@onchaindiligence/agent-evidence 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OnChainDiligence
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,98 @@
+# @onchaindiligence/agent-evidence
+
+Production Node.js/TypeScript implementation of the published
+OnChainDiligence Agent Evidence v0 protocol. It creates deterministic records,
+validates the complete evidence DAG, seals bundles with Ed25519 DSSE, and
+verifies portable bundles offline with caller-supplied trust.
+
+The package is currently **packable and publish-ready, but not yet published to
+npm**. Do not advertise a registry install until the owner completes npm trusted
+publishing. From this repository, test the exact public artifact with:
+
+```sh
+npm pack ./packages/agent-evidence
+npm install ./onchaindiligence-agent-evidence-0.1.0.tgz
+```
+
+Node.js 20.19 or newer and ESM are required.
+
+## What a signature proves
+
+A valid signature proves that the identified key signed the exact canonical
+bundle bytes and that the bundle satisfies the protocol and caller's trust
+policy. It does not prove that an upstream fact is objectively true. Source
+proofs establish attribution to a witness; the verifier never turns embedded
+keys into trust and never contacts OnChainDiligence, a blockchain, a schema
+server, or an evidence provider.
+
+## Stable public API
+
+- `createRecord(kind, statement, options)` creates a schema-valid v0 record and
+  derives its deterministic content ID.
+- `contentId(value)` and `canonicalize(value)` expose the protocol's exact
+  RFC 8785 content-addressing boundary.
+- `createBundlePayload(records, options)` sorts records and validates IDs,
+  roots, references, required relationships, graph completeness, and cycles.
+- `createEd25519Signer(privateKey)` creates a local Node Ed25519 signer.
+- `sealBundle(payload, signer, options)` validates, canonicalizes, performs
+  exact DSSE PAE, verifies the caller signer result, and returns portable data.
+- `createKeyRecord(publicKey, options)` produces a validated lifecycle record.
+- `TrustPolicy.fromKeyRecords(records, options)` creates explicit caller trust.
+- `verifyBundle(bundle, trustPolicy)` returns a machine-readable tri-state
+  `VerificationReport` without network access.
+- `validateBundlePayload` and `validateDocument` support explicit validation.
+- `parseJson`, `parseTimestamp`, `formatTimestamp`, `deriveKeyId`, `dssePae`,
+  and the documented constants/types cover protocol-safe lower-level use.
+
+Construction/configuration errors are typed as `AgentEvidenceError` subclasses:
+`CanonicalizationError`, `ParseError`, `SchemaValidationError`,
+`EvidenceValidationError`, `SigningError`, and `TrustPolicyError`.
+
+## Verification states
+
+- `VALID`: every required structural, graph, cryptographic, lifecycle,
+  freshness, and caller-trust component passed.
+- `INVALID`: the document violates the protocol, such as a bad signature,
+  altered content ID, invalid edge, unsupported version, or invalid key window.
+- `UNVERIFIABLE`: the document may be coherent, but caller trust or required
+  evidence material is insufficient.
+
+`UNVERIFIABLE` is never promoted to `VALID` or collapsed into `INVALID`.
+Inspect `report.components` for stable codes, key/record references, and
+diagnostics.
+
+## Trust and key rotation
+
+Trust is supplied only through `TrustPolicy`. Keys carried inside the portable
+bundle are untrusted hints. Active and retired historical Ed25519 keys are
+evaluated against the bundle's signed `created_at` and their explicit validity
+interval. Revoked or compromised keys are invalid. A missing defensible
+`valid_from` is `UNVERIFIABLE`, not guessed. Replacement links must be distinct
+and resolve inside the caller's trust set.
+
+## Signing
+
+`sealBundle` accepts an `Ed25519Signer` containing a key ID, public key, and
+sync/async signing callback. It verifies that the key ID matches the public key
+and that the returned signature is valid before emitting a bundle. This allows
+external signing implementations without introducing remote signing or key
+fetching into the protocol. `createEd25519Signer` is the local PKCS8/`KeyObject`
+convenience implementation.
+
+Private key material is never loaded from files or configuration by this
+package and no production signing key is bundled.
+
+## Financial-agent example
+
+[`examples/withheld-payment.mjs`](./examples/withheld-payment.mjs) builds
+Principal → Agent → Mandate → Run → Evidence/Policy → Decision → Execution,
+where policy withholds an invoice payment because recipient ownership evidence
+is missing. The execution is `withheld-not-submitted`; the example does not
+fabricate a transaction or settlement.
+
+## Schemas and interoperability
+
+The npm artifact includes the canonical v0 schemas and public conformance
+corpus. Build tests fail if packaged files differ byte-for-byte from
+`spec/agent-evidence/v0`. The same deterministic fixture is produced and
+verified by both the TypeScript and Python implementations.

package/conformance/README.md

@@ -0,0 +1,31 @@
+# Agent Evidence v0 conformance corpus
+
+These fixtures are language-neutral inputs for Agent Evidence v0 producers and
+verifiers. `manifest.json` is the case index and records the exact expected
+overall state. `valid-full-graph.json` contains all eight v0 record kinds and a
+real Ed25519 DSSE signature. The other static files isolate canonicalization,
+graph, and duplicate-name failures; JSON Patch mutations use RFC 6902 paths.
+
+The deterministic private seed in `generate.mjs` is public test material. It
+MUST NOT be deployed, configured as a production trust root, or accepted
+outside conformance tests. Regeneration is deterministic:
+
+```text
+node generate.mjs portable
+node generate.mjs noncanonicalPayload
+node generate.mjs missingParent
+```
+
+Verification rules:
+
+1. Parse with duplicate-name rejection before ordinary JSON-schema validation.
+2. Validate the portable file and the decoded payload against the schemas in
+   `../schema`.
+3. Apply caller trust from `trusted_key_ids`; embedded keys are hints only.
+4. Verify DSSE over the exact decoded bytes before parsing the payload.
+5. Enforce RFC 8785 bytes, IDs, ordering, DAG, references, key lifecycle, and
+   policy in the normative order from `docs/AGENT_EVIDENCE_V0.md`.
+
+JSON Schema covers representation constraints. Graph relationships,
+canonical bytes, signatures, key derivation/trust, and tri-state outcomes are
+semantic conformance requirements and therefore have explicit corpus cases.

