@thehonestmachine/oath-core 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,9 @@
+# @thehonestmachine/oath-core
+
+The [OATH protocol](https://oath.sh/spec), no I/O: RFC 8785 canonicalization,
+SHA-256 / Ed25519 (pure TS via @noble), the RFC-6962-style Merkle log with
+inclusion and consistency proofs, and validation/signing/hashing for oath
+documents, entries, signed tree heads, and receipts.
+
+100% test coverage, enforced. The test suite reproduces the spec's
+Appendix B vectors byte for byte. Apache-2.0.

package/dist/bytes.d.ts

@@ -0,0 +1,7 @@
+export declare function utf8Bytes(s: string): Uint8Array;
+export declare function bytesToHex(bytes: Uint8Array): string;
+/** Strict per spec §1.2: lowercase hex only, even length. */
+export declare function hexToBytes(hex: string): Uint8Array;
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function concatBytes(...arrays: Uint8Array[]): Uint8Array;
+//# sourceMappingURL=bytes.d.ts.map

package/dist/bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAGA,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE/C;AAID,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMpD;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQlD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKhE;AAED,wBAAgB,WAAW,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAU/D"}

package/dist/bytes.js

@@ -0,0 +1,46 @@
+import { utf8ToBytes } from '@noble/hashes/utils';
+import { ProtocolError } from './errors.js';
+export function utf8Bytes(s) {
+    return utf8ToBytes(s);
+}
+const HEX_CHARS = '0123456789abcdef';
+export function bytesToHex(bytes) {
+    let out = '';
+    for (const b of bytes) {
+        out += HEX_CHARS[b >> 4] + HEX_CHARS[b & 0x0f];
+    }
+    return out;
+}
+/** Strict per spec §1.2: lowercase hex only, even length. */
+export function hexToBytes(hex) {
+    if (hex.length % 2 !== 0)
+        throw new ProtocolError('hex string has odd length');
+    if (!/^[0-9a-f]*$/.test(hex))
+        throw new ProtocolError('hex string must be lowercase 0-9a-f');
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+export function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+export function concatBytes(...arrays) {
+    let total = 0;
+    for (const a of arrays)
+        total += a.length;
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const a of arrays) {
+        out.set(a, offset);
+        offset += a.length;
+    }
+    return out;
+}
+//# sourceMappingURL=bytes.js.map

package/dist/bytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,CAAE,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,CAAE,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAC;IAC/E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,qCAAqC,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAG,MAAoB;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ed25519.d.ts

@@ -0,0 +1,11 @@
+/** Derive the public key (hex) from a 32-byte private seed (hex). */
+export declare function edPublicKey(seedHex: string): string;
+/** Sign a message with a 32-byte private seed; returns the 64-byte signature as hex. */
+export declare function edSign(message: Uint8Array, seedHex: string): string;
+/**
+ * Verify an Ed25519 signature. Returns false (never throws) for signatures
+ * that fail, including structurally invalid curve points — every verifier
+ * must reach the same answer on the same bytes.
+ */
+export declare function edVerify(signatureHex: string, message: Uint8Array, pubkeyHex: string): boolean;
+//# sourceMappingURL=ed25519.d.ts.map

package/dist/ed25519.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAgBA,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wFAAwF;AACxF,wBAAgB,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ9F"}

package/dist/ed25519.js

@@ -0,0 +1,37 @@
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha512';
+import { ProtocolError } from './errors.js';
+import { bytesToHex, hexToBytes } from './bytes.js';
+// @noble/ed25519 v2 needs a synchronous SHA-512 wired in for the sync API.
+ed.etc.sha512Sync = (...messages) => sha512(ed.etc.concatBytes(...messages));
+function keyBytes(hex, byteLength, label) {
+    const bytes = hexToBytes(hex);
+    if (bytes.length !== byteLength) {
+        throw new ProtocolError(`${label} must be ${byteLength} bytes of lowercase hex`);
+    }
+    return bytes;
+}
+/** Derive the public key (hex) from a 32-byte private seed (hex). */
+export function edPublicKey(seedHex) {
+    return bytesToHex(ed.getPublicKey(keyBytes(seedHex, 32, 'private key seed')));
+}
+/** Sign a message with a 32-byte private seed; returns the 64-byte signature as hex. */
+export function edSign(message, seedHex) {
+    return bytesToHex(ed.sign(message, keyBytes(seedHex, 32, 'private key seed')));
+}
+/**
+ * Verify an Ed25519 signature. Returns false (never throws) for signatures
+ * that fail, including structurally invalid curve points — every verifier
+ * must reach the same answer on the same bytes.
+ */
+export function edVerify(signatureHex, message, pubkeyHex) {
+    const signature = keyBytes(signatureHex, 64, 'signature');
+    const pubkey = keyBytes(pubkeyHex, 32, 'public key');
+    try {
+        return ed.verify(signature, message, pubkey);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ed25519.js.map

