@sourcey/catalog-verifier 1.1.36 → 1.2.0

package/dist/modules/assets/src/ingestion.js

@@ -1,169 +0,0 @@
-import { digest, digestPathSegment, sha256Bytes } from "provenry/primitives";
-import { assetObjectCoreSchema, assetTransformProfileCoreSchema, assetTransformProfileSchema, assetTransformReceiptCoreSchema, ENTITY_ICON_MAX_SOURCE_BYTES, ENTITY_ICON_RASTER_PROFILE_VERSION, entityAssetProposalCoreSchema, retainedAssetCaptureCoreSchema, SOURCEY_ENTITY_MONOGRAM_PROFILE_VERSION, } from "../../../contracts/assets/src/index.js";
-import { verifyEntityAssetProposal, verifyRetainedAssetCapture } from "./index.js";
-export const ENTITY_ICON_MAX_SOURCE_PIXELS = 4096 * 4096;
-export const ENTITY_ICON_MAX_SOURCE_ASPECT_RATIO = 1.5;
-export const ENTITY_ICON_SIZE = 256;
-export async function retainEntityAssetCapture(input) {
-    if (input.bytes.byteLength === 0 || input.bytes.byteLength > ENTITY_ICON_MAX_SOURCE_BYTES) {
-        throw new Error("Entity icon original bytes violate the encoded byte limit.");
-    }
-    const originalDigest = sha256Bytes(input.bytes);
-    const storage = await input.objects.put({
-        expectedDigest: originalDigest,
-        bytes: input.bytes,
-        mediaType: input.mediaType,
-        classification: "restricted",
-    });
-    verifyStoreReceipt(storage, {
-        objectDigest: originalDigest,
-        bytes: input.bytes.byteLength,
-        mediaType: input.mediaType,
-        classification: "restricted",
-    });
-    const source = input.source.kind === "upload"
-        ? {
-            kind: "upload",
-            upload_receipt_digest: input.source.uploadReceiptDigest,
-        }
-        : input.source.kind === "official_url"
-            ? {
-                kind: "official_url",
-                requested_url: input.source.requestedUrl,
-                final_url: input.source.finalUrl,
-                redirect_count: input.source.redirectCount,
-                capture_receipt_digest: input.source.captureReceiptDigest,
-            }
-            : {
-                kind: "sourcey_fallback",
-                generation_rule: input.source.generationRule,
-                fallback_reason_digest: input.source.fallbackReasonDigest,
-            };
-    const core = retainedAssetCaptureCoreSchema.parse({
-        capture_contract: "sourcey.retained-asset-capture/v1alpha1",
-        source,
-        original_digest: originalDigest,
-        bytes: input.bytes.byteLength,
-        media_type: input.mediaType,
-        captured_at: input.capturedAt,
-        storage_receipt_digest: storage.receiptDigest,
-    });
-    return verifyRetainedAssetCapture({ ...core, capture_digest: digest(core) });
-}
-export async function prepareEntityAssetProposal(input) {
-    const capture = verifyRetainedAssetCapture(input.capture);
-    if (input.originalBytes.byteLength !== capture.bytes ||
-        sha256Bytes(input.originalBytes) !== capture.original_digest) {
-        throw new Error("Entity asset original bytes differ from the retained capture.");
-    }
-    if (input.originalBytes.byteLength > ENTITY_ICON_MAX_SOURCE_BYTES) {
-        throw new Error("Entity icon exceeds the maximum encoded byte size.");
-    }
-    verifyTransformProfile(input.transformer.profile, input.authorityBasis);
-    const transformed = await input.transformer.transform({
-        bytes: input.originalBytes,
-        declaredMediaType: capture.media_type,
-    });
-    if (transformed.width !== ENTITY_ICON_SIZE ||
-        transformed.height !== ENTITY_ICON_SIZE ||
-        transformed.mediaType !== input.transformer.profile.output_media_type) {
-        throw new Error("Entity icon transformer did not produce the exact canonical canvas.");
-    }
-    const safeDigest = sha256Bytes(transformed.bytes);
-    const safeStorage = await input.objects.put({
-        expectedDigest: safeDigest,
-        bytes: transformed.bytes,
-        mediaType: transformed.mediaType,
-        classification: "public",
-    });
-    verifyStoreReceipt(safeStorage, {
-        objectDigest: safeDigest,
-        bytes: transformed.bytes.byteLength,
-        mediaType: transformed.mediaType,
-        classification: "public",
-    });
-    const receiptCore = assetTransformReceiptCoreSchema.parse({
-        receipt_contract: "sourcey.asset-transform-receipt/v1alpha1",
-        original_digest: capture.original_digest,
-        safe_digest: safeDigest,
-        profile_digest: input.transformer.profile.profile_digest,
-        toolchain_digest: input.transformer.profile.toolchain_digest,
-    });
-    const receipt = { ...receiptCore, receipt_digest: digest(receiptCore) };
-    const safePath = `safe/sha256/${digestPathSegment(safeDigest)}`;
-    const objectCore = assetObjectCoreSchema.parse({
-        asset_contract: "sourcey.asset/v1alpha1",
-        original: {
-            digest: capture.original_digest,
-            bytes: capture.bytes,
-            media_type: capture.media_type,
-            source_path: `originals/sha256/${digestPathSegment(capture.original_digest)}`,
-        },
-        safe_variants: [
-            {
-                digest: safeDigest,
-                bytes: transformed.bytes.byteLength,
-                media_type: transformed.mediaType,
-                source_path: safePath,
-                served_path: `sha256/${digestPathSegment(safeDigest)}`,
-                width: transformed.width,
-                height: transformed.height,
-                transform_profile_digest: input.transformer.profile.profile_digest,
-                transform_receipt_digest: receipt.receipt_digest,
-            },
-        ],
-        transform_receipts: [receipt],
-        redistribution: input.redistribution,
-    });
-    const asset = { ...objectCore, asset_object_digest: digest(objectCore) };
-    const core = entityAssetProposalCoreSchema.parse({
-        proposal_contract: "sourcey.entity-asset-proposal/v1alpha1",
-        base_release_id: input.baseReleaseId,
-        entity_id: input.entityId,
-        role: "icon",
-        expected_current_binding_event_id: input.expectedCurrentBindingEventId,
-        capture,
-        transform_profile: input.transformer.profile,
-        asset,
-        served_digest: safeDigest,
-        safe_storage_receipt_digest: safeStorage.receiptDigest,
-        authority_basis: input.authorityBasis,
-        ...(input.authorityClaimId ? { authority_claim_id: input.authorityClaimId } : {}),
-        source_basis: input.sourceBasis,
-        approval_scope: "entity-icon",
-        review: input.reviewArtifact,
-        effective_from: input.effectiveFrom,
-    });
-    return verifyEntityAssetProposal({ ...core, proposal_digest: digest(core) });
-}
-function verifyTransformProfile(profile, authorityBasis) {
-    const parsed = assetTransformProfileSchema.parse(profile);
-    const { profile_digest: profileDigest, ...core } = parsed;
-    if (digest(assetTransformProfileCoreSchema.parse(core)) !== profileDigest) {
-        throw new Error("Entity icon transform profile digest is invalid.");
-    }
-    const canonicalRaster = profile.profile_version === ENTITY_ICON_RASTER_PROFILE_VERSION &&
-        profile.output_media_type === "image/png" &&
-        profile.maximum_width === ENTITY_ICON_SIZE &&
-        profile.maximum_height === ENTITY_ICON_SIZE &&
-        profile.maximum_source_aspect_ratio === ENTITY_ICON_MAX_SOURCE_ASPECT_RATIO;
-    const canonicalSourceyVector = profile.profile_version === SOURCEY_ENTITY_MONOGRAM_PROFILE_VERSION &&
-        profile.output_media_type === "image/svg+xml" &&
-        profile.maximum_width === ENTITY_ICON_SIZE &&
-        profile.maximum_height === ENTITY_ICON_SIZE &&
-        profile.maximum_source_aspect_ratio === 1;
-    if ((authorityBasis === "sourcey-owned" && !canonicalSourceyVector) ||
-        (authorityBasis !== "sourcey-owned" && !canonicalRaster)) {
-        throw new Error("Entity icon transformer does not implement the canonical profile.");
-    }
-}
-function verifyStoreReceipt(receipt, expected) {
-    if (receipt.objectDigest !== expected.objectDigest ||
-        receipt.bytes !== expected.bytes ||
-        receipt.mediaType !== expected.mediaType ||
-        receipt.classification !== expected.classification ||
-        !receipt.receiptDigest.startsWith("sha256:")) {
-        throw new Error("Asset object-store receipt does not bind the exact safe object.");
-    }
-}
-//# sourceMappingURL=ingestion.js.map

package/dist/modules/assets/src/ingestion.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ingestion.js","sourceRoot":"","sources":["../../../../modules/assets/src/ingestion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAS1F,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,+BAA+B,EAC/B,4BAA4B,EAC5B,kCAAkC,EAClC,6BAA6B,EAC7B,8BAA8B,EAC9B,uCAAuC,GACxC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAkCpC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAmB9C;IACC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,4BAA4B,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACtC,cAAc,EAAE,cAAc;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,YAAY;KAC7B,CAAC,CAAC;IACH,kBAAkB,CAAC,OAAO,EAAE;QAC1B,YAAY,EAAE,cAAc;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,YAAY;KAC7B,CAAC,CAAC;IACH,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC5B,CAAC,CAAC;YACE,IAAI,EAAE,QAAiB;YACvB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB;SACxD;QACH,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;YACpC,CAAC,CAAC;gBACE,IAAI,EAAE,cAAuB;gBAC7B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACxC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;gBAChC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;gBAC1C,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;aAC1D;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,kBAA2B;gBACjC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;gBAC5C,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;aAC1D,CAAC;IACV,MAAM,IAAI,GAAG,8BAA8B,CAAC,KAAK,CAAC;QAChD,gBAAgB,EAAE,yCAAyC;QAC3D,MAAM;QACN,eAAe,EAAE,cAAc;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAC7B,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,sBAAsB,EAAE,OAAO,CAAC,aAAa;KAC9C,CAAC,CAAC;IACH,OAAO,0BAA0B,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAkBhD;IACC,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,IACE,KAAK,CAAC,aAAa,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK;QAChD,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,eAAe,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,UAAU,GAAG,4BAA4B,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAExE,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,aAAa;QAC1B,iBAAiB,EAAE,OAAO,CAAC,UAAU;KACtC,CAAC,CAAC;IACH,IACE,WAAW,CAAC,KAAK,KAAK,gBAAgB;QACtC,WAAW,CAAC,MAAM,KAAK,gBAAgB;QACvC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1C,cAAc,EAAE,UAAU;QAC1B,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC;IACH,kBAAkB,CAAC,WAAW,EAAE;QAC9B,YAAY,EAAE,UAAU;QACxB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU;QACnC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,cAAc,EAAE,QAAQ;KACzB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,+BAA+B,CAAC,KAAK,CAAC;QACxD,gBAAgB,EAAE,0CAA0C;QAC5D,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,WAAW,EAAE,UAAU;QACvB,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc;QACxD,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB;KAC7D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,eAAe,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC;QAC7C,cAAc,EAAE,wBAAwB;QACxC,QAAQ,EAAE;YACR,MAAM,EAAE,OAAO,CAAC,eAAe;YAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,oBAAoB,iBAAiB,CAAC,OAAO,CAAC,eAAyB,CAAC,EAAE;SACxF;QACD,aAAa,EAAE;YACb;gBACE,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU;gBACnC,UAAU,EAAE,WAAW,CAAC,SAAS;gBACjC,WAAW,EAAE,QAAQ;gBACrB,WAAW,EAAE,UAAU,iBAAiB,CAAC,UAAU,CAAC,EAAE;gBACtD,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,wBAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc;gBAClE,wBAAwB,EAAE,OAAO,CAAC,cAAc;aACjD;SACF;QACD,kBAAkB,EAAE,CAAC,OAAO,CAAC;QAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,EAAE,GAAG,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,CAAC;QAC/C,iBAAiB,EAAE,wCAAwC;QAC3D,eAAe,EAAE,KAAK,CAAC,aAAa;QACpC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM;QACZ,iCAAiC,EAAE,KAAK,CAAC,6BAA6B;QACtE,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO;QAC5C,KAAK;QACL,aAAa,EAAE,UAAU;QACzB,2BAA2B,EAAE,WAAW,CAAC,aAAa;QACtD,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,cAAc,EAAE,aAAa;QAC7B,MAAM,EAAE,KAAK,CAAC,cAAc;QAC5B,cAAc,EAAE,KAAK,CAAC,aAAa;KACpC,CAAC,CAAC;IACH,OAAO,yBAAyB,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA8B,EAC9B,cAA6F;IAE7F,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC1D,IAAI,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,kCAAkC;QAC9D,OAAO,CAAC,iBAAiB,KAAK,WAAW;QACzC,OAAO,CAAC,aAAa,KAAK,gBAAgB;QAC1C,OAAO,CAAC,cAAc,KAAK,gBAAgB;QAC3C,OAAO,CAAC,2BAA2B,KAAK,mCAAmC,CAAC;IAC9E,MAAM,sBAAsB,GAC1B,OAAO,CAAC,eAAe,KAAK,uCAAuC;QACnE,OAAO,CAAC,iBAAiB,KAAK,eAAe;QAC7C,OAAO,CAAC,aAAa,KAAK,gBAAgB;QAC1C,OAAO,CAAC,cAAc,KAAK,gBAAgB;QAC3C,OAAO,CAAC,2BAA2B,KAAK,CAAC,CAAC;IAC5C,IACE,CAAC,cAAc,KAAK,eAAe,IAAI,CAAC,sBAAsB,CAAC;QAC/D,CAAC,cAAc,KAAK,eAAe,IAAI,CAAC,eAAe,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAgC,EAChC,QAAwD;IAExD,IACE,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC9C,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAChC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACxC,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAClD,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC"}

package/dist/modules/assurance/src/index.d.ts

@@ -1,22 +0,0 @@
-import { type AssuranceMethodPolicy, type EntityIdentityAssurance, type OfferTermsAssurance } from "../../../contracts/assurance/src/index.js";
-import type { CatalogEvent } from "../../../contracts/events/src/index.js";
-import type { EntityRevision, OfferRevision } from "../../../contracts/revisions/src/index.js";
-export declare function deriveEntityIdentityAnchor(revision: EntityRevision): {
-    anchor_contract: "sourcey.entity-identity-anchor/v1alpha1";
-    entity_id: string;
-    name: string;
-    primary_domain: string;
-    identity_epoch_digest: string;
-};
-export declare function validateAssuranceMethodPolicy(input: unknown): AssuranceMethodPolicy;
-export declare function deriveEntityIdentityAssurance(input: {
-    readonly revision: EntityRevision;
-    readonly events: readonly CatalogEvent[];
-    readonly inactiveEventIds: ReadonlySet<string>;
-}): EntityIdentityAssurance | undefined;
-export declare function deriveOfferTermsAssurance(input: {
-    readonly revision: OfferRevision;
-    readonly events: readonly CatalogEvent[];
-    readonly inactiveEventIds: ReadonlySet<string>;
-}): OfferTermsAssurance | undefined;
-//# sourceMappingURL=index.d.ts.map

