@typedstandards/verify-core 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nathan Storey
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,88 @@
+# @typedstandards/verify-core
+
+The portable, **browser-safe** verification core for [Typed Standards][ts] evidence
+packages — the spec §9.2 check suite, factored so it runs **identically** on a
+server (e.g. civicaitools.org's verify route) and in the browser (the
+typedstandards.org client-side verifier). One implementation, so a tampered
+package fails the same way wherever it is checked.
+
+> Originally extracted from `civic-ai-tools-website` (#116 WS2) and published here
+> (#116 WS3) so every consumer depends on **one versioned source** that cannot
+> drift.
+
+## Install
+
+```sh
+npm install @typedstandards/verify-core
+```
+
+## Browser-safety contract
+
+This package depends on **no Node built-ins**. There is no `node:crypto` / `fs` /
+`path` / `process` / `Buffer` anywhere in the source (an upstream ESLint
+`no-restricted-imports` rule enforces it). It runs unchanged in a browser, on the
+edge, and in Node.
+
+- **Hashing** — [`@noble/hashes`][nh] (SHA-256/512). Digests are byte-identical to
+  Node's `crypto.createHash`.
+- **Signatures** — [`@noble/curves`][nc] Ed25519 / Ed25519ph, with algorithm
+  dispatch (a signature verifies only under the scheme it was made with). Raw key
+  bytes come from a fixed-prefix SPKI slice, not `crypto.createPublicKey`.
+- **Canonicalization** — RFC 8785 JCS via [`canonicalize`][cz].
+- **Network is injected** — every check that touches the network takes a
+  `FetchLike` (defaulting to `globalThis.fetch`, read at call time). The server
+  injects its `fetch`, the browser injects `window.fetch`, tests inject a stub.
+
+> **Fetch note.** A `FetchLike` should issue **plain GETs with no custom request
+> headers**. A custom header triggers a CORS preflight, and a preflight `OPTIONS`
+> hitting civicaitools.org's site-wide 307 to its canonical host can be rejected.
+> A simple GET follows the 307 transparently.
+
+## Usage
+
+```ts
+import { verifyEvidence, type VerifyInput, type TrustRegistry } from '@typedstandards/verify-core';
+
+const input: VerifyInput = {
+  package: pkg,            // the parsed package JSON
+  packageHash,            // the claimed envelope hash
+  signature,              // { signature, publicKey, algorithm?, kid? }
+  rfc3161Timestamp,       // optional
+  rekorEntryId,           // optional
+  lifecycle,              // optional sidecar lifecycle state
+};
+
+const result = await verifyEvidence(input, {
+  registry,               // a TrustRegistry (fetched from the package's trustRegistryUrl)
+  fetch: globalThis.fetch,
+});
+// result carries the per-check verdicts: hashMatch, signatureValid, keyTrust,
+// contentHash, typeResolution, signerIdentity, lifecycle, ...
+```
+
+The barrel (`.`) also exports the individual check functions
+(`recomputePackageHash`, `verifySignature`, `verifyKeyTrust`, `verifyContentHash`,
+…), the canonicalization primitives (`computeEnvelopeHash`,
+`computeContentHashSha256`), and every status vocabulary type — so a consumer can
+drive the checks one-at-a-time and render the math as it resolves.
+
+## Check depth (v1)
+
+Fully client-side: #1 envelope hash, #2 signature, #3 canonicalization, #4 content
+hash, #5 key trust, #6 kid consistency, #9 blob refs, #12 type, #13 nodeId, #14
+signer identity, #15 captureMethod vocab. **Presence** only for #7 (RFC 3161).
+**Hash-parity** only for #8 (Rekor). **State** depth for #10 (lifecycle).
+
+The deeper offline crypto — TSA-chain verification, Rekor Merkle-inclusion,
+independent lifecycle-chain verification, and the authoritative bundle-mode test —
+is a fast-follow (#119), not in this release. The UI built on this should be
+honest about what is presence vs. full-crypto.
+
+## License
+
+MIT © Nathan Storey
+
+[ts]: https://typedstandards.org
+[nh]: https://github.com/paulmillr/noble-hashes
+[nc]: https://github.com/paulmillr/noble-curves
+[cz]: https://github.com/erdtman/canonicalize