package/dist/ed25519.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpD,2EAA2E;AAC3E,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,QAAsB,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;AAE3F,SAAS,QAAQ,CAAC,GAAW,EAAE,UAAkB,EAAE,KAAa;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,aAAa,CAAC,GAAG,KAAK,YAAY,UAAU,yBAAyB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,MAAM,CAAC,OAAmB,EAAE,OAAe;IACzD,OAAO,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAoB,EAAE,OAAmB,EAAE,SAAiB;IACnF,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/entry.d.ts

@@ -0,0 +1,27 @@
+import type { Entry, OathDoc, UnsignedEntry } from './types.js';
+/** Action types reserved by the spec (§3.4). */
+export declare const RESERVED_ACTION_TYPES: readonly ["oath.swear", "oath.amend"];
+/** Validate a complete signed entry (SPEC.md §3). Structural only. */
+export declare function assertValidEntry(value: unknown): asserts value is Entry;
+/** Validate an entry that has not been signed yet. */
+export declare function assertValidUnsignedEntry(value: unknown): asserts value is UnsignedEntry;
+/** Canonical bytes of the entry without its signature — the signing input. */
+export declare function entrySigningInput(entry: UnsignedEntry | Entry): Uint8Array;
+/** The leaf bytes (SPEC.md §3.2): canonical bytes of the complete signed entry. */
+export declare function leafBytesOf(entry: Entry): Uint8Array;
+/** The entry's Merkle leaf hash as hex: SHA-256(0x00 || leaf bytes). */
+export declare function entryLeafHash(entry: Entry): string;
+export declare function signEntry(unsigned: UnsignedEntry, seedHex: string): Entry;
+export declare function verifyEntrySignature(entry: Entry, pubkeyHex: string): boolean;
+/**
+ * Cross-check an entry against the oath version it cites (SPEC.md §3, §7):
+ * agent and version match, any cited law exists, and the signature verifies
+ * against the oath's key.
+ */
+export declare function assertEntryUnderOath(entry: Entry, oath: OathDoc): void;
+/**
+ * Promptness (SPEC.md §8.2): the entry was authored within the oath's
+ * max_latency_seconds (default 300) of the action occurring.
+ */
+export declare function isPrompt(entry: Entry, maxLatencySeconds?: number): boolean;
+//# sourceMappingURL=entry.d.ts.map

package/dist/entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.d.ts","sourceRoot":"","sources":["../src/entry.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAiBhE,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,uCAAwC,CAAC;AAoG3E,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAEvE;AAED,sDAAsD;AACtD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAEvF;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,GAAG,UAAU,CAI1E;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAGpD;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAElD;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAIzE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAG7E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CActE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,KAAK,EACZ,iBAAiB,GAAE,MAAoC,GACtD,OAAO,CAOT"}