package/dist/modules/assurance/src/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../modules/assurance/src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,qBAAqB,EAG1B,KAAK,uBAAuB,EAI5B,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG/F,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,cAAc;;;;;;EAQlE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAOnF;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChD,GAAG,uBAAuB,GAAG,SAAS,CAyBtC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChD,GAAG,mBAAmB,GAAG,SAAS,CAyBlC"}

package/dist/modules/assurance/src/index.js

@@ -1,73 +0,0 @@
-import { compareCanonicalStrings, compareInstants, digest } from "provenry/primitives";
-import { assuranceMethodPolicyCoreSchema, assuranceMethodPolicySchema, entityIdentityAnchorCoreSchema, entityIdentityAnchorSchema, entityIdentityCheckedPayloadSchema, offerTermsCheckedPayloadSchema, } from "../../../contracts/assurance/src/index.js";
-import { currentEntityPrimaryDomain } from "../../authority-state/src/index.js";
-export function deriveEntityIdentityAnchor(revision) {
-    const core = entityIdentityAnchorCoreSchema.parse({
-        anchor_contract: "sourcey.entity-identity-anchor/v1alpha1",
-        entity_id: revision.entity_id,
-        name: revision.content.name,
-        primary_domain: currentEntityPrimaryDomain(revision),
-    });
-    return entityIdentityAnchorSchema.parse({ ...core, identity_epoch_digest: digest(core) });
-}
-export function validateAssuranceMethodPolicy(input) {
-    const policy = assuranceMethodPolicySchema.parse(input);
-    const { policy_digest: policyDigest, ...core } = policy;
-    if (digest(assuranceMethodPolicyCoreSchema.parse(core)) !== policyDigest) {
-        throw new Error("Assurance method policy is not content-addressed correctly.");
-    }
-    return policy;
-}
-export function deriveEntityIdentityAssurance(input) {
-    const anchor = deriveEntityIdentityAnchor(input.revision);
-    const candidates = input.events
-        .filter((event) => event.kind === "entity.identity-checked" &&
-        event.subject.subject_type === "entity" &&
-        event.subject.entity_id === input.revision.entity_id &&
-        !input.inactiveEventIds.has(event.event_id))
-        .map((event) => ({ event, payload: entityIdentityCheckedPayloadSchema.parse(event.payload) }))
-        .filter(({ payload }) => payload.identity_epoch_digest === anchor.identity_epoch_digest)
-        .sort(compareAssuranceEvents);
-    const active = candidates.at(-1);
-    if (!active)
-        return undefined;
-    return {
-        status: "verified",
-        assurance_id: active.payload.assurance_id,
-        verified_at: active.payload.checked_at,
-        identity_epoch_digest: anchor.identity_epoch_digest,
-        method_policy_digest: active.payload.method_policy_digest,
-        coverage_policy_digest: active.payload.coverage_policy_digest,
-        event_id: active.event.event_id,
-        receipt_digest: active.payload.receipt_digest,
-    };
-}
-export function deriveOfferTermsAssurance(input) {
-    const candidates = input.events
-        .filter((event) => event.kind === "offer.terms-checked" &&
-        event.subject.subject_type === "offer" &&
-        event.subject.entity_id === input.revision.entity_id &&
-        event.subject.offer_id === input.revision.offer_id &&
-        event.subject.revision_digest === input.revision.revision_digest &&
-        !input.inactiveEventIds.has(event.event_id))
-        .map((event) => ({ event, payload: offerTermsCheckedPayloadSchema.parse(event.payload) }))
-        .sort(compareAssuranceEvents);
-    const active = candidates.at(-1);
-    if (!active)
-        return undefined;
-    return {
-        status: "checked",
-        assurance_id: active.payload.assurance_id,
-        checked_at: active.payload.checked_at,
-        revision_digest: input.revision.revision_digest,
-        method_policy_digest: active.payload.method_policy_digest,
-        coverage_policy_digest: active.payload.coverage_policy_digest,
-        event_id: active.event.event_id,
-        receipt_digest: active.payload.receipt_digest,
-    };
-}
-function compareAssuranceEvents(left, right) {
-    return (compareInstants(left.payload.checked_at, right.payload.checked_at) ||
-        compareCanonicalStrings(left.event.event_id, right.event.event_id));
-}
-//# sourceMappingURL=index.js.map

