@motebit/verify 0.7.0 → 1.1.0

package/dist/index.d.ts

@@ -1,237 +1,32 @@
 /**
- * @motebit/verify — Standalone verifier for all Motebit artifacts.
+ * @motebit/verify — hardware-attestation-aware companion to
+ * `@motebit/verifier`.
+ *
+ * Bundles every Apache-2.0 permissive-floor platform verifier leaf
+ * into a single `HardwareAttestationVerifiers` record + a CLI
+ * `motebit-verify` that hands them to `@motebit/verifier::verifyFile`.
+ * A credential with `hardware_attestation: { platform: "device_check" |
+ * "tpm" | "android_keystore" | "webauthn", ... }` verifies end-to-end
+ * through this package instead of returning the permissive-floor
+ * verifier's `adapter not yet shipped` sentinel. The deprecated
+ * `play_integrity` arm is also wired during the
+ * `@motebit/crypto-play-integrity@1.x` deprecation cycle for backward
+ * compatibility with already-minted credentials.
+ *
+ * Programmatic use:
  *
- * Verifies identity files, execution receipts, verifiable credentials,
- * and verifiable presentations. One function, any artifact, zero config.
- *
- * Zero monorepo dependencies — only @noble/ed25519 for cryptography.
- *
- * Usage:
- *   import { verify } from "@motebit/verify";
- *
- *   // Identity file
- *   const result = await verify(fs.readFileSync("motebit.md", "utf-8"));
- *
- *   // Execution receipt (JSON)
- *   const result = await verify(receiptJson);
- *
- *   // Verifiable credential or presentation (JSON)
- *   const result = await verify(credentialJson);
- *
- *   // With expected type (fail-fast on misclassification)
- *   const result = await verify(artifact, { expectedType: "receipt" });
- */
-interface MotebitIdentityFile {
-    spec: string;
-    motebit_id: string;
-    created_at: string;
-    owner_id: string;
-    type?: "personal" | "service" | "collaborative";
-    service_name?: string;
-    service_description?: string;
-    service_url?: string;
-    capabilities?: string[];
-    terms_url?: string;
-    identity: {
-        algorithm: "Ed25519";
-        public_key: string;
-    };
-    governance: {
-        trust_mode: "full" | "guarded" | "minimal";
-        max_risk_auto: string;
-        require_approval_above: string;
-        deny_above: string;
-        operator_mode: boolean;
-    };
-    privacy: {
-        default_sensitivity: string;
-        retention_days: Record<string, number>;
-        fail_closed: boolean;
-    };
-    memory: {
-        half_life_days: number;
-        confidence_threshold: number;
-        per_turn_limit: number;
-    };
-    /** Organizational guardian for key recovery and enterprise custody (§3.3). */
-    guardian?: {
-        public_key: string;
-        organization?: string;
-        organization_id?: string;
-        established_at: string;
-        /** Ed25519 signature proving guardian governs this agent. */
-        attestation?: string;
-    };
-    devices: Array<{
-        device_id: string;
-        name: string;
-        public_key: string;
-        registered_at: string;
-    }>;
-    succession?: Array<SuccessionRecord>;
-}
-interface SuccessionRecord {
-    old_public_key: string;
-    new_public_key: string;
-    timestamp: number;
-    reason?: string;
-    old_key_signature?: string;
-    new_key_signature: string;
-    /** True when succession was authorized by guardian, not old key. */
-    recovery?: boolean;
-    /** Guardian signature — present only when recovery is true. */
-    guardian_signature?: string;
-}
-interface ExecutionReceipt {
-    task_id: string;
-    motebit_id: string;
-    /** Signer's Ed25519 public key (hex). Enables verification without relay lookup. */
-    public_key?: string;
-    device_id: string;
-    submitted_at: number;
-    completed_at: number;
-    status: string;
-    result: string;
-    tools_used: string[];
-    memories_formed: number;
-    prompt_hash: string;
-    result_hash: string;
-    delegation_receipts?: ExecutionReceipt[];
-    delegated_scope?: string;
-    signature: string;
-}
-interface DataIntegrityProof {
-    type: "DataIntegrityProof";
-    cryptosuite: "eddsa-jcs-2022";
-    created: string;
-    verificationMethod: string;
-    proofPurpose: "assertionMethod" | "authentication";
-    proofValue: string;
-}
-interface VerifiableCredential {
-    "@context": string[];
-    type: string[];
-    issuer: string;
-    credentialSubject: Record<string, unknown> & {
-        id: string;
-    };
-    validFrom: string;
-    validUntil?: string;
-    credentialStatus?: {
-        id: string;
-        type: string;
-    };
-    proof: DataIntegrityProof;
-}
-interface VerifiablePresentation {
-    "@context": string[];
-    type: string[];
-    holder: string;
-    verifiableCredential: VerifiableCredential[];
-    proof: DataIntegrityProof;
-}
-interface VerificationError {
-    message: string;
-    path?: string;
-}
-interface BaseResult {
-    valid: boolean;
