@parmana/verifier 1.6.3 → 2.0.1

package/README.md

@@ -2,9 +2,9 @@
 
 [![CI](https://github.com/pavancharak/parmana-verifier/actions/workflows/ci.yml/badge.svg)](https://github.com/pavancharak/parmana-verifier/actions/workflows/ci.yml) [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE) [![Node](https://img.shields.io/badge/node-%3E%3D24-brightgreen)](package.json)
 
-Every action stays within what your business allowed, and Parmana keeps proof of what happened. This verifier checks that proof using only a file and the keys you trust. No network access, no account, no dependencies.
+**Parmana makes sure AI agents take only the actions your business has approved, and keeps signed proof of what they did.** This verifier checks that proof using only a record file and the keys you trust. It needs no network access, no account and no dependencies.
 
-Parmana signs an **Execution Trust Record** for every action an agent takes through it. The record says what was authorized, what ran, and what the outcome was, and it is signed with keys. This verifier checks that a record has not been changed and that it was signed by keys you chose to trust. It does not ask Parmana's servers anything, so you do not have to trust them to check a record.
+Parmana signs an **Execution Trust Record** for every action an agent takes through it. The record says what was authorized, what ran, and what the outcome was. This verifier checks that a record has not been changed and that it was signed by keys you chose to trust. It does not contact Parmana's servers, so you do not have to trust them to check a record.
 
 The records come from [Parmana](https://github.com/pavancharak/parmana-core), which signs them. The verifier works without the rest of Parmana: it needs only a record and a trust file.
 
@@ -70,7 +70,7 @@ npx @parmana/verifier <proof.json> <trust.json>
 
 From a clone of this repository, run the same commands with `node bin/parmana-verify.mjs` in place of `parmana-verify`.
 
