@sanning/proof 0.9.2 → 0.11.0

package/dist/evidence.d.ts

@@ -1,23 +1,20 @@
 import type { Envelope } from "./types.js";
-export declare const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v2";
+export declare const ANCHOR_TRACE_BODY_TYPE = "sanning.anchor.trace/v3";
 /**
- * The frozen pre-`anchor_ref` body (evidence-bundle.md §5.1.3).
- *
- * Accepted PERMANENTLY, not for a deprecation window. Every bundle emitted
- * before 2026-09-03 carries this shape, and those bundles are evidence — a
- * reader that stopped accepting them would destroy the record it exists to
- * defend (DL-30). Nothing new emits it.
+ * The name `event_bytes` replaced. Under the new majors a body entry that still
+ * carries it is a hard reject, never an ignored unknown field: ignored, it
+ * would read as a withheld record and the event would verify with nothing
+ * checked, the fail-open the new majors exist to prevent (governance.md §8,
+ * W-3).
  */
-export declare const ANCHOR_TRACE_BODY_TYPE_V1 = "sanning.anchor.trace/v1";
-/** Every anchor-trace body this kernel verifies. Order is newest-first. */
-export declare const ANCHOR_TRACE_BODY_TYPES: readonly ["sanning.anchor.trace/v2", "sanning.anchor.trace/v1"];
-export declare const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
+export declare const LEGACY_EVENT_BYTES_FIELD = "record_bytes";
+export declare const EXPORT_BODY_TYPE = "sanning.evidence.export/v2";
 /**
  * The Sanning-signed interval stamp body (evidence-bundle.md §5.2, DL-58).
  *
  * Its own `body_type` rather than a widened anchor-trace body, and the reason
  * is the whole decision: an anchor-trace checkpoint carries a PRODUCER-signed
- * `sanning.events/v1` envelope, and a stamp has no producer signature at all —
+ * `sanning.events/v2` envelope, and a stamp has no producer signature at all:
  * Sanning places it, under DL-52, for a customer who holds no chain identity.
  * The two rejected options were making `envelope` optional and synthesising an
  * envelope that Sanning signs; the second would have made a Sanning
@@ -25,7 +22,7 @@ export declare const EXPORT_BODY_TYPE = "sanning.evidence.export/v1";
  * unrecoverable once witnessed.
  */
 export declare const STAMP_TRACE_BODY_TYPE = "sanning.stamp.trace/v1";
-export declare const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v1";
+export declare const STAMP_EVIDENCE_BODY_TYPE = "sanning.stamp.evidence/v2";
 /**
  * The version string INSIDE a witnessed stamp body — a different string from
  * the `body_type` above, and the two are easy to confuse.
@@ -42,7 +39,6 @@ export interface EvidenceIssuer {
     kind: string;
     tenant_id?: string;
     agent_id?: string;
-    producer_id?: string;
     [k: string]: unknown;
 }
 export interface EvidenceVerdict {
@@ -71,9 +67,8 @@ export interface AnchorRef {
 export interface TraceCheckpoint {
     /**
      * The checkpoint's identity and the join key, DERIVED: hex SHA-256 of the
-     * decoded `record_bytes`. Recomputed by the verifier — in v1 this was an
-     * asserted label matched against another asserted label, so a producer could
-     * relabel a checkpoint and the bundle still verified.
+     * decoded `event_bytes`. Recomputed by the verifier, never taken from the
+     * label.
