@primust/verifier 1.0.0

package/LICENSE

@@ -0,0 +1,93 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form.
+
+      "Work" shall mean the work of authorship made available under
+      the License.
+
+      "Contribution" shall mean any work of authorship submitted to the
+      Licensor for inclusion in the Work.
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      whom a Contribution has been received by the Licensor.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell,
+      import, and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file, You must include
+          a readable copy of the attribution notices contained within
+          such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. The Work is provided on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event shall any Contributor be
+      liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Primust Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/bounded-trace.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Reference TypeScript interpreter for bounded_trace_v1 verification.
+ *
+ * This is the canonical second-opinion verifier described in PRIMUST_V27 §20.2,
+ * ported from verifier-py/src/primust_verify/bounded_trace.py. It is
+ * intentionally small and obviously-correct: consumes a BoundedTraceV1 payload
+ * plus a ProfileRecord and produces one of the §16.3 canonical downgrade
+ * reason codes (or "ok" on success).
+ *
+ * Crypto used: SHA-256 with RFC 6962-style domain-separated leaves (0x00)
+ * and nodes (0x01). Canonical JSON follows RFC 8785 + ECMAScript 7.1.12.1
+ * number serialization for cross-language parity.
+ *
+ * SI-3 (VPEC verifiability): this module's output MUST match the Python
+ * reference byte-for-byte across the shared conformance fixture corpus at
+ * packages/verifier-py/tests/fixtures/bounded_trace_v1/. The conformance
+ * runner in scripts/lane_a_conformance.* enforces this.
+ *
+ * Zero runtime dependencies besides node:crypto.
+ */
+export declare function canonicalNumber(x: number): string;
+/**
+ * Canonical JSON serialization:
+ *   - object keys sorted lexicographically
+ *   - UTF-8
+ *   - separators ",":":",  no whitespace
+ *   - numbers via canonicalNumber
+ *   - strings via JSON.stringify (same escape rules as Python json with ensure_ascii=False)
+ */
+export declare function canonicalJson(obj: unknown): Uint8Array;
+export declare function canonicalJsonString(obj: unknown): string;
+export declare function buildMerkleRoot(leaves: Uint8Array[]): string;
+export interface BoundedTraceResult {
+    valid: boolean;
+    proof_level: "operator_bound" | "execution";
+    reason: string;
+    disclosed_operator_count: number;
+    verified_merkle_paths: number;
+    details: Record<string, unknown>;
+}
+export declare const REASONS: readonly ["profile_not_found", "profile_signature_invalid", "profile_not_empirical", "profile_expired", "profile_revoked", "profile_no_freshness_window", "profile_trace_mismatch", "runtime_not_supported", "trace_schema_unknown", "missing_merkle_root", "merkle_inclusion_failed", "threshold_violation", "runtime_section_missing", "retrieval_section_missing", "closed_api_pre_cohort", "closed_api_pre_promote", "closed_api_v2_promoted", "profile_deprecated", "unknown_lifecycle_state"];
+export type ReasonCode = (typeof REASONS)[number] | "thresholds_verified";
+export declare function verifyBoundedTrace(trace: Record<string, unknown>, profile: Record<string, unknown>, options?: {
+    now?: Date;
+}): BoundedTraceResult;
+//# sourceMappingURL=bounded-trace.d.ts.map

package/dist/bounded-trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-trace.d.ts","sourceRoot":"","sources":["../src/bounded-trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CA6BjD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAGtD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAiBxD;AAiCD,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAgB5D;AAID,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,gBAAgB,GAAG,WAAW,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB,EAAE,MAAM,CAAC;IACjC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAID,eAAO,MAAM,OAAO,qeA0BV,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAC;AAsS1E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAC3B,kBAAkB,CA2JpB"}