-There is also a Python version in [`python/`](python/README.md). It checks the same records and gives the same results, except that it cannot check ML-DSA-65 (hybrid) signatures. Use the Node version for those.
+There is also a Python version in [`python/`](python/README.md). It checks the same records and gives the same results, including ML-DSA-65 (hybrid) signatures when `cryptography` 48.0.0 or later is installed.
 
 ```sh
 pip install parmana-verifier
@@ -129,7 +129,7 @@ A record with no `signatures` array is a legacy-only record. The verifier refuse
 - the trust file sets `hybridRequiredFrom` and the record was created before that instant; or
 - the trust file sets `"allowLegacyOnly": true` and does not set `hybridRequiredFrom`.
 
-Otherwise the result is invalid, and the error says which setting would accept it. A record created at or after `hybridRequiredFrom` always needs a valid hybrid envelope, whatever `allowLegacyOnly` says. See [docs/FORMAT.md](docs/FORMAT.md#trust-set-trustjson).
+Otherwise the result is invalid, and the error says which setting would accept it. A record with no `schemaVersion`, or with `schemaVersion` 2, is refused unless the trust file sets `"allowLegacyV2": true`, because it signs only seven top-level fields. A record created at or after `hybridRequiredFrom` always needs a valid hybrid envelope, whatever `allowLegacyOnly` says. See [docs/FORMAT.md](docs/FORMAT.md#trust-set-trustjson).
 
 ## Examples
 

package/bin/parmana-verify.mjs

@@ -46,7 +46,7 @@ try {
   process.exit(2);
 }
 
-const result = verifyExecutionTrustRecord(proof, policy.keys, { hybridRequiredFrom: policy.hybridRequiredFrom ?? undefined, allowLegacyOnly: policy.allowLegacyOnly });
+const result = verifyExecutionTrustRecord(proof, policy.keys, { hybridRequiredFrom: policy.hybridRequiredFrom ?? undefined, allowLegacyOnly: policy.allowLegacyOnly, allowLegacyV2: policy.allowLegacyV2 });
 
 console.log(JSON.stringify(result));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parmana/verifier",
-  "version": "1.6.3",
+  "version": "2.0.1",
   "description": "Offline verifier for Parmana Execution Trust Records.",
   "license": "Apache-2.0",
   "type": "module",
@@ -14,7 +14,7 @@
     "NOTICE"
   ],
   "scripts": {
-    "test": "node --test test/verify.test.mjs test/hybrid.test.mjs test/trust.test.mjs test/vectors.test.mjs test/whole-record.test.mjs",
+    "test": "node --test test/verify.test.mjs test/hybrid.test.mjs test/trust.test.mjs test/vectors.test.mjs test/whole-record.test.mjs test/agentrust-fixture.test.mjs test/timestamp.test.mjs",
     "examples": "node examples/run-all.mjs"
   },
   "engines": {

package/src/timestamp.mjs

@@ -0,0 +1,65 @@
+// Strict ISO-8601 timestamp parsing, matching python/parmana_verifier/timestamps.py.
+//
+// Accepts a date, or a date and time with an explicit offset ("Z" or "+hh:mm").
+// A timestamp without an offset is rejected rather than read in the local time
+// zone, so a result never depends on the machine's clock setting. Returns NaN
+// for anything else, so callers can keep their existing Number.isNaN checks.
+
+const DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?(Z|[+-]\d{2}:\d{2})$/;
+const DATE_ONLY = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+export function parseTimestamp(value) {
+  if (typeof value !== "string") return NaN;
+
+  const dateOnly = DATE_ONLY.exec(value);
+  if (dateOnly) {
+    return utcOrNaN(Number(dateOnly[1]), Number(dateOnly[2]), Number(dateOnly[3]), 0, 0, 0, 0);
+  }
+
+  const match = DATE_TIME.exec(value);
+  if (!match) return NaN;
+
+  const [, year, month, day, hour, minute, second, fraction, offset] = match;
+  const millis = Number(((fraction ?? "") + "000").slice(0, 3));
+  const utc = utcOrNaN(
+    Number(year),
+    Number(month),
+    Number(day),
+    Number(hour),
+    Number(minute),
+    Number(second ?? 0),
+    millis,
+  );
+  if (Number.isNaN(utc)) return NaN;
+
+  const offsetMs = offset === "Z" ? 0 : offsetToMillis(offset);
+  if (offsetMs === undefined) return NaN;
+
+  return utc - offsetMs;
+}
+
+function utcOrNaN(year, month, day, hour, minute, second, millis) {
+  if (month < 1 || month > 12 || day < 1 || hour > 23 || minute > 59 || second > 59) return NaN;
+
+  const date = new Date(Date.UTC(year, month - 1, day, hour, minute, second, millis));
+
+  // Date.UTC rolls an impossible day (for example 31 February) into the next
+  // month. Reject it by checking the fields round-trip unchanged.
+  if (
+    date.getUTCFullYear() !== year ||
+    date.getUTCMonth() !== month - 1 ||
+    date.getUTCDate() !== day
+  ) {
+    return NaN;
+  }
+
+  return date.getTime();
+}
+
+function offsetToMillis(text) {
+  const sign = text[0] === "+" ? 1 : -1;
+  const hours = Number(text.slice(1, 3));
+  const minutes = Number(text.slice(4, 6));
+  if (hours > 23 || minutes > 59) return undefined;
+  return sign * (hours * 60 + minutes) * 60_000;
+}

package/src/trust.mjs