package/conformance/duplicate-outer-key.json

@@ -0,0 +1 @@
+{"media_type":"application/vnd.onchaindiligence.agent-evidence+json","media_type":"application/vnd.onchaindiligence.agent-evidence+json","bundle_version":"onchaindiligence.agent-evidence.bundle.v0","envelope":{},"verification_material":{}}

package/conformance/manifest.json

@@ -0,0 +1,74 @@
+{
+  "corpus_id": "onchaindiligence.agent-evidence.v0.conformance",
+  "corpus_version": "2026-08-28",
+  "test_key_warning": "Public deterministic test key only. Never trust or deploy it.",
+  "base_fixture": "valid-full-graph.json",
+  "cases": [
+    {
+      "id": "valid-full-graph",
+      "fixture": "valid-full-graph.json",
+      "trusted_key_ids": ["ed25519-3rLe053Cb84OYIW2"],
+      "expected": "VALID",
+      "covers": ["all-record-kinds", "record-ids", "bundle-id", "dag", "dsse", "key-window"]
+    },
+    {
+      "id": "invalid-signature",
+      "fixture": "valid-full-graph.json",
+      "outer_json_patch": [
+        {
+          "op": "replace",
+          "path": "/envelope/signatures/0/sig",
+          "value": "cpQSw7HTSuaPKkYzc/FXL/9lplP5ZEceSesmhQioOqtYXRwdf6jVrnuHZ06+AnfxaFybj/s6oNz5AnZTYF/wBQ=="
+        }
+      ],
+      "trusted_key_ids": ["ed25519-3rLe053Cb84OYIW2"],
+      "expected": "INVALID",
+      "reason": "dsse-signature"
+    },
+    {
+      "id": "outer-version-mismatch",
+      "fixture": "valid-full-graph.json",
+      "outer_json_patch": [
+        {
+          "op": "replace",
+          "path": "/bundle_version",
+          "value": "onchaindiligence.agent-evidence.bundle.v9"
+        }
+      ],
+      "trusted_key_ids": ["ed25519-3rLe053Cb84OYIW2"],
+      "expected": "INVALID",
+      "reason": "outer-inner-version-mismatch"
+    },
+    {
+      "id": "noncanonical-signed-payload",
+      "fixture": "noncanonical-payload.json",
+      "trusted_key_ids": ["ed25519-3rLe053Cb84OYIW2"],
+      "expected": "INVALID",
+      "reason": "payload-not-rfc8785",
+      "note": "The DSSE signature is valid over payload bytes prefixed by one ASCII space."
+    },
+    {
+      "id": "missing-parent",
+      "fixture": "missing-parent.json",
+      "trusted_key_ids": ["ed25519-3rLe053Cb84OYIW2"],
+      "expected": "INVALID",
+      "reason": "missing-parent",
+      "note": "The DSSE signature is valid; the changed record also intentionally exposes a record-ID mismatch."
+    },
+    {
+      "id": "unknown-key",
+      "fixture": "valid-full-graph.json",
+      "trusted_key_ids": [],
+      "expected": "UNVERIFIABLE",
+      "reason": "no-caller-trusted-key",
+      "note": "The embedded key is a hint and MUST NOT become trusted merely because it is embedded."
+    },
+    {
+      "id": "duplicate-outer-key",
+      "fixture": "duplicate-outer-key.json",
+      "trusted_key_ids": ["ed25519-3rLe053Cb84OYIW2"],
+      "expected": "INVALID",
+      "reason": "duplicate-json-name"
+    }
+  ]
+}

