@sanning/proof 0.13.0 → 0.15.0

package/dist/case-file.js

@@ -24,7 +24,7 @@
  * Pure: bytes and a file list in, a reading out. No filesystem, no zip, no
  * network. How the files were listed and hashed is the caller's.
  */
-import { jcsParse } from "./verifier.js";
+import { DuplicateKeyError, jcsParse } from "./verifier.js";
 /** The index's dispatch key (5.6.2). An absent or unknown value makes the index unreadable. */
 export const CASE_FILE_VERSION = "sanning.case-file/v1";
 /** The index, at the root of the case file. */
@@ -176,7 +176,11 @@ function readIndex(raw) {
     try {
         value = jcsParse(raw);
     }
-    catch {
+    catch (e) {
+        // Named, because an index that lists one pack twice under one member name
+        // reads as whichever copy came last (I-JSON, proof#144).
+        if (e instanceof DuplicateKeyError)
+            throw new Unreadable(e.message);
         throw new Unreadable("not readable as JSON");
     }
     if (!isObject(value))

package/dist/case.d.ts

@@ -638,13 +638,21 @@ export declare const RECORD_PROFILE_QUARANTINED = "record_profile_quarantined";
 /** The reader was handed no packs at all. */
 export declare const CASE_HOLDS_NO_PACKS = "case_holds_no_packs";
 /**
- * The two NOTEs (5.5.3 v1.20): findings on the reading with no contribution,
- * printed in the scope sentence so a clean verdict never hides either.
- * `pack_undeclared` is a note only where the reading holds no hand-off record;
- * where it holds one, it is the exception of that name.
+ * The three NOTEs (5.5.3 v1.20, extended proof#148): findings on the reading
+ * with no contribution, printed in the scope sentence so a clean verdict
+ * never hides any of them. `pack_undeclared` is a note only where the
+ * reading holds no hand-off record; where it holds one, it is the exception
+ * of that name.
  */
 export declare const CONTENT_WITHHELD_BY_DECLARATION = "content_withheld_by_declaration";
-export declare const CASE_NOTE_KINDS: readonly ["pack_undeclared", "content_withheld_by_declaration"];
+/**
+ * A pack's wrapper carries a present `co_signatures` (evidence-bundle.md §2,
+ * decided by Phil 2026-09-24 on proof#148). The field verifies nothing and
+ * sits outside the wrapper's signed scope, so the case reading names it
+ * rather than presenting it as evidence, and it contributes no verdict.
+ */
+export declare const CO_SIGNATURES_PRESENT = "co_signatures_present";
+export declare const CASE_NOTE_KINDS: readonly ["pack_undeclared", "content_withheld_by_declaration", "co_signatures_present"];
 export type CaseNoteKind = (typeof CASE_NOTE_KINDS)[number];
 /**
  * Every exception this reader can report, as a closed set. A surface may render
@@ -872,10 +880,30 @@ export declare function renderCaseSummary(reading: CaseReading): string;
 export declare const VERDICT_DISPLAY_TITLES: Readonly<Record<string, string>>;
 /**
  * What a reader may rely on, for each of the six words a case reading reaches
- * (5.5.6 v1.20, A26), the same for every drop. `pending` and `not_found`
- * never head a case reading: they are witness states.
+ * (5.5.6 v1.20, A26; the `verified` text at v1.28, A35), the same for every
+ * drop. `pending` and `not_found` never head a case reading: they are
+ * witness states. `verified` is the base sentence, printed alone where the
+ * drop holds no hand-off record; a caller reads `caseReliance` for
+ * `verified`, never this mapping directly.
  */
 export declare const CASE_RELIANCE: Readonly<Record<CaseVerdict, string>>;
+/**
+ * The clause a `verified` drop that holds a hand-off record gains, inserted
+ * after `CASE_RELIANCE`'s first sentence (5.5.6, A35). Never printed alone,
+ * and never where `handoffRecords` is zero: most drops hold one agent's
+ * pack and no hand-off to say anything about.
+ */
+export declare const CASE_RELIANCE_HANDOFF_CLAUSE = "Every hand-off with both sides in this drop is intact.";
+/**
+ * What a reader may rely on for one case reading (5.5.6 v1.28, A35), byte
+ * for byte the text `case_reliance`'s Python sibling returns.
+ *
+ * For every word but `verified` this is `CASE_RELIANCE` unchanged. For
+ * `verified`, the hand-off clause is inserted after the first sentence
+ * where `handoffRecords` is not zero, and left out where it is zero: the
+ * base sentence never claims a hand-off the drop does not hold.
+ */
+export declare function caseReliance(verdict: CaseVerdict, handoffRecords: number): string;
 /** The three witness states, and how each is printed (5.5.6, D7). No other. */
 export declare const WITNESS_STATES: {
     readonly confirmed: "Confirmed on the public record";
@@ -894,8 +922,24 @@ export interface WitnessLine {
     state: WitnessState;
     reasons: string[];
     services: string[];
+    /**
+     * Witness times a pack caches that no lookup settled, as `[blockHeight,
+     * blockTime]`, distinct and in time order (5.6.6, v1.25, A30). Printed labelled
+     * not checked, and never as a time a reader may rely on. Absent reads as none.
+     */
+    cached?: [number, number][];
+    /**
+     * Witness times the public record returned where they matched a pack's
+     * cache, distinct and in time order. The gateway's answer, named with the
+     * service, never the cache's value. Absent reads as none.
+     */
+    recorded?: [number, number][];
 }
 /** The line printed where no lookup ran, which is every reading this kernel produces on its own. */
 export declare const WITNESS_NOT_LOOKED_UP: Readonly<WitnessLine>;
 /** The witness line as both kernels print it. */
+/** How a witness time a pack caches is printed where nothing checked it (5.5.6, 5.6.6, v1.25, A30). */
+export declare const WITNESS_TIME_CACHED = "the pack dates the witness, not checked";
+/** How a witness time the public record returned is printed where it matched the cache. */
+export declare const WITNESS_TIME_RECORDED = "the public record dates the witness";
 export declare function renderWitnessLine(line: WitnessLine): string;