package/dist/attestation.d.ts

@@ -0,0 +1,5 @@
+export declare const ATTESTATION_WITHDRAWS = "attestation/withdraws/v1";
+export declare const ATTESTATION_REINSTATES = "attestation/reinstates/v1";
+export type LifecycleAttestationType = typeof ATTESTATION_WITHDRAWS | typeof ATTESTATION_REINSTATES;
+/** The lifecycle sub-type URIs the verify side resolves (spec §8.12.1). */
+export declare const LIFECYCLE_ATTESTATION_TYPES: readonly string[];

package/dist/attestation.js

@@ -0,0 +1,12 @@
+// Lifecycle attestation sub-type URIs (spec §8.10, §8.12.1) — browser-safe
+// constants. The server `attestation.ts` builder (which mints nodes and so needs
+// Node's `crypto.randomUUID`) re-exports these from verify-core, keeping a single
+// definition of the URIs the verify side dispatches on. verify-core never builds
+// nodes — it only verifies and orders them — so it carries the constants alone.
+export const ATTESTATION_WITHDRAWS = 'attestation/withdraws/v1';
+export const ATTESTATION_REINSTATES = 'attestation/reinstates/v1';
+/** The lifecycle sub-type URIs the verify side resolves (spec §8.12.1). */
+export const LIFECYCLE_ATTESTATION_TYPES = [
+    ATTESTATION_WITHDRAWS,
+    ATTESTATION_REINSTATES,
+];

package/dist/blob-ref.d.ts

@@ -0,0 +1,61 @@
+import type { FetchLike } from './types.ts';
+/** Format of `ref`: `blob:sha256:<64 hex chars>`. */
+export interface BlobRef {
+    ref: string;
+    url: string;
+    contentType: string;
+    size: number;
+}
+/**
+ * Detect whether a field value is a BlobRef object. Used by the verifier and the
+ * detail-page renderer to branch between inline content and blob-referenced
+ * content.
+ */
+export declare function isBlobRef(value: unknown): value is BlobRef;
+export interface ParsedBlobRef {
+    algo: 'sha256';
+    hash: string;
+}
+/**
+ * Parse a `blob:sha256:<hash>` reference string into its components.
+ * Throws if the format is invalid.
+ */
+export declare function parseBlobRef(ref: string): ParsedBlobRef;
+export declare const BLOB_REF_VERIFY_REASONS: readonly ["invalid_ref", "fetch_failed", "size_mismatch", "hash_mismatch"];
+export type BlobRefVerifyReason = (typeof BLOB_REF_VERIFY_REASONS)[number];
+export interface BlobRefVerifyResult {
+    ok: boolean;
+    reason?: BlobRefVerifyReason;
+    /** SHA-256 of the fetched blob content, if fetched. Lets callers surface both
+     *  the expected (ref) and actual hash when they mismatch. */
+    computedHash?: string;
+    /** Byte length of the fetched blob. */
+    computedSize?: number;
+}
+/** Options accepted by the network-touching blob helpers: an injected fetcher
+ *  (defaults to `globalThis.fetch`, read at call time so a test stub on the
+ *  global is honored) + an optional abort signal. */
+export interface BlobFetchOptions {
+    fetch?: FetchLike;
+    signal?: AbortSignal;
+}
+/**
+ * Fetch a blob and verify that its SHA-256 matches the reference hash and that
+ * its byte size matches the metadata. Returns a structured result; never throws.
+ *
+ * Fetches over HTTPS without auth (Vercel Blob public access is the storage
+ * default for evidence content). A plain GET with no custom headers, so it
+ * follows civicaitools.org's canonical-host 307 without a CORS preflight.
+ */
+export declare function verifyBlobRef(ref: BlobRef, options?: BlobFetchOptions): Promise<BlobRefVerifyResult>;
+/**
+ * Compute the canonical `blob:sha256:<hash>` reference hash for content bytes.
+ * Used by uploaders constructing a BlobRef object.
+ */
+export declare function computeBlobRefHash(content: string | Uint8Array): string;
+/**
+ * Fetch a BlobRef's content as a UTF-8 string. Used by the detail-page renderer
+ * to resolve output-level BlobRefs. Returns null on any failure; callers fall
+ * back to showing only the reference metadata rather than blocking the render.
+ */
+export declare function fetchBlobRefText(ref: BlobRef, options?: BlobFetchOptions): Promise<string | null>;