@@ -9,6 +9,7 @@
 // The trust set is supplied by the caller. The verifier never fetches keys.
 
 import { createHash, createPublicKey } from "node:crypto";
+import { parseTimestamp } from "./timestamp.mjs";
 
 export const ALGORITHM_NAMES = ["ed25519", "dilithium3"];
 
@@ -40,7 +41,7 @@ export function parseTrustPolicy(document) {
   let hybridRequiredFrom = null;
 
   if (document.hybridRequiredFrom !== undefined && document.hybridRequiredFrom !== null) {
-    if (typeof document.hybridRequiredFrom !== "string" || !/Z$/.test(document.hybridRequiredFrom) || Number.isNaN(Date.parse(document.hybridRequiredFrom))) {
+    if (typeof document.hybridRequiredFrom !== "string" || !/Z$/.test(document.hybridRequiredFrom) || Number.isNaN(parseTimestamp(document.hybridRequiredFrom))) {
       throw new Error('hybridRequiredFrom must be an ISO-8601 UTC timestamp ending in "Z"');
     }
 
@@ -55,6 +56,14 @@ export function parseTrustPolicy(document) {
 
   const allowLegacyOnly = document.allowLegacyOnly === true;
 
+  // Off by default: a schema version 2 record (or one with no schemaVersion)
+  // is refused unless the trust file explicitly allows it.
+  if (document.allowLegacyV2 !== undefined && typeof document.allowLegacyV2 !== "boolean") {
+    throw new Error('allowLegacyV2 must be true or false');
+  }
+
+  const allowLegacyV2 = document.allowLegacyV2 === true;
+
   const trustKeys = new Map();
 
   for (const [index, entry] of document.keys.entries()) {
@@ -84,12 +93,12 @@ export function parseTrustPolicy(document) {
       throw new Error(`${at}.fingerprint must be "sha256:" followed by 64 lowercase hex digits`);
     }
 
-    if (typeof entry.validFrom !== "string" || Number.isNaN(Date.parse(entry.validFrom))) {
+    if (typeof entry.validFrom !== "string" || Number.isNaN(parseTimestamp(entry.validFrom))) {
       throw new Error(`${at}.validFrom must be an ISO timestamp`);
     }
 
     if (entry.validUntil !== undefined && entry.validUntil !== null &&
-        (typeof entry.validUntil !== "string" || Number.isNaN(Date.parse(entry.validUntil)))) {
+        (typeof entry.validUntil !== "string" || Number.isNaN(parseTimestamp(entry.validUntil)))) {
       throw new Error(`${at}.validUntil must be an ISO timestamp or null`);
     }
 
@@ -108,5 +117,5 @@ export function parseTrustPolicy(document) {
     });
   }
 
-  return { keys: trustKeys, hybridRequiredFrom, allowLegacyOnly };
+  return { keys: trustKeys, hybridRequiredFrom, allowLegacyOnly, allowLegacyV2 };
 }

package/src/verify.mjs

@@ -39,6 +39,7 @@ import {
 } from "node:crypto";
 import { canonicalBytes } from "./canonical.mjs";
 import { fingerprintOfKey } from "./trust.mjs";
+import { parseTimestamp } from "./timestamp.mjs";
 
 const ALGORITHMS = {
   ed25519: { keyType: "ed25519", commitment: true },
@@ -89,6 +90,22 @@ export function verifyExecutionTrustRecord(record, trustKeys, options = {}) {
     return { valid: false, coverage: "legacy", errors: ["record must be a JSON object"], checks: {} };
   }
 
+  // Schema version 2 signs only seven top-level fields. A record with no
+  // schemaVersion is treated as version 2. Both are refused unless the caller
+  // opts in with allowLegacyV2, so a partially covered record is never
+  // accepted by default.
+  const declaredVersion = record.schemaVersion ?? DEFAULT_SCHEMA_VERSION;
+  if (declaredVersion === 2 && options.allowLegacyV2 !== true) {
+    return {
+      valid: false,
+      coverage: "legacy",
+      errors: [
+        "schemaVersion 2 (or no schemaVersion) covers only seven top-level fields and is refused by default: set allowLegacyV2 to accept it, or re-issue the record as schemaVersion 3.",
+      ],
+      checks: {},
+    };
+  }
+
   const legacyMessage = canonicalBytes(canonicalTrustRecord(record));
   const expectedHash = createHash("sha256").update(legacyMessage).digest("hex");
   const hashValid = expectedHash === record.trustRecordHash;
@@ -151,9 +168,9 @@ function isAtOrAfterCutover(createdAt, hybridRequiredFrom) {
     return false;
   }
 
-  const created = Date.parse(createdAt);
+  const created = parseTimestamp(createdAt);
 
-  return !Number.isNaN(created) && created >= Date.parse(hybridRequiredFrom);
+  return !Number.isNaN(created) && created >= parseTimestamp(hybridRequiredFrom);
 }
 
 function verifyLegacySignature(signature, message, context, errors) {
@@ -269,17 +286,17 @@ function verifyEntry(entry, message, context, errors) {
 }
 
 function withinValidityWindow(trusted, createdAt) {
-  const at = Date.parse(createdAt);
+  const at = parseTimestamp(createdAt);
 
   if (Number.isNaN(at)) {
     return false;
   }
 
-  if (at < Date.parse(trusted.validFrom)) {
+  if (at < parseTimestamp(trusted.validFrom)) {
     return false;
   }
 
-  return trusted.validUntil === null || at < Date.parse(trusted.validUntil);
+  return trusted.validUntil === null || at < parseTimestamp(trusted.validUntil);
 }
 
 function commitment(message) {