {
+        cachedVersion = "0.0.0";
+    }
+    return cachedVersion;
+}
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    if (args.mode === "version") {
+        process.stdout.write(`${getPackageVersion()}\n`);
+        return 0;
+    }
+    if (args.mode === "help") {
+        const help = renderHelp();
+        if (args.usageError !== undefined) {
+            process.stderr.write(`motebit-verify: ${args.usageError}\n\n${help}\n`);
+            return 2;
+        }
+        process.stdout.write(`${help}\n`);
+        return 0;
+    }
+    if (args.file === undefined) {
+        process.stderr.write(`motebit-verify: missing file argument\n\n${renderHelp()}\n`);
+        return 2;
+    }
+    const hardwareAttestation = buildHardwareVerifiers({
+        ...(args.bundleId !== undefined && { appAttestBundleId: args.bundleId }),
+        ...(args.androidPackage !== undefined && { playIntegrityPackageName: args.androidPackage }),
+        ...(args.rpId !== undefined && { webauthnRpId: args.rpId }),
+    });
+    let result;
+    try {
+        result = await verifyFile(args.file, {
+            ...(args.expectedType !== undefined && { expectedType: args.expectedType }),
+            ...(args.clockSkewSeconds !== undefined && { clockSkewSeconds: args.clockSkewSeconds }),
+            hardwareAttestation,
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`motebit-verify: cannot read ${args.file}: ${msg}\n`);
+        return 2;
+    }
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${formatHuman(result)}\n`);
+    }
+    return result.valid ? 0 : 1;
+}
+main()
+    .then((code) => {
+    process.exit(code);
+})
+    .catch((err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`motebit-verify: ${msg}\n`);
+    process.exit(2);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,aAAa,GAA4B;IAC7C,UAAU;IACV,SAAS;IACT,YAAY;IACZ,cAAc;CACf,CAAC;AAcF,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,YAAsC,CAAC;IAC3C,IAAI,gBAAoC,CAAC;IACzC,IAAI,QAA4B,CAAC;IACjC,IAAI,cAAkC,CAAC;IACvC,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,UAAU,CAAC;YAChB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;gBACjE,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,OAAO,KAAK,CAAC,2BAA2B,KAAK,aAAa,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzF,CAAC;gBACD,YAAY,GAAG,KAAqB,CAAC;gBACrC,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACxF,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,KAAK,CAAC,qDAAqD,KAAK,IAAI,CAAC,CAAC;gBAC/E,CAAC;gBACD,gBAAgB,GAAG,CAAC,CAAC;gBACrB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACtE,QAAQ,GAAG,KAAK,CAAC;gBACjB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAC5E,cAAc,GAAG,KAAK,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAClE,IAAI,GAAG,KAAK,CAAC;gBACb,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;gBAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CACV,sDAAsD,GAAG,aAAa,IAAI,IAAI,CAC/E,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;gBACJ,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC;QACvD,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,8EAA8E;QAC9E,EAAE;QACF,OAAO;QACP,mCAAmC;QACnC,EAAE;QACF,SAAS;QACT,8EAA8E;QAC9E,2EAA2E;QAC3E,4DAA4D;QAC5D,gFAAgF;QAChF,4DAA4D;QAC5D,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,qDAAqD;QACrD,6CAA6C;QAC7C,4CAA4C;QAC5C,EAAE;QACF,YAAY;QACZ,kEAAkE;QAClE,qFAAqF;QACrF,0BAA0B;QAC1B,EAAE;QACF,iBAAiB;QACjB,yDAAyD;QACzD,oFAAoF;QACpF,iFAAiF;QACjF,oFAAoF;KACrF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,IAAI,aAAiC,CAAC;AACtC,SAAS,iBAAiB;IACxB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAyB,CAAC;QAC/E,aAAa,GAAG,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,UAAU,OAAO,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,UAAU,EAAE,IAAI,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,wBAAwB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3F,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE;YACnC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvF,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,IAAI,EAAE;KACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,237 +1,29 @@
 /**
- * @motebit/verify — Standalone verifier for all Motebit artifacts.
+ * @motebit/verify — hardware-attestation-aware companion to
+ * `@motebit/verifier`.
  *
- * Verifies identity files, execution receipts, verifiable credentials,
- * and verifiable presentations. One function, any artifact, zero config.
