@primust/artifact-core 1.0.0 → 1.2.0

package/dist/trust_edge_mapping.js

@@ -0,0 +1,88 @@
+// Trust-edge mapping for outbound-action records.
+//
+// TypeScript sibling of
+// `packages/primust-checks/src/primust_checks/trust_edge_mapping.py`.
+//
+// Maps `(target_system_kind, operation)` to one of the six trust edges
+// defined in `docs/v30/foundation/OUTBOUND_ACTION_EVIDENCE_SPEC_v0_1.md` §1.2.
+//
+// SI-1: this module emits only enum values. The mapping itself is content-free.
+export const MAPPING_VERSION = '1.0.0';
+export const TRUST_EDGES = ['A2T', 'A2M', 'A2H', 'A2A', 'A2S', 'A2D'];
+// Primary mapping. Two kinds (mcp_tool, governance_config_surface) are
+// contextual and resolved in `classify` below.
+const PRIMARY = {
+    // A2T
+    sdk_tool: 'A2T',
+    cli_subprocess: 'A2T',
+    // A2M
+    anthropic_messages: 'A2M',
+    openai_chat: 'A2M',
+    bedrock_invoke: 'A2M',
+    calibrated_profile: 'A2M',
+    // A2H
+    approval_gate: 'A2H',
+    cli_prompt: 'A2H',
+    dashboard_escalation: 'A2H',
+    // A2A
+    subagent_spawn: 'A2A',
+    mcp_sampling: 'A2A',
+    cross_org_delegation: 'A2A',
+    // A2S
+    aws_api: 'A2S',
+    salesforce_rest: 'A2S',
+    stripe_api: 'A2S',
+    github_api: 'A2S',
+    fly_api: 'A2S',
+    servicenow_api: 'A2S',
+    slack: 'A2S',
+    k8s: 'A2S',
+    generic_http: 'A2S',
+    // A2D
+    postgres: 'A2D',
+    snowflake: 'A2D',
+    pinecone: 'A2D',
+    s3: 'A2D',
+    filesystem: 'A2D',
+    vector_store: 'A2D',
+};
+const MCP_DATA_METHODS = [
+    'resources/read',
+    'resources/list',
+    'prompts/get',
+    'prompts/list',
+];
+const HTTP_METHOD_PREFIXES = [
+    'GET ',
+    'POST ',
+    'PUT ',
+    'PATCH ',
+    'DELETE ',
+    'HEAD ',
+    'OPTIONS ',
+];
+/**
+ * Resolve the trust edge for a `(target_system_kind, operation)` pair.
+ * Returns `null` if the kind is not recognized — callers MUST treat
+ * this as a gap (record the kind, do not invent a trust edge).
+ */
+export function classify(target_system_kind, operation) {
+    if (target_system_kind === 'mcp_tool') {
+        if (MCP_DATA_METHODS.some((p) => operation.startsWith(p)))
+            return 'A2D';
+        if (operation.includes('sampling'))
+            return 'A2M';
+        return 'A2T';
+    }
+    if (target_system_kind === 'governance_config_surface') {
+        if (HTTP_METHOD_PREFIXES.some((p) => operation.startsWith(p)))
+            return 'A2S';
+        return 'A2D';
+    }
+    return PRIMARY[target_system_kind] ?? null;
+}
+/** All target_system_kind values this mapping recognizes. */
+export function knownKinds() {
+    return new Set([...Object.keys(PRIMARY), 'mcp_tool', 'governance_config_surface']);
+}
+//# sourceMappingURL=trust_edge_mapping.js.map

package/dist/trust_edge_mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust_edge_mapping.js","sourceRoot":"","sources":["../src/trust_edge_mapping.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,wBAAwB;AACxB,sEAAsE;AACtE,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAgB,CAAC;AAEhD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAG/E,uEAAuE;AACvE,+CAA+C;AAC/C,MAAM,OAAO,GAA8B;IACzC,MAAM;IACN,QAAQ,EAAE,KAAK;IACf,cAAc,EAAE,KAAK;IAErB,MAAM;IACN,kBAAkB,EAAE,KAAK;IACzB,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,KAAK;IACrB,kBAAkB,EAAE,KAAK;IAEzB,MAAM;IACN,aAAa,EAAE,KAAK;IACpB,UAAU,EAAE,KAAK;IACjB,oBAAoB,EAAE,KAAK;IAE3B,MAAM;IACN,cAAc,EAAE,KAAK;IACrB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,KAAK;IAE3B,MAAM;IACN,OAAO,EAAE,KAAK;IACd,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,KAAK;IACjB,UAAU,EAAE,KAAK;IACjB,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,KAAK;IACrB,KAAK,EAAE,KAAK;IACZ,GAAG,EAAE,KAAK;IACV,YAAY,EAAE,KAAK;IAEnB,MAAM;IACN,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,QAAQ,EAAE,KAAK;IACf,EAAE,EAAE,KAAK;IACT,UAAU,EAAE,KAAK;IACjB,YAAY,EAAE,KAAK;CACpB,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,cAAc;CACN,CAAC;AAEX,MAAM,oBAAoB,GAAG;IAC3B,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;CACF,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,kBAA0B,EAC1B,SAAiB;IAEjB,IAAI,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACtC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,kBAAkB,KAAK,2BAA2B,EAAE,CAAC;QACvD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;AAC7C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/dist/trust_edge_mapping.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=trust_edge_mapping.test.d.ts.map

package/dist/trust_edge_mapping.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust_edge_mapping.test.d.ts","sourceRoot":"","sources":["../src/trust_edge_mapping.test.ts"],"names":[],"mappings":""}