package/conformance/missing-parent.json

@@ -0,0 +1,31 @@
+{
+  "media_type": "application/vnd.onchaindiligence.agent-evidence+json",
+  "bundle_version": "onchaindiligence.agent-evidence.bundle.v0",
+  "envelope": {
+    "payloadType": "application/vnd.onchaindiligence.agent-evidence.bundle.v0+json",
+    "payload": "eyJidW5kbGVfaWQiOiJzaGEyNTY6ZXpweWczM05SQWNTWllrekpnMzJsX0dURlBNUzdGNnBoMVJ3VzFxZXNtbyIsImJ1bmRsZV92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5idW5kbGUudjAiLCJjcmVhdGVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowNi4wMDBaIiwiZXh0ZW5zaW9ucyI6e30sInJlY29yZHMiOlt7ImlkIjoic2hhMjU2Oi12NVM2Qmg0OFdVNmpDY2hzOFFlOThpdmZfQV9wZEVJR3RtY3hmTThveEkiLCJraW5kIjoiZXhlY3V0aW9uIiwicGFyZW50cyI6WyJzaGEyNTY6Rkx5WVZncWNGTzIxN0JQWDJUMXVpcUpMT2dNaU1OODc5YXZUN3ZLQzhyayJdLCJwcm9vZnMiOltdLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImFtb3VudCI6IjEuMDAiLCJhc3NldCI6InBhdGhVU0QiLCJibG9ja19udW1iZXIiOiIxMjM0NTY3OCIsImNvbmZpcm1lZF9hdCI6IjIwMjYtMDgtMjhUMTI6MDA6MDUuMDAwWiIsImRlY2lzaW9uX3JlZiI6InNoYTI1NjpGTHlZVmdxY0ZPMjE3QlBYMlQxdWlxSkxPZ01pTU44NzlhdlQ3dktDOHJrIiwiZXhlY3V0aW9uX2lkIjoiZXhlY3V0aW9uLWNvbmZvcm1hbmNlLTAwMSIsImV4ZWN1dGlvbl90eXBlIjoib25jaGFpbi10cmFuc2ZlciIsIm5ldHdvcmsiOiJlaXAxNTU6MSIsInJlY2lwaWVudCI6IjB4MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMiIsInNlbmRlciI6IjB4MzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMyIsInN0YXR1cyI6ImNvbmZpcm1lZCIsInN1Ym1pdHRlZF9hdCI6IjIwMjYtMDgtMjhUMTI6MDA6MDQuMDAwWiIsInRyYW5zYWN0aW9uX2RpZ2VzdCI6eyJzaGEyNTYiOiJTa0xCZFBnSVJrbVF0bkowZ3UtTjYyOFN3a2xKUkVIUXVldDhMQXNkUGRNIn0sInRyYW5zYWN0aW9uX2hhc2giOiIweDExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEifX0seyJpZCI6InNoYTI1NjpGTHlZVmdxY0ZPMjE3QlBYMlQxdWlxSkxPZ01pTU44NzlhdlQ3dktDOHJrIiwia2luZCI6ImRlY2lzaW9uIiwicGFyZW50cyI6WyJzaGEyNTY6RzFneFBucVNxTEJMQXFodHpXWmllbEF6OTVHQW9KeGRINjJ1Q2l5Z2t1ZyIsInNoYTI1NjpoV05LbEs0WWlCUG9SVEpFOVNEZTRpZG5mNmxHUGF3UUlybG9qYWVpU2g0Iiwic2hhMjU2OmlxWTZvVWI5V3BRSkhUY3YzdHFIdS04Q3UyNW5OdjdDQVhRWkRoX0huWmciXSwicHJvb2ZzIjpbXSwicmVjb3JkX3ZlcnNpb24iOiJvbmNoYWluZGlsaWdlbmNlLmFnZW50LWV2aWRlbmNlLnJlY29yZC52MCIsInN0YXRlbWVudCI6eyJhZ2VudF9yZWYiOiJzaGEyNTY6TzF6aEkxSnFEY21lS09oU3dSWlQyMGE3aUVDNzFqbEg2LTBRV2JSX0M1NCIsImRlY2lkZWRfYXQiOiIyMDI2LTA4LTI4VDEyOjAwOjAzLjAwMFoiLCJkZWNpc2lvbl9pZCI6ImRlY2lzaW9uLWNvbmZvcm1hbmNlLTAwMSIsImRlY2lzaW9uX3R5cGUiOiJwYXltZW50LWFwcHJvdmFsIiwiZXZpZGVuY2VfcmVmcyI6WyJzaGEyNTY6RzFneFBucVNxTEJMQXFodHpXWmllbEF6OTVHQW9KeGRINjJ1Q2l5Z2t1ZyJdLCJvdXRjb21lIjp7ImFwcHJvdmVkIjp0cnVlfSwicG9saWN5X2RpZ2VzdCI6eyJzaGEyNTYiOiI0VEhWMVNmTkFQTTlIVEx2X05fMGFlSW11YUZmbTlyTmVMUG04ZGtQdTR3In0sInBvbGljeV9yZWYiOiJzaGEyNTY6aXFZNm9VYjlXcFFKSFRjdjN0cUh1LThDdTI1bk52N0NBWFFaRGhfSG5aZyIsInJ1bl9yZWYiOiJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCJ9fSx7ImlkIjoic2hhMjU2OkcxZ3hQbnFTcUxCTEFxaHR6V1ppZWxBejk1R0FvSnhkSDYydUNpeWdrdWciLCJraW5kIjoiZXZpZGVuY2UiLCJwYXJlbnRzIjpbInNoYTI1NjpBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBIl0sInByb29mcyI6W3siZGlnZXN0Ijp7InNoYTI1NiI6IlpORk1taXV4VE0zYU5GcFZqLWNtMjNCR0V2Z0REZnpnZ0VUY092Z3djVzgifSwibWVkaWFfdHlwZSI6ImFwcGxpY2F0aW9uL2pzb24iLCJwcm9vZl90eXBlIjoiZXh0ZXJuYWwtZGlnZXN0In1dLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImV2aWRlbmNlX3R5cGUiOiJzYW5jdGlvbnMtc2NyZWVuIiwiZXhwaXJlc19hdCI6bnVsbCwib2JzZXJ2ZWRfYXQiOiIyMDI2LTA4LTI4VDEyOjAwOjAxLjAwMFoiLCJyZXF1ZXN0Ijp7ImRpZ2VzdCI6eyJzaGEyNTYiOiJwel95UjU2SzJIdmE2OUtrZ1I0VjF0T0Z5bXlZbDdBaEgwYmJVMWF5WnVNIn0sIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIn0sInJlc3BvbnNlIjp7ImRpZ2VzdCI6eyJzaGEyNTYiOiJaTkZNbWl1eFRNM2FORnBWai1jbTIzQkdFdmdERGZ6Z2dFVGNPdmd3Y1c4In0sIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIiwibW9kZSI6ImVtYmVkZGVkIiwidmFsdWUiOnsic2FuY3Rpb25lZCI6ZmFsc2V9fSwicnVuX3JlZiI6InNoYTI1NjpoV05LbEs0WWlCUG9SVEpFOVNEZTRpZG5mNmxHUGF3UUlybG9qYWVpU2g0Iiwic2NvcGUiOnsiY292ZXJhZ2UiOiJvbmUgdGVzdCBhZGRyZXNzIiwicXVlcnkiOiIweDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDEifSwic291cmNlIjp7ImlkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5pbnZhbGlkIiwidHlwZSI6Imh0dHBzLWFwaSJ9LCJ0b29sIjp7Im5hbWUiOiJzY3JlZW5fd2FsbGV0IiwidmVyc2lvbiI6IjEifSwidHJ1c3RfbW9kZSI6ImFnZW50LWFzc2VydGlvbiJ9fSx7ImlkIjoic2hhMjU2OkhKZ2hUX3hIS2FDNWJTXzVINnBYYjlTSFZSbXNhMXhlWG8ydXZwVFVGcWciLCJraW5kIjoicHJpbmNpcGFsIiwicGFyZW50cyI6W10sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsiZGlzcGxheV9uYW1lIjoiQ29uZm9ybWFuY2UgVHJlYXN1cnkiLCJwcmluY2lwYWxfaWQiOiJ1cm46b25jaGFpbmRpbGlnZW5jZTp0ZXN0OnRyZWFzdXJ5IiwicHJpbmNpcGFsX3R5cGUiOiJvcmdhbml6YXRpb24ifX0seyJpZCI6InNoYTI1NjpPMXpoSTFKcURjbWVLT2hTd1JaVDIwYTdpRUM3MWpsSDYtMFFXYlJfQzU0Iiwia2luZCI6ImFnZW50IiwicGFyZW50cyI6WyJzaGEyNTY6SEpnaFRfeEhLYUM1YlNfNUg2cFhiOVNIVlJtc2ExeGVYbzJ1dnBUVUZxZyJdLCJwcm9vZnMiOltdLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImFnZW50X2lkIjoidXJuOm9uY2hhaW5kaWxpZ2VuY2U6dGVzdDphZ2VudCIsImFnZW50X3ZlcnNpb24iOiIxLjAuMCIsIm9wZXJhdG9yX3JlZiI6InNoYTI1NjpISmdoVF94SEthQzViU181SDZwWGI5U0hWUm1zYTF4ZVhvMnV2cFRVRnFnIn19LHsiaWQiOiJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCIsImtpbmQiOiJydW4iLCJwYXJlbnRzIjpbInNoYTI1NjpPMXpoSTFKcURjbWVLT2hTd1JaVDIwYTdpRUM3MWpsSDYtMFFXYlJfQzU0Iiwic2hhMjU2Om12bUg5TWRpeTRDdlZSU2RXclIyUVFRejlPYWVnNDhpdlVMR2RxVjBxU3MiXSwicHJvb2ZzIjpbXSwicmVjb3JkX3ZlcnNpb24iOiJvbmNoYWluZGlsaWdlbmNlLmFnZW50LWV2aWRlbmNlLnJlY29yZC52MCIsInN0YXRlbWVudCI6eyJhZ2VudF9yZWYiOiJzaGEyNTY6TzF6aEkxSnFEY21lS09oU3dSWlQyMGE3aUVDNzFqbEg2LTBRV2JSX0M1NCIsImVuZGVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowNS4wMDBaIiwibWFuZGF0ZV9yZWYiOiJzaGEyNTY6bXZtSDlNZGl5NEN2VlJTZFdyUjJRUVF6OU9hZWc0OGl2VUxHZHFWMHFTcyIsInJ1bl9leHRlcm5hbF9pZCI6InJ1bi1jb25mb3JtYW5jZS0wMDEiLCJzdGFydGVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowMC4wMDBaIn19LHsiaWQiOiJzaGEyNTY6aXFZNm9VYjlXcFFKSFRjdjN0cUh1LThDdTI1bk52N0NBWFFaRGhfSG5aZyIsImtpbmQiOiJwb2xpY3kiLCJwYXJlbnRzIjpbInNoYTI1NjpoV05LbEs0WWlCUG9SVEpFOVNEZTRpZG5mNmxHUGF3UUlybG9qYWVpU2g0Il0sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsiZGlnZXN0Ijp7InNoYTI1NiI6IjRUSFYxU2ZOQVBNOUhUTHZfTl8wYWVJbXVhRmZtOXJOZUxQbThka1B1NHcifSwiZWZmZWN0aXZlX2Zyb20iOiIyMDI2LTA4LTI4VDAwOjAwOjAwLjAwMFoiLCJwb2xpY3kiOnsicnVsZSI6InNhbmN0aW9uZWQgbXVzdCBiZSBmYWxzZSJ9LCJwb2xpY3lfaWQiOiJ1cm46b25jaGFpbmRpbGlnZW5jZTp0ZXN0OnBvbGljeSIsInNvdXJjZSI6Imh0dHBzOi8vZXhhbXBsZS5pbnZhbGlkL3BvbGljeS8xIiwidmVyc2lvbiI6IjEifX0seyJpZCI6InNoYTI1Njptdm1IOU1kaXk0Q3ZWUlNkV3JSMlFRUXo5T2FlZzQ4aXZVTEdkcVYwcVNzIiwia2luZCI6Im1hbmRhdGUiLCJwYXJlbnRzIjpbInNoYTI1NjpISmdoVF94SEthQzViU181SDZwWGI5U0hWUm1zYTF4ZVhvMnV2cFRVRnFnIl0sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsibGltaXRzIjp7ImFtb3VudCI6IjEwLjAwIn0sIm1hbmRhdGVfaWQiOiJtYW5kYXRlLWNvbmZvcm1hbmNlLTAwMSIsInByaW5jaXBhbF9yZWYiOiJzaGEyNTY6SEpnaFRfeEhLYUM1YlNfNUg2cFhiOVNIVlJtc2ExeGVYbzJ1dnBUVUZxZyIsInNjb3BlIjp7ImFjdGlvbiI6InBheSIsImFzc2V0IjoicGF0aFVTRCIsIm1heF9hbW91bnQiOiIxMC4wMCJ9LCJ2YWxpZF9mcm9tIjoiMjAyNi0wOC0yOFQwMDowMDowMC4wMDBaIiwidmFsaWRfdW50aWwiOiIyMDI2LTA4LTI5VDAwOjAwOjAwLjAwMFoifX1dLCJyb290X2lkcyI6WyJzaGEyNTY6LXY1UzZCaDQ4V1U2akNjaHM4UWU5OGl2Zl9BX3BkRUlHdG1jeGZNOG94SSJdLCJydW5faWQiOiJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCJ9",
+    "signatures": [
+      {
+        "keyid": "ed25519-3rLe053Cb84OYIW2",
+        "sig": "U1yLRqrtQYTk1phwK6Q3uLZswXBU7kEs2YaLNDJl8Z0S9ywetcl1pbPJFcjwU8kuTFVmpO4p0XTNcSbRCSxqCQ=="
+      }
+    ]
+  },
+  "verification_material": {
+    "keys": [
+      {
+        "key_id": "ed25519-3rLe053Cb84OYIW2",
+        "algorithm": "ed25519",
+        "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAPUAXw+hDiVqStwqnTRt+vJyYLM8uxJaMwM1V8Sr0Zgw=\n-----END PUBLIC KEY-----\n",
+        "status": "active",
+        "valid_from": "2026-08-28T00:00:00.000Z",
+        "valid_until": null,
+        "status_changed_at": "2026-08-28T00:00:00.000Z",
+        "replacement_key_id": null,
+        "compromised_at": null
+      }
+    ],
+    "registry_snapshots": [],
+    "anchors": []
+  }
+}

