@qed-proof/sdk 0.1.1

package/dist/index.cjs

@@ -0,0 +1,1074 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  QedProof: () => QedProof,
+  QedProofError: () => QedProofError,
+  RateLimitError: () => RateLimitError,
+  SIG_DOMAIN: () => SIG_DOMAIN,
+  SPEC_VERSION: () => SPEC_VERSION,
+  actions: () => actions_exports,
+  b64u: () => b64u,
+  b64uDecode: () => b64uDecode,
+  claimDigest: () => claimDigest,
+  hasFloatText: () => hasFloatText,
+  hasFloatValue: () => hasFloatValue,
+  jcs: () => jcs,
+  keyId: () => keyId,
+  leafHash: () => leafHash,
+  rootFromInclusion: () => rootFromInclusion,
+  sha256: () => sha256,
+  verifyReceipt: () => verifyReceipt,
+  verifySignature: () => verifySignature
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var QedProofError = class extends Error {
+  status;
+  detail;
+  constructor(status, detail) {
+    super(`QedProof API error ${status}: ${detail}`);
+    this.name = "QedProofError";
+    this.status = status;
+    this.detail = detail;
+  }
+};
+var RateLimitError = class extends QedProofError {
+  retryAfter;
+  constructor(detail, retryAfter) {
+    super(429, detail);
+    this.name = "RateLimitError";
+    this.retryAfter = retryAfter;
+  }
+};
+
+// src/primitives.ts
+var import_ed25519 = require("@noble/curves/ed25519");
+var import_sha2 = require("@noble/hashes/sha2");
+var import_canonicalize = __toESM(require("canonicalize"), 1);
+var SPEC_VERSION = "poaw/0.1";
+var SIG_DOMAIN = new TextEncoder().encode("POAW-RECEIPT-V0\n");
+function b64u(data) {
+  let binary = "";
+  for (let i = 0; i < data.length; i++) binary += String.fromCharCode(data[i]);
+  const base64 = btoa(binary);
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64uDecode(text) {
+  const padded = text + "=".repeat((4 - text.length % 4) % 4);
+  const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function jcs(obj) {
+  const text = (0, import_canonicalize.default)(obj);
+  if (text === void 0) {
+    throw new TypeError("jcs: value is not JSON-serializable");
+  }
+  return new TextEncoder().encode(text);
+}
+function sha256(data) {
+  return (0, import_sha2.sha256)(data);
+}
+function concatBytes(...parts) {
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const p of parts) {
+    out.set(p, offset);
+    offset += p.length;
+  }
+  return out;
+}
+function hasFloatValue(value) {
+  if (typeof value === "boolean") return false;
+  if (typeof value === "number") return !Number.isInteger(value);
+  if (Array.isArray(value)) return value.some(hasFloatValue);
+  if (value !== null && typeof value === "object") {
+    return Object.values(value).some(hasFloatValue);
+  }
+  return false;
+}
+function hasFloatText(text) {
+  let i = 0;
+  const n = text.length;
+  while (i < n) {
+    const ch = text[i];
+    if (ch === '"') {
+      i++;
+      while (i < n) {
+        if (text[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (text[i] === '"') {
+          i++;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (ch === "-" || ch >= "0" && ch <= "9") {
+      const start = i;
+      if (ch === "-") i++;
+      let sawFloatChar = false;
+      while (i < n && text[i] >= "0" && text[i] <= "9") i++;
+      if (text[i] === ".") {
+        sawFloatChar = true;
+        i++;
+        while (i < n && text[i] >= "0" && text[i] <= "9") i++;
+      }
+      if (text[i] === "e" || text[i] === "E") {
+        sawFloatChar = true;
+        i++;
+        if (text[i] === "+" || text[i] === "-") i++;
+        while (i < n && text[i] >= "0" && text[i] <= "9") i++;
+      }
+      if (i === start) i++;
+      if (sawFloatChar) return true;
+      continue;
+    }
+    i++;
+  }
+  return false;
+}
+function keyId(pkRaw) {
+  return "ed25519:" + b64u(sha256(pkRaw));
+}
+function verifySignature(pkRaw, body, sigValue) {
+  try {
+    const sig = b64uDecode(sigValue);
+    const message = concatBytes(SIG_DOMAIN, jcs(body));
+    return import_ed25519.ed25519.verify(sig, message, pkRaw);
+  } catch {
+    return false;
+  }
+}
+function claimDigest(claim) {
+  const stripped = {};
