@rubric-protocol/decision-verify 1.0.1

package/dist/bazaar.d.ts

@@ -0,0 +1,56 @@
+/**
+ * x402 discovery + settlement (tasks/P4.md). An unpaid request is answered with
+ * `svcSend402`: HTTP 402 carrying a "bazaar blob" — the discoverable payment
+ * requirements — computed with zero downstream (index/store) work. A settled
+ * (paid) response carries `extensions.bazaar`.
+ */
+import { type VerifyResponse } from "./http.js";
+export interface BazaarConfig {
+    resource: string;
+    network: string;
+    asset: string;
+    maxAmountRequired: string;
+    payTo: string;
+    description?: string;
+    discoveryUrl?: string;
+    category?: string;
+}
+export interface X402Accept {
+    scheme: "exact";
+    network: string;
+    maxAmountRequired: string;
+    resource: string;
+    description: string;
+    payTo: string;
+    asset: string;
+    mimeType: "application/json";
+}
+export interface BazaarBlob {
+    x402Version: 1;
+    accepts: X402Accept[];
+    bazaar: {
+        discoverable: true;
+        resource: string;
+        category: string;
+        url?: string;
+    };
+}
+/** The discoverable 402 challenge body. */
+export declare function buildBazaarBlob(cfg: BazaarConfig): BazaarBlob;
+/** Instant 402 (no downstream work): the discovery response. */
+export declare function svcSend402(cfg: BazaarConfig): VerifyResponse;
+export interface SettlementBlob {
+    settled: true;
+    resource: string;
+    network: string;
+    asset: string;
+    amount: string;
+    payer?: string;
+    settlementId?: string;
+}
+/** The `extensions.bazaar` payload attached to a settled response. */
+export declare function settlementBlob(cfg: BazaarConfig, payment: {
+    payer?: string;
+    settlementId?: string;
+}): SettlementBlob;
+//# sourceMappingURL=bazaar.d.ts.map

package/dist/bazaar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazaar.d.ts","sourceRoot":"","sources":["../src/bazaar.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,EAAE;QAAE,YAAY,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED,2CAA2C;AAC3C,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CAkB7D;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,cAAc,CAE5D;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,cAAc,CAWhB"}

package/dist/bazaar.js

@@ -0,0 +1,48 @@
+/**
+ * x402 discovery + settlement (tasks/P4.md). An unpaid request is answered with
+ * `svcSend402`: HTTP 402 carrying a "bazaar blob" — the discoverable payment
+ * requirements — computed with zero downstream (index/store) work. A settled
+ * (paid) response carries `extensions.bazaar`.
+ */
+import { json } from "./http.js";
+/** The discoverable 402 challenge body. */
+export function buildBazaarBlob(cfg) {
+    const accept = {
+        scheme: "exact",
+        network: cfg.network,
+        maxAmountRequired: cfg.maxAmountRequired,
+        resource: cfg.resource,
+        description: cfg.description ?? "Rubric decision-verify",
+        payTo: cfg.payTo,
+        asset: cfg.asset,
+        mimeType: "application/json",
+    };
+    const bazaar = {
+        discoverable: true,
+        resource: cfg.resource,
+        category: cfg.category ?? "attestation.verify",
+    };
+    if (cfg.discoveryUrl !== undefined)
+        bazaar.url = cfg.discoveryUrl;
+    return { x402Version: 1, accepts: [accept], bazaar };
+}
+/** Instant 402 (no downstream work): the discovery response. */
+export function svcSend402(cfg) {
+    return json(402, buildBazaarBlob(cfg), { "www-authenticate": `x402 resource="${cfg.resource}"` });
+}
+/** The `extensions.bazaar` payload attached to a settled response. */
+export function settlementBlob(cfg, payment) {
+    const blob = {
+        settled: true,
+        resource: cfg.resource,
+        network: cfg.network,
+        asset: cfg.asset,
+        amount: cfg.maxAmountRequired,
+    };
+    if (payment.payer !== undefined)
+        blob.payer = payment.payer;
+    if (payment.settlementId !== undefined)
+        blob.settlementId = payment.settlementId;
+    return blob;
+}
+//# sourceMappingURL=bazaar.js.map

