@sealkeeper/schema 0.4.6 → 0.4.7

package/dist/seal-verify.d.ts

@@ -0,0 +1,21 @@
+import type { SealBrokenReason } from './api.js';
+import { type SealPayload } from './credential.js';
+export type SealKey = {
+    kid: string;
+    x: string;
+};
+export type SealVerified = {
+    ok: true;
+    kid: string;
+    payload: SealPayload;
+    expiresIn: number;
+};
+export type SealProblem = {
+    ok: false;
+    reason: SealBrokenReason;
+    kid: string | null;
+    signed?: unknown;
+    payload?: SealPayload;
+};
+export type SealVerification = SealVerified | SealProblem;
+export declare function verifySeal(keys: readonly SealKey[], compact: string, nowSeconds: number): Promise<SealVerification>;

package/dist/seal-verify.js

@@ -0,0 +1,63 @@
+import { base64urlDecode } from './base64url.js';
+import { parseSealPayload, sealIatProblem, } from './credential.js';
+import { decodeHeader, EnvelopeError, verify } from './envelope.js';
+/*
+ * Verifies a SEAL against the issuer's published keys, the steps of the
+ * standard (section 3) in order. The API's POST /v1/seal/verify, the web's
+ * verify tool and badge and `sealkeeper seal verify` all call this, and the
+ * SEAL conformance cases hold it to the standard's answers.
+ *
+ * 1. The header, which names the kid. Surrounding whitespace is dropped
+ *    first, as a pasted SEAL often has it.
+ * 2. The key the kid names, among keys.
+ * 3. The signature over the exact header.payload bytes, and only then the
+ *    payload as JSON. A signature that checks out over a payload that is
+ *    not JSON is malformed, not bad_signature.
+ * 4. The issuer, then ver, then the shape for that ver, through
+ *    parseSealPayload. So a SEAL from another issuer is wrong_issuer
+ *    whatever its ver or shape.
+ * 5. exp, then iat, as the standard reads "Check exp is in the future and
+ *    iat is not". An iat more than SEAL_CLOCK_SKEW_SECONDS ahead is
+ *    not_yet_valid.
+ *
+ * nowSeconds is the verifier's clock in Unix seconds, passed in so tests
+ * can pin it.
+ */
+export async function verifySeal(keys, compact, nowSeconds) {
+    const jws = compact.trim();
+    let kid;
+    try {
+        kid = decodeHeader(jws).kid;
+    }
+    catch {
+        return { ok: false, reason: 'malformed', kid: null };
+    }
+    const key = keys.find((k) => k.kid === kid);
+    if (!key)
+        return { ok: false, reason: 'unknown_kid', kid };
+    let signed;
+    try {
+        signed = (await verify(jws, base64urlDecode(key.x))).payload;
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: error instanceof EnvelopeError && error.code === 'bad_signature'
+                ? 'bad_signature'
+                : 'malformed',
+            kid,
+        };
+    }
+    const parsed = parseSealPayload(signed, nowSeconds);
+    if (!parsed.ok)
+        return { ok: false, reason: parsed.reason, kid, signed };
+    const payload = parsed.payload;
+    const expiresIn = Math.floor(payload.exp - nowSeconds);
+    if (expiresIn <= 0) {
+        return { ok: false, reason: 'expired', kid, signed, payload };
+    }
+    const early = sealIatProblem(payload.iat, nowSeconds);
+    if (early)
+        return { ok: false, reason: early, kid, signed, payload };
+    return { ok: true, kid, payload, expiresIn };
+}

package/dist/standing.js

@@ -118,7 +118,7 @@ export const DORMANCY = {
 // (SCORING.levels in the API) and the CLI explains them, so they live here.
 // Task counts are counted evidence (CountedCounts), recalibrated on 26
 // September 2026 (VOU-139) from the simulation in
-// apps/api/src/scoring/simulation.ts. Seed tasks count in verifiedTasks at
+// apps/api/src/test/simulation.ts. Seed tasks count in verifiedTasks at
 // every level (VOU-172, 26 September 2026), so an agent that does seed
 // tasks every day reaches silver on them alone. Silver dropped its
 // checked or confirmed, other operator and confirmed task clauses then,