+  for (const k of Object.keys(claim)) {
+    if (k !== "claim_digest") stripped[k] = claim[k];
+  }
+  return b64u(sha256(jcs(stripped)));
+}
+function leafHash(receipt) {
+  return sha256(concatBytes(new Uint8Array([0]), jcs({ body: receipt.body, signature: receipt.signature })));
+}
+function nodeHash(left, right) {
+  return sha256(concatBytes(new Uint8Array([1]), left, right));
+}
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+function rootFromInclusion(index, size, leaf, path) {
+  if (index >= size) return null;
+  let fn = index;
+  let sn = size - 1;
+  let r = leaf;
+  for (const p of path) {
+    if (sn === 0) return null;
+    if ((fn & 1) === 1 || fn === sn) {
+      r = nodeHash(p, r);
+      if ((fn & 1) === 0) {
+        while (fn !== 0 && (fn & 1) === 0) {
+          fn >>= 1;
+          sn >>= 1;
+        }
+      }
+    } else {
+      r = nodeHash(r, p);
+    }
+    fn >>= 1;
+    sn >>= 1;
+  }
+  return sn === 0 ? r : null;
+}
+
+// src/schema.ts
+var import__ = __toESM(require("ajv/dist/2020.js"), 1);
+var import_ajv_formats = __toESM(require("ajv-formats"), 1);
+
+// src/generated/receipt-schema.ts
+var receiptSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:poaw:schema:0.1:receipt",
+  "title": "PoAW receipt (poaw/0.1)",
+  "description": "Structural schema for a Proof of Agent Work receipt. Signature, inclusion and anchor checks are defined in SPEC.md and are not expressible in JSON Schema.",
+  "type": "object",
+  "required": [
+    "body",
+    "signature"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "body": {
+      "$ref": "#/$defs/body"
+    },
+    "signature": {
+      "$ref": "#/$defs/signature"
+    },
+    "proof": {
+      "$ref": "#/$defs/proof"
+    }
+  },
+  "$defs": {
+    "timestamp": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,3})?Z$"
+    },
+    "b64url": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]+$"
+    },
+    "keyId": {
+      "type": "string",
+      "pattern": "^ed25519:[A-Za-z0-9_-]{43}$"
+    },
+    "fingerprint": {
+      "type": "string",
+      "pattern": "^sha256:[A-Za-z0-9_-]{43}$"
+    },
+    "action": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(\\.[a-z0-9_]+){2}$"
+    },
+    "verdictValue": {
+      "enum": [
+        "verified",
+        "late",
+        "mismatch",
+        "failed",
+        "unverifiable"
+      ]
+    },
+    "reasonCode": {
+      "enum": [
+        "not_found",
+        "content_mismatch",
+        "target_mismatch",
+        "observed_after_tolerance",
+        "no_connection",
+        "permission_denied",
+        "rate_limited",
+        "destination_unavailable",
+        "unsupported_action",
+        "claim_ambiguous",
+        "verifier_error"
+      ]
+    },
+    "body": {
+      "type": "object",
+      "required": [
+        "spec_version",
+        "receipt_id",
+        "issued_at",
+        "issuer",
+        "agent",
+        "claim",
+        "observation",
+        "verdict",
+        "trust_level"
+      ],
+      "properties": {
+        "spec_version": {
+          "const": "poaw/0.1"
+        },
+        "receipt_id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "issued_at": {
+          "$ref": "#/$defs/timestamp"
+        },
+        "issuer": {
+          "type": "object",
+          "required": [
+            "key_id"
+          ],
+          "properties": {
+            "key_id": {
+              "$ref": "#/$defs/keyId"
+            },
+            "name": {
+              "type": "string",
+              "maxLength": 128
+            }
+          }
+        },
+        "agent": {
+          "type": "object",
+          "required": [
+            "id"
+          ],
+          "properties": {
+            "id": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 256
+            },
+            "erc8004": {
+              "type": "object",
+              "required": [
+                "chain",
+                "registry",
+                "agent_id"
+              ],
+              "properties": {
+                "chain": {
