@onchaindiligence/agent-evidence 0.1.0

package/dist/graph.js

@@ -0,0 +1,227 @@
+import { contentId, parseTimestamp } from './canonical.js';
+import { EvidenceValidationError, ParseError, SchemaValidationError } from './errors.js';
+import { validateDocument } from './schema.js';
+function fail(message) {
+    throw new EvidenceValidationError(message);
+}
+function requireRecord(byId, recordId, kind, field) {
+    if (typeof recordId !== 'string' || !byId.has(recordId))
+        fail(`${field} does not resolve in this bundle`);
+    const record = byId.get(recordId);
+    if (!record || record.kind !== kind)
+        fail(`${field} must resolve to a ${kind} record`);
+    return record;
+}
+function assertInterval(start, end, label) {
+    if (typeof start !== 'string' || typeof end !== 'string')
+        return;
+    try {
+        if (parseTimestamp(end).getTime() < parseTimestamp(start).getTime())
+            fail(`${label} end precedes start`);
+    }
+    catch (error) {
+        if (error instanceof EvidenceValidationError)
+            throw error;
+        if (error instanceof ParseError)
+            fail(`${label} contains an invalid timestamp: ${error.message}`);
+        throw error;
+    }
+}
+function digestValue(value) {
+    return contentId(value).slice('sha256:'.length);
+}
+function validateEmbeddedDigests(record) {
+    const statement = record.statement;
+    if (record.kind === 'evidence') {
+        const response = statement.response;
+        if (response.mode === 'embedded') {
+            const digest = response.digest;
+            if (digest.sha256 !== digestValue(response.value))
+                fail('embedded evidence response digest does not match value');
+        }
+    }
+    if (record.kind === 'policy' && Object.hasOwn(statement, 'policy')) {
+        const digest = statement.digest;
+        if (digest.sha256 !== digestValue(statement.policy))
+            fail('embedded policy digest does not match policy value');
+    }
+}
+function values(record, field) {
+    const value = record.statement[field];
+    return Array.isArray(value) ? value : [];
+}
+export function validateBundlePayload(input) {
+    const payload = input;
+    try {
+        validateDocument('bundle-payload.schema.json', payload);
+    }
+    catch (error) {
+        if (error instanceof SchemaValidationError)
+            throw new EvidenceValidationError(error.message, { cause: error });
+        throw error;
+    }
+    const records = payload.records;
+    const ids = records.map((record) => record.id);
+    if (ids.join('\u0000') !== [...ids].sort().join('\u0000'))
+        fail('records must be sorted lexicographically by id');
+    if (new Set(ids).size !== ids.length)
+        fail('record ids must be unique');
+    const byId = new Map(records.map((record) => [record.id, record]));
+    for (const record of records) {
+        const { id, ...body } = record;
+        if (contentId(body) !== id)
+            fail(`record id mismatch: ${id}`);
+        const sortedParents = [...new Set(record.parents)].sort();
+        if (record.parents.join('\u0000') !== sortedParents.join('\u0000')) {
+            fail(`parents must be sorted and unique: ${id}`);
+        }
+        for (const parent of record.parents) {
+            if (parent === id)
+                fail(`record cannot parent itself: ${id}`);
+            if (!byId.has(parent))
+                fail(`missing parent ${parent} referenced by ${id}`);
+        }
+        validateEmbeddedDigests(record);
+    }
+    const runs = records.filter((record) => record.kind === 'run');
+    if (runs.length !== 1)
+        fail('a v0 bundle must contain exactly one run record');
+    if (payload.run_id !== runs[0]?.id)
+        fail("run_id must resolve to the bundle's single run record");
+    const parentIds = new Set(records.flatMap((record) => record.parents));
+    const expectedRoots = ids.filter((id) => !parentIds.has(id)).sort();
+    if (payload.root_ids.join('\u0000') !== expectedRoots.join('\u0000')) {
+        fail('root_ids must equal the complete sorted set of records with no children');
+    }
+    const visiting = new Set();
+    const visited = new Set();
+    const visit = (recordId) => {
+        if (visiting.has(recordId))
+            fail(`cycle detected at ${recordId}`);
+        if (visited.has(recordId))
+            return;
+        visiting.add(recordId);
+        for (const parent of byId.get(recordId)?.parents ?? [])
+            visit(parent);
+        visiting.delete(recordId);
+        visited.add(recordId);
+    };
+    for (const root of expectedRoots)
+        visit(root);
+    if (visited.size !== ids.length)
+        fail('every record must be reachable from the complete root set');
+    for (const record of records) {
+        const statement = record.statement;
+        const parents = record.parents;
+        if (record.kind === 'principal') {
+            if (parents.length)
+                fail('principal records cannot have parents');
+        }
+        else if (record.kind === 'agent') {
+            const operator = statement.operator_ref;
+            if (operator !== undefined) {
+                requireRecord(byId, operator, 'principal', 'agent.operator_ref');
+                if (!parents.includes(String(operator)))
+                    fail('agent parents must include operator_ref');
+            }
+            if (parents.some((parent) => byId.get(parent)?.kind !== 'principal')) {
+                fail('agent parents may only be principal records');
+            }
+        }
+        else if (record.kind === 'mandate') {
+            const principal = String(statement.principal_ref);