+ * Bundles the four Apache-2.0 permissive-floor platform verifier leaves
+ * into a single `HardwareAttestationVerifiers` record + a CLI
+ * `motebit-verify` that hands them to `@motebit/verifier::verifyFile`.
+ * A credential with `hardware_attestation: { platform: "device_check" |
+ * "tpm" | "play_integrity" | "webauthn", ... }` verifies end-to-end
+ * through this package instead of returning the permissive-floor
+ * verifier's `adapter not yet shipped` sentinel.
  *
- * Zero monorepo dependencies — only @noble/ed25519 for cryptography.
+ * Programmatic use:
  *
- * Usage:
- *   import { verify } from "@motebit/verify";
- *
- *   // Identity file
- *   const result = await verify(fs.readFileSync("motebit.md", "utf-8"));
- *
- *   // Execution receipt (JSON)
- *   const result = await verify(receiptJson);
- *
- *   // Verifiable credential or presentation (JSON)
- *   const result = await verify(credentialJson);
- *
- *   // With expected type (fail-fast on misclassification)
- *   const result = await verify(artifact, { expectedType: "receipt" });
- */
-interface MotebitIdentityFile {
-    spec: string;
-    motebit_id: string;
-    created_at: string;
-    owner_id: string;
-    type?: "personal" | "service" | "collaborative";
-    service_name?: string;
-    service_description?: string;
-    service_url?: string;
-    capabilities?: string[];
-    terms_url?: string;
-    identity: {
-        algorithm: "Ed25519";
-        public_key: string;
-    };
-    governance: {
-        trust_mode: "full" | "guarded" | "minimal";
-        max_risk_auto: string;
-        require_approval_above: string;
-        deny_above: string;
-        operator_mode: boolean;
-    };
-    privacy: {
-        default_sensitivity: string;
-        retention_days: Record<string, number>;
-        fail_closed: boolean;
-    };
-    memory: {
-        half_life_days: number;
-        confidence_threshold: number;
-        per_turn_limit: number;
-    };
-    /** Organizational guardian for key recovery and enterprise custody (§3.3). */
-    guardian?: {
-        public_key: string;
-        organization?: string;
-        organization_id?: string;
-        established_at: string;
-        /** Ed25519 signature proving guardian governs this agent. */
-        attestation?: string;
-    };
-    devices: Array<{
-        device_id: string;
-        name: string;
-        public_key: string;
-        registered_at: string;
-    }>;
-    succession?: Array<SuccessionRecord>;
-}
-interface SuccessionRecord {
-    old_public_key: string;
-    new_public_key: string;
-    timestamp: number;
-    reason?: string;
-    old_key_signature?: string;
-    new_key_signature: string;
-    /** True when succession was authorized by guardian, not old key. */
-    recovery?: boolean;
-    /** Guardian signature — present only when recovery is true. */
-    guardian_signature?: string;
-}
-interface ExecutionReceipt {
-    task_id: string;
-    motebit_id: string;
-    /** Signer's Ed25519 public key (hex). Enables verification without relay lookup. */
-    public_key?: string;
-    device_id: string;
-    submitted_at: number;
-    completed_at: number;
-    status: string;
-    result: string;
-    tools_used: string[];
-    memories_formed: number;
-    prompt_hash: string;
-    result_hash: string;
-    delegation_receipts?: ExecutionReceipt[];
-    delegated_scope?: string;
-    signature: string;
-}
-interface DataIntegrityProof {
-    type: "DataIntegrityProof";
-    cryptosuite: "eddsa-jcs-2022";
-    created: string;
-    verificationMethod: string;
-    proofPurpose: "assertionMethod" | "authentication";
-    proofValue: string;
-}
-interface VerifiableCredential {
-    "@context": string[];
-    type: string[];
-    issuer: string;
-    credentialSubject: Record<string, unknown> & {
-        id: string;
-    };
-    validFrom: string;
-    validUntil?: string;
-    credentialStatus?: {
-        id: string;
-        type: string;
-    };
-    proof: DataIntegrityProof;
-}
-interface VerifiablePresentation {
-    "@context": string[];
-    type: string[];
-    holder: string;
-    verifiableCredential: VerifiableCredential[];
-    proof: DataIntegrityProof;
-}
-interface VerificationError {
-    message: string;
-    path?: string;
-}
-interface BaseResult {
-    valid: boolean;
-    errors?: VerificationError[];
-}