package/dist/trust_edge_mapping.test.js

@@ -0,0 +1,86 @@
+import { describe, it, expect } from 'vitest';
+import { MAPPING_VERSION, TRUST_EDGES, classify, knownKinds, } from './trust_edge_mapping.js';
+describe('trust_edge_mapping', () => {
+    describe('A2T — Agent → Tool', () => {
+        it('sdk_tool', () => expect(classify('sdk_tool', 'anyop')).toBe('A2T'));
+        it('cli_subprocess', () => expect(classify('cli_subprocess', 'exec')).toBe('A2T'));
+        it('mcp_tool tools/call', () => expect(classify('mcp_tool', 'tools/call:my_tool')).toBe('A2T'));
+    });
+    describe('A2M — Agent → Model', () => {
+        it('anthropic_messages', () => expect(classify('anthropic_messages', 'POST /v1/messages')).toBe('A2M'));
+        it('openai_chat', () => expect(classify('openai_chat', 'POST /v1/chat/completions')).toBe('A2M'));
+        it('bedrock_invoke', () => expect(classify('bedrock_invoke', 'InvokeModel')).toBe('A2M'));
+        it('mcp_tool sampling sub-LLM (spec §2.1)', () => expect(classify('mcp_tool', 'tools/call:sampling_proxy')).toBe('A2M'));
+    });
+    describe('A2H — Agent → Human', () => {
+        it('approval_gate', () => expect(classify('approval_gate', 'request')).toBe('A2H'));
+        it('cli_prompt', () => expect(classify('cli_prompt', 'ask')).toBe('A2H'));
+        it('dashboard_escalation', () => expect(classify('dashboard_escalation', 'notify')).toBe('A2H'));
+    });
+    describe('A2A — Agent → Agent', () => {
+        it('subagent_spawn', () => expect(classify('subagent_spawn', 'spawn')).toBe('A2A'));
+        it('cross_org_delegation', () => expect(classify('cross_org_delegation', 'delegate')).toBe('A2A'));
+    });
+    describe('A2S — Agent → System', () => {
+        it('aws_api', () => expect(classify('aws_api', 'DeleteBucket')).toBe('A2S'));
+        it('stripe_api', () => expect(classify('stripe_api', 'charges.create')).toBe('A2S'));
+        it('github_api', () => expect(classify('github_api', 'POST /repos/{owner}/{repo}/pulls')).toBe('A2S'));
+        it('salesforce_rest', () => expect(classify('salesforce_rest', 'POST /sobjects/Task')).toBe('A2S'));
+        it('slack', () => expect(classify('slack', 'chat.postMessage')).toBe('A2S'));
+        it('k8s', () => expect(classify('k8s', 'DELETE /apis/apps/v1/namespaces/{ns}/deployments/{name}')).toBe('A2S'));
+        it('generic_http', () => expect(classify('generic_http', 'POST /some/path')).toBe('A2S'));
+    });
+    describe('A2D — Agent → Data', () => {
+        it('postgres', () => expect(classify('postgres', 'SELECT')).toBe('A2D'));
+        it('snowflake', () => expect(classify('snowflake', 'INSERT')).toBe('A2D'));
+        it('pinecone', () => expect(classify('pinecone', 'upsert')).toBe('A2D'));
+        it('s3', () => expect(classify('s3', 'GetObject')).toBe('A2D'));
+        it('filesystem', () => expect(classify('filesystem', 'read')).toBe('A2D'));
+        it('vector_store', () => expect(classify('vector_store', 'query')).toBe('A2D'));
+        it('mcp_tool resources/read (spec §2.1)', () => expect(classify('mcp_tool', 'resources/read')).toBe('A2D'));
+        it('mcp_tool resources/list', () => expect(classify('mcp_tool', 'resources/list')).toBe('A2D'));
+        it('mcp_tool prompts/get', () => expect(classify('mcp_tool', 'prompts/get')).toBe('A2D'));
+    });
+    describe('contextual: governance_config_surface', () => {
+        it('file-path-shaped op → A2D', () => expect(classify('governance_config_surface', 'edit_settings_json')).toBe('A2D'));
+        it('POST op → A2S', () => expect(classify('governance_config_surface', 'POST /admin/branch-protection')).toBe('A2S'));
+        it('PATCH op → A2S', () => expect(classify('governance_config_surface', 'PATCH /admin/rules/{id}')).toBe('A2S'));
+    });
+    describe('unknown kind → null (gap, not invented)', () => {
+        it('returns null', () => {
+            expect(classify('not_a_real_kind', 'op')).toBe(null);
+        });
+    });
+    describe('knownKinds enumeration', () => {
+        it('includes mcp_tool and governance_config_surface', () => {
+            const kinds = knownKinds();
+            expect(kinds.has('mcp_tool')).toBe(true);
+            expect(kinds.has('governance_config_surface')).toBe(true);
+        });
+        it('covers all six edges (at least one kind each)', () => {
+            const kinds = knownKinds();
+            expect(kinds.has('sdk_tool')).toBe(true);
+            expect(kinds.has('anthropic_messages')).toBe(true);
+            expect(kinds.has('approval_gate')).toBe(true);
+            expect(kinds.has('subagent_spawn')).toBe(true);
+            expect(kinds.has('aws_api')).toBe(true);
+            expect(kinds.has('postgres')).toBe(true);
+        });
+        it('every known kind classifies to non-null', () => {
+            for (const kind of knownKinds()) {
+                expect(classify(kind, '')).not.toBe(null);
+            }
+        });
+    });
+    describe('versioning + SI-1 shape', () => {
+        it('MAPPING_VERSION is semver', () => {
+            expect(MAPPING_VERSION).toMatch(/^\d+\.\d+\.\d+$/);
+        });
+        it('all edge values use safe alphanum alphabet', () => {
+            for (const edge of TRUST_EDGES) {
+                expect(edge.replace(/_/g, '')).toMatch(/^[A-Za-z0-9]+$/);
+            }
+        });
+    });
+});
+//# sourceMappingURL=trust_edge_mapping.test.js.map