package/dist/bazaar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bazaar.js","sourceRoot":"","sources":["../src/bazaar.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAuB,MAAM,WAAW,CAAC;AA8BtD,2CAA2C;AAC3C,MAAM,UAAU,eAAe,CAAC,GAAiB;IAC/C,MAAM,MAAM,GAAe;QACzB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,wBAAwB;QACxD,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,kBAAkB;KAC7B,CAAC;IACF,MAAM,MAAM,GAAyB;QACnC,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,oBAAoB;KAC/C,CAAC;IACF,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC;IAClE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,GAAiB;IAC1C,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;AACpG,CAAC;AAYD,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAC5B,GAAiB,EACjB,OAAkD;IAElD,MAAM,IAAI,GAAmB;QAC3B,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,iBAAiB;KAC9B,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/chain.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Chain-check: build a continuity report for an agent's per-agent `prev` chain
+ * (tasks/P4.md). Forks (a decision with >1 child) are reported as branches, and
+ * are explicitly NOT treated as tampering — a legitimately branched history is
+ * still authentic. Gaps (a `prev` pointing at an absent decision) are surfaced
+ * too. Actual tampering is detected per-record via the drift flag (see verify).
+ */
+import type { ContinuityReport, IndexRow } from "./ports.js";
+export declare function chainCheck(agentId: string, rows: IndexRow[]): ContinuityReport;
+//# sourceMappingURL=chain.d.ts.map

package/dist/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI7D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CA4C9E"}

package/dist/chain.js

@@ -0,0 +1,39 @@
+const byId = (rows) => new Map(rows.map((r) => [r.decisionId, r]));
+export function chainCheck(agentId, rows) {
+    const present = byId(rows);
+    const childrenOf = new Map();
+    const referenced = new Set();
+    for (const r of rows) {
+        if (r.prev !== null) {
+            referenced.add(r.prev);
+            (childrenOf.get(r.prev) ?? childrenOf.set(r.prev, []).get(r.prev)).push(r.decisionId);
+        }
+    }
+    const sorted = (xs) => xs.slice().sort();
+    const genesis = sorted(rows.filter((r) => r.prev === null).map((r) => r.decisionId));
+    const heads = sorted(rows.filter((r) => !referenced.has(r.decisionId)).map((r) => r.decisionId));
+    const branches = [...childrenOf.entries()]
+        .filter(([, kids]) => kids.length > 1)
+        .map(([parent, kids]) => ({ parent, children: sorted(kids) }))
+        .sort((a, b) => (a.parent < b.parent ? -1 : 1));
+    const gaps = rows
+        .filter((r) => r.prev !== null && !present.has(r.prev))
+        .map((r) => ({ decisionId: r.decisionId, missingPrev: r.prev }))
+        .sort((a, b) => (a.decisionId < b.decisionId ? -1 : 1));
+    const linear = rows.length > 0 &&
+        genesis.length === 1 &&
+        heads.length === 1 &&
+        branches.length === 0 &&
+        gaps.length === 0;
+    return {
+        agentId,
+        count: rows.length,
+        genesis,
+        heads,
+        branches,
+        gaps,
+        linear,
+        tampering: false,
+    };
+}
+//# sourceMappingURL=chain.js.map

package/dist/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AASA,MAAM,IAAI,GAAG,CAAC,IAAgB,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAgB;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,EAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAEnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjG,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC7D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElD,MAAM,IAAI,GAAG,IAAI;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,IAAK,EAAE,CAAC,CAAC;SAChE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1D,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,GAAG,CAAC;QACf,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IAEpB,OAAO;QACL,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,OAAO;QACP,KAAK;QACL,QAAQ;QACR,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC"}

