@onchaindiligence/agent-evidence 0.1.0

package/dist/trust.js

@@ -0,0 +1,254 @@
+import { createHash, createPublicKey, KeyObject, } from 'node:crypto';
+import { formatTimestamp, parseTimestamp } from './canonical.js';
+import { SchemaValidationError, TrustPolicyError } from './errors.js';
+import { validateDocument } from './schema.js';
+const KEY_ID = /^ed25519-[A-Za-z0-9_-]{16}$/;
+function asBuffer(value) {
+    return Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+}
+export function loadPublicKey(value) {
+    try {
+        const key = value instanceof KeyObject
+            ? value
+            : value instanceof Uint8Array && !Buffer.isBuffer(value)
+                ? createPublicKey(asBuffer(value))
+                : createPublicKey(value);
+        if (key.type !== 'public' || key.asymmetricKeyType !== 'ed25519') {
+            throw new TrustPolicyError('public key must be Ed25519');
+        }
+        return key;
+    }
+    catch (error) {
+        if (error instanceof TrustPolicyError)
+            throw error;
+        throw new TrustPolicyError('public key is not a valid Ed25519 SubjectPublicKeyInfo key', { cause: error });
+    }
+}
+export function deriveKeyId(publicKey) {
+    const key = loadPublicKey(publicKey);
+    const der = key.export({ format: 'der', type: 'spki' });
+    return `ed25519-${createHash('sha256').update(der).digest('base64url').slice(0, 16)}`;
+}
+function optionalTimestamp(record, name) {
+    const value = record[name];
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'string')
+        throw new TrustPolicyError(`${String(name)} must be an exact timestamp or null`);
+    try {
+        return parseTimestamp(value);
+    }
+    catch (error) {
+        throw new TrustPolicyError(`invalid key ${String(name)}: ${error instanceof Error ? error.message : String(error)}`, {
+            cause: error,
+        });
+    }
+}
+export class AttestationKey {
+    keyId;
+    publicKey;
+    publicKeyPem;
+    status;
+    replacementKeyId;
+    statusReason;
+    #validFromMs;
+    #validUntilMs;
+    #statusChangedAtMs;
+    #compromisedAtMs;
+    constructor(record, publicKey) {
+        this.keyId = record.key_id;
+        this.publicKey = publicKey;
+        this.publicKeyPem = record.public_key_pem;
+        this.status = record.status;
+        this.#validFromMs = optionalTimestamp(record, 'valid_from')?.getTime() ?? null;
+        this.#validUntilMs = optionalTimestamp(record, 'valid_until')?.getTime() ?? null;
+        this.#statusChangedAtMs = optionalTimestamp(record, 'status_changed_at')?.getTime() ?? null;
+        this.replacementKeyId = record.replacement_key_id;
+        this.#compromisedAtMs = optionalTimestamp(record, 'compromised_at')?.getTime() ?? null;
+        if (record.status_reason !== undefined)
+            this.statusReason = record.status_reason;
+    }
+    get validFrom() { return this.#validFromMs === null ? null : new Date(this.#validFromMs); }
+    get validUntil() { return this.#validUntilMs === null ? null : new Date(this.#validUntilMs); }
+    get statusChangedAt() {
+        return this.#statusChangedAtMs === null ? null : new Date(this.#statusChangedAtMs);
+    }
+    get compromisedAt() {
+        return this.#compromisedAtMs === null ? null : new Date(this.#compromisedAtMs);
+    }
+    static fromRecord(input) {
+        const record = structuredClone(input);
+        try {
+            validateDocument('attestation-key.schema.json', record);
+        }
+        catch (error) {
+            if (error instanceof SchemaValidationError)
+                throw new TrustPolicyError(error.message, { cause: error });
+            throw error;
+        }
+        if (!KEY_ID.test(record.key_id))
+            throw new TrustPolicyError('invalid Ed25519 key_id');
+        const publicKey = loadPublicKey(record.public_key_pem);
+        const derived = deriveKeyId(publicKey);
+        if (derived !== record.key_id) {
+            throw new TrustPolicyError(`key_id does not match SPKI public key: expected ${derived}`);
+        }
+        const key = new AttestationKey(record, publicKey);
+        if (key.validFrom && key.validUntil && key.validUntil.getTime() < key.validFrom.getTime()) {
+            throw new TrustPolicyError('valid_until precedes valid_from');
+        }
+        if (key.validFrom && key.statusChangedAt && key.statusChangedAt.getTime() < key.validFrom.getTime()) {
+            throw new TrustPolicyError('status_changed_at precedes valid_from');
+        }
+        if (key.validFrom && key.compromisedAt && key.compromisedAt.getTime() < key.validFrom.getTime()) {
+            throw new TrustPolicyError('compromised_at precedes valid_from');