+                  "type": "string",
+                  "pattern": "^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$"
+                },
+                "registry": {
+                  "type": "string"
+                },
+                "agent_id": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "operator": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "claim": {
+          "type": "object",
+          "required": [
+            "action",
+            "target",
+            "params",
+            "claimed_at",
+            "claim_digest"
+          ],
+          "properties": {
+            "action": {
+              "$ref": "#/$defs/action"
+            },
+            "target": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 512
+            },
+            "params": {
+              "type": "object"
+            },
+            "claimed_at": {
+              "$ref": "#/$defs/timestamp"
+            },
+            "client_claim_id": {
+              "type": "string",
+              "maxLength": 256
+            },
+            "claim_digest": {
+              "$ref": "#/$defs/b64url"
+            }
+          }
+        },
+        "observation": {
+          "type": "object",
+          "required": [
+            "verifier",
+            "observed_at",
+            "deadline_at",
+            "attempts",
+            "facts"
+          ],
+          "properties": {
+            "verifier": {
+              "type": "object",
+              "required": [
+                "id",
+                "version"
+              ],
+              "properties": {
+                "id": {
+                  "$ref": "#/$defs/action"
+                },
+                "version": {
+                  "type": "string",
+                  "pattern": "^\\d+$"
+                },
+                "code_hash": {
+                  "$ref": "#/$defs/fingerprint"
+                }
+              }
+            },
+            "observed_at": {
+              "$ref": "#/$defs/timestamp"
+            },
+            "deadline_at": {
+              "$ref": "#/$defs/timestamp"
+            },
+            "attempts": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "facts": {
+              "type": "object"
+            }
+          }
+        },
+        "verdict": {
+          "type": "object",
+          "required": [
+            "value"
+          ],
+          "properties": {
+            "value": {
+              "$ref": "#/$defs/verdictValue"
+            },
+            "reason_code": {
+              "$ref": "#/$defs/reasonCode"
+            }
+          },
+          "if": {
+            "properties": {
+              "value": {
+                "const": "unverifiable"
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "value",
+              "reason_code"
+            ]
+          }
+        },
+        "trust_level": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 4
+        },
+        "attestation": {
+          "type": "object",
+          "required": [
+            "type",
+            "document"
+          ],
+          "properties": {
+            "type": {
+              "type": "string"
+            },
+            "document": {
+              "$ref": "#/$defs/b64url"
+            }
+          }
+        },
+        "supersedes": {
+          "type": "string"
+        }
+      },
+      "if": {
+        "properties": {
+          "trust_level": {
+            "minimum": 3
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "attestation"
+        ],
+        "properties": {
+          "observation": {
+            "properties": {
+              "verifier": {
+                "required": [
+                  "id",
+                  "version",
+                  "code_hash"
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "required": [
+        "alg",
+        "key_id",
+        "value"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "alg": {
+          "const": "Ed25519"
+        },
+        "key_id": {
+          "$ref": "#/$defs/keyId"
+        },