package/dist/case.js

@@ -243,8 +243,9 @@
  */
 import { DECLARATION_VERSION, DECLARATION_VERSION_V2, checkDeclaration, declarationClaims, packRecords, } from "./declaration.js";
 import { NOT_A_HANDOFF_FINDING, normalizedSigningKey, readHandoffs, recordIsMalformed, } from "./handoff.js";
-import { verifyEvidenceBundle } from "./evidence.js";
+import { coSignaturesPresent, verifyEvidenceBundle } from "./evidence.js";
 import { accountDisclosure, completenessNotes, gradePack, } from "./grading.js";
+import { renderWitnessTime } from "./witness-cache.js";
 // ---- The vocabulary ---------------------------------------------------------
 /**
  * The verdicts a case can reach. Every one is already in use in
@@ -665,13 +666,25 @@ export const RECORD_PROFILE_QUARANTINED = "record_profile_quarantined";
 /** The reader was handed no packs at all. */
 export const CASE_HOLDS_NO_PACKS = "case_holds_no_packs";
 /**
- * The two NOTEs (5.5.3 v1.20): findings on the reading with no contribution,
- * printed in the scope sentence so a clean verdict never hides either.
- * `pack_undeclared` is a note only where the reading holds no hand-off record;
- * where it holds one, it is the exception of that name.
+ * The three NOTEs (5.5.3 v1.20, extended proof#148): findings on the reading
+ * with no contribution, printed in the scope sentence so a clean verdict
+ * never hides any of them. `pack_undeclared` is a note only where the
+ * reading holds no hand-off record; where it holds one, it is the exception
+ * of that name.
  */
 export const CONTENT_WITHHELD_BY_DECLARATION = "content_withheld_by_declaration";
-export const CASE_NOTE_KINDS = [PACK_UNDECLARED, CONTENT_WITHHELD_BY_DECLARATION];
+/**
+ * A pack's wrapper carries a present `co_signatures` (evidence-bundle.md §2,
+ * decided by Phil 2026-09-24 on proof#148). The field verifies nothing and
+ * sits outside the wrapper's signed scope, so the case reading names it
+ * rather than presenting it as evidence, and it contributes no verdict.
+ */
+export const CO_SIGNATURES_PRESENT = "co_signatures_present";
+export const CASE_NOTE_KINDS = [
+    PACK_UNDECLARED,
+    CONTENT_WITHHELD_BY_DECLARATION,
+    CO_SIGNATURES_PRESENT,
+];
 /**
  * Every exception this reader can report, as a closed set. A surface may render
  * them and a test may assert over them; nothing outside this array is emitted.
@@ -1048,6 +1061,15 @@ export async function readCase(packs) {
             continue;
         }
         holderKeys.add(holder);
+        if (coSignaturesPresent(pack.bundle)) {
+            // A NOTE, with no contribution (5.5.3 v1.20, proof#148): the wrapper's
+            // co_signatures verifies nothing and sits outside its signed scope, so
+            // the case reading names it rather than moving anything on its account.
+            caseNotes.push({
+                position,
+                note: { kind: CO_SIGNATURES_PRESENT, packRef: pack.ref },
+            });
+        }
         const bodyType = bodyTypeOf(pack.bundle);
         const records = packRecords(pack.bundle, pack.content);
         // The per-record gradings below are joined to `records` BY INDEX, so a
@@ -1591,6 +1613,9 @@ export function renderCaseNote(note) {
                 "checked, their content was not");
         case PACK_UNDECLARED:
             return `${note.packRef} does not say what it holds`;
+        case CO_SIGNATURES_PRESENT:
+            return (`${note.packRef} carries unverified co-signatures in its wrapper; ` +
+                "they are not part of the evidence");
         default:
             return note.kind;
     }
@@ -1645,16 +1670,17 @@ export const VERDICT_DISPLAY_TITLES = {
 };
 /**
  * What a reader may rely on, for each of the six words a case reading reaches
- * (5.5.6 v1.20, A26), the same for every drop. `pending` and `not_found`
- * never head a case reading: they are witness states.
+ * (5.5.6 v1.20, A26; the `verified` text at v1.28, A35), the same for every
+ * drop. `pending` and `not_found` never head a case reading: they are
+ * witness states. `verified` is the base sentence, printed alone where the