package/dist/modules/assurance/src/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../modules/assurance/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAe,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAEL,+BAA+B,EAC/B,2BAA2B,EAE3B,8BAA8B,EAC9B,0BAA0B,EAC1B,kCAAkC,EAElC,8BAA8B,GAC/B,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,MAAM,UAAU,0BAA0B,CAAC,QAAwB;IACjE,MAAM,IAAI,GAAG,8BAA8B,CAAC,KAAK,CAAC;QAChD,eAAe,EAAE,yCAAyC;QAC1D,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;QAC3B,cAAc,EAAE,0BAA0B,CAAC,QAAQ,CAAC;KACrD,CAAC,CAAC;IACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACxD,IAAI,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM;SAC5B,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,KAAK,yBAAyB;QACxC,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ;QACvC,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS;QACpD,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C;SACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;SAC7F,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,MAAM,CAAC,qBAAqB,CAAC;SACvF,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;QACzC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;QACtC,qBAAqB,EAAE,MAAM,CAAC,qBAA+B;QAC7D,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,oBAA8B;QACnE,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAgC;QACvE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAkB;QACzC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAwB;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM;SAC5B,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,KAAK,qBAAqB;QACpC,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,OAAO;QACtC,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS;QACpD,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ;QAClD,KAAK,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,QAAQ,CAAC,eAAe;QAChE,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C;SACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;SACzF,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;QACzC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;QACrC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAyB;QACzD,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,oBAA8B;QACnE,sBAAsB,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAgC;QACvE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAkB;QACzC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAwB;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAyF,EACzF,KAA0F;IAE1F,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAClE,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnE,CAAC;AACJ,CAAC"}

package/dist/modules/authority/src/index.d.ts

@@ -1,48 +0,0 @@
-import { type Digest } from "provenry/primitives";
-import { type ReceiptKeys } from "provenry/receipts";
-import type { ProtectedSignature, RootSet, RootSetTransition, RootSetTransitionCore, SignaturePurpose, SignerRegistry, SignerRegistryCore } from "../../../contracts/authority/src/index.js";
-import { type CatalogVerifierIdentityContext, type CatalogVerifierIdentityContextCore } from "../../../contracts/catalog-verifier/src/index.js";
-import { type CatalogEvent, type CatalogEventCore, type CatalogEventKind } from "../../../contracts/events/src/index.js";
-import { type ChangeCursor, type ChangeCursorCore, type SearchCursor, type SearchCursorCore } from "../../../contracts/feed/src/index.js";
-import { type ReleasePublication, type ReleasePublicationCore } from "../../../contracts/release/src/index.js";
-export declare function signaturePurposeForKind(kind: CatalogEventKind): SignaturePurpose;
-/** The registry's keys as Provenry receipts judges them, built once per registry. */
-export declare function signerRegistryReceiptKeys(registry: SignerRegistry): ReceiptKeys;
-export declare function signerRegistryPreimage(core: SignerRegistryCore): Buffer;
-export declare function rootSetTransitionPreimage(core: RootSetTransitionCore): Buffer;
-export declare function validateRootSetTransition(input: {
-    readonly previousRootSet: RootSet;
-    readonly nextRootSet: RootSet;
-    readonly transition: unknown;
-    readonly releaseSequence: number;
-}): RootSetTransition;
-export declare function eventSignaturePreimage(core: CatalogEventCore, eventId: Digest, protectedHeader: Omit<ProtectedSignature, "signature">): Buffer;
-export declare function releasePublicationSignaturePreimage(core: ReleasePublicationCore, publicationDigest: Digest, protectedHeader: Omit<ProtectedSignature, "signature">): Buffer;
-export declare function changeCursorSignaturePreimage(core: ChangeCursorCore | SearchCursorCore, cursorDigest: Digest, protectedHeader: Omit<ProtectedSignature, "signature">): Buffer;
-export declare function catalogVerifierIdentityContextSignaturePreimage(core: CatalogVerifierIdentityContextCore, contextDigest: Digest, protectedHeader: Omit<ProtectedSignature, "signature">): Buffer;
-export declare function validateCatalogVerifierIdentityContext(input: unknown, registry: SignerRegistry, verifiedAt: string): CatalogVerifierIdentityContext;
-export declare function validateSearchCursor(input: unknown, registry: SignerRegistry, context?: {
-    readonly releaseSequence: number;
-}): SearchCursor;
-export declare function validateSignerRegistry(rootSet: RootSet, input: unknown): SignerRegistry;
-export declare function registryIssuerForPurpose(registry: SignerRegistry, purpose: SignaturePurpose): string;
-/**
- * Resolve the one registry authority that may issue a purpose-bound object at
- * an exact instant and release. This is deliberately independent of private
- * key custody: callers learn only the public issuer/key identity that their
- * immutable object must name.