package/dist/blob-ref.js

@@ -0,0 +1,127 @@
+// Content-addressable blob references for evidence package fields (spec §9.2
+// check #9) — browser-safe.
+//
+// Large fields (full output text, trace JSON, composed skill guidance) can be
+// stored as a separate blob and referenced from the package JSON rather than
+// inlined. The package hash still binds the reference (the BlobRef object is part
+// of the canonical JSON), and the referenced content has its own SHA-256 so
+// consumers verify each piece independently.
+//
+// Factored from the server `blob-ref.ts` (WS2): the SHA-256 backend is
+// `@noble/hashes` and the network fetch is INJECTED (defaulting to the universal
+// `globalThis.fetch`, which the server provides and the browser provides as
+// `window.fetch`). No `node:crypto`, no hardcoded transport.
+import { sha256Hex } from "./primitives.js";
+const REF_PATTERN = /^blob:sha256:([0-9a-f]{64})$/;
+/**
+ * Detect whether a field value is a BlobRef object. Used by the verifier and the
+ * detail-page renderer to branch between inline content and blob-referenced
+ * content.
+ */
+export function isBlobRef(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return (typeof v.ref === 'string' &&
+        REF_PATTERN.test(v.ref) &&
+        typeof v.url === 'string' &&
+        typeof v.contentType === 'string' &&
+        typeof v.size === 'number');
+}
+/**
+ * Parse a `blob:sha256:<hash>` reference string into its components.
+ * Throws if the format is invalid.
+ */
+export function parseBlobRef(ref) {
+    const match = REF_PATTERN.exec(ref);
+    if (!match) {
+        throw new Error(`Invalid blob reference: expected "blob:sha256:<64 hex>", got "${ref}"`);
+    }
+    return { algo: 'sha256', hash: match[1] };
+}
+// Source-of-truth array (not just a type) so the trust-signal vocabulary
+// (civic-ai-tools-website#110) can enumerate every BlobRef failure reason at
+// runtime. Each reason is a sub-explanation of a failed (Alarm-tier) BlobRef
+// integrity check (#9).
+export const BLOB_REF_VERIFY_REASONS = [
+    'invalid_ref',
+    'fetch_failed',
+    'size_mismatch',
+    'hash_mismatch',
+];
+function resolveFetch(options) {
+    return options.fetch ?? globalThis.fetch;
+}
+/**
+ * Fetch a blob and verify that its SHA-256 matches the reference hash and that
+ * its byte size matches the metadata. Returns a structured result; never throws.
+ *
+ * Fetches over HTTPS without auth (Vercel Blob public access is the storage
+ * default for evidence content). A plain GET with no custom headers, so it
+ * follows civicaitools.org's canonical-host 307 without a CORS preflight.
+ */
+export async function verifyBlobRef(ref, options = {}) {
+    let parsed;
+    try {
+        parsed = parseBlobRef(ref.ref);
+    }
+    catch {
+        return { ok: false, reason: 'invalid_ref' };
+    }
+    const fetcher = resolveFetch(options);
+    let response;
+    try {
+        response = await fetcher(ref.url, {
+            signal: options.signal ?? AbortSignal.timeout(15_000),
+        });
+    }
+    catch {
+        return { ok: false, reason: 'fetch_failed' };
+    }
+    if (!response.ok) {
+        return { ok: false, reason: 'fetch_failed' };
+    }
+    let bytes;
+    try {
+        const buffer = await response.arrayBuffer();
+        bytes = new Uint8Array(buffer);
+    }
+    catch {
+        return { ok: false, reason: 'fetch_failed' };
+    }
+    const computedSize = bytes.byteLength;
+    if (computedSize !== ref.size) {
+        return { ok: false, reason: 'size_mismatch', computedSize };
+    }
+    const computedHash = sha256Hex(bytes);
+    if (computedHash !== parsed.hash) {
+        return { ok: false, reason: 'hash_mismatch', computedHash, computedSize };
+    }
+    return { ok: true, computedHash, computedSize };
+}
+/**
+ * Compute the canonical `blob:sha256:<hash>` reference hash for content bytes.
+ * Used by uploaders constructing a BlobRef object.
+ */
+export function computeBlobRefHash(content) {
+    return sha256Hex(content);
+}
+/**
+ * Fetch a BlobRef's content as a UTF-8 string. Used by the detail-page renderer
+ * to resolve output-level BlobRefs. Returns null on any failure; callers fall
+ * back to showing only the reference metadata rather than blocking the render.
+ */
+export async function fetchBlobRefText(ref, options = {}) {
+    try {
+        const fetcher = resolveFetch(options);
+        const response = await fetcher(ref.url, {
+            signal: options.signal ?? AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            return null;
+        return await response.text();
+    }
+    catch {
+        return null;
+    }
+}