+            requireRecord(byId, principal, 'principal', 'mandate.principal_ref');
+            if (!parents.includes(principal))
+                fail('mandate parents must include principal_ref');
+            if (parents.some((parent) => byId.get(parent)?.kind !== 'principal')) {
+                fail('mandate parents may only be principal records');
+            }
+            assertInterval(statement.valid_from, statement.valid_until, 'mandate');
+        }
+        else if (record.kind === 'run') {
+            const agent = String(statement.agent_ref);
+            const mandate = String(statement.mandate_ref);
+            requireRecord(byId, agent, 'agent', 'run.agent_ref');
+            const mandateRecord = requireRecord(byId, mandate, 'mandate', 'run.mandate_ref');
+            if (parents.join('\u0000') !== [agent, mandate].sort().join('\u0000')) {
+                fail('run parents must be exactly agent_ref and mandate_ref');
+            }
+            if (statement.ended_at !== undefined)
+                assertInterval(statement.started_at, statement.ended_at, 'run');
+            const started = parseTimestamp(String(statement.started_at)).getTime();
+            const mandateStatement = mandateRecord.statement;
+            if (started < parseTimestamp(String(mandateStatement.valid_from)).getTime()
+                || started > parseTimestamp(String(mandateStatement.valid_until)).getTime())
+                fail('run.started_at is outside the presented mandate interval');
+        }
+        else if (record.kind === 'evidence') {
+            const runRef = String(statement.run_ref);
+            requireRecord(byId, runRef, 'run', 'evidence.run_ref');
+            if (!parents.includes(runRef))
+                fail('evidence parents must include run_ref');
+            if (parents.some((parent) => !['run', 'evidence'].includes(byId.get(parent)?.kind ?? ''))) {
+                fail('evidence parents may only be run or evidence records');
+            }
+            if (statement.expires_at !== null)
+                assertInterval(statement.observed_at, statement.expires_at, 'evidence');
+        }
+        else if (record.kind === 'policy') {
+            if (!parents.some((parent) => ['run', 'mandate'].includes(byId.get(parent)?.kind ?? ''))) {
+                fail('policy parents must include a run or mandate');
+            }
+            if (parents.some((parent) => !['run', 'mandate'].includes(byId.get(parent)?.kind ?? ''))) {
+                fail('policy parents may only be run or mandate records');
+            }
+            if (statement.effective_until !== undefined) {
+                assertInterval(statement.effective_from, statement.effective_until, 'policy');
+            }
+        }
+        else if (record.kind === 'decision') {
+            const runRef = String(statement.run_ref);
+            const policyRef = String(statement.policy_ref);
+            const agentRef = String(statement.agent_ref);
+            requireRecord(byId, runRef, 'run', 'decision.run_ref');
+            requireRecord(byId, agentRef, 'agent', 'decision.agent_ref');
+            const policyRecord = requireRecord(byId, policyRef, 'policy', 'decision.policy_ref');
+            for (const evidenceRef of values(record, 'evidence_refs')) {
+                requireRecord(byId, evidenceRef, 'evidence', 'decision.evidence_refs');
+            }
+            const expected = [...new Set([runRef, policyRef, ...values(record, 'evidence_refs')])].sort();
+            if (parents.join('\u0000') !== expected.join('\u0000')) {
+                fail('decision parents must exactly equal run, policy, and evidence references');
+            }
+            if (JSON.stringify(statement.policy_digest) !== JSON.stringify(policyRecord.statement.digest)) {
+                fail('decision.policy_digest does not match the referenced policy');
+            }
+            const decidedAt = parseTimestamp(String(statement.decided_at)).getTime();
+            const policyStatement = policyRecord.statement;
+            if (decidedAt < parseTimestamp(String(policyStatement.effective_from)).getTime()) {
+                fail("decision predates the referenced policy's effective interval");
+            }
+            if (policyStatement.effective_until !== undefined
+                && decidedAt > parseTimestamp(String(policyStatement.effective_until)).getTime())
+                fail("decision follows the referenced policy's effective interval");
+        }
+        else if (record.kind === 'execution') {
+            const decisionRef = String(statement.decision_ref);
+            requireRecord(byId, decisionRef, 'decision', 'execution.decision_ref');
+            if (parents.length !== 1 || parents[0] !== decisionRef) {
+                fail('v0 execution parents must contain exactly decision_ref');
+            }
+            if (String(statement.execution_type).startsWith('onchain')) {
+                const missing = ['network', 'transaction_hash', 'transaction_digest']
+                    .filter((name) => !Object.hasOwn(statement, name));
+                if (missing.length)
+                    fail(`onchain execution is missing: ${missing.join(', ')}`);
+            }
+            if (statement.confirmed_at !== undefined) {
+                assertInterval(statement.submitted_at, statement.confirmed_at, 'execution');
+            }
+        }
+    }
+    const { bundle_id: _bundleId, ...withoutId } = payload;
+    if (payload.bundle_id !== contentId(withoutId)) {
+        fail('bundle_id does not match the canonical payload without bundle_id');
+    }
+}
+//# sourceMappingURL=graph.js.map

