@rubric-protocol/attest-decision 1.0.0

package/dist/index.js

@@ -0,0 +1,16 @@
+/**
+ * @rubric-protocol/attest-decision — core SDK (DAR/0.1).
+ *
+ * Public surface: fire-and-forget attestation (`Attestor`), the DAR builder,
+ * JCS canonicalization, SHA3-256 hashing, ULID minting, the durable spool, and
+ * transports. See spec/dar-0.1.md and tasks/P1.md.
+ */
+export { DAR_VERSION, HASH_ALGORITHM, HASH_PREFIX, TIERED_ATTEST_PATH, API_KEY_ENV, } from "./constants.js";
+export { canonicalize, canonicalizeToBytes, JcsError } from "./jcs.js";
+export { sha3_256, sha3_256Hex, hashJson } from "./hash.js";
+export { ulid, monotonicUlidFactory } from "./ulid.js";
+export { DarBuilder, leafHash, canonicalDar, decisionHashOf, toPayload, } from "./dar.js";
+export { Spool, DEFAULT_MAX_BYTES } from "./spool.js";
+export { HttpTransport, } from "./transport.js";
+export { Attestor } from "./attestor.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,GAOZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,SAAS,GAIV,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAuC,MAAM,YAAY,CAAC;AAC3F,OAAO,EACL,aAAa,GAGd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAC"}

package/dist/jcs.d.ts

@@ -0,0 +1,18 @@
+/**
+ * JCS canonicalization — RFC 8785 (spec/dar-0.1.md §3).
+ *
+ * We lean on the platform: ECMAScript's Number-to-String and `JSON.stringify`
+ * string escaping are byte-for-byte what RFC 8785 mandates (§3.2.2.2/§3.2.2.3),
+ * and the default string sort compares by UTF-16 code unit — exactly JCS's key
+ * ordering rule. So canonicalization reduces to: recurse, sort object keys, and
+ * defer scalar serialization to `JSON.stringify`.
+ */
+declare class JcsError extends Error {
+    constructor(message: string);
+}
+/** Canonicalize a JSON value to its RFC 8785 (JCS) string form. */
+export declare function canonicalize(value: unknown): string;
+/** Canonicalize a JSON value to its RFC 8785 (JCS) UTF-8 bytes. */
+export declare function canonicalizeToBytes(value: unknown): Buffer;
+export { JcsError };
+//# sourceMappingURL=jcs.d.ts.map

package/dist/jcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.d.ts","sourceRoot":"","sources":["../src/jcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAM,QAAS,SAAQ,KAAK;gBACd,OAAO,EAAE,MAAM;CAI5B;AA0FD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE1D;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/jcs.js