- */
-export declare function resolveActiveSignerAuthority(registry: SignerRegistry, input: {
-    readonly purpose: SignaturePurpose;
-    readonly at: string;
-    readonly releaseSequence: number;
-}): {
-    readonly issuerId: string;
-    readonly keyId: string;
-};
-export declare function validateProtectedEvent(input: unknown, registry: SignerRegistry, releaseSequence: number): CatalogEvent;
-export declare function validateReleasePublication(input: unknown, registry: SignerRegistry): ReleasePublication;
-export declare function validateChangeCursor(input: unknown, registry: SignerRegistry, context?: {
-    readonly releaseSequence: number;
-}): ChangeCursor;
-//# sourceMappingURL=index.d.ts.map

package/dist/modules/authority/src/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../modules/authority/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAU,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAEL,KAAK,WAAW,EAOjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,kBAAkB,EAClB,OAAO,EACP,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,2CAA2C,CAAC;AAOnD,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EAGxC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EAGtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAGtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAG5B,MAAM,yCAAyC,CAAC;AASjD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,gBAAgB,CAwBhF;AAKD,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,WAAW,CAkB/E;AAmBD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAEvE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAE7E;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GAAG,iBAAiB,CAgCpB;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CAMR;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,sBAAsB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CAMR;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,gBAAgB,GAAG,gBAAgB,EACzC,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CAMR;AAED,wBAAgB,+CAA+C,CAC7D,IAAI,EAAE,kCAAkC,EACxC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CAMR;AAED,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,MAAM,GACjB,8BAA8B,CAoChC;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC7C,YAAY,CAsBd;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,cAAc,CAmBvF;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,gBAAgB,GACxB,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IACL,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GACA;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAWvD;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,MAAM,GACtB,YAAY,CA8Bd;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,GACvB,kBAAkB,CAmCpB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC7C,YAAY,CAqBd"}

package/dist/modules/authority/src/index.js

@@ -1,298 +0,0 @@
-import { digest } from "provenry/primitives";
-import { activeReceiptKey, receiptKeys, receiptPreimage, receiptRoots, verifyReceipt, verifyReceiptThreshold, } from "provenry/receipts";
-import { rootSetTransitionCoreSchema, rootSetTransitionSchema, signerRegistryCoreSchema, signerRegistrySchema, } from "../../../contracts/authority/src/index.js";
-import { catalogVerifierIdentityContextCoreSchema, catalogVerifierIdentityContextSchema, } from "../../../contracts/catalog-verifier/src/index.js";
-import { catalogEventCoreSchema, catalogEventSchema, } from "../../../contracts/events/src/index.js";
-import { changeCursorCoreSchema, changeCursorSchema, searchCursorCoreSchema, searchCursorSchema, } from "../../../contracts/feed/src/index.js";
-import { releasePublicationCoreSchema, releasePublicationSchema, } from "../../../contracts/release/src/index.js";
-const REGISTRY_DOMAIN = "sourcey:signer-registry:v1alpha1";
-const EVENT_DOMAIN = "sourcey:catalog-event:v1alpha1";
-const RELEASE_DOMAIN = "sourcey:release-publication:v1alpha1";
-const FEED_CURSOR_DOMAIN = "sourcey:change-cursor:v1alpha1";
-const ROOT_TRANSITION_DOMAIN = "sourcey:root-set-transition:v1alpha1";
-const VERIFIER_IDENTITY_CONTEXT_DOMAIN = "sourcey:catalog-verifier-identity-context:v1alpha1";
-export function signaturePurposeForKind(kind) {
-    if (kind === "evidence.bound" ||
-        kind === "evidence.retracted" ||
-        kind === "discrepancy.resolved" ||
-        kind === "agent-readiness-profile.admitted") {
-        return "catalog-evidence";
-    }
-    if (kind.startsWith("authority."))
-        return "catalog-authority";
-    if (kind === "subject.attested" || kind === "attestation.revoked") {
-        return "catalog-attestation";
-    }
-    if (kind === "verification.completed" ||
-        kind === "entity.identity-checked" ||
-        kind === "offer.terms-checked" ||
-        kind === "assurance.revoked") {
-        return "catalog-verification";
-    }
-    if (kind.startsWith("freshness."))
-        return "catalog-policy";
-    if (kind.startsWith("dispute."))
-        return "catalog-dispute";
-    return "catalog-identity";
-}
-const registryReceiptKeys = new WeakMap();
-const rootSetReceiptRoots = new WeakMap();
-/** The registry's keys as Provenry receipts judges them, built once per registry. */
-export function signerRegistryReceiptKeys(registry) {
-    const built = registryReceiptKeys.get(registry);
-    if (built)
-        return built;
-    const keys = receiptKeys(registry.issuers.flatMap((issuer) => issuer.keys.map((key) => ({
-        issuerId: issuer.issuer_id,
-        keyId: key.key_id,
-        purposes: key.purposes,
-        publicKeyPem: key.public_key_pem,
-        validFrom: key.valid_from,
-        validUntil: key.valid_until ?? null,
-        compromisedAfterSequence: key.compromised_after_sequence ?? null,
-    }))));
-    registryReceiptKeys.set(registry, keys);
-    return keys;
-}
-function rootSetRoots(rootSet) {
-    const built = rootSetReceiptRoots.get(rootSet);
-    if (built)
-        return built;
-    const roots = receiptRoots(rootSet.keys.map((key) => ({ keyId: key.key_id, publicKeyPem: key.public_key_pem })), rootSet.threshold);
-    rootSetReceiptRoots.set(rootSet, roots);
-    return roots;
-}
-function rootSignatures(signatures) {
-    return signatures.map(({ key_id, signature }) => ({ keyId: key_id, signature }));
-}
-export function signerRegistryPreimage(core) {
-    return receiptPreimage([REGISTRY_DOMAIN], core);
-}