package/dist/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../src/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAG9C,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,aAAa,CACpB,IAAsC,EACtC,QAAiB,EACjB,IAAiC,EACjC,KAAa;IAEb,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAA;IACzG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,IAAI,CAAC,GAAG,KAAK,sBAAsB,IAAI,SAAS,CAAC,CAAA;IACtF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,GAAY,EAAE,KAAa;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAM;IAChE,IAAI,CAAC;QACH,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;YAAE,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAA;IAC1G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAA;QACzD,IAAI,KAAK,YAAY,UAAU;YAAE,IAAI,CAAC,GAAG,KAAK,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACjG,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA2B;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAsB,CAAA;QACjD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAoB,CAAA;YAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,wDAAwD,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAoB,CAAA;QAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACjH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAA2B,EAAE,KAAa;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAiB,CAAC,CAAC,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA8C;IAClF,MAAM,OAAO,GAAG,KAAsB,CAAA;IACtC,IAAI,CAAC;QACH,gBAAgB,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9G,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC9C,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IACjH,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAElE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAC9B,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;YAAE,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAA;QAC7D,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,KAAK,EAAE;gBAAE,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,kBAAkB,MAAM,kBAAkB,EAAE,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,uBAAuB,CAAC,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAA;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAAE,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAEjG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACtE,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACnE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,yEAAyE,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAQ,EAAE;QACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;QACjE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAM;QACjC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACtB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACrE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACvB,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAElG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,MAAM;gBAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;QACnE,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAA;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAA;gBAChE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;YAC1F,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,6CAA6C,CAAC,CAAA;YACrD,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YACjD,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB,CAAC,CAAA;YACpE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;YACpF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,+CAA+C,CAAC,CAAA;YACvD,CAAC;YACD,cAAc,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACxE,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7C,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;YACpD,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAA;YAChF,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtE,IAAI,CAAC,uDAAuD,CAAC,CAAA;YAC/D,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAAE,cAAc,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YACrG,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;YACtE,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAA;YAChD,IACE,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE;mBACpE,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC3E,IAAI,CAAC,0DAA0D,CAAC,CAAA;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACxC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAA;YACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;YAC5E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC1F,IAAI,CAAC,sDAAsD,CAAC,CAAA;YAC9D,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI;gBAAE,cAAc,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAC5G,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzF,IAAI,CAAC,8CAA8C,CAAC,CAAA;YACtD,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBACzF,IAAI,CAAC,mDAAmD,CAAC,CAAA;YAC3D,CAAC;YACD,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC5C,cAAc,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACxC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAA;YACtD,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAA;YAC5D,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAA;YACpF,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC1D,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7F,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,0EAA0E,CAAC,CAAA;YAClF,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9F,IAAI,CAAC,6DAA6D,CAAC,CAAA;YACrE,CAAC;YACD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;YACxE,MAAM,eAAe,GAAG,YAAY,CAAC,SAAS,CAAA;YAC9C,IAAI,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjF,IAAI,CAAC,8DAA8D,CAAC,CAAA;YACtE,CAAC;YACD,IACE,eAAe,CAAC,eAAe,KAAK,SAAS;mBAC1C,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE;gBAChF,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACvE,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAA;YACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACvD,IAAI,CAAC,wDAAwD,CAAC,CAAA;YAChE,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,CAAC;qBAClE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;gBACpD,IAAI,OAAO,CAAC,MAAM;oBAAE,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACzC,cAAc,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAA;IACtD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,kEAAkE,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { ATTESTATION_ISSUER, ATTESTATION_PURPOSE, ATTESTATION_V2, BUNDLE_PAYLOAD_TYPE, BUNDLE_VERSION, MEDIA_TYPE, RECORD_VERSION, SPECIFICATION_ID, } from './constants.js';
+export { canonicalize, canonicalizeText, contentId, enforceLimits, formatTimestamp, parseJson, parseTimestamp, } from './canonical.js';
+export { createEd25519Signer, dssePae, sealBundle } from './dsse.js';
+export type { SealBundleOptions } from './dsse.js';
+export { AgentEvidenceError, CanonicalizationError, EvidenceValidationError, ParseError, SchemaValidationError, SigningError, TrustPolicyError, } from './errors.js';
+export { validateBundlePayload } from './graph.js';
+export { createBundlePayload, createRecord } from './records.js';
+export type { CreateBundlePayloadOptions, CreateRecordOptions } from './records.js';
+export { validateDocument } from './schema.js';
+export { AttestationKey, createKeyRecord, deriveKeyId, evaluateKeyLifecycle, loadPublicKey, TrustPolicy, } from './trust.js';
+export type { CreateKeyRecordOptions, TrustPolicyOptions } from './trust.js';
+export { overallState, verifyBundle } from './verifier.js';
+export type { AgentEvidenceRecord, AttestationKeyRecord, BundlePayload, ComponentResult, DsseEnvelope, DsseSignature, Ed25519Signer, JsonObject, JsonPrimitive, JsonValue, KeyInput, PortableBundle, RecordKind, VerificationMaterial, VerificationReport, VerificationState, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,GACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAChE,YAAY,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EACL,cAAc,EACd,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa,EACb,SAAS,EACT,QAAQ,EACR,cAAc,EACd,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,10 @@
+export { ATTESTATION_ISSUER, ATTESTATION_PURPOSE, ATTESTATION_V2, BUNDLE_PAYLOAD_TYPE, BUNDLE_VERSION, MEDIA_TYPE, RECORD_VERSION, SPECIFICATION_ID, } from './constants.js';
+export { canonicalize, canonicalizeText, contentId, enforceLimits, formatTimestamp, parseJson, parseTimestamp, } from './canonical.js';
+export { createEd25519Signer, dssePae, sealBundle } from './dsse.js';
+export { AgentEvidenceError, CanonicalizationError, EvidenceValidationError, ParseError, SchemaValidationError, SigningError, TrustPolicyError, } from './errors.js';
+export { validateBundlePayload } from './graph.js';
+export { createBundlePayload, createRecord } from './records.js';
+export { validateDocument } from './schema.js';
+export { AttestationKey, createKeyRecord, deriveKeyId, evaluateKeyLifecycle, loadPublicKey, TrustPolicy, } from './trust.js';
+export { overallState, verifyBundle } from './verifier.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEpE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,GACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EACL,cAAc,EACd,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA"}