package/dist/entry.js

@@ -0,0 +1,183 @@
+import { ProtocolError } from './errors.js';
+import { canonicalBytes } from './jcs.js';
+import { leafHash } from './merkle.js';
+import { bytesToHex } from './bytes.js';
+import { edSign, edVerify } from './ed25519.js';
+import { DEFAULT_MAX_LATENCY_SECONDS, SPEC_VERSION } from './oath.js';
+import { assertKeys, assertPlainObject, isHandle, isHex, isNonEmptyString, isPositiveInteger, isTimestamp, } from './validate.js';
+const REQUIRED = [
+    'spec_version',
+    'agent',
+    'oath_version',
+    'action',
+    'verdict',
+    'law_cited',
+    'adjudication',
+    'timestamp',
+];
+const OPTIONAL = ['confession'];
+/** Dotted lowercase identifier (SPEC.md §3.1), e.g. "cycle.publish". */
+const ACTION_TYPE_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
+/** Action types reserved by the spec (§3.4). */
+export const RESERVED_ACTION_TYPES = ['oath.swear', 'oath.amend'];
+function validateAction(value) {
+    const action = assertPlainObject(value, 'entry action');
+    assertKeys(action, 'entry action', ['type', 'summary', 'content_hash', 'occurred_at'], []);
+    const type = action['type'];
+    if (!isNonEmptyString(type) || !ACTION_TYPE_RE.test(type)) {
+        throw new ProtocolError('action type must be a dotted lowercase identifier');
+    }
+    if (!isNonEmptyString(action['summary'])) {
+        throw new ProtocolError('action summary must be a non-empty string');
+    }
+    if (action['content_hash'] !== null && !isHex(action['content_hash'], 32)) {
+        throw new ProtocolError('action content_hash must be 32 bytes of lowercase hex or null');
+    }
+    if (!isTimestamp(action['occurred_at'])) {
+        throw new ProtocolError('action occurred_at must be an RFC 3339 UTC timestamp');
+    }
+    if (type.startsWith('oath.')) {
+        if (!RESERVED_ACTION_TYPES.includes(type)) {
+            throw new ProtocolError('action types beginning "oath." are reserved by the spec');
+        }
+        if (action['content_hash'] === null) {
+            throw new ProtocolError(`${type} entries must carry the oath hash in content_hash`);
+        }
+    }
+}
+function validateAdjudication(value) {
+    const adjudication = assertPlainObject(value, 'entry adjudication');
+    const mode = adjudication['mode'];
+    if (mode === 'machine') {
+        assertKeys(adjudication, 'machine adjudication', ['mode', 'check'], ['check_version']);
+        if (!isNonEmptyString(adjudication['check'])) {
+            throw new ProtocolError('machine adjudication check must be a non-empty string');
+        }
+        if ('check_version' in adjudication && !isNonEmptyString(adjudication['check_version'])) {
+            throw new ProtocolError('machine adjudication check_version must be a non-empty string');
+        }
+    }
+    else if (mode === 'model') {
+        assertKeys(adjudication, 'model adjudication', ['mode', 'model', 'prompt_hash', 'inputs_hash'], []);
+        if (!isNonEmptyString(adjudication['model'])) {
+            throw new ProtocolError('model adjudication model must be a non-empty string');
+        }
+        if (!isHex(adjudication['prompt_hash'], 32)) {
+            throw new ProtocolError('model adjudication prompt_hash must be 32 bytes of lowercase hex');
+        }
+        if (!isHex(adjudication['inputs_hash'], 32)) {
+            throw new ProtocolError('model adjudication inputs_hash must be 32 bytes of lowercase hex');
+        }
+    }
+    else {
+        throw new ProtocolError('adjudication mode must be "machine" or "model"');
+    }
+}
+function validateEntryShape(value, requireSignature) {
+    const entry = assertPlainObject(value, 'entry');
+    const required = requireSignature ? [...REQUIRED, 'signature'] : REQUIRED;
+    const optional = requireSignature ? OPTIONAL : [...OPTIONAL, 'signature'];
+    assertKeys(entry, 'entry', required, optional);
+    if (entry['spec_version'] !== SPEC_VERSION) {
+        throw new ProtocolError(`entry spec_version must be "${SPEC_VERSION}"`);
+    }
+    if (!isHandle(entry['agent']))
+        throw new ProtocolError('entry agent must be a valid handle');
+    if (!isPositiveInteger(entry['oath_version'])) {
+        throw new ProtocolError('entry oath_version must be an integer >= 1');
+    }
+    validateAction(entry['action']);
+    const verdict = entry['verdict'];
+    if (verdict !== 'compliant' && verdict !== 'violation' && verdict !== 'uncertain') {
+        throw new ProtocolError('verdict must be "compliant", "violation", or "uncertain"');
+    }
+    const lawCited = entry['law_cited'];
+    if (lawCited !== null && !isPositiveInteger(lawCited)) {
+        throw new ProtocolError('law_cited must be a law number or null');
+    }
+    if (verdict === 'violation' && lawCited === null) {
+        throw new ProtocolError('a violation must cite the violated law (SPEC.md §3.3)');
+    }
+    if ('confession' in entry) {
+        const confession = assertPlainObject(entry['confession'], 'confession');
+        assertKeys(confession, 'confession', ['note'], []);
+        if (!isNonEmptyString(confession['note'])) {
+            throw new ProtocolError('confession note must be a non-empty string');
+        }
+    }
+    else if (verdict !== 'compliant') {
+        throw new ProtocolError(`a ${verdict} verdict requires a confession (SPEC.md §3.3)`);
+    }
+    validateAdjudication(entry['adjudication']);
+    if (!isTimestamp(entry['timestamp'])) {
+        throw new ProtocolError('entry timestamp must be an RFC 3339 UTC timestamp');
+    }
+    if (requireSignature && !isHex(entry['signature'], 64)) {
+        throw new ProtocolError('entry signature must be 64 bytes of lowercase hex');
+    }
+}
+/** Validate a complete signed entry (SPEC.md §3). Structural only. */
+export function assertValidEntry(value) {
+    validateEntryShape(value, true);
+}
+/** Validate an entry that has not been signed yet. */
+export function assertValidUnsignedEntry(value) {
+    validateEntryShape(value, false);
+}
+/** Canonical bytes of the entry without its signature — the signing input. */
+export function entrySigningInput(entry) {
+    const { signature: _signature, ...unsigned } = entry;
+    assertValidUnsignedEntry(unsigned);
+    return canonicalBytes(unsigned);
+}
+/** The leaf bytes (SPEC.md §3.2): canonical bytes of the complete signed entry. */
+export function leafBytesOf(entry) {
+    assertValidEntry(entry);
+    return canonicalBytes(entry);
+}
+/** The entry's Merkle leaf hash as hex: SHA-256(0x00 || leaf bytes). */
+export function entryLeafHash(entry) {
+    return bytesToHex(leafHash(leafBytesOf(entry)));
+}
+export function signEntry(unsigned, seedHex) {
+    assertValidUnsignedEntry(unsigned);
+    const signature = edSign(canonicalBytes(unsigned), seedHex);
+    return { ...unsigned, signature };
+}
+export function verifyEntrySignature(entry, pubkeyHex) {
+    assertValidEntry(entry);
+    return edVerify(entry.signature, entrySigningInput(entry), pubkeyHex);
+}
+/**
+ * Cross-check an entry against the oath version it cites (SPEC.md §3, §7):
+ * agent and version match, any cited law exists, and the signature verifies
+ * against the oath's key.
+ */
+export function assertEntryUnderOath(entry, oath) {
+    assertValidEntry(entry);
+    if (entry.agent !== oath.agent) {
+        throw new ProtocolError('entry agent does not match the oath');
+    }
+    if (entry.oath_version !== oath.version) {
+        throw new ProtocolError('entry oath_version does not match the oath');
+    }
+    if (entry.law_cited !== null && entry.law_cited > oath.laws.length) {
+        throw new ProtocolError(`entry cites law ${entry.law_cited}, but the oath has ${oath.laws.length} laws`);
+    }
+    if (!verifyEntrySignature(entry, oath.pubkey)) {
+        throw new ProtocolError("entry signature does not verify against the oath's key");
+    }
+}
+/**
+ * Promptness (SPEC.md §8.2): the entry was authored within the oath's
+ * max_latency_seconds (default 300) of the action occurring.
+ */
+export function isPrompt(entry, maxLatencySeconds = DEFAULT_MAX_LATENCY_SECONDS) {
+    assertValidEntry(entry);
+    if (!isPositiveInteger(maxLatencySeconds)) {
+        throw new ProtocolError('maxLatencySeconds must be an integer >= 1');
+    }
+    const delta = Date.parse(entry.timestamp) - Date.parse(entry.action.occurred_at);
+    return delta <= maxLatencySeconds * 1000;
+}
+//# sourceMappingURL=entry.js.map