@@ -0,0 +1,101 @@
+/**
+ * JCS canonicalization — RFC 8785 (spec/dar-0.1.md §3).
+ *
+ * We lean on the platform: ECMAScript's Number-to-String and `JSON.stringify`
+ * string escaping are byte-for-byte what RFC 8785 mandates (§3.2.2.2/§3.2.2.3),
+ * and the default string sort compares by UTF-16 code unit — exactly JCS's key
+ * ordering rule. So canonicalization reduces to: recurse, sort object keys, and
+ * defer scalar serialization to `JSON.stringify`.
+ */
+class JcsError extends Error {
+    constructor(message) {
+        super(`JCS: ${message}`);
+        this.name = "JcsError";
+    }
+}
+function serialize(v) {
+    if (v === null)
+        return "null";
+    const t = typeof v;
+    if (t === "number") {
+        const n = v;
+        if (!Number.isFinite(n)) {
+            throw new JcsError("non-finite number (NaN/Infinity) is not representable");
+        }
+        // Spec §3.3: integers beyond the safe range MUST be carried as strings — a
+        // JS number cannot represent them exactly, so we reject rather than hash a
+        // silently-rounded value.
+        if (Number.isInteger(n) && !Number.isSafeInteger(n)) {
+            throw new JcsError(`integer ${n} exceeds Number.MAX_SAFE_INTEGER; carry it as a string (spec §3.3)`);
+        }
+        // ES Number::toString === RFC 8785 §3.2.2.3. JSON.stringify(-0) === "0".
+        return JSON.stringify(n);
+    }
+    if (t === "boolean")
+        return v ? "true" : "false";
+    // RFC 8785 §3.2.2.2 escaping is exactly JSON.stringify's minimal escaping.
+    if (t === "string")
+        return escapeString(v);
+    if (t === "bigint") {
+        throw new JcsError("bigint is not JSON; carry large integers as strings");
+    }
+    if (Array.isArray(v)) {
+        return "[" + v.map(serializeElement).join(",") + "]";
+    }
+    if (t === "object") {
+        const proto = Object.getPrototypeOf(v);
+        if (proto !== Object.prototype && proto !== null) {
+            // Date, Map, Set, class instances, etc. are not part of the JSON model.
+            throw new JcsError("non-plain object is not JSON-canonicalizable");
+        }
+        const obj = v;
+        // Default sort compares by UTF-16 code unit — the RFC 8785 ordering.
+        const keys = Object.keys(obj).sort();
+        return ("{" +
+            keys
+                .map((k) => {
+                const val = obj[k];
+                rejectNonJson(val, `property '${k}'`);
+                return escapeString(k) + ":" + serialize(val);
+            })
+                .join(",") +
+            "}");
+    }
+    // undefined, function, symbol at the top level.
+    throw new JcsError(`unsupported value of type '${t}'`);
+}
+/**
+ * Spec §3.3: `undefined`, functions, and symbols MUST NOT appear in a payload —
+ * we reject rather than silently stripping them, so a malformed producer input
+ * cannot canonicalize to bytes that differ from the producer's intent.
+ */
+function rejectNonJson(value, where) {
+    const t = typeof value;
+    if (value === undefined || t === "function" || t === "symbol") {
+        throw new JcsError(`${where} has non-JSON value of type '${value === undefined ? "undefined" : t}'`);
+    }
+}
+function serializeElement(el) {
+    rejectNonJson(el, "array element");
+    return serialize(el);
+}
+// Unpaired UTF-16 surrogate: a high surrogate not followed by a low, or a low
+// not preceded by a high — i.e. invalid Unicode that RFC 8785 does not admit.
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+/** JSON.stringify a string after rejecting invalid Unicode (unpaired surrogates). */
+function escapeString(s) {
+    if (LONE_SURROGATE.test(s)) {
+        throw new JcsError("string contains an unpaired surrogate (invalid Unicode)");
+    }
+    return JSON.stringify(s);
+}
+/** Canonicalize a JSON value to its RFC 8785 (JCS) string form. */
+export function canonicalize(value) {
+    return serialize(value);
+}
+/** Canonicalize a JSON value to its RFC 8785 (JCS) UTF-8 bytes. */
+export function canonicalizeToBytes(value) {
+    return Buffer.from(serialize(value), "utf8");
+}
+export { JcsError };
+//# sourceMappingURL=jcs.js.map

package/dist/jcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jcs.js","sourceRoot":"","sources":["../src/jcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,QAAS,SAAQ,KAAK;IAC1B,YAAY,OAAe;QACzB,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAE9B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC;IAEnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAW,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAAC,uDAAuD,CAAC,CAAC;QAC9E,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,0BAA0B;QAC1B,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,oEAAoE,CAAC,CAAC;QACvG,CAAC;QACD,yEAAyE;QACzE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAEjD,2EAA2E;IAC3E,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,CAAW,CAAC,CAAC;IAErD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjD,wEAAwE;YACxE,MAAM,IAAI,QAAQ,CAAC,8CAA8C,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,OAAO,CACL,GAAG;YACH,IAAI;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBACnB,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;gBACtC,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,CAAC;YACZ,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,IAAI,QAAQ,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC;IACvB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,gCAAgC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAW;IACnC,aAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,cAAc,GAAG,wEAAwE,CAAC;AAEhG,qFAAqF;AACrF,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,yDAAyD,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/spool.d.ts