package/dist/gate.d.ts

@@ -0,0 +1,24 @@
+/**
+ * x402 payment gate (tasks/P4.md). Fronts a handler: an unpaid request is
+ * answered instantly with `svcSend402` (the bazaar discovery blob) — the wrapped
+ * handler, which does the index/store work, is NEVER invoked until payment is
+ * present, so discovery does zero DB work. A settled response carries
+ * `extensions.bazaar` (and an `x-payment-response` header).
+ */
+import { type BazaarConfig } from "./bazaar.js";
+import type { Handler, VerifyRequest } from "./http.js";
+export declare const X402_PAYMENT_HEADER = "x-payment";
+export interface PaymentResult {
+    paid: boolean;
+    payer?: string;
+    settlementId?: string;
+}
+/** Verifies a payment header. Injected + mockable; MUST NOT do DB work. */
+export type PaymentVerifier = (paymentHeader: string | undefined, req: VerifyRequest) => PaymentResult;
+export interface GateOptions {
+    bazaar: BazaarConfig;
+    verifyPayment: PaymentVerifier;
+    paymentHeader?: string;
+}
+export declare function gate(handler: Handler, opts: GateOptions): Handler;
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAA8B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAkB,MAAM,WAAW,CAAC;AAExE,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,CAC5B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,aAAa,KACf,aAAa,CAAC;AAEnB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,eAAe,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,wBAAgB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAoBjE"}

package/dist/gate.js

@@ -0,0 +1,32 @@
+/**
+ * x402 payment gate (tasks/P4.md). Fronts a handler: an unpaid request is
+ * answered instantly with `svcSend402` (the bazaar discovery blob) — the wrapped
+ * handler, which does the index/store work, is NEVER invoked until payment is
+ * present, so discovery does zero DB work. A settled response carries
+ * `extensions.bazaar` (and an `x-payment-response` header).
+ */
+import { svcSend402, settlementBlob } from "./bazaar.js";
+export const X402_PAYMENT_HEADER = "x-payment";
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export function gate(handler, opts) {
+    const headerName = (opts.paymentHeader ?? X402_PAYMENT_HEADER).toLowerCase();
+    return async (req) => {
+        const payment = opts.verifyPayment(req.headers[headerName], req);
+        if (!payment.paid) {
+            // Discovery: instant 402 with the bazaar blob, before any downstream work.
+            return svcSend402(opts.bazaar);
+        }
+        const res = await handler(req);
+        // Settle path: attach extensions.bazaar to a successful JSON body.
+        if (res.status >= 200 && res.status < 300 && isObject(res.body)) {
+            const settle = settlementBlob(opts.bazaar, payment);
+            const existingExt = isObject(res.body.extensions) ? res.body.extensions : {};
+            res.body = { ...res.body, extensions: { ...existingExt, bazaar: settle } };
+            res.headers["x-payment-response"] = Buffer.from(JSON.stringify(settle), "utf8").toString("base64");
+        }
+        return res;
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAqB,MAAM,aAAa,CAAC;AAG5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAoB/C,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAgB,EAAE,IAAiB;IACtD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,KAAK,EAAE,GAAkB,EAA2B,EAAE;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,2EAA2E;YAC3E,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAE/B,mEAAmE;QACnE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;YAC3E,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Framework-agnostic request/response shapes for the route, plus a thin Node
+ * `http` adapter. The route is a pure `Handler` so tests drive it directly; the
+ * adapter is for running it as a real server.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+export interface VerifyRequest {
+    method: string;
+    path: string;
+    query: Record<string, string | undefined>;
+    headers: Record<string, string | undefined>;
+}
+export interface VerifyResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: unknown;
+}
+export type Handler = (req: VerifyRequest) => VerifyResponse | Promise<VerifyResponse>;
+/** Build a JSON response. */
+export declare function json(status: number, body: unknown, headers?: Record<string, string>): VerifyResponse;
+/** Adapt a Handler to a Node `http` request listener. */
+export declare function toNodeListener(handler: Handler): (req: IncomingMessage, res: ServerResponse) => void;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAEvF,6BAA6B;AAC7B,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,cAAc,CAExG;AAMD,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,IACrC,KAAK,eAAe,EAAE,KAAK,cAAc,KAAG,IAAI,CAmBzD"}