package/dist/records.d.ts

@@ -0,0 +1,14 @@
+import type { AgentEvidenceRecord, BundlePayload, JsonObject, RecordKind } from './types.js';
+export interface CreateRecordOptions {
+    parents?: readonly string[];
+    proofs?: readonly JsonObject[];
+}
+export declare function createRecord(kind: RecordKind, statement: JsonObject, options?: CreateRecordOptions): AgentEvidenceRecord;
+export interface CreateBundlePayloadOptions {
+    createdAt: string | Date;
+    runId?: string;
+    rootIds?: readonly string[];
+    extensions?: JsonObject;
+}
+export declare function createBundlePayload(inputRecords: Iterable<AgentEvidenceRecord>, options: CreateBundlePayloadOptions): BundlePayload;
+//# sourceMappingURL=records.d.ts.map

package/dist/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../src/records.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,UAAU,EAAa,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvG,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAC/B;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE,mBAAwB,GAChC,mBAAmB,CAgBrB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB;AAED,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAC3C,OAAO,EAAE,0BAA0B,GAClC,aAAa,CA4Bf"}

package/dist/records.js

@@ -0,0 +1,55 @@
+import { BUNDLE_VERSION, RECORD_VERSION } from './constants.js';
+import { cloneJson, contentId, formatTimestamp } from './canonical.js';
+import { EvidenceValidationError, SchemaValidationError } from './errors.js';
+import { validateBundlePayload } from './graph.js';
+import { validateDocument } from './schema.js';
+export function createRecord(kind, statement, options = {}) {
+    const body = {
+        record_version: RECORD_VERSION,
+        kind,
+        parents: [...new Set(options.parents ?? [])].sort(),
+        statement: cloneJson(statement),
+        proofs: cloneJson([...(options.proofs ?? [])]),
+    };
+    const record = { id: contentId(body), ...body };
+    try {
+        validateDocument('record.schema.json', record);
+    }
+    catch (error) {
+        if (error instanceof SchemaValidationError)
+            throw new EvidenceValidationError(error.message, { cause: error });
+        throw error;
+    }
+    return record;
+}
+export function createBundlePayload(inputRecords, options) {
+    const records = [...inputRecords].map((record) => cloneJson(record));
+    records.sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
+    const runs = records.filter((record) => record.kind === 'run');
+    const runId = options.runId ?? (runs.length === 1 ? runs[0]?.id : undefined);
+    if (!runId)
+        throw new EvidenceValidationError('run_id can only be inferred when exactly one run exists');
+    const parentIds = new Set(records.flatMap((record) => record.parents));
+    const computedRoots = records.map((record) => record.id).filter((id) => !parentIds.has(id)).sort();
+    const createdAt = options.createdAt instanceof Date ? formatTimestamp(options.createdAt) : options.createdAt;
+    const withoutId = {
+        bundle_version: BUNDLE_VERSION,
+        created_at: createdAt,
+        run_id: runId,
+        root_ids: [...(options.rootIds ?? computedRoots)],
+        records,
+        extensions: cloneJson((options.extensions ?? {})),
+    };
+    const payload = {
+        bundle_version: BUNDLE_VERSION,
+        bundle_id: contentId(withoutId),
+        created_at: createdAt,
+        run_id: runId,
+        root_ids: withoutId.root_ids,
+        records,
+        extensions: withoutId.extensions,
+    };
+    validateBundlePayload(payload);
+    return payload;
+}
+//# sourceMappingURL=records.js.map

package/dist/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../src/records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAQ9C,MAAM,UAAU,YAAY,CAC1B,IAAgB,EAChB,SAAqB,EACrB,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,cAAc;QAC9B,IAAI;QACJ,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACnD,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAgB,CAAiB;KAC9E,CAAA;IACD,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9G,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AASD,MAAM,UAAU,mBAAmB,CACjC,YAA2C,EAC3C,OAAmC;IAEnC,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAA8B,CAAmC,CAAC,CAAA;IAC9H,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAA;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC5E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,uBAAuB,CAAC,yDAAyD,CAAC,CAAA;IACxG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACtE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAClG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAA;IAC5G,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,cAAc;QAC9B,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,CAAC;QACjD,OAAO;QACP,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAc,CAAe;KAC7E,CAAA;IACD,MAAM,OAAO,GAAkB;QAC7B,cAAc,EAAE,cAAc;QAC9B,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;QAC/B,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,OAAO;QACP,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAA;IACD,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,4 @@
+export declare const SCHEMA_BASE = "https://onchaindiligence.com/schemas/agent-evidence/v0/";
+export declare const SCHEMA_NAMES: readonly ["common.schema.json", "attestation-key.schema.json", "dsse-envelope.schema.json", "proof.schema.json", "record.schema.json", "bundle-payload.schema.json", "portable-file.schema.json"];
+export declare function validateDocument(name: string, value: unknown): void;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,WAAW,4DAA4D,CAAA;AACpF,eAAO,MAAM,YAAY,mMAQf,CAAA;AA6BV,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAOnE"}