+        }
+        if ((key.status === 'revoked' || key.status === 'compromised') && !key.statusChangedAt) {
+            throw new TrustPolicyError(`${key.status} key requires status_changed_at`);
+        }
+        if (key.replacementKeyId === key.keyId)
+            throw new TrustPolicyError('a key cannot name itself as its replacement');
+        return key;
+    }
+    toRecord() {
+        const record = {
+            key_id: this.keyId,
+            algorithm: 'ed25519',
+            public_key_pem: this.publicKeyPem,
+            status: this.status,
+            valid_from: this.validFrom?.toISOString() ?? null,
+            valid_until: this.validUntil?.toISOString() ?? null,
+            status_changed_at: this.statusChangedAt?.toISOString() ?? null,
+            replacement_key_id: this.replacementKeyId,
+            compromised_at: this.compromisedAt?.toISOString() ?? null,
+        };
+        if (this.statusReason !== undefined)
+            record.status_reason = this.statusReason;
+        return record;
+    }
+}
+function timestamp(value) {
+    if (value instanceof Date)
+        return formatTimestamp(value);
+    return value ?? null;
+}
+export function createKeyRecord(publicKeyInput, options) {
+    const publicKey = loadPublicKey(publicKeyInput);
+    const status = options.status ?? 'active';
+    const validFrom = timestamp(options.validFrom);
+    const changed = options.statusChangedAt === undefined && status === 'active'
+        ? validFrom
+        : timestamp(options.statusChangedAt);
+    const record = {
+        key_id: deriveKeyId(publicKey),
+        algorithm: 'ed25519',
+        public_key_pem: publicKey.export({ format: 'pem', type: 'spki' }).toString(),
+        status,
+        valid_from: validFrom,
+        valid_until: timestamp(options.validUntil),
+        status_changed_at: changed,
+        replacement_key_id: options.replacementKeyId ?? null,
+        compromised_at: timestamp(options.compromisedAt),
+    };
+    if (options.statusReason !== undefined)
+        record.status_reason = options.statusReason;
+    return AttestationKey.fromRecord(record).toRecord();
+}
+export class TrustPolicy {
+    minimumValidSignatures;
+    maxFutureSkewMs;
+    maxBundleAgeMs;
+    enforceEvidenceExpiration;
+    allowDigestOnlyEvidence;
+    requireVerifiedAnchor;
+    maxFileSize;
+    maxDepth;
+    maxStringLength;
+    maxArrayLength;
+    #keys;
+    #nowMs;
+    #requiredSignatureKeyIds;
+    constructor(keys, options) {
+        this.#nowMs = options.now?.getTime() ?? Date.now();
+        if (Number.isNaN(this.#nowMs))
+            throw new TrustPolicyError('policy now must be a valid Date');
+        this.#requiredSignatureKeyIds = new Set(options.requiredSignatureKeyIds ?? []);
+        this.minimumValidSignatures = options.minimumValidSignatures ?? 1;
+        this.maxFutureSkewMs = options.maxFutureSkewMs ?? 5 * 60 * 1000;
+        this.maxBundleAgeMs = options.maxBundleAgeMs ?? null;
+        this.enforceEvidenceExpiration = options.enforceEvidenceExpiration ?? true;
+        this.allowDigestOnlyEvidence = options.allowDigestOnlyEvidence ?? false;
+        this.requireVerifiedAnchor = options.requireVerifiedAnchor ?? false;
+        this.maxFileSize = options.maxFileSize ?? 10 * 1024 * 1024;
+        this.maxDepth = options.maxDepth ?? 64;
+        this.maxStringLength = options.maxStringLength ?? 1024 * 1024;
+        this.maxArrayLength = options.maxArrayLength ?? 10_000;
+        if (!Number.isInteger(this.minimumValidSignatures) || this.minimumValidSignatures < 1) {
+            throw new TrustPolicyError('minimumValidSignatures must be at least one');
+        }
+        if (this.maxFutureSkewMs < 0)
+            throw new TrustPolicyError('maxFutureSkewMs cannot be negative');
+        if (this.maxBundleAgeMs !== null && this.maxBundleAgeMs < 0) {
+            throw new TrustPolicyError('maxBundleAgeMs cannot be negative');
+        }
+        if ([this.maxFileSize, this.maxDepth, this.maxStringLength, this.maxArrayLength].some((value) => value < 1)) {
+            throw new TrustPolicyError('parser limits must be positive');
+        }
+        const missing = [...this.#requiredSignatureKeyIds].filter((keyId) => !keys.has(keyId));
+        if (missing.length) {
+            throw new TrustPolicyError(`required signature keys are absent from caller trust: ${missing.sort().join(', ')}`);
+        }
+        this.#keys = new Map(keys);
+    }
+    static fromKeyRecords(records, options = {}) {
+        const keys = new Map();
+        for (const record of records) {
+            const key = AttestationKey.fromRecord(record);