@@ -0,0 +1,58 @@
+import type { DarCore, PayloadRecord } from "./constants.js";
+declare const DEFAULT_MAX_BYTES: number;
+export interface SpoolRecord {
+    seq: number;
+    dar: DarCore;
+    /** Raw content, present only in `payload` mode (spec §4). */
+    payload?: PayloadRecord;
+}
+export interface SpoolOptions {
+    maxBytes?: number;
+    /** Called when the drop-oldest cap policy discards records (data loss). */
+    onDrop?: (count: number) => void;
+}
+export declare class Spool {
+    private readonly path;
+    private readonly dir;
+    private readonly ackPath;
+    private readonly maxBytes;
+    private readonly onDrop?;
+    private fd;
+    private seq;
+    private ackedThrough;
+    private bytes;
+    private droppedForCap;
+    private compactionPending;
+    private pendingRecords;
+    constructor(path: string, options?: SpoolOptions);
+    /** Records written but not yet acknowledged, in FIFO order. */
+    pending(): SpoolRecord[];
+    /** Count of records dropped by the drop-oldest cap policy so far. */
+    droppedCount(): number;
+    currentSeq(): number;
+    /**
+     * Append a record durably (single `writeSync`, no fsync). Returns its seq.
+     * Never compacts inline — that would put a multi-MB `writeFileSync`+`fsync` on
+     * the caller's `attest()` path. Crossing the cap only flags compaction, which
+     * `compactIfNeeded()` performs off the caller path (see the Attestor flush).
+     */
+    append(dar: DarCore, payload?: PayloadRecord): number;
+    /** Whether the file has grown past the cap and awaits compaction. */
+    needsCompaction(): boolean;
+    /** Reclaim acked space and enforce the cap (drop-oldest). Off the caller path. */
+    compactIfNeeded(): void;
+    /**
+     * Acknowledge every record with seq <= `throughSeq` (they were delivered).
+     * Advances the durable watermark; truncates the file once fully drained.
+     */
+    ack(throughSeq: number): void;
+    /** Flush OS buffers to disk. Called off the caller path, before network I/O. */
+    fsync(): void;
+    close(): void;
+    private recover;
+    private compact;
+    private readAck;
+    private writeAck;
+}
+export { DEFAULT_MAX_BYTES };
+//# sourceMappingURL=spool.d.ts.map

package/dist/spool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spool.d.ts","sourceRoot":"","sources":["../src/spool.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7D,QAAA,MAAM,iBAAiB,QAAmB,CAAC;AAE3C,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,OAAO,CAAC;IACb,6DAA6D;IAC7D,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AA+BD,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA0B;IAElD,OAAO,CAAC,EAAE,CAAS;IACnB,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAAqB;gBAE/B,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB;IAgBpD,+DAA+D;IAC/D,OAAO,IAAI,WAAW,EAAE;IAIxB,qEAAqE;IACrE,YAAY,IAAI,MAAM;IAItB,UAAU,IAAI,MAAM;IAIpB;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM;IAYrD,qEAAqE;IACrE,eAAe,IAAI,OAAO;IAI1B,kFAAkF;IAClF,eAAe,IAAI,IAAI;IAMvB;;;OAGG;IACH,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAY7B,gFAAgF;IAChF,KAAK,IAAI,IAAI;IAIb,KAAK,IAAI,IAAI;IAMb,OAAO,CAAC,OAAO;IAwBf,OAAO,CAAC,OAAO;IA0Bf,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,QAAQ;CAKjB;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/spool.js