      */
     checkpoint_ref: string;
     /**
@@ -83,14 +78,7 @@ export interface TraceCheckpoint {
      */
     anchor_ref?: AnchorRef;
     envelope: Envelope;
-    record_bytes: string;
-    merkle_root: string;
-}
-/** The frozen `sanning.anchor.trace/v1` checkpoint (§5.1.3). Read, never written. */
-export interface TraceCheckpointV1 {
-    tx_id: string;
-    envelope: Envelope;
-    record_bytes: string;
+    event_bytes: string;
     merkle_root: string;
 }
 export interface TraceInclusion {
@@ -98,12 +86,12 @@ export interface TraceInclusion {
     leaf_index: number;
     leaf_count: number;
     audit_path: string[];
-    /** Resolves against `checkpoints[].checkpoint_ref`. v1 spells this `checkpoint_tx_id`. */
+    /** Resolves against `checkpoints[].checkpoint_ref`. */
     checkpoint_ref: string;
 }
 export interface TraceEvent {
     envelope: Envelope;
-    record_bytes?: string;
+    event_bytes?: string;
     content?: string;
     inclusion: TraceInclusion;
 }
@@ -174,7 +162,7 @@ export interface StampEvidenceInclusion {
 }
 export interface StampEvidenceEvent {
     envelope: Envelope;
-    record_bytes?: string;
+    event_bytes?: string;
     content?: string;
     inclusion: StampEvidenceInclusion;
 }
@@ -211,23 +199,12 @@ export interface OnChainResult {
     perGateway: PerGatewayOutcome[];
 }
 export interface CheckpointResult {
-    /**
-     * The checkpoint's join key AS THE BUNDLE SPELLS IT — the derived
-     * `checkpoint_ref` for a v2 body, the legacy `tx_id` for a frozen v1 body.
-     * Never re-derived across forms: a v1 bundle's key is its `tx_id`, because
-     * that is what its own events resolve against and what an attestation
-     * written against it carries.
-     */
+    /** The derived `checkpoint_ref`, empty when it could not be derived. */
     checkpointRef: string;
     /**
-     * Where this checkpoint was witnessed, normalised to one shape.
-     *
-     * `null` when a v2 checkpoint carries no `anchor_ref` — placed but not yet
-     * witnessed, which is a normal state and NOT a deficiency. For a frozen v1
-     * checkpoint this is synthesised as `{ kind: "arweave", id: tx_id }`, which
-     * is exactly what v1's spec said the field was ("the Arweave TX the
-     * checkpoint envelope was anchored as"). The synthesis is reader-side only
-     * and never re-enters a signed artifact or a verdict.
+     * Where this checkpoint was witnessed. `null` when the checkpoint carries no
+     * `anchor_ref`: placed but not yet witnessed, which is a normal state and NOT
+     * a deficiency.
      */
     anchorRef: AnchorRef | null;
     envelopeOk: boolean;
@@ -299,12 +276,14 @@ export interface StampResult {
      * ── The four states, and why none of them collapses ──
      *
      * `null` means not checked — no gateways were supplied, or this stamp names
-     * no witness to check. It is a statement about the RUN, never about the
-     * stamp. The other three are statements about the stamp and live in
-     * `onChain.rollup`: `confirm` (a gateway returned the witnessed bytes),
-     * `mismatch` (a gateway returned DIFFERENT bytes — a finding, and the only
-     * one of the four that fails anything), `unreachable` (we asked and nobody
-     * answered — an availability gap, never an accusation).
+     * no witness to check, or its `anchor_ref.kind` has no witness adapter, or
+     * its id is not one the adapter accepts; the witness was not checked. It is
+     * a statement about the RUN, never about the stamp. The other three are
+     * statements about the stamp and live in `onChain.rollup`: `confirm` (a
+     * gateway returned the witnessed bytes), `mismatch` (a gateway returned
+     * DIFFERENT bytes: a finding, and the only one of the four that fails
+     * anything), `unreachable` (we asked and nobody answered: an availability
+     * gap, never an accusation).
      *
      * Keeping "not checked" distinct from "unreachable" is the whole point. A
      * surface handed a collapsed boolean cannot tell "no gateway could be
@@ -339,11 +318,7 @@ export interface EvidenceBundleResult {
     errors: string[];
 }
 export interface AttestationRecord {
-    /**
-     * The source checkpoint this attestation binds to, spelled in the SOURCE
-     * bundle's vocabulary: `checkpoint_ref` for a v2 source, the legacy `tx_id`
-     * for a frozen v1 one. Not re-derived across forms.
-     */
+    /** The source checkpoint's derived `checkpoint_ref` this attestation binds to. */
     checkpoint_ref: string;
     payload: AttestationPayload;
     signature_alg: string;