+        "value": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{86}$"
+        }
+      }
+    },
+    "proof": {
+      "type": "object",
+      "required": [
+        "log_id",
+        "leaf_index",
+        "tree_size",
+        "root_hash",
+        "inclusion"
+      ],
+      "properties": {
+        "log_id": {
+          "$ref": "#/$defs/b64url"
+        },
+        "leaf_index": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "tree_size": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "root_hash": {
+          "$ref": "#/$defs/b64url"
+        },
+        "inclusion": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/b64url"
+          }
+        },
+        "anchor": {
+          "type": "object",
+          "required": [
+            "chain",
+            "scheme",
+            "uid",
+            "tx_hash",
+            "tree_size"
+          ],
+          "properties": {
+            "chain": {
+              "type": "string"
+            },
+            "scheme": {
+              "const": "eas"
+            },
+            "uid": {
+              "type": "string",
+              "pattern": "^0x[0-9a-fA-F]{64}$"
+            },
+            "tx_hash": {
+              "type": "string",
+              "pattern": "^0x[0-9a-fA-F]{64}$"
+            },
+            "tree_size": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        }
+      }
+    }
+  }
+};
+
+// src/schema.ts
+var ajv = new import__.default({ allErrors: false, strict: false });
+(0, import_ajv_formats.default)(ajv);
+var validate = ajv.compile(receiptSchema);
+function schemaValid(receipt) {
+  return Boolean(validate(receipt));
+}
+
+// src/anchor.ts
+var import_sha3 = require("@noble/hashes/sha3");
+
+// src/abi.ts
+function readWord(data, wordIndex) {
+  const start = wordIndex * 32;
+  return data.subarray(start, start + 32);
+}
+function decodeStaticField(word, kind) {
+  switch (kind) {
+    case "bytes32":
+      return word.slice();
+    case "uint64": {
+      let v = 0n;
+      for (let i = 24; i < 32; i++) v = v << 8n | BigInt(word[i]);
+      return v;
+    }
+    case "address": {
+      const bytes = word.subarray(12, 32);
+      return "0x" + Buffer_toHex(bytes);
+    }
+    case "bool":
+      return word[31] !== 0;
+  }
+}
+function Buffer_toHex(bytes) {
+  let s = "";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+function decodeTupleWithTrailingDynamic(data, staticKinds, dynamicKind) {
+  const statics = staticKinds.map((kind, i) => decodeStaticField(readWord(data, i), kind));
+  const offsetWord = readWord(data, staticKinds.length);
+  let offset = 0n;
+  for (const b of offsetWord) offset = offset << 8n | BigInt(b);
+  const off = Number(offset);
+  const lenWord = data.subarray(off, off + 32);
+  let len = 0n;
+  for (const b of lenWord) len = len << 8n | BigInt(b);
+  const length = Number(len);
+  const raw = data.subarray(off + 32, off + 32 + length);
+  const dynamic = dynamicKind === "string" ? new TextDecoder().decode(raw) : raw.slice();
+  return { statics, dynamic };
+}
+function decodeSingleDynamicTupleReturn(returnData, staticKinds, dynamicKind) {
+  const outerOffsetWord = readWord(returnData, 0);
+  let outerOffset = 0n;
+  for (const b of outerOffsetWord) outerOffset = outerOffset << 8n | BigInt(b);
+  const tupleStart = Number(outerOffset);
+  return decodeTupleWithTrailingDynamic(returnData.subarray(tupleStart), staticKinds, dynamicKind);
+}
+function bytesToHex0x(bytes) {
+  return "0x" + Buffer_toHex(bytes);
+}
+function hexToBytes(hex) {
+  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  const out = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(clean.substr(i * 2, 2), 16);
+  return out;
+}
+
+// src/anchor.ts
+var EAS = "0x4200000000000000000000000000000000000021";
+function selector(signature) {
+  return (0, import_sha3.keccak_256)(new TextEncoder().encode(signature)).slice(0, 4);
+}
+var GET_SELECTOR = selector("getAttestation(bytes32)");
+var ATT_STATIC_KINDS = ["bytes32", "bytes32", "uint64", "uint64", "uint64", "bytes32", "address", "address", "bool"];