package/dist/canonicalization.d.ts

@@ -0,0 +1,47 @@
+export declare const LEGACY_JSON_CANONICALIZATION = "https://typedstandards.org/canonicalization/legacy-json/v1";
+export declare const DATHERE_AG_JUPYTER_CANONICALIZATION = "https://typedstandards.org/canonicalization/dathere-ag-jupyter/v1";
+/** Canonicalization-rule URIs this implementation knows how to apply. An
+ *  unknown URI fails verify check #3 (`unknown_canonicalization_rule`). */
+export declare const KNOWN_CANONICALIZATION_RULES: readonly string[];
+/**
+ * RFC 8785 JSON Canonicalization Scheme. Wraps the `canonicalize` reference
+ * implementation (by the RFC 8785 author); its return type is
+ * `string | undefined`, undefined when the input isn't JSON-canonicalizable
+ * (e.g. `undefined`). We throw in that case so a malformed package fails loudly
+ * rather than silently producing a wrong hash.
+ */
+export declare function jcs(value: unknown): string;
+/**
+ * §8.2 detection rule: a package whose `contentHash` is embedded as a multihash
+ * OBJECT (keyed by lowercase algorithm name, hex-string values) is a v0.1
+ * package on the JCS chain. Absence — or an external single-SHA-256 hex string
+ * carried out of band on the DB row — marks a pre-v0.1 package on the legacy
+ * `JSON.stringify` chain.
+ */
+export declare function isMultihashContentHash(value: unknown): value is Record<string, string>;
+/**
+ * The envelope hash for a package, routed by the §8.2 detection rule:
+ *   - v0.1 (multihash `contentHash` present) → SHA-256 of the RFC 8785 JCS
+ *     canonicalization of the unsigned envelope.
+ *   - pre-v0.1 (no multihash `contentHash`) → SHA-256 of the legacy
+ *     insertion-order `JSON.stringify`, preserving byte-identical verification
+ *     of every package published before the JCS switch.
+ *
+ * The signature envelope is persisted on the database row, not inside the
+ * package object, so the package object already IS the unsigned envelope — there
+ * is no `sig` field to strip here. Used by BOTH the packager and the verifier so
+ * producer and verifier agree.
+ */
+export declare function computeEnvelopeHash(pkg: Record<string, unknown>): string;
+/**
+ * SHA-256 of a package's off-log content, canonicalized per the named rule
+ * (spec §8.2). Symmetric across produce/verify: `contentHash` is stripped before
+ * hashing, so the result is identical whether the package already carries
+ * `contentHash` (verify) or does not yet (packager).
+ *
+ *   - legacy-json/v1        → the canonical-JSON package with `contentHash`
+ *     (and the sig envelope, which lives off-package here) omitted.
+ *   - dathere-ag-jupyter/v1 → the executed notebook object
+ *     (`extensions["org.civicaitools.notebook"]` and its rendered outputs).
+ */
+export declare function computeContentHashSha256(pkg: Record<string, unknown>, rule: string): string;