package/dist/trust_edge_mapping.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust_edge_mapping.test.js","sourceRoot":"","sources":["../src/trust_edge_mapping.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,WAAW,EACX,QAAQ,EACR,UAAU,GACX,MAAM,yBAAyB,CAAC;AAEjC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAC5B,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE,CACrB,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE,CAC/C,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC9B,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAC9B,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACzB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACb,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC,CAAC,IAAI,CACrF,KAAK,CACN,CAAC,CAAC;QACL,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAChF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAC7C,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE,CACjC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACrD,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE,CACnC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,CACvB,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,+BAA+B,CAAC,CAAC,CAAC,IAAI,CACjF,KAAK,CACN,CAAC,CAAC;QACL,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACxB,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACvD,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;gBAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/types/artifact.d.ts

@@ -14,7 +14,8 @@
  * 7. issuer.public_key_url must match primust.com/.well-known/ pattern
  * 8. test_mode: true rejected by primust-verify in --production mode
  */
-export type ProofLevel = 'mathematical' | 'verifiable_inference' | 'execution' | 'witnessed' | 'attestation';
+import type { ProofArtifact } from './proof_artifact.js';
+export type ProofLevel = 'mathematical' | 'verifiable_inference' | 'operator_bound' | 'execution' | 'witnessed' | 'attestation';
 export type SurfaceType = 'in_process_adapter' | 'middleware_interceptor' | 'platform_event_feed' | 'audit_log_ingest' | 'manual_assertion';
 export type ObservationMode = 'pre_action' | 'in_flight' | 'post_action_realtime' | 'post_action_batch';
 export type ScopeType = 'full_workflow' | 'orchestration_boundary' | 'platform_logged_events' | 'component_scope' | 'partial_unknown';
@@ -22,11 +23,11 @@ export type PolicyBasis = 'P1_self_declared' | 'P2_baseline_aligned' | 'P3_basel
 export type ArtifactState = 'provisional' | 'signed' | 'final';
 export type CommitmentAlgorithm = 'poseidon2' | 'sha256';
 export type Prover = 'local' | 'modal_cpu' | 'modal_gpu';
-export type ProverSystem = 'ultrahonk' | 'ezkl' | 'groth16_bionetta';
+export type ProverSystem = 'ultrahonk' | 'ezkl' | 'groth16_bionetta' | 'sp1';
 export type TsaProvider = 'digicert_us' | 'digicert_eu' | 'none';
 export type OrgRegion = 'us' | 'eu';
 export type GapSeverity = 'Critical' | 'High' | 'Medium' | 'Low' | 'Informational';
-export type GapType = 'check_not_executed' | 'enforcement_override' | 'engine_error' | 'check_degraded' | 'external_boundary_traversal' | 'lineage_token_missing' | 'admission_gate_override' | 'check_timing_suspect' | 'reviewer_credential_invalid' | 'witnessed_display_missing' | 'witnessed_rationale_missing' | 'deterministic_consistency_violation' | 'skip_rationale_missing' | 'policy_config_drift' | 'zkml_proof_pending_timeout' | 'zkml_proof_failed' | 'explanation_missing' | 'bias_audit_missing';
+export type GapType = 'check_not_executed' | 'enforcement_override' | 'engine_error' | 'check_degraded' | 'external_boundary_traversal' | 'lineage_token_missing' | 'admission_gate_override' | 'check_timing_suspect' | 'reviewer_credential_invalid' | 'witnessed_display_missing' | 'witnessed_rationale_missing' | 'witnessed_timestamp_invalid' | 'deterministic_consistency_violation' | 'skip_rationale_missing' | 'policy_config_drift' | 'proof_level_floor_breach' | 'zkml_proof_pending_timeout' | 'zkml_proof_failed' | 'system_error' | 'sla_breach' | 'explanation_missing' | 'bias_audit_missing' | 'system_unavailable' | 'archetype_unmapped' | 'upstream_vpec_invalid_signature' | 'upstream_vpec_sandbox' | 'upstream_vpec_key_revoked' | 'upstream_vpec_insufficient_proof_level' | 'upstream_vpec_missing_claim' | 'upstream_vpec_issuer_mismatch' | 'upstream_vpec_missing' | 'model_profile_missing' | 'missing_executor' | 'complyadvantage_api_error' | 'complyadvantage_auth_failure' | 'actimize_api_error' | 'actimize_auth_failure' | 'blaze_api_error' | 'blaze_auth_failure' | 'odm_api_error' | 'odm_auth_failure' | 'falcon_api_error' | 'falcon_auth_failure' | 'pega_api_error' | 'pega_auth_failure' | 'wolters_kluwer_api_error' | 'wolters_kluwer_auth_failure' | 'guidewire_api_error' | 'guidewire_auth_failure';
 export interface SurfaceEntry {
     surface_id: string;
     surface_type: SurfaceType;
@@ -39,6 +40,8 @@ export interface SurfaceEntry {
 export interface ProofDistribution {
     mathematical: number;
     verifiable_inference: number;
+    /** Optional until all issuers emit six-way distributions. */
+    operator_bound?: number;
     execution: number;
     witnessed: number;
     attestation: number;
@@ -121,7 +124,21 @@ export interface VPECArtifact {
     surface_summary: SurfaceEntry[];
     /** MUST equal proof_distribution.weakest_link. Computed — never set manually. */
     proof_level: ProofLevel;
+    /** Integer count per proof level. Canonical wire field (TECH_SPEC §3.5 field 15). */
     proof_distribution: ProofDistribution;
+    /**
+     * API-enriched distribution (same shape as ProofDistribution, plus fractional
+     * _count fields in the richer API response). Emitted alongside proof_distribution;
+     * not a replacement (TECH_SPEC §3.5 field 16, §3.7.2 dual naming is intentional).
+     */
+    provable_surface_breakdown?: ProofDistribution;
+    /**
+     * Scalar fraction 0.0-1.0 — aggregate proof quality (mathematical/total ratio).
+     * PS-INV-1: sub-fields of provable_surface_breakdown sum to this value (±0.0001).
+     * Distinct from proof_distribution and provable_surface_breakdown
+     * (TECH_SPEC §3.5 field 17).
+     */
+    provable_surface?: number | null;
     state: ArtifactState;
     coverage: Coverage;
     gaps: GapEntry[];
@@ -130,14 +147,58 @@ export interface VPECArtifact {
     /** Merkle root over all CheckExecutionRecord commitment_hashes. null when zero records. */
     commitment_root: string | null;
     commitment_algorithm: CommitmentAlgorithm;
+    /**
+     * Additive Poseidon2 Merkle root over the same `commitment_hashes`
+     * (BN254 field-element tree), emitted alongside the legacy SHA-256
+     * `commitment_root` for ZK-bearing artifacts.
+     *
+     * The primary `commitment_root` is SHA-256 (preserves SI-3 backward
+     * compatibility — ten years of consumers do `computeMerkleRoot` over
+     * the artifact's record commitment_hash list with SHA-256). ZK circuits
+     * operate over BN254 field elements with Poseidon2; their public-input
+     * `commitment_root` cannot be a SHA-256 digest. To anchor ZK proof
+     * commitment_roots to the same record list independently of the
+     * legacy SHA-256 root, ZK-bearing artifacts also publish this Poseidon2
+     * root.
+     *
+     * Used by:
+     *  - `verifySkipConditionProofAnchoring` (Finding 5 follow-up): reproduces
+     *    the modified record-tree root the proof's `commitment_root` public
+     *    input claims.
+     *  - `governance_upstream_vpec_inclusion` (Finding C corrective): downstream
+     *    run's lineage commitment is included in this tree without re-hashing
+     *    32-byte SHA-256 leaves inside the circuit.
+     *
+     * Format: `'poseidon2:<64-hex>'` matching the rest of the codebase's
+     * Poseidon2 commitment string convention.
+     *
+     * Convention:
+     *  - null for legacy artifacts and any ZK-less artifact (omitted on
+     *    older VPECs entirely).
+     *  - `'poseidon2:<64-hex>'` for artifacts that requested ZK proofs.
+     *
+     * Optional / additive — pre-fix VPECs predate this field. Verifiers must
+     * tolerate its absence on legacy artifacts.
+     */
+    commitment_root_poseidon2?: string | null;
     zk_proof: ZkProof | null;
+    /** GD-2: individual proof artifacts. Optional — absent on legacy VPECs. */
+    proof_artifacts?: ProofArtifact[];
     issuer: ArtifactIssuer;
     signature: ArtifactSignature;
     timestamp_anchor: TimestampAnchor;
     transparency_log: TransparencyLog;
     issued_at: string;
     pending_flags: PendingFlags;
-    /** true when issued with pk_test_xxx key. Rejected by primust-verify in --production. */
+    /** true when issued with pk_test_xxx or pk_sb_xxx key. Rejected by primust-verify in --production. */
     test_mode: boolean;
+    /** Hash of the active ControlPlan at issuance. null/absent for pre-v21 VPECs. */
+    control_plan_hash?: string | null;
+    /** Hash of the ObligationPlan linked to the active ControlPlan. */
+    obligation_plan_hash?: string | null;
+    /** ID of the active compliance approval on the ControlPlan. */
+    approval_id?: string | null;
+    /** Hash of the ApplicabilitySnapshot anchoring the governance chain. */
+    applicability_snapshot_hash?: string | null;
 }
 //# sourceMappingURL=artifact.d.ts.map