package/dist/http.js

@@ -0,0 +1,30 @@
+/** Build a JSON response. */
+export function json(status, body, headers = {}) {
+    return { status, headers: { "content-type": "application/json", ...headers }, body };
+}
+function firstHeader(v) {
+    return Array.isArray(v) ? v[0] : v;
+}
+/** Adapt a Handler to a Node `http` request listener. */
+export function toNodeListener(handler) {
+    return (req, res) => {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const query = {};
+        for (const [k, val] of url.searchParams)
+            query[k] = val;
+        const headers = {};
+        for (const [k, val] of Object.entries(req.headers))
+            headers[k.toLowerCase()] = firstHeader(val);
+        const request = { method: req.method ?? "GET", path: url.pathname, query, headers };
+        Promise.resolve(handler(request))
+            .then((r) => {
+            res.writeHead(r.status, r.headers);
+            res.end(typeof r.body === "string" ? r.body : JSON.stringify(r.body));
+        })
+            .catch(() => {
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "internal error" }));
+        });
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAsBA,6BAA6B;AAC7B,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,IAAa,EAAE,UAAkC,EAAE;IACtF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,CAAgC;IACnD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAQ,EAAE;QACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,KAAK,GAAuC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QACxD,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAEhG,MAAM,OAAO,GAAkB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAEnG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;aAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @rubric-protocol/decision-verify — the x402-gated decision-verify route (tasks/P4.md).
+ *
+ * A framework-agnostic Handler that, once payment is present, verifies a DAR
+ * against its Merkle inclusion proof, HCS anchor ref, and service signature
+ * (surfacing a drift flag), or produces a chain-check continuity report.
+ */
+export { createDecisionVerifyRoute, DECISION_VERIFY_PATH, type VerifyRouteDeps } from "./route.js";
+export { gate, X402_PAYMENT_HEADER, type GateOptions, type PaymentVerifier, type PaymentResult } from "./gate.js";
+export { svcSend402, buildBazaarBlob, settlementBlob, type BazaarConfig, type BazaarBlob, type SettlementBlob, } from "./bazaar.js";
+export { assembleVerification } from "./verify.js";
+export { chainCheck } from "./chain.js";
+export { verifyMerkleProof, buildMerkleTree, nodeHash } from "./merkle.js";
+export { json, toNodeListener, type VerifyRequest, type VerifyResponse, type Handler } from "./http.js";
+export type { IndexPort, StorePort, SignatureVerifier, SignatureResult, VerifiableBundle, VerificationResult, VerifyStatus, MerkleProof, MerkleProofStep, AnchorRef, BatchSignature, ContinuityReport, ChainBranch, ChainGap, IndexRow, } from "./ports.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAClH,OAAO,EACL,UAAU,EACV,eAAe,EACf,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AACxG,YAAY,EACV,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,QAAQ,EACR,QAAQ,GACT,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+/**
+ * @rubric-protocol/decision-verify — the x402-gated decision-verify route (tasks/P4.md).
+ *
+ * A framework-agnostic Handler that, once payment is present, verifies a DAR
+ * against its Merkle inclusion proof, HCS anchor ref, and service signature
+ * (surfacing a drift flag), or produces a chain-check continuity report.
+ */
+export { createDecisionVerifyRoute, DECISION_VERIFY_PATH } from "./route.js";
+export { gate, X402_PAYMENT_HEADER } from "./gate.js";
+export { svcSend402, buildBazaarBlob, settlementBlob, } from "./bazaar.js";
+export { assembleVerification } from "./verify.js";
+export { chainCheck } from "./chain.js";
+export { verifyMerkleProof, buildMerkleTree, nodeHash } from "./merkle.js";
+export { json, toNodeListener } from "./http.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAwB,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAA8D,MAAM,WAAW,CAAC;AAClH,OAAO,EACL,UAAU,EACV,eAAe,EACf,cAAc,GAIf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAyD,MAAM,WAAW,CAAC"}

