@superbee/core 0.1.4 → 0.1.5

package/dist/verification.d.ts

@@ -0,0 +1,64 @@
+/** One verification event. Producer extras beyond `by`/`at` are preserved, never interpreted. */
+export interface VerificationEvent {
+    by: string;
+    at?: string;
+    [extra: string]: unknown;
+}
+/** Trust tiers, lowest to highest (SPEC 5.3). */
+export type TrustTier = "unverified" | "machine-confirmed" | "human-reviewed";
+/** The three tiers in ascending order — the one place a consumer iterates them. */
+export declare const TRUST_TIERS: readonly TrustTier[];
+/** The derived projection name surfaces expose (`list --fields trust`, receipts, status counts). */
+export declare const TRUST_TIER_FIELD = "trust";
+/**
+ * The document's verification events as the list the spec defines, or `[]` when the key is absent.
+ * A bare `{ by, at }` mapping reads as a one-element list (SPEC 5.2 MUST). Entries that carry no
+ * usable `by` cannot name a verifier and therefore cannot raise a tier; they are skipped here, and
+ * {@link appendVerificationEvent} refuses to write around them.
+ */
+export declare function verificationEvents(frontmatter: Readonly<Record<string, unknown>>): VerificationEvent[];
+/** Derive the trust tier (SPEC 5.3): keyed on the `human:` prefix of any verifier. */
+export declare function trustTier(frontmatter: Readonly<Record<string, unknown>>): TrustTier;
+/** The latest parseable `at` across the events ("how recently" per SPEC 5.2), or `undefined`. */
+export declare function latestVerifiedAt(events: readonly VerificationEvent[]): string | undefined;
+/** Documents per tier — the one fold `status` and `home` both render. */
+export type TrustTierCounts = Record<TrustTier, number>;
+export declare function trustTierCounts(docs: Iterable<{
+    frontmatter: Readonly<Record<string, unknown>>;
+}>): TrustTierCounts;
+/**
+ * Parse an instant a verifier supplies, or return `null`. Unlike `Date.parse`, this refuses what
+ * a caller did not say: an impossible calendar date (`2026-02-30`, a non-leap `02-29`), an
+ * out-of-range time, or a value without a zone designator (which would name a different instant
+ * on every host). Read-side consumers stay permissive (see {@link latestVerifiedAt}); this rule
+ * guards what gets WRITTEN. Defaults to millisecond truncation; `ceil` compares expiration
+ * deadlines against a millisecond clock without expiring before a fractional deadline.
+ */
+export declare function parseIsoInstant(raw: string, rounding?: "truncate" | "ceil"): number | null;
+/**
+ * The instant a stored `at` denotes, for comparison and "how recently" selection: the strict
+ * grammar first (so every spelling the write path accepts resolves identically), then the
+ * permissive `Date.parse` for legacy producer spellings the read side must not drop. `null` when
+ * neither understands the value.
+ */
+export declare function storedInstant(value: unknown): number | null;
+export interface AppendVerificationOptions {
+    /** The verifier; must satisfy the OKF actor convention (SPEC 7). */
+    by: string;
+    /** ISO-8601 instant of the confirmation, with a zone designator (see {@link parseIsoInstant}). */
+    at: string;
+}
+/**
+ * Return frontmatter with one more verification event appended. The result is always a list:
+ * an absent key becomes `[event]`, a bare mapping becomes `[existing, event]`, a list grows by one.
+ * Every other `verified` shape (a scalar, a list containing a non-event) is refused, because
+ * rewriting it would destroy trust history the caller did not ask to change.
+ *
+ * Idempotent: an event that already exists (same `by`, same instant) is already recorded, so the
+ * frontmatter is returned as-is and the caller's mutation converges to a no-op — repeating a
+ * satisfied verification never manufactures a duplicate confirmation or a new revision.
+ */
+export declare function appendVerificationEvent<F extends Readonly<Record<string, unknown>>>(frontmatter: F, options: AppendVerificationOptions): F & {
+    verified: VerificationEvent[];
+};
+//# sourceMappingURL=verification.d.ts.map

package/dist/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../src/verification.ts"],"names":[],"mappings":"AAkBA,iGAAiG;AACjG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAE9E,mFAAmF;AACnF,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAI1C,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAUxC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAKtG;AAED,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAInF;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,GAAG,SAAS,CASzF;AAED,yEAAyE;AACzE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAExD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC;IAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,GACjE,eAAe,CAIjB;AASD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,UAAU,GAAG,MAAmB,GAAG,MAAM,GAAG,IAAI,CA8BtG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAM3D;AAED,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,kGAAkG;IAClG,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACjF,WAAW,EAAE,CAAC,EACd,OAAO,EAAE,yBAAyB,GACjC,CAAC,GAAG;IAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAgCvC"}