package/dist/types/artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../src/types/artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,MAAM,UAAU,GAClB,cAAc,GACd,sBAAsB,GACtB,WAAW,GACX,WAAW,GACX,aAAa,CAAC;AAElB,MAAM,MAAM,WAAW,GACnB,oBAAoB,GACpB,wBAAwB,GACxB,qBAAqB,GACrB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,WAAW,GACX,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,wBAAwB,GACxB,wBAAwB,GACxB,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,6BAA6B,CAAC;AAElC,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/D,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzD,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAEzD,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAErE,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,MAAM,CAAC;AAEjE,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,eAAe,CAAC;AAEnF,MAAM,MAAM,OAAO,GACf,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,gBAAgB,GAChB,6BAA6B,GAC7B,uBAAuB,GACvB,yBAAyB,GACzB,sBAAsB,GACtB,6BAA6B,GAC7B,2BAA2B,GAC3B,6BAA6B,GAC7B,qCAAqC,GACrC,wBAAwB,GACxB,qBAAqB,GACrB,4BAA4B,GAC5B,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,CAAC;AAIzB,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,CAAC;IAC1B,gBAAgB,EAAE,eAAe,CAAC;IAClC,aAAa,EAAE,UAAU,CAAC;IAC1B,UAAU,EAAE,SAAS,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,UAAU,CAAC;IACzB,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gJAAgJ;IAChJ,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,0EAA0E;IAC1E,6BAA6B,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,YAAY,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,+CAA+C;IAC/C,aAAa,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC;CACxB;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IAExB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IAEpB,mEAAmE;IACnE,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,WAAW,CAAC;IAE1B,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;IAEjB,eAAe,EAAE,YAAY,EAAE,CAAC;IAEhC,iFAAiF;IACjF,WAAW,EAAE,UAAU,CAAC;IACxB,kBAAkB,EAAE,iBAAiB,CAAC;IAEtC,KAAK,EAAE,aAAa,CAAC;IAErB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEjB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC,2FAA2F;IAC3F,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,EAAE,mBAAmB,CAAC;IAE1C,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IAEzB,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,gBAAgB,EAAE,eAAe,CAAC;IAElC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,YAAY,CAAC;IAE5B,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../src/types/artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,MAAM,MAAM,UAAU,GAClB,cAAc,GACd,sBAAsB,GACtB,gBAAgB,GAChB,WAAW,GACX,WAAW,GACX,aAAa,CAAC;AAElB,MAAM,MAAM,WAAW,GACnB,oBAAoB,GACpB,wBAAwB,GACxB,qBAAqB,GACrB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,WAAW,GACX,sBAAsB,GACtB,mBAAmB,CAAC;AAExB,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,wBAAwB,GACxB,wBAAwB,GACxB,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,6BAA6B,CAAC;AAElC,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/D,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzD,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAEzD,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,kBAAkB,GAAG,KAAK,CAAC;AAE7E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,aAAa,GAAG,MAAM,CAAC;AAEjE,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,eAAe,CAAC;AAEnF,MAAM,MAAM,OAAO,GAEf,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,gBAAgB,GAChB,6BAA6B,GAC7B,uBAAuB,GACvB,yBAAyB,GACzB,sBAAsB,GACtB,6BAA6B,GAC7B,2BAA2B,GAC3B,6BAA6B,GAC7B,6BAA6B,GAC7B,qCAAqC,GACrC,wBAAwB,GACxB,qBAAqB,GACrB,0BAA0B,GAC1B,4BAA4B,GAC5B,mBAAmB,GACnB,cAAc,GACd,YAAY,GACZ,qBAAqB,GACrB,oBAAoB,GAEpB,oBAAoB,GAEpB,oBAAoB,GAEpB,iCAAiC,GACjC,uBAAuB,GACvB,2BAA2B,GAC3B,wCAAwC,GACxC,6BAA6B,GAC7B,+BAA+B,GAC/B,uBAAuB,GAEvB,uBAAuB,GAEvB,kBAAkB,GAElB,2BAA2B,GAC3B,8BAA8B,GAC9B,oBAAoB,GACpB,uBAAuB,GACvB,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,qBAAqB,GACrB,gBAAgB,GAChB,mBAAmB,GACnB,0BAA0B,GAC1B,6BAA6B,GAC7B,qBAAqB,GACrB,wBAAwB,CAAC;AAI7B,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,CAAC;IAC1B,gBAAgB,EAAE,eAAe,CAAC;IAClC,aAAa,EAAE,UAAU,CAAC;IAC1B,UAAU,EAAE,SAAS,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,UAAU,CAAC;IACzB,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gJAAgJ;IAChJ,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,0EAA0E;IAC1E,6BAA6B,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,YAAY,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,GAAG,EAAE,WAAW,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,+CAA+C;IAC/C,aAAa,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC;CACxB;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IAExB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IAEpB,mEAAmE;IACnE,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,WAAW,CAAC;IAE1B,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;IAEjB,eAAe,EAAE,YAAY,EAAE,CAAC;IAEhC,iFAAiF;IACjF,WAAW,EAAE,UAAU,CAAC;IAExB,qFAAqF;IACrF,kBAAkB,EAAE,iBAAiB,CAAC;IAEtC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,iBAAiB,CAAC;IAE/C;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,KAAK,EAAE,aAAa,CAAC;IAErB,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEjB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC,2FAA2F;IAC3F,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,EAAE,mBAAmB,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1C,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IAEzB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;IAElC,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,gBAAgB,EAAE,eAAe,CAAC;IAElC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,YAAY,CAAC;IAE5B,sGAAsG;IACtG,SAAS,EAAE,OAAO,CAAC;IAEnB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wEAAwE;IACxE,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C"}

