@sanning/proof 0.10.0 → 0.11.1

package/src/index.ts

@@ -145,6 +145,80 @@ export type {
   PackVerdict,
 } from "./grading.js";
 
+// The declaration (src/declaration.ts): what a pack SAYS it holds, checked
+// against what it does (evidence-bundle.md §5.4).
+//
+// Every other check in this kernel checks a record that is PRESENT, so a pack
+// with half its records dropped verifies perfectly and an auditor cannot tell
+// a full hand-over from a trimmed one. The declaration is the pack's own
+// statement of what it was meant to contain, inside `body` and therefore under
+// the bundle's signature. Any deviation FAILS and every deviation is NAMED; a
+// pack that carries no declaration is `partial`, never `verified`; and a
+// reading that rests on the UNSIGNED content handed in beside the pack is
+// named on its own and carries the weaker word, because whoever assembles a
+// case chose those bytes (proof#147).
+//
+// Pure: data in, data out, no I/O. `gradePack` takes the result as an
+// optional fourth argument, so a surface gets one verdict; omitting it is the
+// pre-§5.4 behavior, unchanged. Additive: no existing export changes.
+export {
+  DECLARATION_VERSION,
+  checkDeclaration,
+  declarationClaims,
+  packRecords,
+  renderContentFinding,
+  renderDeclarationSummary,
+  renderDeviation,
+  renderNote,
+} from "./declaration.js";
+export type {
+  DeclarationCheck,
+  DeclarationClaims,
+  DeclarationContentFinding,
+  DeclarationContentKind,
+  DeclarationDeviation,
+  DeclarationDeviationKind,
+  DeclarationNote,
+  DeclarationNoteKind,
+  DeclarationVerdict,
+  PackRecord,
+} from "./declaration.js";
+
+// The case (src/case.ts): one verdict over SEVERAL packs, across organizations
+// (anchor#198). The layer above the declaration, and the closure for what a
+// declaration cannot reach.
+//
+// A pack a party assembles about itself is not self-proving about what that
+// party LEFT OUT (envelope-spec.md §4.1 A15, evidence-bundle.md §5.4.2 rule 7),
+// because the omission happens before any reader runs. Reading several parties'
+// packs at once is what closes it: a `handoff.sent` with no counterpart is
+// always named, and where a pack signed by the key it names is in the case, the
+// reading says that pack holds no counterpart. Whether a party that presented
+// no such pack recorded anything is not established (proof#143). `readCase`
+// verifies every pack itself, offline, so it is async. Matching is on keys and hashes alone and NEVER on tenancy, so a pair from two
+// organizations verifies (DL-60).
+//
+// Pure: data in, data out, no I/O. Additive: a new module, no existing export
+// changes, and no new verdict word anywhere.
+export {
+  CASE_BODY_TYPES,
+  CASE_EXCEPTION_KINDS,
+  CASE_QUARANTINED_PROFILES,
+  CASE_RECORD_PROFILES,
+  CASE_VERDICTS,
+  readCase,
+  renderCaseSummary,
+  renderException,
+} from "./case.js";
+export type {
+  CaseException,
+  CaseExceptionKind,
+  CasePack,
+  CaseReading,
+  CaseRecordReading,
+  CaseVerdict,
+} from "./case.js";
+
 // Chain reading (src/chain.ts): following the pointer every sanning.events/v2
 // record carries to the record before it, over the records ONE bundle presents.
 //
@@ -195,3 +269,56 @@ export type {
   AgentProofResult,
   VerifyAgentProofOptions,
 } from "./agent-proof.js";
+
+// The hand-off pairing rule (src/handoff.ts): which records are candidates to
+// be the counterpart of a hand-off record, how a candidate set of more than one
+// is ordered, and what a formed pair grades to (specs/envelope-spec.md §4.1
+// v1.9, proof#132 and proof#136). The Python half is src/sanning_proof/handoff.py and the two
+// answer identically on identical bytes. Additive: a new module, and no
+// existing export changes.
+export {
+  CANDIDATE_NAMESPACE,
+  DEFINED_EVENT_TYPES,
+  NOT_A_HANDOFF_FINDING,
+  isConformantHandoffRecord,
+  readHandoff,
+  readHandoffs,
+  recordIsMalformed,
+} from "./handoff.js";
+export type {
+  CandidateReading,
+  HandoffReading,
+  HandoffRecord,
+  HandoffVerdict,
+  HeldRecord,
+} from "./handoff.js";
+
+// A file part's BYTES (src/message-parts.ts): what a file part is, and what a
+// receiver that HOLDS a part's bytes commits to (envelope-spec.md section 4.1
+// v1.13, A18, proof#145). A receiver that holds the bytes hashes them and, on a
+// mismatch, commits to the message AS IT HELD IT, so the pair fails on
+// `message_hash` rather than verifying over bytes nobody checked. The Python
+// half is src/sanning_proof/message_parts.py and the two are held together by
+// cross-kernel/run_parts.sh. Pure: it neither canonicalizes nor hashes the
+// message.
+export {
+  BYTES_FOR_UNKNOWN_PART,
+  CONFLICTING_PART_BYTES,
+  INLINE_BYTES_KEYS,
+  MESSAGE_RESULT_ORDER,
+  PARTS_NOT_AN_ARRAY,
+  PART_ENCODING_MISMATCH,
+  PART_INLINE_BYTES,
+  PART_INLINE_MISMATCHED,
+  PART_MALFORMED_DESCRIPTOR,
+  PART_MATCHED,
+  PART_MISMATCHED,
+  PART_NOT_A_FILE,
+  PART_SUPPLIED_TWICE,
+  PART_UNCHECKED,
+  REFUSAL_ORDER,
+  commitHeldMessage,
+  isFilePart,
+  uncheckedHeldParts,
+} from "./message-parts.js";
+export type { HeldMessage, Note, PartReading, Refusal, SuppliedPart } from "./message-parts.js";