-interface IdentityVerifyResult extends BaseResult {
-    type: "identity";
-    identity: MotebitIdentityFile | null;
-    did?: string;
-    /** First error message. Convenience accessor for backward compatibility. */
-    error?: string;
-    succession?: {
-        valid: boolean;
-        genesis_public_key?: string;
-        rotations: number;
-        error?: string;
-    };
-}
-interface ReceiptVerifyResult extends BaseResult {
-    type: "receipt";
-    receipt: ExecutionReceipt | null;
-    signer?: string;
-    delegations?: ReceiptVerifyResult[];
-}
-interface CredentialVerifyResult extends BaseResult {
-    type: "credential";
-    credential: VerifiableCredential | null;
-    issuer?: string;
-    subject?: string;
-    expired?: boolean;
-}
-interface PresentationVerifyResult extends BaseResult {
-    type: "presentation";
-    presentation: VerifiablePresentation | null;
-    holder?: string;
-    credentials?: CredentialVerifyResult[];
-}
-type VerifyResult = IdentityVerifyResult | ReceiptVerifyResult | CredentialVerifyResult | PresentationVerifyResult;
-type ArtifactType = VerifyResult["type"];
-interface VerifyOptions {
-    expectedType?: ArtifactType;
-    /** Clock skew tolerance in seconds for credential expiry checks. Default: 60. */
-    clockSkewSeconds?: number;
-}
-/** @deprecated Use VerifyResult instead. Kept for backward compatibility. */
-interface LegacyVerifyResult {
-    valid: boolean;
-    identity: MotebitIdentityFile | null;
-    did?: string;
-    error?: string;
-    succession?: {
-        valid: boolean;
-        genesis_public_key?: string;
-        rotations: number;
-        error?: string;
-    };
-}
-/**
- * Parse a motebit.md file into its components.
- * Does not verify the signature — use `verify()` for that.
- */
-declare function parse(content: string): {
-    frontmatter: MotebitIdentityFile;
-    signature: string;
-    rawFrontmatter: string;
-};
-/**
- * Verify any Motebit artifact: identity file, execution receipt,
- * verifiable credential, or verifiable presentation.
- *
- * Accepts strings (identity files, JSON) or parsed objects (receipts,
- * credentials, presentations). Detects the artifact type automatically.
- *
- * Use `options.expectedType` to fail fast if the artifact doesn't match
- * the expected type.
- *
- * @example
  * ```ts
- * import { verify } from "@motebit/verify";
- *
- * // Identity file (string)
- * const r1 = await verify(identityFileContent);
- * if (r1.type === "identity" && r1.valid) console.log(r1.did);
+ * import { verifyFile } from "@motebit/verifier";
+ * import { buildHardwareVerifiers } from "@motebit/verify";
  *
- * // Execution receipt (object or JSON string)
- * const r2 = await verify(receipt, { expectedType: "receipt" });
- * if (r2.type === "receipt" && r2.valid) console.log(r2.signer);
- *
- * // Verifiable credential
- * const r3 = await verify(credential);
- * if (r3.type === "credential" && r3.valid) console.log(r3.issuer);
+ * const result = await verifyFile("cred.json", {
+ *   hardwareAttestation: buildHardwareVerifiers(),
+ * });
  * ```
- */
-declare function verify(artifact: unknown, options?: VerifyOptions): Promise<VerifyResult>;
-/**
- * Verify a motebit.md identity file. Backward-compatible with pre-0.4.0.
  *
- * @deprecated Use `verify(content)` instead — it handles all artifact types.
+ * CLI use: `motebit-verify <file>` — same args as `motebit-verify`,
+ * plus hardware-attestation verification. See `cli.ts`.
  */
-declare function verifyIdentityFile(content: string): Promise<LegacyVerifyResult>;
-
-export { type ArtifactType, type CredentialVerifyResult, type DataIntegrityProof, type ExecutionReceipt, type IdentityVerifyResult, type LegacyVerifyResult, type MotebitIdentityFile, type PresentationVerifyResult, type ReceiptVerifyResult, type SuccessionRecord, type VerifiableCredential, type VerifiablePresentation, type VerificationError, type VerifyOptions, type VerifyResult, parse, verify, verifyIdentityFile };
+export { buildHardwareVerifiers } from "./adapters.js";
+export type { HardwareVerifierBundleConfig } from "./adapters.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAMD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAyTD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAqBA;AA2bD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAwD9F;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC"}