package/dist/types/proof_artifact.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ProofArtifact — individual proof record within a VPEC.
+ *
+ * Append-only: once created, a ProofArtifact MUST NOT be mutated.
+ * Each artifact represents a single proof job (Noir circuit, EZKL proof, etc.)
+ * and its verification outcome.
+ *
+ * Added in GD-2. Lives alongside the legacy zk_proof field on VPECArtifact;
+ * both shapes are valid.
+ */
+/**
+ * Verification status.
+ *
+ * Live DB row states (proof_artifacts.verification_status):
+ *   - 'pending'        — job submitted, awaiting webhook callback
+ *   - 'verified'       — terminal: proof verified
+ *   - 'failed'         — terminal: proof rejected or job errored
+ *   - 'not_applicable' — terminal: backend did not run (e.g. test_mode)
+ *
+ * Envelope-only state (sealed VPECs only; never appears in DB):
+ *   - 'unresolved_at_seal' — the proof job had not reached a terminal state
+ *     when the VPEC was sealed. The envelope is sealed-once (Phase 5), so
+ *     it can never observe the later verified|failed transition. Verifiers
+ *     MUST treat this as a hard error: counterparties must consult the
+ *     live API or treat the proof as unverified.
+ */
+export type VerificationStatus = 'verified' | 'pending' | 'failed' | 'not_applicable' | 'unresolved_at_seal';
+export interface ProofArtifact {
+    /** Primary key. Prefix: pa_ */
+    proof_artifact_id: string;
+    /** The proof job that produced this artifact, if tracked. */
+    proof_job_id?: string;
+    /** Backend that generated the proof (e.g. NoirBackend, EZKLBackend). */
+    backend: string;
+    /** Mechanism used (e.g. noir_circuit, ezkl_proof, groth16_bionetta). */
+    proof_mechanism: string;
+    /** Maps to an AssuranceClass via the assurance mapper (e.g. mathematical, verifiable_inference). */
+    assurance_subtype: string;
+    /** Reference to the verification material (e.g. S3 key, IPFS CID). */
+    verification_material_ref?: string;
+    /** Version of the backend that produced this proof. */
+    backend_version?: string;
+    /** Control ID this proof satisfies, if applicable. */
+    control_id?: string;
+    /** Component ID this proof covers, if applicable. */
+    component_id?: string;
+    /** Terminal verification status. Append-only — never transition backwards. */
+    verification_status: VerificationStatus;
+    /** When verification completed. null while pending. */
+    completed_at?: string;
+}
+//# sourceMappingURL=proof_artifact.d.ts.map