+var DATA_STATIC_KINDS = ["bytes32", "uint64", "bytes32", "uint64", "bytes32"];
+async function rpc(url, method, ...params) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json", "user-agent": "qed-proof-sdk-js/0.1" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+  });
+  const body = await res.json();
+  if (body && body.error) {
+    throw new Error(`${method}: ${body.error.message ?? "rpc error"}`);
+  }
+  return body.result;
+}
+async function checkAnchor(proof, keyset, rpcUrl) {
+  const a = proof.anchor;
+  if (!a) return { ok: false, reason: "unknown_scheme", proven_by: null };
+  try {
+    if (a.scheme !== "eas") return { ok: false, reason: "unknown_scheme", proven_by: null };
+    const chainIdHex = await rpc(rpcUrl, "eth_chainId");
+    const wantChainId = a.chain.split(":")[1];
+    if (BigInt(chainIdHex) !== BigInt(wantChainId)) {
+      return { ok: false, reason: "rpc_chain_mismatch", proven_by: null };
+    }
+    const uid = hexToBytes(a.uid);
+    const callData = new Uint8Array([...GET_SELECTOR, ...uid]);
+    const out = await rpc(rpcUrl, "eth_call", { to: EAS, data: bytesToHex0x(callData) }, "latest");
+    const returnData = hexToBytes(out);
+    const { statics, dynamic } = decodeSingleDynamicTupleReturn(returnData, [...ATT_STATIC_KINDS], "bytes");
+    const [uid_, schema, time_, _exp, revokedAt, _ref, _recipient, attester, _revocable] = statics;
+    const data = dynamic;
+    if (!bytesEqual(uid_, uid) || time_ === 0n) {
+      return { ok: false, reason: "attestation_not_found", proven_by: null };
+    }
+    if (revokedAt !== 0n) {
+      return { ok: false, reason: "attestation_revoked", proven_by: null };
+    }
+    const attesterLower = attester.toLowerCase();
+    const publishedAttesters = new Set((keyset.anchor_addresses ?? []).map((x) => x.toLowerCase()));
+    if (!publishedAttesters.has(attesterLower)) {
+      return { ok: false, reason: "attester_not_published", proven_by: null };
+    }
+    const schemaHex = "0x" + bytesToHex0x(schema).slice(2);
+    const publishedSchemas = new Set((keyset.anchor_schemas ?? []).map((x) => x.toLowerCase()));
+    if (!publishedSchemas.has(schemaHex.toLowerCase())) {
+      return { ok: false, reason: "schema_not_published", proven_by: null };
+    }
+    let decodedData;
+    try {
+      decodedData = decodeTupleWithTrailingDynamic(data, [...DATA_STATIC_KINDS], "string");
+    } catch {
+      return { ok: false, reason: "data_undecodable", proven_by: null };
+    }
+    const [logId, size, root, _prevSize, _prevRoot] = decodedData.statics;
+    if (!bytesEqual(logId, b64uDecode(proof.log_id)) || size !== BigInt(a.tree_size)) {
+      return { ok: false, reason: "log_or_size_mismatch", proven_by: null };
+    }
+    if (a.tree_size !== proof.tree_size) {
+      return { ok: false, reason: "consistency_proof_required", proven_by: null };
+    }
+    if (!bytesEqual(root, b64uDecode(proof.root_hash))) {
+      return { ok: false, reason: "root_mismatch", proven_by: null };
+    }
+    return { ok: true, reason: "anchored", proven_by: Number(time_) };
+  } catch (exc) {
+    const name = exc instanceof Error ? exc.constructor.name : "Error";
+    return { ok: false, reason: `unreadable:${name}`, proven_by: null };
+  }
+}
+
+// src/verify.ts
+var RECEIPT_TEXT = /* @__PURE__ */ new WeakMap();
+async function verifyReceipt(receipt, options) {
+  const raw = typeof receipt === "string" ? receipt : receipt && typeof receipt === "object" ? RECEIPT_TEXT.get(receipt) : void 0;
+  const parsed = typeof receipt === "string" ? JSON.parse(receipt) : receipt ?? {};
+  const keyset = options.keys ?? {};
+  const checks = {};
+  const body = (parsed && typeof parsed === "object" ? parsed.body : void 0) ?? {};
+  const version = String(body.spec_version ?? "");
+  const parts = version.split("/");
+  checks.spec_version = parts[0] === "poaw" && (parts[parts.length - 1] ?? "").split(".")[0] === "0";
+  checks.schema = schemaValid(parsed);
+  const integerFail = raw !== void 0 ? hasFloatText(raw) : hasFloatValue(parsed);