package/dist/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../src/entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,GACZ,MAAM,eAAe,CAAC;AAGvB,MAAM,QAAQ,GAAG;IACf,cAAc;IACd,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,WAAW;IACX,cAAc;IACd,WAAW;CACZ,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,YAAY,CAAC,CAAC;AAEhC,wEAAwE;AACxE,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAErD,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,YAAY,CAAU,CAAC;AAE3E,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxD,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,aAAa,CAAC,mDAAmD,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,aAAa,CAAC,+DAA+D,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,aAAa,CAAC,sDAAsD,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAE,qBAA2C,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,aAAa,CAAC,yDAAyD,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,mDAAmD,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,UAAU,CAAC,YAAY,EAAE,sBAAsB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CAAC,uDAAuD,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,eAAe,IAAI,YAAY,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,aAAa,CAAC,+DAA+D,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,UAAU,CAAC,YAAY,EAAE,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CAAC,qDAAqD,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,aAAa,CAAC,kEAAkE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,aAAa,CAAC,kEAAkE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,aAAa,CAAC,gDAAgD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,gBAAyB;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1E,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,aAAa,CAAC,+BAA+B,YAAY,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;IAC7F,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,4CAA4C,CAAC,CAAC;IACxE,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAClF,MAAM,IAAI,aAAa,CAAC,0DAA0D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,aAAa,CAAC,wCAAwC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,KAAK,WAAW,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,aAAa,CAAC,uDAAuD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QACxE,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CAAC,4CAA4C,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,KAAK,OAAO,+CAA+C,CAAC,CAAC;IACvF,CAAC;IAED,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CAAC,mDAAmD,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,gBAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,aAAa,CAAC,mDAAmD,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,KAA4B;IAC5D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAc,CAAC;IAC9D,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAuB,EAAE,OAAe;IAChE,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAY,EAAE,SAAiB;IAClE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAY,EAAE,IAAa;IAC9D,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,qCAAqC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,aAAa,CAAC,4CAA4C,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,aAAa,CAAC,mBAAmB,KAAK,CAAC,SAAS,sBAAsB,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,wDAAwD,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAY,EACZ,oBAA4B,2BAA2B;IAEvD,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,OAAO,KAAK,IAAI,iBAAiB,GAAG,IAAI,CAAC;AAC3C,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,5 @@
+/** Thrown when a structure or operation violates the OATH protocol spec. */
+export declare class ProtocolError extends Error {
+    name: string;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,qBAAa,aAAc,SAAQ,KAAK;IAC7B,IAAI,SAAmB;CACjC"}