package/dist/types/proof_artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof_artifact.d.ts","sourceRoot":"","sources":["../../src/types/proof_artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,SAAS,GACT,QAAQ,GACR,gBAAgB,GAChB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAE1B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAEhB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IAExB,oGAAoG;IACpG,iBAAiB,EAAE,MAAM,CAAC;IAE1B,sEAAsE;IACtE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8EAA8E;IAC9E,mBAAmB,EAAE,kBAAkB,CAAC;IAExC,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/types/proof_artifact.js

@@ -0,0 +1,12 @@
+/**
+ * ProofArtifact — individual proof record within a VPEC.
+ *
+ * Append-only: once created, a ProofArtifact MUST NOT be mutated.
+ * Each artifact represents a single proof job (Noir circuit, EZKL proof, etc.)
+ * and its verification outcome.
+ *
+ * Added in GD-2. Lives alongside the legacy zk_proof field on VPECArtifact;
+ * both shapes are valid.
+ */
+export {};
+//# sourceMappingURL=proof_artifact.js.map

package/dist/types/proof_artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof_artifact.js","sourceRoot":"","sources":["../../src/types/proof_artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/validate-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-artifact.d.ts","sourceRoot":"","sources":["../src/validate-artifact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAiCD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CA6HpF"}
+{"version":3,"file":"validate-artifact.d.ts","sourceRoot":"","sources":["../src/validate-artifact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AA8GD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAgIpF"}

package/dist/validate-artifact.js

@@ -7,30 +7,106 @@
 const PROOF_LEVELS = [
     'mathematical',
     'verifiable_inference',
+    'operator_bound',
     'execution',
     'witnessed',
     'attestation',
 ];
+// Authoritative list synced with packages/db/migrations/076_gap_type_allowlist_expansion.sql
+// plus additional control-plan / GRT / action-level gap types that are emitted by
+// code paths not yet represented in migration 076. Keep in lockstep with the
+// Python sibling at packages/artifact-core-py/src/primust_artifact_core/validate_artifact.py.
 const GAP_TYPES = new Set([
+    // Original runtime-governance set (migration 019)
+    'admission_gate_override',
+    'check_degraded',
     'check_not_executed',
+    'check_timing_suspect',
+    'deterministic_consistency_violation',
     'enforcement_override',
     'engine_error',
-    'check_degraded',
     'external_boundary_traversal',
     'lineage_token_missing',
-    'admission_gate_override',
-    'check_timing_suspect',
+    'policy_config_drift',
     'reviewer_credential_invalid',
+    'skip_rationale_missing',
     'witnessed_display_missing',
     'witnessed_rationale_missing',
-    'deterministic_consistency_violation',
-    'skip_rationale_missing',
-    'policy_config_drift',
-    'zkml_proof_pending_timeout',
     'zkml_proof_failed',
+    'zkml_proof_pending_timeout',
+    // Server-emitted during run enrichment / VPEC assembly (migration 076)
+    'archetype_unmapped',
+    'bias_audit_missing',
+    'bounded_inference_downgrade',
+    'explanation_missing',
+    'manifest_metadata_missing',
+    'model_profile_missing',
+    'nesting_depth_exceeded',
+    'orphan_run_gap',
+    'parent_run_invalid',
+    'partial_submission',
+    'proof_level_floor_breach',
+    'provable_surface_invariant_violation',
+    'queue_drain_exhausted',
+    'record_count_mismatch',
+    'run_expired_without_close',
+    'sla_breach',
+    'stage_type_unresolved',
+    'subagent_identity_ambiguous',
+    'system_error',
+    'system_unavailable',
+    'witnessed_timestamp_invalid',
+    // Upstream VPEC verification failures
+    'upstream_vpec_insufficient_proof_level',
+    'upstream_vpec_invalid_signature',
+    'upstream_vpec_issuer_mismatch',
+    'upstream_vpec_key_revoked',
+    'upstream_vpec_missing',
+    'upstream_vpec_missing_claim',
+    'upstream_vpec_sandbox',
+    // Connector adapter errors (per-vendor allowlist)
+    'actimize_api_error',
+    'actimize_auth_failure',
+    'blaze_api_error',
+    'blaze_auth_failure',
+    'complyadvantage_api_error',
+    'complyadvantage_auth_failure',
+    'falcon_api_error',
+    'falcon_auth_failure',
+    'guidewire_api_error',
+    'guidewire_auth_failure',
+    'odm_api_error',
+    'odm_auth_failure',
+    'pega_api_error',
+    'pega_auth_failure',
+    'wolters_kluwer_api_error',
+    'wolters_kluwer_auth_failure',
+    // Migration-tool error categories
+    'migration_auth_failed',
+    'migration_record_unmigratable',
+    // Control-plan binding gaps (not yet in migration 076 but emitted by runs.py / auto_dispatcher)
+    'control_plan_binding_missing',
+    'control_plan_hash_mismatch',
+    'control_plan_system_mismatch',
+    // GRT / signing gaps
+    'grt_signing_failed',
+    'signing_delayed',
+    // Action-level gaps (ungoverned action discovery)
+    'ungoverned_action',
+    'consequential_ungoverned_action',
+    'missing_executor',
+    // Phase 6 bridge taxonomy (migration 134; docs/v29/ZK_BRIDGE_BUILD_PLAN.md §3)
+    'proof_dispatch_failure',
+    'proof_timeout',
+    'proof_verification_failure',
+    'circuit_not_green_yellow_quarantined',
+    'circuit_not_green_red_quarantined',
+    'witness_build_failure',
+    // Pre-bridge proof-failed webhook emits this; was missing from earlier allowlists
+    'proof_generation_failed',
 ]);
 const GAP_SEVERITIES = new Set(['Critical', 'High', 'Medium', 'Low', 'Informational']);
-const PUBLIC_KEY_URL_PATTERN = /^https:\/\/primust\.com\/\.well-known\/primust-pubkeys\/.+\.pem$/;
+const PUBLIC_KEY_URL_PATTERN = /^https:\/\/(?:primust|keys\.primust)\.com\/\.well-known\/primust-pubkeys\/.+\.pem$/;
 /**
  * Validate a VPEC artifact against all critical invariants.
  *
@@ -136,13 +212,15 @@ export function validateArtifact(artifact) {
             });
         }
     }
-    // Invariant 7: issuer.public_key_url must match primust.com/.well-known/ pattern
+    // Invariant 7: issuer.public_key_url must match an approved Primust key host
     const issuer = artifact.issuer;
     if (issuer && typeof issuer.public_key_url === 'string') {
         if (!PUBLIC_KEY_URL_PATTERN.test(issuer.public_key_url)) {
             errors.push({
                 code: 'ISSUER_URL_INVALID',
-                message: `issuer.public_key_url must match https://primust.com/.well-known/primust-pubkeys/*.pem, got "${issuer.public_key_url}"`,
+                message: 'issuer.public_key_url must match ' +
+                    'https://primust.com/.well-known/primust-pubkeys/*.pem or ' +
+                    `https://keys.primust.com/.well-known/primust-pubkeys/*.pem, got "${issuer.public_key_url}"`,
                 path: 'issuer.public_key_url',
             });
         }