package/conformance/noncanonical-payload.json

@@ -0,0 +1,31 @@
+{
+  "media_type": "application/vnd.onchaindiligence.agent-evidence+json",
+  "bundle_version": "onchaindiligence.agent-evidence.bundle.v0",
+  "envelope": {
+    "payloadType": "application/vnd.onchaindiligence.agent-evidence.bundle.v0+json",
+    "payload": "IHsiYnVuZGxlX2lkIjoic2hhMjU2OmV6cHlnMzNOUkFjU1pZa3pKZzMybF9HVEZQTVM3RjZwaDFSd1cxcWVzbW8iLCJidW5kbGVfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UuYnVuZGxlLnYwIiwiY3JlYXRlZF9hdCI6IjIwMjYtMDgtMjhUMTI6MDA6MDYuMDAwWiIsImV4dGVuc2lvbnMiOnt9LCJyZWNvcmRzIjpbeyJpZCI6InNoYTI1NjotdjVTNkJoNDhXVTZqQ2NoczhRZTk4aXZmX0FfcGRFSUd0bWN4Zk04b3hJIiwia2luZCI6ImV4ZWN1dGlvbiIsInBhcmVudHMiOlsic2hhMjU2OkZMeVlWZ3FjRk8yMTdCUFgyVDF1aXFKTE9nTWlNTjg3OWF2VDd2S0M4cmsiXSwicHJvb2ZzIjpbXSwicmVjb3JkX3ZlcnNpb24iOiJvbmNoYWluZGlsaWdlbmNlLmFnZW50LWV2aWRlbmNlLnJlY29yZC52MCIsInN0YXRlbWVudCI6eyJhbW91bnQiOiIxLjAwIiwiYXNzZXQiOiJwYXRoVVNEIiwiYmxvY2tfbnVtYmVyIjoiMTIzNDU2NzgiLCJjb25maXJtZWRfYXQiOiIyMDI2LTA4LTI4VDEyOjAwOjA1LjAwMFoiLCJkZWNpc2lvbl9yZWYiOiJzaGEyNTY6Rkx5WVZncWNGTzIxN0JQWDJUMXVpcUpMT2dNaU1OODc5YXZUN3ZLQzhyayIsImV4ZWN1dGlvbl9pZCI6ImV4ZWN1dGlvbi1jb25mb3JtYW5jZS0wMDEiLCJleGVjdXRpb25fdHlwZSI6Im9uY2hhaW4tdHJhbnNmZXIiLCJuZXR3b3JrIjoiZWlwMTU1OjEiLCJyZWNpcGllbnQiOiIweDIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJzZW5kZXIiOiIweDMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMiLCJzdGF0dXMiOiJjb25maXJtZWQiLCJzdWJtaXR0ZWRfYXQiOiIyMDI2LTA4LTI4VDEyOjAwOjA0LjAwMFoiLCJ0cmFuc2FjdGlvbl9kaWdlc3QiOnsic2hhMjU2IjoiU2tMQmRQZ0lSa21RdG5KMGd1LU42MjhTd2tsSlJFSFF1ZXQ4TEFzZFBkTSJ9LCJ0cmFuc2FjdGlvbl9oYXNoIjoiMHgxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExIn19LHsiaWQiOiJzaGEyNTY6Rkx5WVZncWNGTzIxN0JQWDJUMXVpcUpMT2dNaU1OODc5YXZUN3ZLQzhyayIsImtpbmQiOiJkZWNpc2lvbiIsInBhcmVudHMiOlsic2hhMjU2OkcxZ3hQbnFTcUxCTEFxaHR6V1ppZWxBejk1R0FvSnhkSDYydUNpeWdrdWciLCJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCIsInNoYTI1NjppcVk2b1ViOVdwUUpIVGN2M3RxSHUtOEN1MjVuTnY3Q0FYUVpEaF9IblpnIl0sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsiYWdlbnRfcmVmIjoic2hhMjU2Ok8xemhJMUpxRGNtZUtPaFN3UlpUMjBhN2lFQzcxamxINi0wUVdiUl9DNTQiLCJkZWNpZGVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowMy4wMDBaIiwiZGVjaXNpb25faWQiOiJkZWNpc2lvbi1jb25mb3JtYW5jZS0wMDEiLCJkZWNpc2lvbl90eXBlIjoicGF5bWVudC1hcHByb3ZhbCIsImV2aWRlbmNlX3JlZnMiOlsic2hhMjU2OkcxZ3hQbnFTcUxCTEFxaHR6V1ppZWxBejk1R0FvSnhkSDYydUNpeWdrdWciXSwib3V0Y29tZSI6eyJhcHByb3ZlZCI6dHJ1ZX0sInBvbGljeV9kaWdlc3QiOnsic2hhMjU2IjoiNFRIVjFTZk5BUE05SFRMdl9OXzBhZUltdWFGZm05ck5lTFBtOGRrUHU0dyJ9LCJwb2xpY3lfcmVmIjoic2hhMjU2OmlxWTZvVWI5V3BRSkhUY3YzdHFIdS04Q3UyNW5OdjdDQVhRWkRoX0huWmciLCJydW5fcmVmIjoic2hhMjU2OmhXTktsSzRZaUJQb1JUSkU5U0RlNGlkbmY2bEdQYXdRSXJsb2phZWlTaDQifX0seyJpZCI6InNoYTI1NjpHMWd4UG5xU3FMQkxBcWh0eldaaWVsQXo5NUdBb0p4ZEg2MnVDaXlna3VnIiwia2luZCI6ImV2aWRlbmNlIiwicGFyZW50cyI6WyJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCJdLCJwcm9vZnMiOlt7ImRpZ2VzdCI6eyJzaGEyNTYiOiJaTkZNbWl1eFRNM2FORnBWai1jbTIzQkdFdmdERGZ6Z2dFVGNPdmd3Y1c4In0sIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIiwicHJvb2ZfdHlwZSI6ImV4dGVybmFsLWRpZ2VzdCJ9XSwicmVjb3JkX3ZlcnNpb24iOiJvbmNoYWluZGlsaWdlbmNlLmFnZW50LWV2aWRlbmNlLnJlY29yZC52MCIsInN0YXRlbWVudCI6eyJldmlkZW5jZV90eXBlIjoic2FuY3Rpb25zLXNjcmVlbiIsImV4cGlyZXNfYXQiOm51bGwsIm9ic2VydmVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowMS4wMDBaIiwicmVxdWVzdCI6eyJkaWdlc3QiOnsic2hhMjU2IjoicHpfeVI1NksySHZhNjlLa2dSNFYxdE9GeW15WWw3QWhIMGJiVTFheVp1TSJ9LCJtZWRpYV90eXBlIjoiYXBwbGljYXRpb24vanNvbiJ9LCJyZXNwb25zZSI6eyJkaWdlc3QiOnsic2hhMjU2IjoiWk5GTW1pdXhUTTNhTkZwVmotY20yM0JHRXZnRERmemdnRVRjT3Znd2NXOCJ9LCJtZWRpYV90eXBlIjoiYXBwbGljYXRpb24vanNvbiIsIm1vZGUiOiJlbWJlZGRlZCIsInZhbHVlIjp7InNhbmN0aW9uZWQiOmZhbHNlfX0sInJ1bl9yZWYiOiJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCIsInNjb3BlIjp7ImNvdmVyYWdlIjoib25lIHRlc3QgYWRkcmVzcyIsInF1ZXJ5IjoiMHgwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAxIn0sInNvdXJjZSI6eyJpZCI6Imh0dHBzOi8vYXBpLmV4YW1wbGUuaW52YWxpZCIsInR5cGUiOiJodHRwcy1hcGkifSwidG9vbCI6eyJuYW1lIjoic2NyZWVuX3dhbGxldCIsInZlcnNpb24iOiIxIn0sInRydXN0X21vZGUiOiJhZ2VudC1hc3NlcnRpb24ifX0seyJpZCI6InNoYTI1NjpISmdoVF94SEthQzViU181SDZwWGI5U0hWUm1zYTF4ZVhvMnV2cFRVRnFnIiwia2luZCI6InByaW5jaXBhbCIsInBhcmVudHMiOltdLCJwcm9vZnMiOltdLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImRpc3BsYXlfbmFtZSI6IkNvbmZvcm1hbmNlIFRyZWFzdXJ5IiwicHJpbmNpcGFsX2lkIjoidXJuOm9uY2hhaW5kaWxpZ2VuY2U6dGVzdDp0cmVhc3VyeSIsInByaW5jaXBhbF90eXBlIjoib3JnYW5pemF0aW9uIn19LHsiaWQiOiJzaGEyNTY6TzF6aEkxSnFEY21lS09oU3dSWlQyMGE3aUVDNzFqbEg2LTBRV2JSX0M1NCIsImtpbmQiOiJhZ2VudCIsInBhcmVudHMiOlsic2hhMjU2OkhKZ2hUX3hIS2FDNWJTXzVINnBYYjlTSFZSbXNhMXhlWG8ydXZwVFVGcWciXSwicHJvb2ZzIjpbXSwicmVjb3JkX3ZlcnNpb24iOiJvbmNoYWluZGlsaWdlbmNlLmFnZW50LWV2aWRlbmNlLnJlY29yZC52MCIsInN0YXRlbWVudCI6eyJhZ2VudF9pZCI6InVybjpvbmNoYWluZGlsaWdlbmNlOnRlc3Q6YWdlbnQiLCJhZ2VudF92ZXJzaW9uIjoiMS4wLjAiLCJvcGVyYXRvcl9yZWYiOiJzaGEyNTY6SEpnaFRfeEhLYUM1YlNfNUg2cFhiOVNIVlJtc2ExeGVYbzJ1dnBUVUZxZyJ9fSx7ImlkIjoic2hhMjU2OmhXTktsSzRZaUJQb1JUSkU5U0RlNGlkbmY2bEdQYXdRSXJsb2phZWlTaDQiLCJraW5kIjoicnVuIiwicGFyZW50cyI6WyJzaGEyNTY6TzF6aEkxSnFEY21lS09oU3dSWlQyMGE3aUVDNzFqbEg2LTBRV2JSX0M1NCIsInNoYTI1Njptdm1IOU1kaXk0Q3ZWUlNkV3JSMlFRUXo5T2FlZzQ4aXZVTEdkcVYwcVNzIl0sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsiYWdlbnRfcmVmIjoic2hhMjU2Ok8xemhJMUpxRGNtZUtPaFN3UlpUMjBhN2lFQzcxamxINi0wUVdiUl9DNTQiLCJlbmRlZF9hdCI6IjIwMjYtMDgtMjhUMTI6MDA6MDUuMDAwWiIsIm1hbmRhdGVfcmVmIjoic2hhMjU2Om12bUg5TWRpeTRDdlZSU2RXclIyUVFRejlPYWVnNDhpdlVMR2RxVjBxU3MiLCJydW5fZXh0ZXJuYWxfaWQiOiJydW4tY29uZm9ybWFuY2UtMDAxIiwic3RhcnRlZF9hdCI6IjIwMjYtMDgtMjhUMTI6MDA6MDAuMDAwWiJ9fSx7ImlkIjoic2hhMjU2OmlxWTZvVWI5V3BRSkhUY3YzdHFIdS04Q3UyNW5OdjdDQVhRWkRoX0huWmciLCJraW5kIjoicG9saWN5IiwicGFyZW50cyI6WyJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCJdLCJwcm9vZnMiOltdLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImRpZ2VzdCI6eyJzaGEyNTYiOiI0VEhWMVNmTkFQTTlIVEx2X05fMGFlSW11YUZmbTlyTmVMUG04ZGtQdTR3In0sImVmZmVjdGl2ZV9mcm9tIjoiMjAyNi0wOC0yOFQwMDowMDowMC4wMDBaIiwicG9saWN5Ijp7InJ1bGUiOiJzYW5jdGlvbmVkIG11c3QgYmUgZmFsc2UifSwicG9saWN5X2lkIjoidXJuOm9uY2hhaW5kaWxpZ2VuY2U6dGVzdDpwb2xpY3kiLCJzb3VyY2UiOiJodHRwczovL2V4YW1wbGUuaW52YWxpZC9wb2xpY3kvMSIsInZlcnNpb24iOiIxIn19LHsiaWQiOiJzaGEyNTY6bXZtSDlNZGl5NEN2VlJTZFdyUjJRUVF6OU9hZWc0OGl2VUxHZHFWMHFTcyIsImtpbmQiOiJtYW5kYXRlIiwicGFyZW50cyI6WyJzaGEyNTY6SEpnaFRfeEhLYUM1YlNfNUg2cFhiOVNIVlJtc2ExeGVYbzJ1dnBUVUZxZyJdLCJwcm9vZnMiOltdLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImxpbWl0cyI6eyJhbW91bnQiOiIxMC4wMCJ9LCJtYW5kYXRlX2lkIjoibWFuZGF0ZS1jb25mb3JtYW5jZS0wMDEiLCJwcmluY2lwYWxfcmVmIjoic2hhMjU2OkhKZ2hUX3hIS2FDNWJTXzVINnBYYjlTSFZSbXNhMXhlWG8ydXZwVFVGcWciLCJzY29wZSI6eyJhY3Rpb24iOiJwYXkiLCJhc3NldCI6InBhdGhVU0QiLCJtYXhfYW1vdW50IjoiMTAuMDAifSwidmFsaWRfZnJvbSI6IjIwMjYtMDgtMjhUMDA6MDA6MDAuMDAwWiIsInZhbGlkX3VudGlsIjoiMjAyNi0wOC0yOVQwMDowMDowMC4wMDBaIn19XSwicm9vdF9pZHMiOlsic2hhMjU2Oi12NVM2Qmg0OFdVNmpDY2hzOFFlOThpdmZfQV9wZEVJR3RtY3hmTThveEkiXSwicnVuX2lkIjoic2hhMjU2OmhXTktsSzRZaUJQb1JUSkU5U0RlNGlkbmY2bEdQYXdRSXJsb2phZWlTaDQifQ==",
+    "signatures": [
+      {
+        "keyid": "ed25519-3rLe053Cb84OYIW2",
+        "sig": "bliqXg9CCHAalaxCW8tNf79uZX1UDQlozGFA2EPTfFIkTe+w2qv5GS4LpZ62Q7+/ecwXhbyMwnWh3gY2n0L2BQ=="
+      }
+    ]
+  },
+  "verification_material": {
+    "keys": [
+      {
+        "key_id": "ed25519-3rLe053Cb84OYIW2",
+        "algorithm": "ed25519",
+        "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAPUAXw+hDiVqStwqnTRt+vJyYLM8uxJaMwM1V8Sr0Zgw=\n-----END PUBLIC KEY-----\n",
+        "status": "active",
+        "valid_from": "2026-08-28T00:00:00.000Z",
+        "valid_until": null,
+        "status_changed_at": "2026-08-28T00:00:00.000Z",
+        "replacement_key_id": null,
+        "compromised_at": null
+      }
+    ],
+    "registry_snapshots": [],
+    "anchors": []
+  }
+}