@@ -0,0 +1,210 @@
+/**
+ * Durable append-only spool (tasks/P1.md).
+ *
+ * Durability model: `attest()` must add <1 ms to the caller, so we CANNOT fsync
+ * on the append path. Instead each record is appended with a single `writeSync`.
+ * A `writeSync` hands the bytes to the kernel, so they survive process death
+ * (`kill -9`) — only a machine/OS crash could lose them, and that is what the
+ * background `fsync()` (called off the caller path, before each network flush)
+ * defends against. On restart, `pending()` replays everything not yet acked, so
+ * zero spooled records are lost.
+ *
+ * Format: one JSON line per record, `{"seq":N,"dar":{...}}\n`. Acknowledgement
+ * is a monotonic high-water mark `ackedThrough` persisted in a `<path>.ack`
+ * sidecar; records are FIFO so a single watermark suffices. When the file
+ * exceeds `maxBytes` it is compacted (acked records dropped; then oldest pending
+ * dropped — "drop-oldest" — until under cap).
+ */
+import { closeSync, fstatSync, fsyncSync, ftruncateSync, mkdirSync, openSync, readFileSync, renameSync, writeSync, } from "node:fs";
+import { dirname } from "node:path";
+const DEFAULT_MAX_BYTES = 50 * 1024 * 1024; // 50 MB (tasks/P1.md)
+/** Write an entire buffer, looping over short writes (write(2) may be partial). */
+function writeFully(fd, buf) {
+    let offset = 0;
+    while (offset < buf.length) {
+        offset += writeSync(fd, buf, offset, buf.length - offset);
+    }
+}
+/** Durably write a small file (write + fsync). */
+function writeFileDurable(path, contents) {
+    const fd = openSync(path, "w");
+    try {
+        writeFully(fd, Buffer.from(contents, "utf8"));
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** fsync a directory so a rename/create within it is durable. */
+function fsyncDir(path) {
+    const fd = openSync(path, "r");
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export class Spool {
+    path;
+    dir;
+    ackPath;
+    maxBytes;
+    onDrop;
+    fd;
+    seq = 0;
+    ackedThrough = 0;
+    bytes = 0;
+    droppedForCap = 0;
+    compactionPending = false;
+    pendingRecords = [];
+    constructor(path, options = {}) {
+        this.path = path;
+        this.dir = dirname(path);
+        this.ackPath = `${path}.ack`;
+        this.maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+        this.onDrop = options.onDrop;
+        // Create the spool directory if missing so a documented path like
+        // /var/lib/rubric/attest.spool works without a separate mkdir.
+        mkdirSync(this.dir, { recursive: true });
+        this.ackedThrough = this.readAck();
+        this.recover();
+        // Open the append fd after recovery has read the current contents.
+        this.fd = openSync(this.path, "a");
+        this.bytes = fstatSync(this.fd).size;
+    }
+    /** Records written but not yet acknowledged, in FIFO order. */
+    pending() {
+        return this.pendingRecords.slice();
+    }
+    /** Count of records dropped by the drop-oldest cap policy so far. */
+    droppedCount() {
+        return this.droppedForCap;
+    }
+    currentSeq() {
+        return this.seq;
+    }
+    /**
+     * Append a record durably (single `writeSync`, no fsync). Returns its seq.
+     * Never compacts inline — that would put a multi-MB `writeFileSync`+`fsync` on
+     * the caller's `attest()` path. Crossing the cap only flags compaction, which
+     * `compactIfNeeded()` performs off the caller path (see the Attestor flush).
+     */
+    append(dar, payload) {
+        const seq = ++this.seq;
+        const record = payload ? { seq, dar, payload } : { seq, dar };
+        const line = JSON.stringify(record) + "\n";
+        const buf = Buffer.from(line, "utf8");
+        writeFully(this.fd, buf); // loop over short writes so a line is never torn
+        this.bytes += buf.byteLength;
+        this.pendingRecords.push(record);
+        if (this.bytes > this.maxBytes)
+            this.compactionPending = true;
+        return seq;
+    }
+    /** Whether the file has grown past the cap and awaits compaction. */
+    needsCompaction() {
+        return this.compactionPending;
+    }
+    /** Reclaim acked space and enforce the cap (drop-oldest). Off the caller path. */
+    compactIfNeeded() {
+        if (!this.compactionPending)
+            return;
+        this.compact();
+        this.compactionPending = false;
+    }
+    /**
+     * Acknowledge every record with seq <= `throughSeq` (they were delivered).
+     * Advances the durable watermark; truncates the file once fully drained.
+     */
+    ack(throughSeq) {
+        if (throughSeq <= this.ackedThrough)
+            return;
+        this.ackedThrough = throughSeq;
+        this.pendingRecords = this.pendingRecords.filter((r) => r.seq > throughSeq);
+        this.writeAck();
+        if (this.pendingRecords.length === 0) {
+            // Steady state: everything delivered. Reclaim the file entirely.
+            ftruncateSync(this.fd, 0);
+            this.bytes = 0;
+        }
+    }
+    /** Flush OS buffers to disk. Called off the caller path, before network I/O. */
+    fsync() {
+        fsyncSync(this.fd);
+    }
+    close() {
+        closeSync(this.fd);
+    }
+    // --- internals ---
+    recover() {
+        let raw;
+        try {
+            raw = readFileSync(this.path, "utf8");
+        }
+        catch {
+            return; // no spool file yet
+        }
+        let maxSeq = 0;
+        for (const line of raw.split("\n")) {
+            if (line.length === 0)
+                continue;
+            let record;
+            try {
+                record = JSON.parse(line);
+            }
+            catch {
+                continue; // tolerate a torn trailing line from a crash mid-write
+            }
+            if (typeof record.seq !== "number")
+                continue;
+            if (record.seq > maxSeq)
+                maxSeq = record.seq;
+            if (record.seq > this.ackedThrough)
+                this.pendingRecords.push(record);
+        }
+        this.pendingRecords.sort((a, b) => a.seq - b.seq);
+        this.seq = maxSeq;
+    }
+    compact() {
+        // Drop oldest pending until the surviving set fits under the cap.
+        const kept = this.pendingRecords.slice();
+        let size = kept.reduce((n, r) => n + Buffer.byteLength(JSON.stringify(r) + "\n"), 0);
+        let droppedNow = 0;
+        while (size > this.maxBytes && kept.length > 0) {
+            const dropped = kept.shift();
+            size -= Buffer.byteLength(JSON.stringify(dropped) + "\n");
+            this.droppedForCap++;
+            droppedNow++;
+        }
+        const tmp = `${this.path}.compact`;
+        const body = kept.map((r) => JSON.stringify(r) + "\n").join("");
+        writeFileDurable(tmp, body);
+        closeSync(this.fd);
+        renameSync(tmp, this.path);
+        fsyncDir(this.dir); // make the rename durable across a power loss
+        this.fd = openSync(this.path, "a");
+        this.bytes = fstatSync(this.fd).size;
+        this.pendingRecords = kept;
+        // Surface the drop-oldest data loss rather than discarding silently.
+        if (droppedNow > 0)
+            this.onDrop?.(droppedNow);
+    }
+    readAck() {
+        try {
+            const n = Number.parseInt(readFileSync(this.ackPath, "utf8").trim(), 10);
+            return Number.isFinite(n) && n >= 0 ? n : 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    writeAck() {
+        // fsync the watermark so a crash cannot resurrect already-acked records
+        // (bounding duplicate re-delivery on recovery).
+        writeFileDurable(this.ackPath, String(this.ackedThrough));
+    }
+}
+export { DEFAULT_MAX_BYTES };
+//# sourceMappingURL=spool.js.map