package/dist/schema.js

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs';
+import Ajv2020Import, {} from 'ajv/dist/2020.js';
+import addFormatsImport from 'ajv-formats';
+import { SchemaValidationError } from './errors.js';
+export const SCHEMA_BASE = 'https://onchaindiligence.com/schemas/agent-evidence/v0/';
+export const SCHEMA_NAMES = [
+    'common.schema.json',
+    'attestation-key.schema.json',
+    'dsse-envelope.schema.json',
+    'proof.schema.json',
+    'record.schema.json',
+    'bundle-payload.schema.json',
+    'portable-file.schema.json',
+];
+const Ajv2020 = Ajv2020Import;
+const addFormats = addFormatsImport;
+const ajv = new Ajv2020({ allErrors: true, strict: true });
+addFormats(ajv);
+for (const name of SCHEMA_NAMES) {
+    const bytes = readFileSync(new URL(`../schemas/${name}`, import.meta.url), 'utf8');
+    ajv.addSchema(JSON.parse(bytes));
+}
+function validator(name) {
+    if (!SCHEMA_NAMES.includes(name)) {
+        throw new RangeError(`unknown Agent Evidence schema: ${name}`);
+    }
+    const validate = ajv.getSchema(`${SCHEMA_BASE}${name}`);
+    if (!validate)
+        throw new Error(`packaged Agent Evidence schema did not compile: ${name}`);
+    return validate;
+}
+function errorSortKey(error) {
+    return `${error.instancePath}\u0000${error.schemaPath}\u0000${error.keyword}`;
+}
+export function validateDocument(name, value) {
+    const validate = validator(name);
+    if (validate(value))
+        return;
+    const errors = [...(validate.errors ?? [])].sort((left, right) => errorSortKey(left).localeCompare(errorSortKey(right)));
+    const error = errors[0];
+    if (!error)
+        throw new SchemaValidationError(`${name}/: schema validation failed`);
+    throw new SchemaValidationError(`${name}${error.instancePath || '/'}: ${error.message ?? error.keyword}`);
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,aAAa,EAAE,EAA2C,MAAM,kBAAkB,CAAA;AACzF,OAAO,gBAAgB,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,MAAM,CAAC,MAAM,WAAW,GAAG,yDAAyD,CAAA;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,oBAAoB;IACpB,6BAA6B;IAC7B,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,4BAA4B;IAC5B,2BAA2B;CACnB,CAAA;AAOV,MAAM,OAAO,GAAG,aAAgF,CAAA;AAChG,MAAM,UAAU,GAAG,gBAA6D,CAAA;AAChF,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1D,UAAU,CAAC,GAAG,CAAC,CAAA;AACf,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAClF,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAA;IACzF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,KAAkB;IACtC,OAAO,GAAG,KAAK,CAAC,YAAY,SAAS,KAAK,CAAC,UAAU,SAAS,KAAK,CAAC,OAAO,EAAE,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAM;IAC3B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACxH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,qBAAqB,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAA;IACjF,MAAM,IAAI,qBAAqB,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,GAAG,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;AAC3G,CAAC"}