+            if (keys.has(key.keyId))
+                throw new TrustPolicyError(`duplicate caller-trusted key: ${key.keyId}`);
+            keys.set(key.keyId, key);
+        }
+        for (const key of keys.values()) {
+            if (key.replacementKeyId && !keys.has(key.replacementKeyId)) {
+                throw new TrustPolicyError(`key ${key.keyId} references an absent replacement key: ${key.replacementKeyId}`);
+            }
+        }
+        return new TrustPolicy(keys, options);
+    }
+    key(keyId) {
+        return this.#keys.get(keyId);
+    }
+    get now() { return new Date(this.#nowMs); }
+    get requiredSignatureKeyIds() {
+        return new Set(this.#requiredSignatureKeyIds);
+    }
+}
+export function evaluateKeyLifecycle(key, signedAt, policy) {
+    if (key.status === 'revoked')
+        return ['INVALID', 'key-revoked', 'the caller-trusted key is revoked'];
+    if (key.status === 'compromised')
+        return ['INVALID', 'key-compromised', 'the caller-trusted key is compromised'];
+    if (!key.validFrom) {
+        return ['UNVERIFIABLE', 'key-valid-from-missing', 'the caller-trusted key has no defensible activation boundary'];
+    }
+    if (!signedAt) {
+        if (key.status === 'retired') {
+            return ['UNVERIFIABLE', 'signature-time-missing', 'a retired key cannot validate a proof that carries no signed issuance time'];
+        }
+        if (policy.now.getTime() < key.validFrom.getTime()) {
+            return ['INVALID', 'key-not-yet-valid', 'the key is not active at policy time'];
+        }
+        return ['VALID', 'key-active', 'the caller-trusted key is currently active'];
+    }
+    if (signedAt.getTime() > policy.now.getTime() + policy.maxFutureSkewMs) {
+        return ['INVALID', 'signature-time-future', 'signed time exceeds allowed clock skew'];
+    }
+    if (signedAt.getTime() < key.validFrom.getTime()) {
+        return ['INVALID', 'key-not-yet-valid', 'signed time precedes key activation'];
+    }
+    if (key.validUntil && signedAt.getTime() > key.validUntil.getTime()) {
+        return ['INVALID', 'key-expired', 'signed time follows the key validity interval'];
+    }
+    return ['VALID', 'key-window-valid', 'signed time is inside the key validity interval'];
+}
+//# sourceMappingURL=trust.js.map

package/dist/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,eAAe,EACf,SAAS,GACV,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAG9C,MAAM,MAAM,GAAG,6BAA6B,CAAA;AAE5C,SAAS,QAAQ,CAAC,KAAiB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,YAAY,SAAS;YACpC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,YAAY,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxD,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC,CAAC,eAAe,CAAC,KAAwB,CAAC,CAAA;QAC7C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAA;QAC1D,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,KAAK,CAAA;QAClD,MAAM,IAAI,gBAAgB,CAAC,4DAA4D,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAmB;IAC7C,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvD,OAAO,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;AACvF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA4B,EAAE,IAAgC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IAC/G,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YACnH,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,KAAK,CAAQ;IACb,SAAS,CAAW;IACpB,YAAY,CAAQ;IACpB,MAAM,CAAgC;IACtC,gBAAgB,CAAe;IAC/B,YAAY,CAAS;IACrB,YAAY,CAAe;IAC3B,aAAa,CAAe;IAC5B,kBAAkB,CAAe;IACjC,gBAAgB,CAAe;IAExC,YAAoB,MAA4B,EAAE,SAAoB;QACpE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,cAAc,CAAA;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC3B,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAA;QAC9E,IAAI,CAAC,aAAa,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAA;QAChF,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAA;QAC3F,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAA;QACjD,IAAI,CAAC,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,CAAA;QACtF,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAAA;IAClF,CAAC;IAED,IAAI,SAAS,KAAkB,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA,CAAC,CAAC;IACvG,IAAI,UAAU,KAAkB,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA,CAAC,CAAC;IAC1G,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAqD;QACrE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAyB,CAAA;QAC7D,IAAI,CAAC;YACH,gBAAgB,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB;gBAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YACvG,MAAM,KAAK,CAAA;QACb,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAA;QACrF,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAA;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACjD,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1F,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACpG,MAAM,IAAI,gBAAgB,CAAC,uCAAuC,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YAChG,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YACvF,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,CAAC,MAAM,iCAAiC,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAA;QACjH,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,QAAQ;QACN,MAAM,MAAM,GAAyB;YACnC,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,SAAS,EAAE,SAAS;YACpB,cAAc,EAAE,IAAI,CAAC,YAAY;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;YACjD,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;YACnD,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,IAAI;YAC9D,kBAAkB,EAAE,IAAI,CAAC,gBAAgB;YACzC,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,IAAI;SAC1D,CAAA;QACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAA;QAC7E,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAYD,SAAS,SAAS,CAAC,KAAuC;IACxD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;IACxD,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,cAAwB,EAAE,OAA+B;IACvF,MAAM,SAAS,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAA;IACzC,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ;QAC1E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACtC,MAAM,MAAM,GAAyB;QACnC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;QAC9B,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC5E,MAAM;QACN,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1C,iBAAiB,EAAE,OAAO;QAC1B,kBAAkB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QACpD,cAAc,EAAE,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC;KACjD,CAAA;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAA;IACnF,OAAO,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;AACrD,CAAC;AAiBD,MAAM,OAAO,WAAW;IACb,sBAAsB,CAAQ;IAC9B,eAAe,CAAQ;IACvB,cAAc,CAAe;IAC7B,yBAAyB,CAAS;IAClC,uBAAuB,CAAS;IAChC,qBAAqB,CAAS;IAC9B,WAAW,CAAQ;IACnB,QAAQ,CAAQ;IAChB,eAAe,CAAQ;IACvB,cAAc,CAAQ;IACtB,KAAK,CAAqC;IAC1C,MAAM,CAAQ;IACd,wBAAwB,CAAqB;IAEtD,YAAoB,IAAiC,EAAE,OAA2B;QAChF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;QAClD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAA;QAC5F,IAAI,CAAC,wBAAwB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAA;QAC9E,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;QAC/D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAA;QACpD,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,yBAAyB,IAAI,IAAI,CAAA;QAC1E,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,IAAI,KAAK,CAAA;QACvE,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,KAAK,CAAA;QACnE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;QAC1D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;QACtC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,GAAG,IAAI,CAAA;QAC7D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAA;QAC9F,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,gBAAgB,CAAC,mCAAmC,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,gBAAgB,CAAC,gCAAgC,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACtF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,gBAAgB,CAAC,yDAAyD,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClH,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,OAAiE,EACjE,UAA8B,EAAE;QAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAA;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACjG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC1B,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,gBAAgB,CACxB,OAAO,GAAG,CAAC,KAAK,0CAA0C,GAAG,CAAC,gBAAgB,EAAE,CACjF,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC;IAED,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,GAAG,KAAW,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC;IAEhD,IAAI,uBAAuB;QACzB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAmB,EACnB,QAAqB,EACrB,MAAmB;IAEnB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,mCAAmC,CAAC,CAAA;IACpG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,CAAC,SAAS,EAAE,iBAAiB,EAAE,uCAAuC,CAAC,CAAA;IAChH,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,CAAC,cAAc,EAAE,wBAAwB,EAAE,8DAA8D,CAAC,CAAA;IACnH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,cAAc,EAAE,wBAAwB,EAAE,4EAA4E,CAAC,CAAA;QACjI,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,OAAO,CAAC,SAAS,EAAE,mBAAmB,EAAE,sCAAsC,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,4CAA4C,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACvE,OAAO,CAAC,SAAS,EAAE,uBAAuB,EAAE,wCAAwC,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,OAAO,CAAC,SAAS,EAAE,mBAAmB,EAAE,qCAAqC,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,+CAA+C,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,iDAAiD,CAAC,CAAA;AACzF,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,83 @@