package/dist/validate-artifact.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-artifact.js","sourceRoot":"","sources":["../src/validate-artifact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,MAAM,YAAY,GAAiB;IACjC,cAAc;IACd,sBAAsB;IACtB,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,cAAc;IACd,gBAAgB;IAChB,6BAA6B;IAC7B,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,6BAA6B;IAC7B,2BAA2B;IAC3B,6BAA6B;IAC7B,qCAAqC;IACrC,wBAAwB;IACxB,qBAAqB;IACrB,4BAA4B;IAC5B,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAEvF,MAAM,sBAAsB,GAAG,kEAAkE,CAAC;AAElG;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiC;IAChE,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,+DAA+D;IAC/D,IAAI,eAAe,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oDAAoD;YAC7D,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IACD,uBAAuB,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAE9C,+BAA+B;IAC/B,IAAI,QAAQ,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wCAAwC,QAAQ,CAAC,cAAc,GAAG;YAC3E,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,kBAAyD,CAAC;IACrF,IAAI,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,gBAAgB,QAAQ,CAAC,WAAW,qDAAqD,SAAS,CAAC,YAAY,GAAG;YAC3H,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAyB,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,gBAAgB,QAAQ,CAAC,WAAW,8BAA8B;YAC3E,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA4B,CAAC;YAE/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,QAAQ,CAAC,mEAAmE;oBACrF,IAAI,EAAE,QAAQ,CAAC,GAAG;iBACnB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,QAAQ,CAAC,gDAAgD;oBAClE,IAAI,EAAE,QAAQ,CAAC,GAAG;iBACnB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,QAAQ,CAAC,0CAA0C;oBAC5D,IAAI,EAAE,QAAQ,CAAC,GAAG;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAkB,CAAC,EAAE,CAAC;gBAC3D,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,QAAQ,CAAC,eAAe,GAAG,CAAC,QAAQ,2BAA2B;oBACxE,IAAI,EAAE,QAAQ,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAkB,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,QAAQ,CAAC,eAAe,GAAG,CAAC,QAAQ,2BAA2B;oBACxE,IAAI,EAAE,QAAQ,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAC;IAC1E,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC1C,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,IAAI,QAAQ,CAAC,mBAAmB,KAAK,CAAC,EAAE,CAAC;YAC3F,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,2DAA2D,QAAQ,CAAC,mBAAmB,EAAE;gBAClG,IAAI,EAAE,8BAA8B;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA6C,CAAC;IACtE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACxD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,gGAAgG,MAAM,CAAC,cAAc,GAAG;gBACjI,IAAI,EAAE,uBAAuB;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,+DAA+D;AAC/D,SAAS,uBAAuB,CAC9B,GAA4B,EAC5B,IAAY,EACZ,MAAyB;IAEzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,IAAI,GAAG,KAAK,eAAe,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,gEAAgE,WAAW,GAAG;gBACvF,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,uBAAuB,CAAC,KAAgC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate-artifact.js","sourceRoot":"","sources":["../src/validate-artifact.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,MAAM,YAAY,GAAiB;IACjC,cAAc;IACd,sBAAsB;IACtB,gBAAgB;IAChB,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC;AAEF,6FAA6F;AAC7F,kFAAkF;AAClF,6EAA6E;AAC7E,8FAA8F;AAC9F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,kDAAkD;IAClD,yBAAyB;IACzB,gBAAgB;IAChB,oBAAoB;IACpB,sBAAsB;IACtB,qCAAqC;IACrC,sBAAsB;IACtB,cAAc;IACd,6BAA6B;IAC7B,uBAAuB;IACvB,qBAAqB;IACrB,6BAA6B;IAC7B,wBAAwB;IACxB,2BAA2B;IAC3B,6BAA6B;IAC7B,mBAAmB;IACnB,4BAA4B;IAC5B,uEAAuE;IACvE,oBAAoB;IACpB,oBAAoB;IACpB,6BAA6B;IAC7B,qBAAqB;IACrB,2BAA2B;IAC3B,uBAAuB;IACvB,wBAAwB;IACxB,gBAAgB;IAChB,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;IAC1B,sCAAsC;IACtC,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,YAAY;IACZ,uBAAuB;IACvB,6BAA6B;IAC7B,cAAc;IACd,oBAAoB;IACpB,6BAA6B;IAC7B,sCAAsC;IACtC,wCAAwC;IACxC,iCAAiC;IACjC,+BAA+B;IAC/B,2BAA2B;IAC3B,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;IACvB,kDAAkD;IAClD,oBAAoB;IACpB,uBAAuB;IACvB,iBAAiB;IACjB,oBAAoB;IACpB,2BAA2B;IAC3B,8BAA8B;IAC9B,kBAAkB;IAClB,qBAAqB;IACrB,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,0BAA0B;IAC1B,6BAA6B;IAC7B,kCAAkC;IAClC,uBAAuB;IACvB,+BAA+B;IAC/B,gGAAgG;IAChG,8BAA8B;IAC9B,4BAA4B;IAC5B,8BAA8B;IAC9B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kDAAkD;IAClD,mBAAmB;IACnB,iCAAiC;IACjC,kBAAkB;IAClB,+EAA+E;IAC/E,wBAAwB;IACxB,eAAe;IACf,4BAA4B;IAC5B,sCAAsC;IACtC,mCAAmC;IACnC,uBAAuB;IACvB,kFAAkF;IAClF,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;AAEvF,MAAM,sBAAsB,GAC1B,oFAAoF,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiC;IAChE,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,+DAA+D;IAC/D,IAAI,eAAe,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oDAAoD;YAC7D,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;IACD,uBAAuB,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAE9C,+BAA+B;IAC/B,IAAI,QAAQ,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wCAAwC,QAAQ,CAAC,cAAc,GAAG;YAC3E,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,kBAAyD,CAAC;IACrF,IAAI,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,gBAAgB,QAAQ,CAAC,WAAW,qDAAqD,SAAS,CAAC,YAAY,GAAG;YAC3H,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAyB,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,gBAAgB,QAAQ,CAAC,WAAW,8BAA8B;YAC3E,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA4B,CAAC;YAE/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,QAAQ,CAAC,mEAAmE;oBACrF,IAAI,EAAE,QAAQ,CAAC,GAAG;iBACnB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,QAAQ,CAAC,gDAAgD;oBAClE,IAAI,EAAE,QAAQ,CAAC,GAAG;iBACnB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,QAAQ,CAAC,0CAA0C;oBAC5D,IAAI,EAAE,QAAQ,CAAC,GAAG;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAkB,CAAC,EAAE,CAAC;gBAC3D,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,QAAQ,CAAC,eAAe,GAAG,CAAC,QAAQ,2BAA2B;oBACxE,IAAI,EAAE,QAAQ,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAkB,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,QAAQ,CAAC,eAAe,GAAG,CAAC,QAAQ,2BAA2B;oBACxE,IAAI,EAAE,QAAQ,CAAC,YAAY;iBAC5B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAC;IAC1E,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC1C,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,IAAI,QAAQ,CAAC,mBAAmB,KAAK,CAAC,EAAE,CAAC;YAC3F,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,2DAA2D,QAAQ,CAAC,mBAAmB,EAAE;gBAClG,IAAI,EAAE,8BAA8B;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA6C,CAAC;IACtE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACxD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EACL,mCAAmC;oBACnC,2DAA2D;oBAC3D,oEAAoE,MAAM,CAAC,cAAc,GAAG;gBAC9F,IAAI,EAAE,uBAAuB;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,+DAA+D;AAC/D,SAAS,uBAAuB,CAC9B,GAA4B,EAC5B,IAAY,EACZ,MAAyB;IAEzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,IAAI,GAAG,KAAK,eAAe,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,gEAAgE,WAAW,GAAG;gBACvF,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,uBAAuB,CAAC,KAAgC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/validate-artifact.test.js