-    errors?: VerificationError[];
-}
-interface IdentityVerifyResult extends BaseResult {
-    type: "identity";
-    identity: MotebitIdentityFile | null;
-    did?: string;
-    /** First error message. Convenience accessor for backward compatibility. */
-    error?: string;
-    succession?: {
-        valid: boolean;
-        genesis_public_key?: string;
-        rotations: number;
-        error?: string;
-    };
-}
-interface ReceiptVerifyResult extends BaseResult {
-    type: "receipt";
-    receipt: ExecutionReceipt | null;
-    signer?: string;
-    delegations?: ReceiptVerifyResult[];
-}
-interface CredentialVerifyResult extends BaseResult {
-    type: "credential";
-    credential: VerifiableCredential | null;
-    issuer?: string;
-    subject?: string;
-    expired?: boolean;
-}
-interface PresentationVerifyResult extends BaseResult {
-    type: "presentation";
-    presentation: VerifiablePresentation | null;
-    holder?: string;
-    credentials?: CredentialVerifyResult[];
-}
-type VerifyResult = IdentityVerifyResult | ReceiptVerifyResult | CredentialVerifyResult | PresentationVerifyResult;
-type ArtifactType = VerifyResult["type"];
-interface VerifyOptions {
-    expectedType?: ArtifactType;
-    /** Clock skew tolerance in seconds for credential expiry checks. Default: 60. */
-    clockSkewSeconds?: number;
-}
-/** @deprecated Use VerifyResult instead. Kept for backward compatibility. */
-interface LegacyVerifyResult {
-    valid: boolean;
-    identity: MotebitIdentityFile | null;
-    did?: string;
-    error?: string;
-    succession?: {
-        valid: boolean;
-        genesis_public_key?: string;
-        rotations: number;
-        error?: string;
-    };
-}
-/**
- * Parse a motebit.md file into its components.
- * Does not verify the signature — use `verify()` for that.
- */
-declare function parse(content: string): {
-    frontmatter: MotebitIdentityFile;
-    signature: string;
-    rawFrontmatter: string;
-};
-/**
- * Verify any Motebit artifact: identity file, execution receipt,
- * verifiable credential, or verifiable presentation.
- *
- * Accepts strings (identity files, JSON) or parsed objects (receipts,
- * credentials, presentations). Detects the artifact type automatically.
- *
- * Use `options.expectedType` to fail fast if the artifact doesn't match
- * the expected type.
- *
- * @example
  * ```ts
- * import { verify } from "@motebit/verify";
+ * import { verifyFile } from "@motebit/verifier";
+ * import { buildHardwareVerifiers } from "@motebit/verify";
  *
- * // Identity file (string)
- * const r1 = await verify(identityFileContent);
- * if (r1.type === "identity" && r1.valid) console.log(r1.did);
- *
- * // Execution receipt (object or JSON string)
- * const r2 = await verify(receipt, { expectedType: "receipt" });
- * if (r2.type === "receipt" && r2.valid) console.log(r2.signer);
- *
- * // Verifiable credential
- * const r3 = await verify(credential);
- * if (r3.type === "credential" && r3.valid) console.log(r3.issuer);
+ * const result = await verifyFile("cred.json", {
+ *   hardwareAttestation: buildHardwareVerifiers(),
+ * });
  * ```
- */
-declare function verify(artifact: unknown, options?: VerifyOptions): Promise<VerifyResult>;
-/**
- * Verify a motebit.md identity file. Backward-compatible with pre-0.4.0.
  *
- * @deprecated Use `verify(content)` instead — it handles all artifact types.
+ * CLI use: `motebit-verify <file>` — same args as `motebit-verify`,
+ * plus hardware-attestation verification. See `cli.ts`.
  */
-declare function verifyIdentityFile(content: string): Promise<LegacyVerifyResult>;
-
-export { type ArtifactType, type CredentialVerifyResult, type DataIntegrityProof, type ExecutionReceipt, type IdentityVerifyResult, type LegacyVerifyResult, type MotebitIdentityFile, type PresentationVerifyResult, type ReceiptVerifyResult, type SuccessionRecord, type VerifiableCredential, type VerifiablePresentation, type VerificationError, type VerifyOptions, type VerifyResult, parse, verify, verifyIdentityFile };
+export { buildHardwareVerifiers } from "./adapters.js";
+export type { HardwareVerifierBundleConfig } from "./adapters.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE;QACR,SAAS,EAAE,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF,UAAU,EAAE;QACV,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IAEF,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC;IAEF,MAAM,EAAE;QACN,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,6DAA6D;QAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAMD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC;QACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAyTD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,CAqBA;AA2bD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAwD9F;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CASrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC"}