+import type { KeyObject } from 'node:crypto';
+import type { BUNDLE_VERSION, RECORD_VERSION } from './constants.js';
+export type JsonPrimitive = null | boolean | number | string;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export type RecordKind = 'principal' | 'agent' | 'mandate' | 'run' | 'evidence' | 'policy' | 'decision' | 'execution';
+export interface AgentEvidenceRecord {
+    id: string;
+    record_version: typeof RECORD_VERSION;
+    kind: RecordKind;
+    parents: string[];
+    statement: JsonObject;
+    proofs: JsonObject[];
+}
+export interface BundlePayload {
+    bundle_version: typeof BUNDLE_VERSION;
+    bundle_id: string;
+    created_at: string;
+    run_id: string;
+    root_ids: string[];
+    records: AgentEvidenceRecord[];
+    extensions: JsonObject;
+}
+export interface DsseSignature {
+    keyid: string;
+    sig: string;
+}
+export interface DsseEnvelope {
+    payloadType: string;
+    payload: string;
+    signatures: DsseSignature[];
+}
+export interface AttestationKeyRecord extends JsonObject {
+    key_id: string;
+    algorithm: 'ed25519';
+    public_key_pem: string;
+    status: 'active' | 'retired' | 'revoked' | 'compromised';
+    valid_from: string | null;
+    valid_until: string | null;
+    status_changed_at: string | null;
+    replacement_key_id: string | null;
+    compromised_at: string | null;
+    status_reason?: string;
+}
+export interface VerificationMaterial {
+    keys: AttestationKeyRecord[];
+    registry_snapshots: JsonObject[];
+    anchors: JsonObject[];
+}
+export interface PortableBundle {
+    media_type: string;
+    bundle_version: typeof BUNDLE_VERSION;
+    envelope: DsseEnvelope;
+    verification_material: VerificationMaterial;
+}
+export type KeyInput = string | Buffer | Uint8Array | KeyObject;
+export interface Ed25519Signer {
+    readonly keyId: string;
+    readonly publicKey: KeyInput;
+    sign(message: Uint8Array): Uint8Array | Promise<Uint8Array>;
+}
+export type VerificationState = 'VALID' | 'INVALID' | 'UNVERIFIABLE';
+export interface ComponentResult {
+    component: string;
+    state: VerificationState;
+    code: string;
+    message: string;
+    required: boolean;
+    key_id?: string;
+    record_id?: string;
+}
+export interface VerificationReport {
+    state: VerificationState;
+    valid: boolean;
+    bundle_id: string | null;
+    components: ComponentResult[];
+    payload?: BundlePayload;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpE,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAA;AAC5D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAA;AAClF,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAA;AAErD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,OAAO,GACP,SAAS,GACT,KAAK,GACL,UAAU,GACV,QAAQ,GACR,UAAU,GACV,WAAW,CAAA;AAEf,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,EAAE,UAAU,CAAA;IACrB,MAAM,EAAE,UAAU,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,EAAE,mBAAmB,EAAE,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,aAAa,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,SAAS,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAA;IACxD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,oBAAoB,EAAE,CAAA;IAC5B,kBAAkB,EAAE,UAAU,EAAE,CAAA;IAChC,OAAO,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,QAAQ,EAAE,YAAY,CAAA;IACtB,qBAAqB,EAAE,oBAAoB,CAAA;CAC5C;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAC5D;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,CAAA;AAEpE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,iBAAiB,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,iBAAiB,CAAA;IACxB,KAAK,EAAE,OAAO,CAAA;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,eAAe,EAAE,CAAA;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/verifier.d.ts

@@ -0,0 +1,5 @@
+import { TrustPolicy } from './trust.js';
+import type { ComponentResult, PortableBundle, VerificationReport, VerificationState } from './types.js';
+export declare function overallState(components: readonly ComponentResult[]): VerificationState;
+export declare function verifyBundle(document: string | Uint8Array | PortableBundle | Record<string, unknown>, policy: TrustPolicy): VerificationReport;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA6C,WAAW,EAAE,MAAM,YAAY,CAAA;AACnF,OAAO,KAAK,EAGV,eAAe,EAIf,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,YAAY,CAAA;AA4BnB,wBAAgB,YAAY,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,GAAG,iBAAiB,CAKtF;AAoXD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxE,MAAM,EAAE,WAAW,GAClB,kBAAkB,CA6JpB"}