package/dist/merkle.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Merkle inclusion proofs over SHA3-256 (tasks/P4.md; interior-node hashing is
+ * defined by the attestation service per spec/dar-0.1.md §4.3). Leaves are DAR
+ * leaf hashes; interior nodes are domain-separated to prevent second-preimage
+ * ambiguity between leaves and internal nodes.
+ */
+import { type HashString } from "@rubric-protocol/attest-decision";
+import type { MerkleProofStep } from "./ports.js";
+/** Hash an interior node from its ordered children. */
+export declare function nodeHash(left: HashString, right: HashString): HashString;
+/** Fold a leaf up through its proof steps and check it reproduces `root`. */
+export declare function verifyMerkleProof(leaf: HashString, steps: MerkleProofStep[], root: HashString): boolean;
+/**
+ * Build a Merkle root and an inclusion proof for every leaf. Odd levels promote
+ * the last node by pairing it with itself. Utility for constructing anchored
+ * bundles (and test fixtures); the route only needs verifyMerkleProof.
+ */
+export declare function buildMerkleTree(leaves: HashString[]): {
+    root: HashString;
+    proofs: MerkleProofStep[][];
+};
+//# sourceMappingURL=merkle.d.ts.map

package/dist/merkle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.d.ts","sourceRoot":"","sources":["../src/merkle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAExE;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAMvG;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,EAAE,CAAA;CAAE,CAgCvG"}

package/dist/merkle.js

@@ -0,0 +1,58 @@
+/**
+ * Merkle inclusion proofs over SHA3-256 (tasks/P4.md; interior-node hashing is
+ * defined by the attestation service per spec/dar-0.1.md §4.3). Leaves are DAR
+ * leaf hashes; interior nodes are domain-separated to prevent second-preimage
+ * ambiguity between leaves and internal nodes.
+ */
+import { sha3_256 } from "@rubric-protocol/attest-decision";
+const NODE_DOMAIN = "rubric-merkle-node/1\n";
+/** Hash an interior node from its ordered children. */
+export function nodeHash(left, right) {
+    return sha3_256(`${NODE_DOMAIN}${left}\n${right}`);
+}
+/** Fold a leaf up through its proof steps and check it reproduces `root`. */
+export function verifyMerkleProof(leaf, steps, root) {
+    let acc = leaf;
+    for (const step of steps) {
+        acc = step.position === "left" ? nodeHash(step.sibling, acc) : nodeHash(acc, step.sibling);
+    }
+    return acc === root;
+}
+/**
+ * Build a Merkle root and an inclusion proof for every leaf. Odd levels promote
+ * the last node by pairing it with itself. Utility for constructing anchored
+ * bundles (and test fixtures); the route only needs verifyMerkleProof.
+ */
+export function buildMerkleTree(leaves) {
+    if (leaves.length === 0)
+        throw new Error("merkle: cannot build a tree over zero leaves");
+    const proofs = leaves.map(() => []);
+    // indexAtLevel[i] tracks where original leaf i currently sits in `level`.
+    let level = leaves.slice();
+    let positions = leaves.map((_, i) => i);
+    while (level.length > 1) {
+        const next = [];
+        const nextPositions = positions.map(() => 0);
+        for (let i = 0; i < level.length; i += 2) {
+            const left = level[i];
+            const right = i + 1 < level.length ? level[i + 1] : level[i]; // promote odd tail
+            const parent = nodeHash(left, right);
+            const parentIdx = next.length;
+            next.push(parent);
+            for (let li = 0; li < positions.length; li++) {
+                if (positions[li] === i) {
+                    proofs[li].push({ sibling: right, position: "right" });
+                    nextPositions[li] = parentIdx;
+                }
+                else if (positions[li] === i + 1) {
+                    proofs[li].push({ sibling: left, position: "left" });
+                    nextPositions[li] = parentIdx;
+                }
+            }
+        }
+        level = next;
+        positions = nextPositions;
+    }
+    return { root: level[0], proofs };
+}
+//# sourceMappingURL=merkle.js.map