@@ -93,6 +93,19 @@ describe('validateArtifact', () => {
         expect(result.valid).toBe(true);
         expect(result.errors).toHaveLength(0);
     });
+    it('keys.primust.com public key URL passes validation', () => {
+        const result = validateArtifact(validArtifact({
+            issuer: {
+                signer_id: 'signer_test',
+                kid: 'kid_test',
+                algorithm: 'Ed25519',
+                public_key_url: 'https://keys.primust.com/.well-known/primust-pubkeys/abc123.pem',
+                org_region: 'us',
+            },
+        }));
+        expect(result.valid).toBe(true);
+        expect(result.errors).toHaveLength(0);
+    });
     describe('MUST PASS: invariant enforcement', () => {
         it('proof_level above weakest_link → validation error', () => {
             const artifact = validArtifact({
@@ -161,14 +174,15 @@ describe('validateArtifact', () => {
             expect(result.valid).toBe(false);
             expect(result.errors.some((e) => e.code === 'INVALID_SCHEMA_VERSION')).toBe(true);
         });
-        it('all 5 proof levels valid in proof_level enum', () => {
-            const levels = ['mathematical', 'verifiable_inference', 'execution', 'witnessed', 'attestation'];
+        it('all 6 proof levels valid in proof_level enum', () => {
+            const levels = ['mathematical', 'verifiable_inference', 'operator_bound', 'execution', 'witnessed', 'attestation'];
             for (const level of levels) {
                 const artifact = validArtifact({
                     proof_level: level,
                     proof_distribution: {
                         mathematical: 0,
                         verifiable_inference: 0,
+                        operator_bound: 0,
                         execution: 0,
                         witnessed: 0,
                         attestation: 0,