-export function rootSetTransitionPreimage(core) {
-    return receiptPreimage([ROOT_TRANSITION_DOMAIN], core);
-}
-export function validateRootSetTransition(input) {
-    const transition = rootSetTransitionSchema.parse(input.transition);
-    const { transition_digest: transitionDigest, previous_root_signatures: previousSignatures, next_root_signatures: nextSignatures, ...coreInput } = transition;
-    const core = rootSetTransitionCoreSchema.parse(coreInput);
-    if (digest(core) !== transitionDigest)
-        throw new Error("Root-set transition digest mismatch.");
-    if (core.previous_root_set_digest !== digest(input.previousRootSet) ||
-        core.next_root_set_digest !== digest(input.nextRootSet) ||
-        core.previous_generation !== input.previousRootSet.generation ||
-        core.next_generation !== input.nextRootSet.generation ||
-        core.next_generation !== core.previous_generation + 1 ||
-        core.effective_release_sequence !== input.releaseSequence) {
-        throw new Error("Root-set transition does not bind the exact adjacent trust generations.");
-    }
-    const preimage = rootSetTransitionPreimage(core);
-    verifyReceiptThreshold(rootSetRoots(input.previousRootSet), {
-        subject: "Root-set transition (previous roots)",
-        preimage,
-        signatures: rootSignatures(previousSignatures),
-    });
-    verifyReceiptThreshold(rootSetRoots(input.nextRootSet), {
-        subject: "Root-set transition (next roots)",
-        preimage,
-        signatures: rootSignatures(nextSignatures),
-    });
-    return transition;
-}
-export function eventSignaturePreimage(core, eventId, protectedHeader) {
-    return receiptPreimage([EVENT_DOMAIN, protectedHeader.signature_purpose], {
-        event_id: eventId,
-        event_core_digest: digest(core),
-        protected: protectedHeader,
-    });
-}
-export function releasePublicationSignaturePreimage(core, publicationDigest, protectedHeader) {
-    return receiptPreimage([RELEASE_DOMAIN, protectedHeader.signature_purpose], {
-        publication_digest: publicationDigest,
-        publication_core_digest: digest(core),
-        protected: protectedHeader,
-    });
-}
-export function changeCursorSignaturePreimage(core, cursorDigest, protectedHeader) {
-    return receiptPreimage([FEED_CURSOR_DOMAIN, protectedHeader.signature_purpose], {
-        cursor_digest: cursorDigest,
-        cursor_core_digest: digest(core),
-        protected: protectedHeader,
-    });
-}
-export function catalogVerifierIdentityContextSignaturePreimage(core, contextDigest, protectedHeader) {
-    return receiptPreimage([VERIFIER_IDENTITY_CONTEXT_DOMAIN, protectedHeader.signature_purpose], {
-        context_digest: contextDigest,
-        context_core_digest: digest(core),
-        protected: protectedHeader,
-    });
-}
-export function validateCatalogVerifierIdentityContext(input, registry, verifiedAt) {
-    const context = catalogVerifierIdentityContextSchema.parse(input);
-    const { context_digest: contextDigest, protected: protectedSignature, ...coreInput } = context;
-    const core = catalogVerifierIdentityContextCoreSchema.parse(coreInput);
-    if (digest(core) !== contextDigest) {
-        throw new Error("Catalog verifier identity context digest mismatch.");
-    }
-    if (protectedSignature.signature_purpose !== "catalog-identity" ||
-        protectedSignature.signer_registry_digest !== registry.registry_digest) {
-        throw new Error("Catalog verifier identity context uses invalid protected authority.");
-    }
-    const verificationInstant = Date.parse(verifiedAt);
-    if (!Number.isFinite(verificationInstant) ||
-        verificationInstant < Date.parse(context.issued_at) ||
-        verificationInstant >= Date.parse(context.expires_at)) {
-        throw new Error("Catalog verifier identity context is outside its signed freshness interval.");
-    }
-    const { signature, ...protectedHeader } = protectedSignature;
-    verifyReceipt(signerRegistryReceiptKeys(registry), {
-        subject: "Catalog verifier identity context",
-        keyId: protectedSignature.key_id,
-        purpose: "catalog-identity",
-        at: context.issued_at,
-        sequence: context.live_parent_release_sequence,
-        preimage: catalogVerifierIdentityContextSignaturePreimage(core, contextDigest, protectedHeader),
-        signature,
-    });
-    return context;
-}
-export function validateSearchCursor(input, registry, context) {
-    const cursor = searchCursorSchema.parse(input);
-    const { cursor_digest: cursorDigest, protected: protectedSignature, ...coreInput } = cursor;
-    const core = searchCursorCoreSchema.parse(coreInput);
-    if (cursorDigest !== digest(core))
-        throw new Error("Search cursor digest mismatch.");
-    if (protectedSignature.signature_purpose !== "catalog-feed" ||
-        protectedSignature.signer_registry_digest !== registry.registry_digest) {
-        throw new Error("Search cursor uses invalid protected authority.");
-    }
-    const { signature, ...protectedHeader } = protectedSignature;
-    // A cursor names no signing time; a compromised key is refused unless the release says otherwise.
-    verifyReceipt(signerRegistryReceiptKeys(registry), {
-        subject: "Search cursor",
-        keyId: protectedSignature.key_id,
-        purpose: "catalog-feed",
-        ...(context ? { sequence: context.releaseSequence } : {}),
-        preimage: changeCursorSignaturePreimage(core, cursorDigest, protectedHeader),
-        signature,
-    });
-    return cursor;
-}
-export function validateSignerRegistry(rootSet, input) {
-    const registry = signerRegistrySchema.parse(input);
-    const { registry_digest: registryDigest, root_signatures: signatures, ...coreInput } = registry;
-    const core = signerRegistryCoreSchema.parse(coreInput);
-    const expectedDigest = digest(core);
-    if (registryDigest !== expectedDigest) {
-        throw new Error(`Signer registry digest mismatch: expected ${expectedDigest}, received ${registryDigest}.`);
-    }
-    verifyReceiptThreshold(rootSetRoots(rootSet), {
-        subject: "Signer registry",
-        preimage: signerRegistryPreimage(core),
-        signatures: rootSignatures(signatures),
-    });
-    // Its keys are judged once, here: every object it authorizes verifies from them.