+ * drop holds no hand-off record; a caller reads `caseReliance` for
+ * `verified`, never this mapping directly.
  */
 export const CASE_RELIANCE = {
-    verified: "Every pack in this drop is genuine and unaltered and agrees with its " +
-        "own signed declaration. Every hand-off with both sides here is " +
-        "intact. Every other record is one its holder signed as a step. " +
-        "Nothing here could not be checked. This was read offline, on this " +
-        "device. It does not say these packs are everything the parties " +
-        "recorded.",
+    verified: "Every pack in this drop is genuine, unaltered, and matches its own " +
+        "signed declaration. Every record in it was signed by its holder's " +
+        "key. This was read offline, on this device. It does not say this " +
+        "drop holds everything that was recorded.",
     partial: "Nothing here was proven wrong, and a check could not be completed: a " +
         "pack names no witness, or a pack in a hand-off reading does not say " +
         "what it holds. The exceptions say which.",
@@ -1671,6 +1697,32 @@ export const CASE_RELIANCE = {
         "and some could not be checked. Read each pack's row and each " +
         "exception before relying on any of it.",
 };
+/**
+ * The clause a `verified` drop that holds a hand-off record gains, inserted
+ * after `CASE_RELIANCE`'s first sentence (5.5.6, A35). Never printed alone,
+ * and never where `handoffRecords` is zero: most drops hold one agent's
+ * pack and no hand-off to say anything about.
+ */
+export const CASE_RELIANCE_HANDOFF_CLAUSE = "Every hand-off with both sides in this drop is intact.";
+/**
+ * What a reader may rely on for one case reading (5.5.6 v1.28, A35), byte
+ * for byte the text `case_reliance`'s Python sibling returns.
+ *
+ * For every word but `verified` this is `CASE_RELIANCE` unchanged. For
+ * `verified`, the hand-off clause is inserted after the first sentence
+ * where `handoffRecords` is not zero, and left out where it is zero: the
+ * base sentence never claims a hand-off the drop does not hold.
+ */
+export function caseReliance(verdict, handoffRecords) {
+    if (verdict === "verified" && handoffRecords > 0) {
+        return ("Every pack in this drop is genuine, unaltered, and matches its own " +
+            "signed declaration. Every hand-off with both sides in this drop is " +
+            "intact. Every record in it was signed by its holder's key. This " +
+            "was read offline, on this device. It does not say this drop holds " +
+            "everything that was recorded.");
+    }
+    return CASE_RELIANCE[verdict];
+}
 /** The three witness states, and how each is printed (5.5.6, D7). No other. */
 export const WITNESS_STATES = {
     confirmed: "Confirmed on the public record",
@@ -1684,10 +1736,23 @@ export const WITNESS_NOT_LOOKED_UP = Object.freeze({
     services: [],
 });
 /** The witness line as both kernels print it. */
+/** How a witness time a pack caches is printed where nothing checked it (5.5.6, 5.6.6, v1.25, A30). */
+export const WITNESS_TIME_CACHED = "the pack dates the witness, not checked";
+/** How a witness time the public record returned is printed where it matched the cache. */
+export const WITNESS_TIME_RECORDED = "the public record dates the witness";
+function witnessTimes(times) {
+    return times.map(([h, t]) => renderWitnessTime(h, t)).join(", ");
+}
 export function renderWitnessLine(line) {
     let text = `Witness: ${WITNESS_STATES[line.state]}`;
-    if (line.reasons.length > 0)
-        text += `: ${line.reasons.join("; ")}`;
+    const parts = [...line.reasons];
+    if (line.cached && line.cached.length > 0)
+        parts.push(`${WITNESS_TIME_CACHED}: ${witnessTimes(line.cached)}`);
+    if (line.recorded && line.recorded.length > 0) {
+        parts.push(`${WITNESS_TIME_RECORDED}: ${witnessTimes(line.recorded)}`);
+    }
+    if (parts.length > 0)
+        text += `: ${parts.join("; ")}`;
     if (line.services.length > 0)
         text += ` (answered: ${line.services.join(", ")})`;
     return text;