package/conformance/rfc8785-vectors.json

@@ -0,0 +1,31 @@
+{
+  "corpus_version": 1,
+  "source": "RFC 8785 sections 3.2.2 and 3.2.3, plus OnChainDiligence parser policy",
+  "canonicalization": [
+    {
+      "id": "recursive-order-arrays-empty-negative-zero",
+      "input": { "z": [], "n": -0, "a": { "y": true, "x": ["b", "a"], "empty": {} } },
+      "expected": "{\"a\":{\"empty\":{},\"x\":[\"b\",\"a\"],\"y\":true},\"n\":0,\"z\":[]}"
+    },
+    {
+      "id": "rfc8785-unicode-property-order",
+      "input": { "€": "Euro Sign", "\r": "Carriage Return", "דּ": "Hebrew Letter Dalet With Dagesh", "1": "One", "😀": "Emoji: Grinning Face", "€": "Control", "ö": "Latin Small Letter O With Diaeresis" },
+      "expected": "{\"\\r\":\"Carriage Return\",\"1\":\"One\",\"€\":\"Control\",\"ö\":\"Latin Small Letter O With Diaeresis\",\"€\":\"Euro Sign\",\"😀\":\"Emoji: Grinning Face\",\"דּ\":\"Hebrew Letter Dalet With Dagesh\"}"
+    },
+    {
+      "id": "rfc8785-numbers-and-escapes",
+      "input": { "numbers": [333333333.3333333, 1e30, 4.5, 0.002, 1e-27], "text": "line\n\"\\" },
+      "expected": "{\"numbers\":[333333333.3333333,1e+30,4.5,0.002,1e-27],\"text\":\"line\\n\\\"\\\\\"}"
+    },
+    {
+      "id": "boundary-safe-integers",
+      "input": [-9007199254740991, 9007199254740991],
+      "expected": "[-9007199254740991,9007199254740991]"
+    }
+  ],
+  "invalid_json": [
+    { "id": "duplicate-key", "input": "{\"data\":1,\"data\":2}", "error_code": "duplicate_key" },
+    { "id": "unsafe-positive-integer", "input": "{\"n\":9007199254740992}", "error_code": "unsafe_integer" },
+    { "id": "unsafe-negative-integer", "input": "{\"n\":-9007199254740992}", "error_code": "unsafe_integer" }
+  ]
+}