-    signerRegistryReceiptKeys(registry);
-    return registry;
-}
-export function registryIssuerForPurpose(registry, purpose) {
-    const issuers = registry.issuers.filter((issuer) => issuer.keys.some((key) => key.purposes.includes(purpose)));
-    if (issuers.length !== 1 || !issuers[0]) {
-        throw new Error(`Signer registry must name exactly one issuer for ${purpose}.`);
-    }
-    return issuers[0].issuer_id;
-}
-/**
- * Resolve the one registry authority that may issue a purpose-bound object at
- * an exact instant and release. This is deliberately independent of private
- * key custody: callers learn only the public issuer/key identity that their
- * immutable object must name.
- */
-export function resolveActiveSignerAuthority(registry, input) {
-    if (!Number.isFinite(Date.parse(input.at)))
-        throw new Error("Signer authority time is invalid.");
-    if (!Number.isInteger(input.releaseSequence) || input.releaseSequence <= 0) {
-        throw new Error("Signer authority release sequence must be a positive integer.");
-    }
-    const key = activeReceiptKey(signerRegistryReceiptKeys(registry), {
-        purpose: input.purpose,
-        at: input.at,
-        sequence: input.releaseSequence,
-    });
-    return { issuerId: key.issuerId, keyId: key.keyId };
-}
-export function validateProtectedEvent(input, registry, releaseSequence) {
-    const event = catalogEventSchema.parse(input);
-    const { event_id: eventId, protected: protectedSignature, ...coreInput } = event;
-    const core = catalogEventCoreSchema.parse(coreInput);
-    const expectedEventId = digest(core);
-    if (eventId !== expectedEventId) {
-        throw new Error(`Event ID mismatch: expected ${expectedEventId}, received ${eventId}.`);
-    }
-    if (protectedSignature.signer_registry_digest !== registry.registry_digest) {
-        throw new Error(`Event ${eventId} does not use the release-pinned signer registry.`);
-    }
-    const expectedPurpose = signaturePurposeForKind(event.kind);
-    if (protectedSignature.signature_purpose !== expectedPurpose) {
-        throw new Error(`Event ${eventId} uses ${protectedSignature.signature_purpose}; ${expectedPurpose} required.`);
-    }
-    const { signature, ...protectedHeader } = protectedSignature;
-    verifyReceipt(signerRegistryReceiptKeys(registry), {
-        subject: `Event ${eventId}`,
-        keyId: protectedSignature.key_id,
-        issuerId: event.issuer_id,
-        purpose: expectedPurpose,
-        at: event.occurred_at,
-        sequence: releaseSequence,
-        preimage: eventSignaturePreimage(core, eventId, protectedHeader),
-        signature,
-    });
-    return event;
-}
-export function validateReleasePublication(input, registry) {
-    const publication = releasePublicationSchema.parse(input);
-    const { publication_digest: publicationDigest, protected: protectedSignature, ...coreInput } = publication;
-    const core = releasePublicationCoreSchema.parse(coreInput);
-    const expectedDigest = digest(core);
-    if (publicationDigest !== expectedDigest) {
-        throw new Error(`Publication digest mismatch: expected ${expectedDigest}, received ${publicationDigest}.`);
-    }
-    if (protectedSignature.signature_purpose !== "catalog-release") {
-        throw new Error("Release publication requires a catalog-release signature.");
-    }
-    if (protectedSignature.signer_registry_digest !== registry.registry_digest) {
-        throw new Error("Release publication does not use the bundle-pinned signer registry.");
-    }
-    const { signature, ...protectedHeader } = protectedSignature;
-    verifyReceipt(signerRegistryReceiptKeys(registry), {
-        subject: "Release publication",
-        keyId: protectedSignature.key_id,
-        purpose: "catalog-release",
-        at: publication.published_at,
-        sequence: publication.release_sequence,
-        preimage: releasePublicationSignaturePreimage(core, publicationDigest, protectedHeader),
-        signature,
-    });
-    return publication;
-}
-export function validateChangeCursor(input, registry, context) {
-    const cursor = changeCursorSchema.parse(input);
-    const { cursor_digest: cursorDigest, protected: protectedSignature, ...coreInput } = cursor;
-    const core = changeCursorCoreSchema.parse(coreInput);
-    if (cursorDigest !== digest(core))
-        throw new Error("Change cursor digest mismatch.");
-    if (protectedSignature.signature_purpose !== "catalog-feed" ||
-        protectedSignature.signer_registry_digest !== registry.registry_digest) {
-        throw new Error("Change cursor uses invalid protected authority.");
-    }
-    const { signature, ...protectedHeader } = protectedSignature;
-    verifyReceipt(signerRegistryReceiptKeys(registry), {
-        subject: "Change cursor",
-        keyId: protectedSignature.key_id,
-        purpose: "catalog-feed",
-        ...(context ? { sequence: context.releaseSequence } : {}),
-        preimage: changeCursorSignaturePreimage(core, cursorDigest, protectedHeader),
-        signature,
-    });
-    return cursor;
-}
-//# sourceMappingURL=index.js.map