package/dist/spool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spool.js","sourceRoot":"","sources":["../src/spool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,sBAAsB;AAelE,mFAAmF;AACnF,SAAS,UAAU,CAAC,EAAU,EAAE,GAAW;IACzC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,SAAS,gBAAgB,CAAC,IAAY,EAAE,QAAgB;IACtD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,KAAK;IACC,IAAI,CAAS;IACb,GAAG,CAAS;IACZ,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,MAAM,CAA2B;IAE1C,EAAE,CAAS;IACX,GAAG,GAAG,CAAC,CAAC;IACR,YAAY,GAAG,CAAC,CAAC;IACjB,KAAK,GAAG,CAAC,CAAC;IACV,aAAa,GAAG,CAAC,CAAC;IAClB,iBAAiB,GAAG,KAAK,CAAC;IAC1B,cAAc,GAAkB,EAAE,CAAC;IAE3C,YAAY,IAAY,EAAE,UAAwB,EAAE;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,kEAAkE;QAClE,+DAA+D;QAC/D,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,mEAAmE;QACnE,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,+DAA+D;IAC/D,OAAO;QACL,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,qEAAqE;IACrE,YAAY;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAY,EAAE,OAAuB;QAC1C,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACvB,MAAM,MAAM,GAAgB,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,iDAAiD;QAC3E,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,qEAAqE;IACrE,eAAe;QACb,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,kFAAkF;IAClF,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAO;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,UAAkB;QACpB,IAAI,UAAU,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,iEAAiE;YACjE,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,KAAK;QACH,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,oBAAoB;IAEZ,OAAO;QACb,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,oBAAoB;QAC9B,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,IAAI,MAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,uDAAuD;YACnE,CAAC;YACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC7C,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;YAC7C,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;IACpB,CAAC;IAEO,OAAO;QACb,kEAAkE;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAG,CAAC;YAC9B,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,UAAU,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,8CAA8C;QAClE,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAE3B,qEAAqE;QACrE,IAAI,UAAU,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,wEAAwE;QACxE,gDAAgD;QAChD,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/transport.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Batch transport. One POST per flush to /v1/tiered-attest (tasks/P1.md).
+ * The SDK reads exactly one credential env var: RUBRIC_API_KEY (CLAUDE.md).
+ */
+import { type DarCore, type PayloadRecord } from "./constants.js";
+export interface Transport {
+    /**
+     * Deliver one batch. `records` are hashes-only DAR cores; `payloads` (raw
+     * content) is present only in `payload` mode and rides in the envelope, never
+     * in a core. Must reject on failure so the spool retains the batch.
+     */
+    send(records: DarCore[], payloads?: PayloadRecord[]): Promise<void>;
+}
+export interface HttpTransportOptions {
+    baseUrl: string;
+    /** Defaults to reading process.env.RUBRIC_API_KEY at send time. */
+    apiKey?: () => string | undefined;
+    fetchImpl?: typeof fetch;
+    /** Abort a POST after this many ms so a hung endpoint can't stall flushing. Default 30000. */
+    timeoutMs?: number;
+    /** Permit a non-HTTPS baseUrl (localhost is always allowed). Default false. */
+    allowInsecure?: boolean;
+}
+/** Default transport: one JSON POST of the batch to `${baseUrl}/v1/tiered-attest`. */
+export declare class HttpTransport implements Transport {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(options: HttpTransportOptions);
+    send(records: DarCore[], payloads?: PayloadRecord[]): Promise<void>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAmC,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnG,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAMD,sFAAsF;AACtF,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,EAAE,oBAAoB;IAcnC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAwB1E"}