package/dist/verification.js

@@ -0,0 +1,175 @@
+/**
+ * OKF v0.2 `verified` events and the trust tier consumers derive from them (SPEC 5.2, 5.3).
+ *
+ * Read side: `verified` is a list of `{ by, at }` events. A producer MAY write a single event as
+ * a bare mapping; consumers MUST treat it as a one-element list. Every surface that classifies
+ * trust reads through {@link verificationEvents} so the normalization exists exactly once.
+ *
+ * Write side: {@link appendVerificationEvent} is the one policy that adds an event. It preserves
+ * existing events byte-for-byte (including producer extras such as `method`), normalizes a bare
+ * mapping into the list it already meant, and refuses to append onto a `verified` value that is
+ * not a list of events rather than silently replacing it.
+ *
+ * Pure and dependency-light on purpose: the browser UI consumes it through the
+ * `@superbee/core/verification` subpath without pulling the storage engine.
+ */
+import { InvalidInputError, OkfActorError } from "./errors.js";
+import { isHumanActor, isOkfActor } from "./okf-actor.js";
+/** The three tiers in ascending order — the one place a consumer iterates them. */
+export const TRUST_TIERS = Object.freeze([
+    "unverified",
+    "machine-confirmed",
+    "human-reviewed",
+]);
+/** The derived projection name surfaces expose (`list --fields trust`, receipts, status counts). */
+export const TRUST_TIER_FIELD = "trust";
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isEvent(value) {
+    return isRecord(value) && typeof value.by === "string" && value.by.trim() !== "";
+}
+/**
+ * The document's verification events as the list the spec defines, or `[]` when the key is absent.
+ * A bare `{ by, at }` mapping reads as a one-element list (SPEC 5.2 MUST). Entries that carry no
+ * usable `by` cannot name a verifier and therefore cannot raise a tier; they are skipped here, and
+ * {@link appendVerificationEvent} refuses to write around them.
+ */
+export function verificationEvents(frontmatter) {
+    const raw = frontmatter.verified;
+    if (raw === undefined || raw === null)
+        return [];
+    const entries = Array.isArray(raw) ? raw : [raw];
+    return entries.filter(isEvent).map((event) => ({ ...event }));
+}
+/** Derive the trust tier (SPEC 5.3): keyed on the `human:` prefix of any verifier. */
+export function trustTier(frontmatter) {
+    const events = verificationEvents(frontmatter);
+    if (events.length === 0)
+        return "unverified";
+    return events.some((event) => isHumanActor(event.by)) ? "human-reviewed" : "machine-confirmed";
+}
+/** The latest parseable `at` across the events ("how recently" per SPEC 5.2), or `undefined`. */
+export function latestVerifiedAt(events) {
+    let latest;
+    for (const event of events) {
+        if (typeof event.at !== "string")
+            continue;
+        const ms = storedInstant(event.at);
+        if (ms === null)
+            continue;
+        if (latest === undefined || ms > latest.ms)
+            latest = { at: event.at, ms };
+    }
+    return latest?.at;
+}
+export function trustTierCounts(docs) {
+    const counts = { unverified: 0, "machine-confirmed": 0, "human-reviewed": 0 };
+    for (const doc of docs)
+        counts[trustTier(doc.frontmatter)] += 1;
+    return counts;
+}
+/**
+ * Strict ISO-8601 instant grammar: calendar date, `T`, time, and a REQUIRED zone designator
+ * (`Z`, `±hh`, `±hhmm`, or `±hh:mm`). Fractional seconds optional. Lowercase `t`/`z` accepted as
+ * ISO permits.
+ */
+const ISO_INSTANT = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(?:([Zz])|([+-])(\d{2})(?::?(\d{2}))?)$/;
+/**
+ * Parse an instant a verifier supplies, or return `null`. Unlike `Date.parse`, this refuses what
+ * a caller did not say: an impossible calendar date (`2026-02-30`, a non-leap `02-29`), an
+ * out-of-range time, or a value without a zone designator (which would name a different instant
+ * on every host). Read-side consumers stay permissive (see {@link latestVerifiedAt}); this rule
+ * guards what gets WRITTEN. Defaults to millisecond truncation; `ceil` compares expiration
+ * deadlines against a millisecond clock without expiring before a fractional deadline.
+ */
+export function parseIsoInstant(raw, rounding = "truncate") {
+    const match = ISO_INSTANT.exec(raw);
+    if (!match)
+        return null;
+    const [, y, mo, d, h, mi, sec = "0", frac = "0", zulu, sign, oh, om = "0"] = match;
+    const year = Number(y);
+    const month = Number(mo);
+    const day = Number(d);
+    const hour = Number(h);
+    const minute = Number(mi);
+    const second = Number(sec);
+    if (month < 1 || month > 12)
+        return null;
+    const probe = new Date(0);
+    probe.setUTCFullYear(year, month, 0); // day 0 of the NEXT month = last day of this one
+    if (day < 1 || day > probe.getUTCDate())
+        return null;
+    if (hour > 23 || minute > 59 || second > 59)
+        return null;
+    let offsetMinutes = 0;
+    if (!zulu) {
+        const offsetHours = Number(oh);
+        const offsetMins = Number(om);
+        if (offsetHours > 23 || offsetMins > 59)
+            return null;
+        offsetMinutes = (sign === "-" ? -1 : 1) * (offsetHours * 60 + offsetMins);
+    }
+    // Truncate, never round: a recorded instant must not be later than the one the caller supplied.
+    const millis = Number(frac.padEnd(3, "0").slice(0, 3));
+    const instant = new Date(0);
+    instant.setUTCFullYear(year, month - 1, day);
+    instant.setUTCHours(hour, minute, second, millis);
+    // Expiration consumers round up so a sub-millisecond deadline never expires early.
+    const remainder = rounding === "ceil" && /[1-9]/.test(frac.slice(3)) ? 1 : 0;
+    return instant.getTime() - offsetMinutes * 60_000 + remainder;
+}
+/**
+ * The instant a stored `at` denotes, for comparison and "how recently" selection: the strict
+ * grammar first (so every spelling the write path accepts resolves identically), then the
+ * permissive `Date.parse` for legacy producer spellings the read side must not drop. `null` when
+ * neither understands the value.
+ */
+export function storedInstant(value) {
+    if (typeof value !== "string")
+        return null;
+    const strict = parseIsoInstant(value.trim());
+    if (strict !== null)
+        return strict;
+    const legacy = Date.parse(value);
+    return Number.isNaN(legacy) ? null : legacy;
+}
+/**
+ * Return frontmatter with one more verification event appended. The result is always a list:
+ * an absent key becomes `[event]`, a bare mapping becomes `[existing, event]`, a list grows by one.
+ * Every other `verified` shape (a scalar, a list containing a non-event) is refused, because
+ * rewriting it would destroy trust history the caller did not ask to change.
+ *
+ * Idempotent: an event that already exists (same `by`, same instant) is already recorded, so the
+ * frontmatter is returned as-is and the caller's mutation converges to a no-op — repeating a
+ * satisfied verification never manufactures a duplicate confirmation or a new revision.
+ */
+export function appendVerificationEvent(frontmatter, options) {
+    if (!isOkfActor(options.by)) {
+        throw new OkfActorError(options.by, `OKF v0.2 verifier '${options.by}' must be human:<id>, process:<id>, or <producer>/<version>`);
+    }
+    const instant = typeof options.at === "string" ? parseIsoInstant(options.at) : null;
+    if (instant === null) {
+        throw new InvalidInputError("OKF v0.2 verified.at must be a real ISO-8601 date-time with a timezone designator (e.g. 2026-09-07T12:00:00Z)");
+    }
+    const raw = frontmatter.verified;
+    let existing;
+    if (raw === undefined || raw === null) {
+        existing = [];
+    }
+    else {
+        const entries = Array.isArray(raw) ? raw : [raw];
+        if (!entries.every(isEvent)) {
+            throw new InvalidInputError("OKF v0.2 verified must be a list of { by, at } events (or one bare event) before a verification can be appended");
+        }
+        existing = entries;
+    }
+    // Same resolver as the read side, so any spelling the grammar accepts on write (including an
+    // imported `+02` offset) is recognized as the same instant on repeat.
+    const alreadyRecorded = existing.some((prior) => prior.by === options.by && storedInstant(prior.at) === instant);
+    if (alreadyRecorded)
+        return frontmatter;
+    const event = { by: options.by, at: options.at };
+    return { ...frontmatter, verified: [...existing, event] };
+}
+//# sourceMappingURL=verification.js.map