+  checks.integers_only = !integerFail;
+  const sig = (parsed && typeof parsed === "object" ? parsed.signature : void 0) ?? {};
+  const keys = keyset.keys ?? [];
+  const key = keys.find((k) => k.key_id === sig?.key_id);
+  const issued = String(body.issued_at ?? "");
+  const issuer = body.issuer;
+  let keyOk = false;
+  if (key && sig?.key_id === issuer?.key_id) {
+    try {
+      const computedKeyId = keyId(b64uDecode(key.public_key));
+      keyOk = computedKeyId === key.key_id && key.valid_from <= issued && (key.revoked_at === null || key.revoked_at === void 0 || issued < key.revoked_at);
+    } catch {
+      keyOk = false;
+    }
+  }
+  checks.key = keyOk;
+  let sigOk = false;
+  if (keyOk && key) {
+    try {
+      sigOk = verifySignature(b64uDecode(key.public_key), body, sig?.value ?? "");
+    } catch {
+      sigOk = false;
+    }
+  }
+  checks.signature = sigOk;
+  const claim = body.claim;
+  checks.claim_digest = Boolean(claim) && typeof claim === "object" && claim.claim_digest === claimDigest(claim);
+  const proof = parsed && typeof parsed === "object" ? parsed.proof : void 0;
+  let provenBy;
+  if (!proof) {
+    checks.inclusion = "absent";
+  } else {
+    const root = rootFromInclusion(
+      proof.leaf_index,
+      proof.tree_size,
+      leafHash({ body: parsed.body, signature: parsed.signature }),
+      proof.inclusion.map((h) => b64uDecode(h))
+    );
+    checks.inclusion = root !== null && b64u(root) === proof.root_hash;
+  }
+  if (!(proof && proof.anchor)) {
+    checks.anchor = "absent";
+  } else if (!options.rpcUrl) {
+    checks.anchor = "not_checked_offline";
+  } else {
+    const a = await checkAnchor(proof, keyset, options.rpcUrl);
+    checks.anchor = a.ok ? true : a.reason;
+    provenBy = a.proven_by;
+  }
+  const required = [
+    "spec_version",
+    "schema",
+    "integers_only",
+    "key",
+    "signature",
+    "claim_digest"
+  ];
+  const valid = required.every((k) => checks[k] === true) && (checks.inclusion === true || checks.inclusion === "absent");
+  const achievedTrustLevel = valid ? checks.inclusion === true && checks.anchor === true ? 2 : 1 : 0;
+  const verdictValue = body.verdict;
+  const verdict = valid ? verdictValue?.value ?? null : null;
+  const report = {
+    checks,
+    valid,
+    verdict: verdict ?? null,
+    achieved_trust_level: achievedTrustLevel
+  };
+  if (provenBy !== void 0) {
+    report.proven_by = provenBy;
+  }
+  return report;
+}
+
+// src/client.ts
+var LIST_CLAIMS_DEFAULT_LIMIT = 50;
+var LIST_CLAIMS_MIN_LIMIT = 1;
+var LIST_CLAIMS_MAX_LIMIT = 200;
+var DEFAULT_BASE_URL = "https://api.qedproof.site";
+function isoNow() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+var QedProof = class {
+  apiKey;
+  baseUrl;
+  fetchImpl;
+  constructor(options = {}) {
+    this.apiKey = options.apiKey;
+    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? globalThis.fetch;
+    if (!this.fetchImpl) {
+      throw new Error("QedProof: no fetch implementation available; pass { fetch } explicitly");
+    }
+  }
+  async request(method, path, { auth = true, body, text = false } = {}) {
+    const headers = { accept: "application/json" };
+    if (body !== void 0) headers["content-type"] = "application/json";
+    if (auth) {
+      if (!this.apiKey) {
+        throw new QedProofError(401, "no API key configured");
+      }
+      headers["authorization"] = `Bearer ${this.apiKey}`;
+    }
+    let res;
+    try {
+      res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0
+      });
+    } catch (exc) {
+      throw new QedProofError(0, `network error: ${exc instanceof Error ? exc.message : String(exc)}`);
+    }
+    if (res.status === 429) {
+      const retryAfterHeader = res.headers.get("retry-after");
+      const retryAfter = retryAfterHeader ? Number(retryAfterHeader) : void 0;
+      let detail = "rate limit exceeded";
+      try {
+        const parsed = await res.json();
+        if (parsed?.detail) detail = parsed.detail;
+      } catch {
+      }