package/dist/transport.js

@@ -0,0 +1,52 @@
+/**
+ * Batch transport. One POST per flush to /v1/tiered-attest (tasks/P1.md).
+ * The SDK reads exactly one credential env var: RUBRIC_API_KEY (CLAUDE.md).
+ */
+import { API_KEY_ENV, TIERED_ATTEST_PATH } from "./constants.js";
+function isLocalhost(u) {
+    return u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "::1";
+}
+/** Default transport: one JSON POST of the batch to `${baseUrl}/v1/tiered-attest`. */
+export class HttpTransport {
+    baseUrl;
+    apiKey;
+    fetchImpl;
+    timeoutMs;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+        // Refuse to send the bearer credential over cleartext unless explicitly allowed.
+        const parsed = new URL(this.baseUrl);
+        if (parsed.protocol !== "https:" && !isLocalhost(parsed) && !options.allowInsecure) {
+            throw new Error(`HttpTransport: refusing non-HTTPS baseUrl '${this.baseUrl}' (set allowInsecure to override)`);
+        }
+        this.apiKey = options.apiKey ?? (() => process.env[API_KEY_ENV]);
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.timeoutMs = options.timeoutMs ?? 30_000;
+    }
+    async send(records, payloads) {
+        const key = this.apiKey();
+        if (!key)
+            throw new Error(`${API_KEY_ENV} is not set`);
+        const body = payloads && payloads.length > 0 ? { records, payloads } : { records };
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const res = await this.fetchImpl(`${this.baseUrl}${TIERED_ATTEST_PATH}`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${key}`,
+                },
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            if (!res.ok) {
+                throw new Error(`tiered-attest POST failed: ${res.status} ${res.statusText}`);
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAoC,MAAM,gBAAgB,CAAC;AAsBnG,SAAS,WAAW,CAAC,CAAM;IACzB,OAAO,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,aAAa;IACP,OAAO,CAAS;IAChB,MAAM,CAA2B;IACjC,SAAS,CAAe;IACxB,SAAS,CAAS;IAEnC,YAAY,OAA6B;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,iFAAiF;QACjF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,OAAO,mCAAmC,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAkB,EAAE,QAA0B;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,aAAa,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QACnF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,kBAAkB,EAAE,EAAE;gBACvE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,GAAG,EAAE;iBAC/B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/ulid.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Create a monotonic ULID generator. `now` returns epoch milliseconds
+ * (injectable for deterministic tests). If the clock does not advance (or goes
+ * backwards) the randomness is incremented to keep ids strictly increasing.
+ */
+export declare function monotonicUlidFactory(now?: () => number): () => string;
+/** Default process-wide monotonic ULID generator. */
+export declare const ulid: () => string;
+//# sourceMappingURL=ulid.d.ts.map