package/dist/merkle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../src/merkle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAmB,MAAM,kCAAkC,CAAC;AAG7E,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,uDAAuD;AACvD,MAAM,UAAU,QAAQ,CAAC,IAAgB,EAAE,KAAiB;IAC1D,OAAO,QAAQ,CAAC,GAAG,WAAW,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,KAAwB,EAAE,IAAgB;IAC5F,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAEzF,MAAM,MAAM,GAAwB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,0EAA0E;IAC1E,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAExC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,mBAAmB;YACnF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;gBAC7C,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;oBACxD,aAAa,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBAChC,CAAC;qBAAM,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;oBACtD,aAAa,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;QACb,SAAS,GAAG,aAAa,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC"}

package/dist/ports.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Ports and wire types for the decision-verify route (tasks/P4.md).
+ *
+ * The route depends only on these interfaces, so tests inject in-memory mocks
+ * for the index and store ("route tests green on mocked index+store").
+ */
+import type { DarCore, HashString } from "@rubric-protocol/attest-decision";
+import type { IndexRow } from "@rubric-protocol/attest-index";
+export type { IndexRow };
+/** A Merkle inclusion proof step: a sibling hash and which side it sits on. */
+export interface MerkleProofStep {
+    sibling: HashString;
+    position: "left" | "right";
+}
+/** Inclusion proof from a leaf up to a published root. */
+export interface MerkleProof {
+    leaf: HashString;
+    steps: MerkleProofStep[];
+    root: HashString;
+}
+/** Reference to the on-chain (HCS) anchor that committed a Merkle root. */
+export interface AnchorRef {
+    network: string;
+    topicId: string;
+    sequenceNumber: number;
+    root: HashString;
+    consensusTimestamp?: string;
+}
+/** Service signature over an anchored root. */
+export interface BatchSignature {
+    alg: string;
+    keyRef: string;
+    signature: string;
+    over: HashString;
+}
+/** A stored bundle: the DAR core plus the attestation envelope (spec §6). */
+export interface VerifiableBundle {
+    attestationId: string;
+    dar: DarCore;
+    merkleProof: MerkleProof;
+    anchorRef: AnchorRef;
+    signature: BatchSignature;
+}
+/** Index port — row lookups by decisionId/decisionHash and per-agent chains. */
+export interface IndexPort {
+    byDecisionId(decisionId: string): IndexRow | undefined;
+    byDecisionHash(decisionHash: string): IndexRow | undefined;
+    agentChain(agentId: string): IndexRow[];
+}
+/** Store port — load a full bundle by its path. */
+export interface StorePort {
+    get(bundlePath: string): VerifiableBundle | undefined;
+}
+export interface SignatureResult {
+    verified: boolean;
+    keyRef: string;
+}
+/** Verifies a service signature over an anchored root. Injected (mockable). */
+export type SignatureVerifier = (signature: BatchSignature, root: HashString) => SignatureResult;
+/** Version gate outcome (spec §5.1). */
+export type VerifyStatus = "ok" | "needs-upgrade" | "rejected";
+/** The decision-verify result body. */
+export interface VerificationResult {
+    decisionId: string;
+    dar: DarCore;
+    merkleProof: MerkleProof;
+    anchorRef: AnchorRef;
+    signature: SignatureResult;
+    /** True when the record no longer matches the proof/root carried in its bundle (tampering). */
+    drift: boolean;
+    /**
+     * Version gate per spec §5.1: `rejected` (unknown DAR major or bad leafType),
+     * `needs-upgrade` (known major but a newer minor this verifier can't fully
+     * check), or `ok` (this verifier fully understands the record's version).
+     */
+    status: VerifyStatus;
+    /**
+     * INTERNAL CONSISTENCY ONLY. True iff status is `ok`, there is no drift, and
+     * the supplied signature verified. This attests that the bundle is internally
+     * self-consistent — it is NOT proof that the Merkle root was anchored on HCS,
+     * nor that the signing key is trusted. Those require the (out-of-scope)
+     * attestation service; this route does not contact any ledger.
+     */
+    consistencyVerified: boolean;
+}
+/** A fork point: a decision with more than one child in the chain. */
+export interface ChainBranch {
+    parent: string;
+    children: string[];
+}
+/** A break where a record's `prev` points at a decision absent from the index. */
+export interface ChainGap {
+    decisionId: string;
+    missingPrev: string;
+}
+/** Continuity report for an agent's chain (tasks/P4.md). */
+export interface ContinuityReport {
+    agentId: string;
+    count: number;
+    genesis: string[];
+    heads: string[];
+    branches: ChainBranch[];
+    gaps: ChainGap[];
+    /** True iff a single unbroken linear chain (one genesis, one head, no forks/gaps). */
+    linear: boolean;
+    /** Forks and gaps are structural, not tampering — always false here. */
+    tampering: false;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAE9D,YAAY,EAAE,QAAQ,EAAE,CAAC;AAEzB,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3D,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAAC;CACzC;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,KAAK,eAAe,CAAC;AAEjG,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,eAAe,GAAG,UAAU,CAAC;AAE/D,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,EAAE,YAAY,CAAC;IACrB;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,kFAAkF;AAClF,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,sFAAsF;IACtF,MAAM,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,SAAS,EAAE,KAAK,CAAC;CAClB"}