package/conformance/valid-full-graph.json

@@ -0,0 +1,31 @@
+{
+  "media_type": "application/vnd.onchaindiligence.agent-evidence+json",
+  "bundle_version": "onchaindiligence.agent-evidence.bundle.v0",
+  "envelope": {
+    "payloadType": "application/vnd.onchaindiligence.agent-evidence.bundle.v0+json",
+    "payload": "eyJidW5kbGVfaWQiOiJzaGEyNTY6ZXpweWczM05SQWNTWllrekpnMzJsX0dURlBNUzdGNnBoMVJ3VzFxZXNtbyIsImJ1bmRsZV92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5idW5kbGUudjAiLCJjcmVhdGVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowNi4wMDBaIiwiZXh0ZW5zaW9ucyI6e30sInJlY29yZHMiOlt7ImlkIjoic2hhMjU2Oi12NVM2Qmg0OFdVNmpDY2hzOFFlOThpdmZfQV9wZEVJR3RtY3hmTThveEkiLCJraW5kIjoiZXhlY3V0aW9uIiwicGFyZW50cyI6WyJzaGEyNTY6Rkx5WVZncWNGTzIxN0JQWDJUMXVpcUpMT2dNaU1OODc5YXZUN3ZLQzhyayJdLCJwcm9vZnMiOltdLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImFtb3VudCI6IjEuMDAiLCJhc3NldCI6InBhdGhVU0QiLCJibG9ja19udW1iZXIiOiIxMjM0NTY3OCIsImNvbmZpcm1lZF9hdCI6IjIwMjYtMDgtMjhUMTI6MDA6MDUuMDAwWiIsImRlY2lzaW9uX3JlZiI6InNoYTI1NjpGTHlZVmdxY0ZPMjE3QlBYMlQxdWlxSkxPZ01pTU44NzlhdlQ3dktDOHJrIiwiZXhlY3V0aW9uX2lkIjoiZXhlY3V0aW9uLWNvbmZvcm1hbmNlLTAwMSIsImV4ZWN1dGlvbl90eXBlIjoib25jaGFpbi10cmFuc2ZlciIsIm5ldHdvcmsiOiJlaXAxNTU6MSIsInJlY2lwaWVudCI6IjB4MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMiIsInNlbmRlciI6IjB4MzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMyIsInN0YXR1cyI6ImNvbmZpcm1lZCIsInN1Ym1pdHRlZF9hdCI6IjIwMjYtMDgtMjhUMTI6MDA6MDQuMDAwWiIsInRyYW5zYWN0aW9uX2RpZ2VzdCI6eyJzaGEyNTYiOiJTa0xCZFBnSVJrbVF0bkowZ3UtTjYyOFN3a2xKUkVIUXVldDhMQXNkUGRNIn0sInRyYW5zYWN0aW9uX2hhc2giOiIweDExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEifX0seyJpZCI6InNoYTI1NjpGTHlZVmdxY0ZPMjE3QlBYMlQxdWlxSkxPZ01pTU44NzlhdlQ3dktDOHJrIiwia2luZCI6ImRlY2lzaW9uIiwicGFyZW50cyI6WyJzaGEyNTY6RzFneFBucVNxTEJMQXFodHpXWmllbEF6OTVHQW9KeGRINjJ1Q2l5Z2t1ZyIsInNoYTI1NjpoV05LbEs0WWlCUG9SVEpFOVNEZTRpZG5mNmxHUGF3UUlybG9qYWVpU2g0Iiwic2hhMjU2OmlxWTZvVWI5V3BRSkhUY3YzdHFIdS04Q3UyNW5OdjdDQVhRWkRoX0huWmciXSwicHJvb2ZzIjpbXSwicmVjb3JkX3ZlcnNpb24iOiJvbmNoYWluZGlsaWdlbmNlLmFnZW50LWV2aWRlbmNlLnJlY29yZC52MCIsInN0YXRlbWVudCI6eyJhZ2VudF9yZWYiOiJzaGEyNTY6TzF6aEkxSnFEY21lS09oU3dSWlQyMGE3aUVDNzFqbEg2LTBRV2JSX0M1NCIsImRlY2lkZWRfYXQiOiIyMDI2LTA4LTI4VDEyOjAwOjAzLjAwMFoiLCJkZWNpc2lvbl9pZCI6ImRlY2lzaW9uLWNvbmZvcm1hbmNlLTAwMSIsImRlY2lzaW9uX3R5cGUiOiJwYXltZW50LWFwcHJvdmFsIiwiZXZpZGVuY2VfcmVmcyI6WyJzaGEyNTY6RzFneFBucVNxTEJMQXFodHpXWmllbEF6OTVHQW9KeGRINjJ1Q2l5Z2t1ZyJdLCJvdXRjb21lIjp7ImFwcHJvdmVkIjp0cnVlfSwicG9saWN5X2RpZ2VzdCI6eyJzaGEyNTYiOiI0VEhWMVNmTkFQTTlIVEx2X05fMGFlSW11YUZmbTlyTmVMUG04ZGtQdTR3In0sInBvbGljeV9yZWYiOiJzaGEyNTY6aXFZNm9VYjlXcFFKSFRjdjN0cUh1LThDdTI1bk52N0NBWFFaRGhfSG5aZyIsInJ1bl9yZWYiOiJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCJ9fSx7ImlkIjoic2hhMjU2OkcxZ3hQbnFTcUxCTEFxaHR6V1ppZWxBejk1R0FvSnhkSDYydUNpeWdrdWciLCJraW5kIjoiZXZpZGVuY2UiLCJwYXJlbnRzIjpbInNoYTI1NjpoV05LbEs0WWlCUG9SVEpFOVNEZTRpZG5mNmxHUGF3UUlybG9qYWVpU2g0Il0sInByb29mcyI6W3siZGlnZXN0Ijp7InNoYTI1NiI6IlpORk1taXV4VE0zYU5GcFZqLWNtMjNCR0V2Z0REZnpnZ0VUY092Z3djVzgifSwibWVkaWFfdHlwZSI6ImFwcGxpY2F0aW9uL2pzb24iLCJwcm9vZl90eXBlIjoiZXh0ZXJuYWwtZGlnZXN0In1dLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImV2aWRlbmNlX3R5cGUiOiJzYW5jdGlvbnMtc2NyZWVuIiwiZXhwaXJlc19hdCI6bnVsbCwib2JzZXJ2ZWRfYXQiOiIyMDI2LTA4LTI4VDEyOjAwOjAxLjAwMFoiLCJyZXF1ZXN0Ijp7ImRpZ2VzdCI6eyJzaGEyNTYiOiJwel95UjU2SzJIdmE2OUtrZ1I0VjF0T0Z5bXlZbDdBaEgwYmJVMWF5WnVNIn0sIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIn0sInJlc3BvbnNlIjp7ImRpZ2VzdCI6eyJzaGEyNTYiOiJaTkZNbWl1eFRNM2FORnBWai1jbTIzQkdFdmdERGZ6Z2dFVGNPdmd3Y1c4In0sIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIiwibW9kZSI6ImVtYmVkZGVkIiwidmFsdWUiOnsic2FuY3Rpb25lZCI6ZmFsc2V9fSwicnVuX3JlZiI6InNoYTI1NjpoV05LbEs0WWlCUG9SVEpFOVNEZTRpZG5mNmxHUGF3UUlybG9qYWVpU2g0Iiwic2NvcGUiOnsiY292ZXJhZ2UiOiJvbmUgdGVzdCBhZGRyZXNzIiwicXVlcnkiOiIweDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDEifSwic291cmNlIjp7ImlkIjoiaHR0cHM6Ly9hcGkuZXhhbXBsZS5pbnZhbGlkIiwidHlwZSI6Imh0dHBzLWFwaSJ9LCJ0b29sIjp7Im5hbWUiOiJzY3JlZW5fd2FsbGV0IiwidmVyc2lvbiI6IjEifSwidHJ1c3RfbW9kZSI6ImFnZW50LWFzc2VydGlvbiJ9fSx7ImlkIjoic2hhMjU2OkhKZ2hUX3hIS2FDNWJTXzVINnBYYjlTSFZSbXNhMXhlWG8ydXZwVFVGcWciLCJraW5kIjoicHJpbmNpcGFsIiwicGFyZW50cyI6W10sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsiZGlzcGxheV9uYW1lIjoiQ29uZm9ybWFuY2UgVHJlYXN1cnkiLCJwcmluY2lwYWxfaWQiOiJ1cm46b25jaGFpbmRpbGlnZW5jZTp0ZXN0OnRyZWFzdXJ5IiwicHJpbmNpcGFsX3R5cGUiOiJvcmdhbml6YXRpb24ifX0seyJpZCI6InNoYTI1NjpPMXpoSTFKcURjbWVLT2hTd1JaVDIwYTdpRUM3MWpsSDYtMFFXYlJfQzU0Iiwia2luZCI6ImFnZW50IiwicGFyZW50cyI6WyJzaGEyNTY6SEpnaFRfeEhLYUM1YlNfNUg2cFhiOVNIVlJtc2ExeGVYbzJ1dnBUVUZxZyJdLCJwcm9vZnMiOltdLCJyZWNvcmRfdmVyc2lvbiI6Im9uY2hhaW5kaWxpZ2VuY2UuYWdlbnQtZXZpZGVuY2UucmVjb3JkLnYwIiwic3RhdGVtZW50Ijp7ImFnZW50X2lkIjoidXJuOm9uY2hhaW5kaWxpZ2VuY2U6dGVzdDphZ2VudCIsImFnZW50X3ZlcnNpb24iOiIxLjAuMCIsIm9wZXJhdG9yX3JlZiI6InNoYTI1NjpISmdoVF94SEthQzViU181SDZwWGI5U0hWUm1zYTF4ZVhvMnV2cFRVRnFnIn19LHsiaWQiOiJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCIsImtpbmQiOiJydW4iLCJwYXJlbnRzIjpbInNoYTI1NjpPMXpoSTFKcURjbWVLT2hTd1JaVDIwYTdpRUM3MWpsSDYtMFFXYlJfQzU0Iiwic2hhMjU2Om12bUg5TWRpeTRDdlZSU2RXclIyUVFRejlPYWVnNDhpdlVMR2RxVjBxU3MiXSwicHJvb2ZzIjpbXSwicmVjb3JkX3ZlcnNpb24iOiJvbmNoYWluZGlsaWdlbmNlLmFnZW50LWV2aWRlbmNlLnJlY29yZC52MCIsInN0YXRlbWVudCI6eyJhZ2VudF9yZWYiOiJzaGEyNTY6TzF6aEkxSnFEY21lS09oU3dSWlQyMGE3aUVDNzFqbEg2LTBRV2JSX0M1NCIsImVuZGVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowNS4wMDBaIiwibWFuZGF0ZV9yZWYiOiJzaGEyNTY6bXZtSDlNZGl5NEN2VlJTZFdyUjJRUVF6OU9hZWc0OGl2VUxHZHFWMHFTcyIsInJ1bl9leHRlcm5hbF9pZCI6InJ1bi1jb25mb3JtYW5jZS0wMDEiLCJzdGFydGVkX2F0IjoiMjAyNi0wOC0yOFQxMjowMDowMC4wMDBaIn19LHsiaWQiOiJzaGEyNTY6aXFZNm9VYjlXcFFKSFRjdjN0cUh1LThDdTI1bk52N0NBWFFaRGhfSG5aZyIsImtpbmQiOiJwb2xpY3kiLCJwYXJlbnRzIjpbInNoYTI1NjpoV05LbEs0WWlCUG9SVEpFOVNEZTRpZG5mNmxHUGF3UUlybG9qYWVpU2g0Il0sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsiZGlnZXN0Ijp7InNoYTI1NiI6IjRUSFYxU2ZOQVBNOUhUTHZfTl8wYWVJbXVhRmZtOXJOZUxQbThka1B1NHcifSwiZWZmZWN0aXZlX2Zyb20iOiIyMDI2LTA4LTI4VDAwOjAwOjAwLjAwMFoiLCJwb2xpY3kiOnsicnVsZSI6InNhbmN0aW9uZWQgbXVzdCBiZSBmYWxzZSJ9LCJwb2xpY3lfaWQiOiJ1cm46b25jaGFpbmRpbGlnZW5jZTp0ZXN0OnBvbGljeSIsInNvdXJjZSI6Imh0dHBzOi8vZXhhbXBsZS5pbnZhbGlkL3BvbGljeS8xIiwidmVyc2lvbiI6IjEifX0seyJpZCI6InNoYTI1Njptdm1IOU1kaXk0Q3ZWUlNkV3JSMlFRUXo5T2FlZzQ4aXZVTEdkcVYwcVNzIiwia2luZCI6Im1hbmRhdGUiLCJwYXJlbnRzIjpbInNoYTI1NjpISmdoVF94SEthQzViU181SDZwWGI5U0hWUm1zYTF4ZVhvMnV2cFRVRnFnIl0sInByb29mcyI6W10sInJlY29yZF92ZXJzaW9uIjoib25jaGFpbmRpbGlnZW5jZS5hZ2VudC1ldmlkZW5jZS5yZWNvcmQudjAiLCJzdGF0ZW1lbnQiOnsibGltaXRzIjp7ImFtb3VudCI6IjEwLjAwIn0sIm1hbmRhdGVfaWQiOiJtYW5kYXRlLWNvbmZvcm1hbmNlLTAwMSIsInByaW5jaXBhbF9yZWYiOiJzaGEyNTY6SEpnaFRfeEhLYUM1YlNfNUg2cFhiOVNIVlJtc2ExeGVYbzJ1dnBUVUZxZyIsInNjb3BlIjp7ImFjdGlvbiI6InBheSIsImFzc2V0IjoicGF0aFVTRCIsIm1heF9hbW91bnQiOiIxMC4wMCJ9LCJ2YWxpZF9mcm9tIjoiMjAyNi0wOC0yOFQwMDowMDowMC4wMDBaIiwidmFsaWRfdW50aWwiOiIyMDI2LTA4LTI5VDAwOjAwOjAwLjAwMFoifX1dLCJyb290X2lkcyI6WyJzaGEyNTY6LXY1UzZCaDQ4V1U2akNjaHM4UWU5OGl2Zl9BX3BkRUlHdG1jeGZNOG94SSJdLCJydW5faWQiOiJzaGEyNTY6aFdOS2xLNFlpQlBvUlRKRTlTRGU0aWRuZjZsR1Bhd1FJcmxvamFlaVNoNCJ9",
+    "signatures": [
+      {
+        "keyid": "ed25519-3rLe053Cb84OYIW2",
+        "sig": "c5QSw7HTSuaPKkYzc/FXL/9lplP5ZEceSesmhQioOqtYXRwdf6jVrnuHZ06+AnfxaFybj/s6oNz5AnZTYF/wBQ=="
+      }
+    ]
+  },
+  "verification_material": {
+    "keys": [
+      {
+        "key_id": "ed25519-3rLe053Cb84OYIW2",
+        "algorithm": "ed25519",
+        "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAPUAXw+hDiVqStwqnTRt+vJyYLM8uxJaMwM1V8Sr0Zgw=\n-----END PUBLIC KEY-----\n",
+        "status": "active",
+        "valid_from": "2026-08-28T00:00:00.000Z",
+        "valid_until": null,
+        "status_changed_at": "2026-08-28T00:00:00.000Z",
+        "replacement_key_id": null,
+        "compromised_at": null
+      }
+    ],
+    "registry_snapshots": [],
+    "anchors": []
+  }
+}

package/dist/canonical.d.ts

@@ -0,0 +1,14 @@
+import type { JsonValue } from './types.js';
+export declare function canonicalize(value: unknown): Uint8Array;
+export declare function canonicalizeText(value: unknown): string;
+export declare function contentId(value: unknown): string;
+export declare function formatTimestamp(value: Date): string;
+export declare function parseTimestamp(value: string): Date;
+export declare function cloneJson<T extends JsonValue>(value: T): T;
+export declare function enforceLimits(value: unknown, limits: {
+    maxDepth: number;
+    maxStringLength: number;
+    maxArrayLength: number;
+}): void;
+export declare function parseJson(data: string | Uint8Array): JsonValue;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAwD3C,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEvD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEvD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,IAAI,GAAG,MAAM,CAGnD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAOlD;AAED,wBAAgB,SAAS,CAAC,CAAC,SAAS,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAE1D;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC5E,IAAI,CAmCN;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAQ9D"}