package/dist/cli.d.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { type WitnessLine } from "./case.js";
 interface Cli {
     out: (s: string) => void;
     err: (s: string) => void;
@@ -33,18 +32,23 @@ export declare class CaseInputError extends Error {
 /**
  * `bundle.json` bytes that `readBundleBytes` will not read. `tooDeep` separates
  * the one refusal that is not a parse error; `detail` is the parser's own words,
- * which differ by kernel and are printed by `verify` only.
+ * which differ by kernel and are printed by `verify` only. `duplicate` marks the
+ * one parse refusal whose `detail` is kernel wording, identical in both kernels
+ * (`duplicate key "<name>"`, proof#144), so both commands print it.
  */
 export declare class BundleReadError extends Error {
     readonly tooDeep: boolean;
     readonly detail: string;
-    constructor(tooDeep: boolean, detail: string);
+    readonly duplicate: boolean;
+    constructor(tooDeep: boolean, detail: string, duplicate?: boolean);
 }
+export declare const NOT_I_JSON = "is not I-JSON (RFC 7493)";
 /**
  * How both `verify` and `case` turn `bundle.json` bytes into JSON, in both
  * kernels (`read_bundle_bytes` in the Python twin). UTF-8 with each ill-formed
  * sequence read as U+FFFD, and a byte-order mark kept; then nesting deeper than
- * MAX_JSON_DEPTH is refused before any parser walks into it; then `JSON.parse`.
+ * MAX_JSON_DEPTH is refused before any parser walks into it; then `JSON.parse`,
+ * refusing an object that repeats a member name (I-JSON, RFC 7493; proof#144).
  * Throws `BundleReadError`.
  */
 export declare function readBundleBytes(bytes: Uint8Array): unknown;
@@ -100,29 +104,6 @@ export declare function readFileEntry(entry: TreeEntry, key: string): Promise<Ui
  */
 export declare function treeFromArguments(paths: readonly string[]): Promise<Map<string, TreeEntry>>;
 export declare const CASE_USAGE: string;
-interface OnChainRow {
-    ref: string;
-    witnesses: number;
-    confirmed: number;
-    mismatched: number;
-    unreachable: number;
-    not_checked: number;
-}
-interface OnChainHalf {
-    /** Present only where a lookup ran: each gateway that answered, in the order given. */
-    answered?: string[];
-    checked: boolean;
-    gateways: string[];
-    packs: OnChainRow[];
-    verdict: "not_checked" | "confirmed" | "failed" | "undetermined";
-}
-/**
- * The witness line (evidence-bundle 5.5.6 v1.20, A24, D7) from the on-chain
- * half: `confirmed` is `confirmed`, `not_checked` and `undetermined` are
- * `not_checked` with the reason, and `failed` is `differs`. It never moves the
- * headline.
- */
-export declare function witnessLine(onChain: OnChainHalf): WitnessLine;
 /**
  * The case verdict's code, moved only by an on-chain half that was asked for:
  * a witness that does not match is a failure whatever the reading said, and an