package/dist/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../src/ports.ts"],"names":[],"mappings":""}

package/dist/route.d.ts

@@ -0,0 +1,15 @@
+import { type PaymentVerifier } from "./gate.js";
+import { type Handler } from "./http.js";
+import type { BazaarConfig } from "./bazaar.js";
+import type { IndexPort, SignatureVerifier, StorePort } from "./ports.js";
+export declare const DECISION_VERIFY_PATH = "/v1/x402/decision-verify";
+export interface VerifyRouteDeps {
+    index: IndexPort;
+    store: StorePort;
+    verifySignature: SignatureVerifier;
+    bazaar: BazaarConfig;
+    verifyPayment: PaymentVerifier;
+}
+/** Build the gate()-fronted route handler. */
+export declare function createDecisionVerifyRoute(deps: VerifyRouteDeps): Handler;
+//# sourceMappingURL=route.d.ts.map

package/dist/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../src/route.ts"],"names":[],"mappings":"AASA,OAAO,EAAQ,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAQ,KAAK,OAAO,EAA2C,MAAM,WAAW,CAAC;AACxF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE1E,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,eAAe,EAAE,iBAAiB,CAAC;IACnC,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,eAAe,CAAC;CAChC;AA4BD,8CAA8C;AAC9C,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAGxE"}

package/dist/route.js

@@ -0,0 +1,41 @@
+/**
+ * The gate()-fronted /v1/x402/decision-verify route (tasks/P4.md).
+ *
+ * Query:
+ *   ?decisionId=... | ?decisionHash=...   -> single-record verification
+ *   ?agentId=...    (or ?mode=chain)      -> chain-check continuity report
+ */
+import { assembleVerification } from "./verify.js";
+import { chainCheck } from "./chain.js";
+import { gate } from "./gate.js";
+import { json } from "./http.js";
+export const DECISION_VERIFY_PATH = "/v1/x402/decision-verify";
+/** The paid handler — this is where index/store work happens. */
+function decisionVerify(req, deps) {
+    const { decisionId, decisionHash, agentId, mode } = req.query;
+    if (mode === "chain" || agentId) {
+        if (!agentId)
+            return json(400, { error: "agentId is required for chain-check" });
+        return json(200, chainCheck(agentId, deps.index.agentChain(agentId)));
+    }
+    const row = decisionId
+        ? deps.index.byDecisionId(decisionId)
+        : decisionHash
+            ? deps.index.byDecisionHash(decisionHash)
+            : undefined;
+    if (!decisionId && !decisionHash) {
+        return json(400, { error: "decisionId or decisionHash is required" });
+    }
+    if (!row)
+        return json(404, { error: "decision not found" });
+    const bundle = deps.store.get(row.bundlePath);
+    if (!bundle)
+        return json(502, { error: "bundle missing from store", bundlePath: row.bundlePath });
+    return json(200, assembleVerification(bundle, deps.verifySignature));
+}
+/** Build the gate()-fronted route handler. */
+export function createDecisionVerifyRoute(deps) {
+    const handler = (req) => decisionVerify(req, deps);
+    return gate(handler, { bazaar: deps.bazaar, verifyPayment: deps.verifyPayment });
+}
+//# sourceMappingURL=route.js.map