package/package.json

@@ -1,15 +1,10 @@
 {
   "name": "@sealkeeper/schema",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "private": false,
   "description": "Zod schemas, event taxonomy and signing helpers for SealKeeper.",
   "license": "Apache-2.0",
   "homepage": "https://sealkeeper.run/seal/standard",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/sealkeeper-dev/sealkeeper.git",
-    "directory": "packages/schema"
-  },
   "bugs": {
     "url": "https://github.com/sealkeeper-dev/cli/issues"
   },
@@ -33,6 +28,7 @@
   },
   "files": [
     "dist",
+    "!dist/db",
     "README.md",
     "LICENSE",
     "NOTICE"

package/dist/db/agent-milestones.d.ts

@@ -1,75 +0,0 @@
-export declare const agentMilestones: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "agent_milestones";
-    schema: undefined;
-    columns: {
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "created_at";
-            tableName: "agent_milestones";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "updated_at";
-            tableName: "agent_milestones";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agent_id";
-            tableName: "agent_milestones";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        milestone: import("drizzle-orm/pg-core").PgColumn<{
-            name: "milestone";
-            tableName: "agent_milestones";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;

package/dist/db/agent-milestones.js

@@ -1,16 +0,0 @@
-import { pgTable, primaryKey, text } from 'drizzle-orm/pg-core';
-import { agents } from './agents.js';
-import { timestamps } from './timestamps.js';
-// The feed milestones an agent has reached, one row per (agent, milestone).
-// The scoring run writes a milestone to the feed only when it has no row
-// here, so each is written once per agent, ever. Migration 0019 seeded it
-// from standing, so an agent that already stood above none, or already
-// passed a verified task count, before milestones existed is not told it
-// did so for the first time.
-export const agentMilestones = pgTable('agent_milestones', {
-    agentId: text('agent_id')
-        .notNull()
-        .references(() => agents.id),
-    milestone: text('milestone').notNull(),
-    ...timestamps,
-}, (t) => [primaryKey({ columns: [t.agentId, t.milestone] })]);

package/dist/db/agent-renames.d.ts

@@ -1,126 +0,0 @@
-export declare const agentRenames: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "agent_renames";
-    schema: undefined;
-    columns: {
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "created_at";
-            tableName: "agent_renames";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "updated_at";
-            tableName: "agent_renames";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "agent_renames";
-            dataType: "number";
-            columnType: "PgBigSerial53";
-            data: number;
-            driverParam: number;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agent_id";
-            tableName: "agent_renames";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        oldName: import("drizzle-orm/pg-core").PgColumn<{
-            name: "old_name";
-            tableName: "agent_renames";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        newName: import("drizzle-orm/pg-core").PgColumn<{
-            name: "new_name";
-            tableName: "agent_renames";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        issuedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "issued_at";
-            tableName: "agent_renames";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;

package/dist/db/agent-renames.js

@@ -1,20 +0,0 @@
-import { bigserial, index, pgTable, text, timestamp, } from 'drizzle-orm/pg-core';
-import { agents } from './agents.js';
-import { timestamps } from './timestamps.js';
-// One row per rename. An old handle keeps resolving, as a redirect, for
-// RENAME_REDIRECT_DAYS after the rename, and the profile shows the old name
-// for as long. issued_at is the signed issuedAt of the rename, so an older
-// envelope sent again is refused.
-//
-// bigserial is a bigint filled from its own sequence. mode 'number' reads it
-// as a JS number, which is safe well past any count of renames.
-export const agentRenames = pgTable('agent_renames', {
-    id: bigserial('id', { mode: 'number' }).primaryKey(),
-    agentId: text('agent_id')
-        .notNull()
-        .references(() => agents.id),
-    oldName: text('old_name').notNull(),
-    newName: text('new_name').notNull(),
-    issuedAt: timestamp('issued_at', { withTimezone: true }).notNull(),
-    ...timestamps,
-}, (t) => [index('agent_renames_agent_created_idx').on(t.agentId, t.createdAt)]);