+      throw new RateLimitError(detail, Number.isFinite(retryAfter) ? retryAfter : void 0);
+    }
+    if (!res.ok) {
+      let detail = res.statusText;
+      try {
+        const parsed = await res.json();
+        if (parsed?.detail) detail = parsed.detail;
+      } catch {
+      }
+      throw new QedProofError(res.status, detail);
+    }
+    if (res.status === 204) return void 0;
+    if (text) return res.text();
+    return res.json();
+  }
+  async submitClaim(claim, options) {
+    const claimedAt = options.claimedAt instanceof Date ? options.claimedAt.toISOString() : options.claimedAt ?? isoNow();
+    const body = {
+      client_claim_id: options.clientClaimId ?? cryptoRandomId(),
+      agent_id: options.agentId,
+      action: claim.action,
+      target: claim.target,
+      params: claim.params,
+      claimed_at: claimedAt
+    };
+    return await this.request("POST", "/v1/claims", { body });
+  }
+  async getClaim(claimId) {
+    return await this.request("GET", `/v1/claims/${encodeURIComponent(claimId)}`);
+  }
+  async waitForVerdict(claimId, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 12e4;
+    const pollIntervalMs = options.pollIntervalMs ?? 2e3;
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      let wait = pollIntervalMs;
+      try {
+        const status = await this.getClaim(claimId);
+        if (status.state === "decided") return status;
+      } catch (exc) {
+        if (exc instanceof RateLimitError && exc.retryAfter !== void 0) {
+          wait = Math.max(wait, exc.retryAfter * 1e3);
+        } else {
+          throw exc;
+        }
+      }
+      if (Date.now() >= deadline) {
+        throw new QedProofError(408, `timed out after ${timeoutMs}ms waiting for claim ${claimId} to decide`);
+      }
+      await sleep(Math.min(wait, Math.max(0, deadline - Date.now())));
+    }
+  }
+  /**
+   * `GET /v1/claims`, newest first. `options.limit` (1-200, default 50) is validated locally —
+   * out of range throws a `RangeError` before any request is made.
+   */
+  async listClaims(options = {}) {
+    const limit = options.limit ?? LIST_CLAIMS_DEFAULT_LIMIT;
+    if (limit < LIST_CLAIMS_MIN_LIMIT || limit > LIST_CLAIMS_MAX_LIMIT) {
+      throw new RangeError(`limit must be between ${LIST_CLAIMS_MIN_LIMIT} and ${LIST_CLAIMS_MAX_LIMIT}, got ${limit}`);
+    }
+    const query = { limit: String(limit) };
+    if (options.cursor !== void 0) query.cursor = options.cursor;
+    if (options.agentId !== void 0) query.agent_id = options.agentId;
+    if (options.action !== void 0) query.action = options.action;
+    if (options.verdict !== void 0) query.verdict = options.verdict;
+    if (options.state !== void 0) query.state = options.state;
+    const qs = new URLSearchParams(query).toString();
+    const data = await this.request("GET", `/v1/claims?${qs}`);
+    return { claims: data.claims, nextCursor: data.next_cursor };
+  }
+  /** Yields every claim matching the filters, following `nextCursor` until exhausted. */
+  async *iterClaims(options = {}) {
+    const { pageSize, ...filters } = options;
+    let cursor;
+    for (; ; ) {
+      const page = await this.listClaims({ ...filters, limit: pageSize, cursor });
+      yield* page.claims;
+      if (page.nextCursor === null) return;
+      cursor = page.nextCursor;
+    }
+  }
+  /** Receipts are designed to be shared and checked by anyone (SPEC §1): no Authorization header. */
+  async getReceipt(receiptId) {
+    const text = await this.request("GET", `/v1/receipts/${encodeURIComponent(receiptId)}`, { auth: false, text: true });
+    const receipt = JSON.parse(text);
+    RECEIPT_TEXT.set(receipt, text);
+    return receipt;
+  }
+  /** Public by design: `/.well-known/poaw-keys.json` (SPEC §5.2, §8.4). */
+  async getKeys() {
+    return await this.request("GET", "/.well-known/poaw-keys.json", { auth: false });
+  }
+  async verify(receipt, options = {}) {
+    const keys = options.keys ?? await this.getKeys();
+    return verifyReceipt(receipt, { keys, rpcUrl: options.rpcUrl });
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function cryptoRandomId() {