package/dist/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../src/verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAY1D,mFAAmF;AACnF,MAAM,CAAC,MAAM,WAAW,GAAyB,MAAM,CAAC,MAAM,CAAC;IAC7D,YAAY;IACZ,mBAAmB;IACnB,gBAAgB;CACjB,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAExC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA8C;IAC/E,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,WAA8C;IACtE,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACjG,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,MAAoC;IACnE,IAAI,MAA8C,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAAE,SAAS;QAC3C,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE;YAAE,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,EAAE,EAAE,CAAC;AACpB,CAAC;AAKD,MAAM,UAAU,eAAe,CAC7B,IAAkE;IAElE,MAAM,MAAM,GAAoB,EAAE,UAAU,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;IAC/F,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG,iHAAiH,CAAC;AAEtI;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,WAAgC,UAAU;IACrF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,iDAAiD;IACvF,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,IAAI,GAAG,EAAE,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,WAAW,GAAG,EAAE,IAAI,UAAU,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACrD,aAAa,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC;IAC5E,CAAC;IACD,gGAAgG;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,mFAAmF;IACnF,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,MAAM,GAAG,SAAS,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAc,EACd,OAAkC;IAElC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CACrB,OAAO,CAAC,EAAE,EACV,sBAAsB,OAAO,CAAC,EAAE,6DAA6D,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAiB,CACzB,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;IACjC,IAAI,QAA6B,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,iHAAiH,CAClH,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC;IACrB,CAAC;IACD,6FAA6F;IAC7F,sEAAsE;IACtE,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC;IACjH,IAAI,eAAe;QAAE,OAAO,WAAoD,CAAC;IACjF,MAAM,KAAK,GAAsB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACpE,OAAO,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC"}