package/dist/errors.js

@@ -0,0 +1,5 @@
+/** Thrown when a structure or operation violates the OATH protocol spec. */
+export class ProtocolError extends Error {
+    name = 'ProtocolError';
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,GAAG,eAAe,CAAC;CACjC"}

package/dist/hash.d.ts

@@ -0,0 +1,3 @@
+export declare function sha256(bytes: Uint8Array): Uint8Array;
+export declare function sha256Hex(bytes: Uint8Array): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAGA,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAEpD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnD"}

package/dist/hash.js

@@ -0,0 +1,9 @@
+import { sha256 as nobleSha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from './bytes.js';
+export function sha256(bytes) {
+    return nobleSha256(bytes);
+}
+export function sha256Hex(bytes) {
+    return bytesToHex(nobleSha256(bytes));
+}
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,UAAU,MAAM,CAAC,KAAiB;IACtC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { ProtocolError } from './errors.js';
+export { bytesToHex, hexToBytes, bytesEqual, concatBytes, utf8Bytes } from './bytes.js';
+export { sha256, sha256Hex } from './hash.js';
+export { canonicalize, canonicalBytes } from './jcs.js';
+export { HANDLE_RE, isHandle, isTimestamp, isHex, isPositiveInteger, isNonNegativeInteger, isNonEmptyString, assertPlainObject, assertKeys, } from './validate.js';
+export { edPublicKey, edSign, edVerify } from './ed25519.js';
+export { EMPTY_ROOT, leafHash, nodeHash, rootFromLeafHashes, inclusionPath, consistencyPath, verifyInclusion, verifyConsistency, } from './merkle.js';
+export { SPEC_VERSION, DEFAULT_MAX_LATENCY_SECONDS, assertValidOathDoc, assertValidUnsignedOathDoc, oathSigningInput, oathHash, signOathDoc, verifyOathSignature, assertValidAmendment, } from './oath.js';
+export { RESERVED_ACTION_TYPES, assertValidEntry, assertValidUnsignedEntry, entrySigningInput, leafBytesOf, entryLeafHash, signEntry, verifyEntrySignature, assertEntryUnderOath, isPrompt, } from './entry.js';
+export { assertValidSth, assertValidUnsignedSth, sthSigningInput, signSth, verifySthSignature, assertValidReceipt, assertValidUnsignedReceipt, receiptSigningInput, signReceipt, verifyReceiptSignature, } from './sth.js';
+export type { Verdict, LawMode, Law, OathCommitments, UnsignedOathDoc, OathDoc, Action, MachineAdjudication, ModelAdjudication, Adjudication, Confession, UnsignedEntry, Entry, UnsignedTreeHead, SignedTreeHead, UnsignedReceipt, Receipt, InclusionProof, ConsistencyProof, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EACL,SAAS,EACT,QAAQ,EACR,WAAW,EACX,KAAK,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,2BAA2B,EAC3B,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,SAAS,EACT,oBAAoB,EACpB,oBAAoB,EACpB,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,OAAO,EACP,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,OAAO,EACP,OAAO,EACP,GAAG,EACH,eAAe,EACf,eAAe,EACf,OAAO,EACP,MAAM,EACN,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,aAAa,EACb,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,OAAO,EACP,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC"}