+  const g = globalThis;
+  if (g.crypto?.randomUUID) return g.crypto.randomUUID();
+  return `claim-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+
+// src/actions.ts
+var actions_exports = {};
+__export(actions_exports, {
+  githubChecksPass: () => githubChecksPass,
+  githubCommitPush: () => githubCommitPush,
+  githubPrOpen: () => githubPrOpen,
+  httpUrlStatus: () => httpUrlStatus,
+  slackMessagePost: () => slackMessagePost,
+  xPostPublish: () => xPostPublish
+});
+var REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+var SHA_RE = /^[0-9a-f]{40}$/;
+var HANDLE_RE = /^@[A-Za-z0-9_]{1,15}$/;
+var POST_ID_RE = /^[0-9]{1,20}$/;
+var HEX64_RE = /^[0-9a-f]{64}$/;
+var SLACK_TARGET_RE = /^slack:\/\/(T[A-Z0-9]{2,20})\/([CG][A-Z0-9]{2,20})$/;
+var SLACK_TS_RE = /^[0-9]{10}\.[0-9]{6}$/;
+function assert(condition, message) {
+  if (!condition) throw new TypeError(message);
+}
+function githubCommitPush(input) {
+  assert(REPO_RE.test(input.target), "githubCommitPush: target must be 'owner/repo'");
+  assert(SHA_RE.test(input.sha), "githubCommitPush: sha must be 40 lowercase hex characters");
+  assert(input.branch && input.branch.length > 0, "githubCommitPush: branch is required");
+  return { action: "github.commit.push", target: input.target, params: { sha: input.sha, branch: input.branch } };
+}
+function githubPrOpen(input) {
+  assert(REPO_RE.test(input.target), "githubPrOpen: target must be 'owner/repo'");
+  assert(Number.isInteger(input.number) && input.number >= 1, "githubPrOpen: number must be a positive integer");
+  if (input.headSha !== void 0) {
+    assert(SHA_RE.test(input.headSha), "githubPrOpen: headSha must be 40 lowercase hex characters");
+  }
+  const params = { number: input.number };
+  if (input.base !== void 0) params.base = input.base;
+  if (input.headSha !== void 0) params.head_sha = input.headSha;
+  return { action: "github.pr.open", target: input.target, params };
+}
+function githubChecksPass(input) {
+  assert(REPO_RE.test(input.target), "githubChecksPass: target must be 'owner/repo'");
+  assert(SHA_RE.test(input.sha), "githubChecksPass: sha must be 40 lowercase hex characters");
+  return { action: "github.checks.pass", target: input.target, params: { sha: input.sha } };
+}
+function xPostPublish(input) {
+  assert(HANDLE_RE.test(input.target), "xPostPublish: target must be an @handle");
+  assert(POST_ID_RE.test(input.postId), "xPostPublish: postId must be digits");
+  if (input.textSha256 !== void 0) {
+    assert(HEX64_RE.test(input.textSha256), "xPostPublish: textSha256 must be 64 lowercase hex characters");
+  }
+  const params = { post_id: input.postId };
+  if (input.textSha256 !== void 0) params.text_sha256 = input.textSha256;
+  return { action: "x.post.publish", target: input.target, params };
+}
+function slackMessagePost(input) {
+  assert(SLACK_TARGET_RE.test(input.target), "slackMessagePost: target must be slack://<team_id>/<channel_id>");
+  assert(SLACK_TS_RE.test(input.ts), "slackMessagePost: ts must match ^[0-9]{10}\\.[0-9]{6}$");
+  if (input.textSha256 !== void 0) {
+    assert(HEX64_RE.test(input.textSha256), "slackMessagePost: textSha256 must be 64 lowercase hex characters");
+  }
+  const params = { ts: input.ts };
+  if (input.textSha256 !== void 0) params.text_sha256 = input.textSha256;
+  return { action: "slack.message.post", target: input.target, params };
+}
+function httpUrlStatus(input) {
+  let url;
+  try {
+    url = new URL(input.target);
+  } catch {
+    throw new TypeError("httpUrlStatus: target must be a valid URL");
+  }
+  assert(url.protocol === "https:", "httpUrlStatus: target must be an https:// URL");
+  const params = {};
+  if (input.status !== void 0) {
+    assert(Number.isInteger(input.status), "httpUrlStatus: status must be an integer");
+    params.status = input.status;
+  }
+  if (input.contentFingerprint !== void 0) params.content_fingerprint = input.contentFingerprint;
+  return { action: "http.url.status", target: input.target, params };
+}
+//# sourceMappingURL=index.cjs.map