package/dist/view-admission.d.ts

@@ -0,0 +1,9 @@
+/** Byte-format admission only. Callers own bounded retrieval, registration,
+ * exact-version checks, isolation and authorization; this grants no execution authority. */
+export declare const MAX_ACTIVE_VIEW_BYTES: number;
+export declare const ACTIVE_VIEW_CONTENT_TYPE = "text/html; charset=utf-8";
+export declare function admitActiveView(bytes: Uint8Array, contentType: string): {
+    bytes: Uint8Array;
+    contentType: typeof ACTIVE_VIEW_CONTENT_TYPE;
+};
+//# sourceMappingURL=view-admission.d.ts.map

package/dist/view-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-admission.d.ts","sourceRoot":"","sources":["../src/view-admission.ts"],"names":[],"mappings":"AAAA;4FAC4F;AAC5F,eAAO,MAAM,qBAAqB,QAAa,CAAC;AAChD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,GAClB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,OAAO,wBAAwB,CAAA;CAAE,CAerE"}

package/dist/view-admission.js

@@ -0,0 +1,22 @@
+/** Byte-format admission only. Callers own bounded retrieval, registration,
+ * exact-version checks, isolation and authorization; this grants no execution authority. */
+export const MAX_ACTIVE_VIEW_BYTES = 512 * 1024;
+export const ACTIVE_VIEW_CONTENT_TYPE = "text/html; charset=utf-8";
+export function admitActiveView(bytes, contentType) {
+    if (bytes.byteLength > MAX_ACTIVE_VIEW_BYTES) {
+        throw new Error("active View HTML must be at most 512 KiB");
+    }
+    const [mediaType, ...parameters] = contentType
+        .split(";")
+        .map((part) => part.trim().toLowerCase());
+    if (mediaType !== "text/html")
+        throw new Error("active View entries must use text/html");
+    for (const parameter of parameters) {
+        if (parameter && parameter !== "charset=utf-8" && parameter !== 'charset="utf-8"') {
+            throw new Error("active View entries may declare only UTF-8 HTML");
+        }
+    }
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return { bytes: bytes.slice(), contentType: ACTIVE_VIEW_CONTENT_TYPE };
+}
+//# sourceMappingURL=view-admission.js.map

package/dist/view-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-admission.js","sourceRoot":"","sources":["../src/view-admission.ts"],"names":[],"mappings":"AAAA;4FAC4F;AAC5F,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,MAAM,UAAU,eAAe,CAC7B,KAAiB,EACjB,WAAmB;IAEnB,IAAI,KAAK,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,WAAW;SAC3C,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,SAAS,KAAK,eAAe,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;AACzE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superbee/core",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "description": "OKF store engine — bundle I/O, cross-links, derived backlinks, freshness, and versioned writes.",
   "license": "Apache-2.0",
@@ -13,6 +13,10 @@
   "types": "./dist/index.d.ts",
   "sideEffects": false,
   "exports": {
+    "./view-admission": {
+      "types": "./dist/view-admission.d.ts",
+      "default": "./dist/view-admission.js"
+    },
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
@@ -45,6 +49,10 @@
       "types": "./dist/mutation-attribution.d.ts",
       "default": "./dist/mutation-attribution.js"
     },
+    "./verification": {
+      "types": "./dist/verification.d.ts",
+      "default": "./dist/verification.js"
+    },
     "./page": {
       "types": "./dist/page.d.ts",
       "default": "./dist/page.js"