package/dist/ulid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ulid.d.ts","sourceRoot":"","sources":["../src/ulid.ts"],"names":[],"mappings":"AAoDA;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,MAAiB,GAAG,MAAM,MAAM,CAc/E;AAED,qDAAqD;AACrD,eAAO,MAAM,IAAI,QAjByD,MAiBhC,CAAC"}

package/dist/ulid.js

@@ -0,0 +1,71 @@
+/**
+ * ULID (https://github.com/ulid/spec): 48-bit millisecond timestamp + 80 bits
+ * of randomness, Crockford base32, 26 chars. Used for `decisionId` (spec §2).
+ *
+ * A monotonic factory guarantees strictly increasing ids even within the same
+ * millisecond (randomness is incremented), so per-agent `prev` chains built from
+ * mint order are well-defined.
+ */
+import { randomFillSync } from "node:crypto";
+const ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"; // Crockford base32 (no I,L,O,U)
+const TIME_LEN = 10;
+const RAND_LEN = 16;
+function encodeTime(ms) {
+    if (!Number.isInteger(ms) || ms < 0 || ms > 0xffffffffffff) {
+        throw new Error(`ulid: time ${ms} out of 48-bit range`);
+    }
+    let out = "";
+    let t = ms;
+    for (let i = 0; i < TIME_LEN; i++) {
+        out = ENCODING[t % 32] + out;
+        t = Math.floor(t / 32);
+    }
+    return out;
+}
+function randomDigits() {
+    // Each byte's low 5 bits are uniform over 0..31 (256 is a multiple of 32).
+    const bytes = randomFillSync(new Uint8Array(RAND_LEN));
+    return Array.from(bytes, (b) => b & 31);
+}
+function incrementDigits(digits) {
+    const next = digits.slice();
+    for (let i = RAND_LEN - 1; i >= 0; i--) {
+        if (next[i] < 31) {
+            next[i]++;
+            return next;
+        }
+        next[i] = 0;
+    }
+    // Overflow within one millisecond (2^80 ids) — astronomically unlikely.
+    return randomDigits();
+}
+function encodeDigits(digits) {
+    let out = "";
+    for (const d of digits)
+        out += ENCODING[d];
+    return out;
+}
+/**
+ * Create a monotonic ULID generator. `now` returns epoch milliseconds
+ * (injectable for deterministic tests). If the clock does not advance (or goes
+ * backwards) the randomness is incremented to keep ids strictly increasing.
+ */
+export function monotonicUlidFactory(now = Date.now) {
+    let lastTime = -1;
+    let lastRand = [];
+    return function ulid() {
+        let t = Math.trunc(now());
+        if (t <= lastTime) {
+            t = lastTime;
+            lastRand = incrementDigits(lastRand);
+        }
+        else {
+            lastTime = t;
+            lastRand = randomDigits();
+        }
+        return encodeTime(t) + encodeDigits(lastRand);
+    };
+}
+/** Default process-wide monotonic ULID generator. */
+export const ulid = monotonicUlidFactory();
+//# sourceMappingURL=ulid.js.map

package/dist/ulid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ulid.js","sourceRoot":"","sources":["../src/ulid.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,QAAQ,GAAG,kCAAkC,CAAC,CAAC,gCAAgC;AACrF,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,GAAG,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QAC7B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY;IACnB,2EAA2E;IAC3E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,MAAgB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,CAAC,CAAE,GAAG,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB,IAAI,CAAC,GAAG;IAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,OAAO,SAAS,IAAI;QAClB,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YAClB,CAAC,GAAG,QAAQ,CAAC;YACb,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,CAAC,CAAC;YACb,QAAQ,GAAG,YAAY,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC"}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@rubric-protocol/attest-decision",
+  "version": "1.0.0",
+  "type": "module",
+  "description": "Rubric core SDK: DAR/0.1 builder, JCS+SHA3-256, fire-and-forget attest()",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/0xsims/rubric-attest.git",
+    "directory": "packages/attest-decision"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "src"],
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "prepublishOnly": "npm run build",
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run"
+  }
+}