package/dist/trust.d.ts

@@ -0,0 +1,64 @@
+import { KeyObject } from 'node:crypto';
+import type { AttestationKeyRecord, KeyInput, VerificationState } from './types.js';
+export declare function loadPublicKey(value: KeyInput): KeyObject;
+export declare function deriveKeyId(publicKey: KeyInput): string;
+export declare class AttestationKey {
+    #private;
+    readonly keyId: string;
+    readonly publicKey: KeyObject;
+    readonly publicKeyPem: string;
+    readonly status: AttestationKeyRecord['status'];
+    readonly replacementKeyId: string | null;
+    readonly statusReason?: string;
+    private constructor();
+    get validFrom(): Date | null;
+    get validUntil(): Date | null;
+    get statusChangedAt(): Date | null;
+    get compromisedAt(): Date | null;
+    static fromRecord(input: AttestationKeyRecord | Record<string, unknown>): AttestationKey;
+    toRecord(): AttestationKeyRecord;
+}
+export interface CreateKeyRecordOptions {
+    validFrom: string | Date | null;
+    status?: AttestationKeyRecord['status'];
+    validUntil?: string | Date | null;
+    statusChangedAt?: string | Date | null;
+    replacementKeyId?: string | null;
+    compromisedAt?: string | Date | null;
+    statusReason?: string;
+}
+export declare function createKeyRecord(publicKeyInput: KeyInput, options: CreateKeyRecordOptions): AttestationKeyRecord;
+export interface TrustPolicyOptions {
+    now?: Date;
+    requiredSignatureKeyIds?: Iterable<string>;
+    minimumValidSignatures?: number;
+    maxFutureSkewMs?: number;
+    maxBundleAgeMs?: number | null;
+    enforceEvidenceExpiration?: boolean;
+    allowDigestOnlyEvidence?: boolean;
+    requireVerifiedAnchor?: boolean;
+    maxFileSize?: number;
+    maxDepth?: number;
+    maxStringLength?: number;
+    maxArrayLength?: number;
+}
+export declare class TrustPolicy {
+    #private;
+    readonly minimumValidSignatures: number;
+    readonly maxFutureSkewMs: number;
+    readonly maxBundleAgeMs: number | null;
+    readonly enforceEvidenceExpiration: boolean;
+    readonly allowDigestOnlyEvidence: boolean;
+    readonly requireVerifiedAnchor: boolean;
+    readonly maxFileSize: number;
+    readonly maxDepth: number;
+    readonly maxStringLength: number;
+    readonly maxArrayLength: number;
+    private constructor();
+    static fromKeyRecords(records: Iterable<AttestationKeyRecord | Record<string, unknown>>, options?: TrustPolicyOptions): TrustPolicy;
+    key(keyId: string): AttestationKey | undefined;
+    get now(): Date;
+    get requiredSignatureKeyIds(): ReadonlySet<string>;
+}
+export declare function evaluateKeyLifecycle(key: AttestationKey, signedAt: Date | null, policy: TrustPolicy): readonly [VerificationState, string, string];
+//# sourceMappingURL=trust.d.ts.map

package/dist/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,SAAS,EACV,MAAM,aAAa,CAAA;AAIpB,OAAO,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAQnF,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,CAexD;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAIvD;AAeD,qBAAa,cAAc;;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAM9B,OAAO;IAaP,IAAI,SAAS,IAAI,IAAI,GAAG,IAAI,CAA2E;IACvG,IAAI,UAAU,IAAI,IAAI,GAAG,IAAI,CAA6E;IAC1G,IAAI,eAAe,IAAI,IAAI,GAAG,IAAI,CAEjC;IACD,IAAI,aAAa,IAAI,IAAI,GAAG,IAAI,CAE/B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;IA+BxF,QAAQ,IAAI,oBAAoB;CAejC;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACvC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IACjC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IACtC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IACpC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAOD,wBAAgB,eAAe,CAAC,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,GAAG,oBAAoB,CAoB/G;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,uBAAuB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qBAAa,WAAW;;IACtB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAA;IAC3C,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAA;IACzC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAK/B,OAAO;IA+BP,MAAM,CAAC,cAAc,CACnB,OAAO,EAAE,QAAQ,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACjE,OAAO,GAAE,kBAAuB,GAC/B,WAAW;IAiBd,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI9C,IAAI,GAAG,IAAI,IAAI,CAAiC;IAEhD,IAAI,uBAAuB,IAAI,WAAW,CAAC,MAAM,CAAC,CAEjD;CACF;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,IAAI,GAAG,IAAI,EACrB,MAAM,EAAE,WAAW,GAClB,SAAS,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,CAyB9C"}