package/dist/canonicalization.js

@@ -0,0 +1,100 @@
+// Canonicalization + hashing core (spec §8.2, §8.3.1, §12.3) — browser-safe.
+//
+// Factored from the server `src/lib/evidence/canonicalization.ts` (WS2) with one
+// change: the SHA-256 backend is `@noble/hashes` instead of `node:crypto`, so the
+// same code hashes in the browser. The `canonicalize` (RFC 8785 JCS) reference
+// implementation was already pure and is reused verbatim. The server module now
+// re-exports everything here, so producer and verifier — across both runtimes —
+// remain on a single implementation; a package re-verifies to the exact hash it
+// was published under regardless of where the check runs.
+//
+// The §8.2 detection rule routes each package to its chain: a package whose
+// `contentHash` is a multihash object is a v0.1 package on the JCS chain;
+// absence marks a pre-v0.1 package on the legacy `JSON.stringify` chain.
+import canonicalize from 'canonicalize';
+import { sha256Hex } from "./primitives.js";
+// Content-canonicalization rule URIs (spec §8.2, §12.3). Identifiers, not fetch
+// targets — verifiers resolve them via the local registry below.
+export const LEGACY_JSON_CANONICALIZATION = 'https://typedstandards.org/canonicalization/legacy-json/v1';
+export const DATHERE_AG_JUPYTER_CANONICALIZATION = 'https://typedstandards.org/canonicalization/dathere-ag-jupyter/v1';
+/** Canonicalization-rule URIs this implementation knows how to apply. An
+ *  unknown URI fails verify check #3 (`unknown_canonicalization_rule`). */
+export const KNOWN_CANONICALIZATION_RULES = [
+    LEGACY_JSON_CANONICALIZATION,
+    DATHERE_AG_JUPYTER_CANONICALIZATION,
+];
+/** Notebook extension whose object the dathere-ag-jupyter/v1 rule fingerprints
+ *  (spec §8.2, §8.7.2). */
+const NOTEBOOK_EXTENSION_KEY = 'org.civicaitools.notebook';
+/**
+ * RFC 8785 JSON Canonicalization Scheme. Wraps the `canonicalize` reference
+ * implementation (by the RFC 8785 author); its return type is
+ * `string | undefined`, undefined when the input isn't JSON-canonicalizable
+ * (e.g. `undefined`). We throw in that case so a malformed package fails loudly
+ * rather than silently producing a wrong hash.
+ */
+export function jcs(value) {
+    const out = canonicalize(value);
+    if (typeof out !== 'string') {
+        throw new Error('JCS canonicalization produced no output (non-JSON value)');
+    }
+    return out;
+}
+/**
+ * §8.2 detection rule: a package whose `contentHash` is embedded as a multihash
+ * OBJECT (keyed by lowercase algorithm name, hex-string values) is a v0.1
+ * package on the JCS chain. Absence — or an external single-SHA-256 hex string
+ * carried out of band on the DB row — marks a pre-v0.1 package on the legacy
+ * `JSON.stringify` chain.
+ */
+export function isMultihashContentHash(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const entries = Object.entries(value);
+    return entries.length > 0 && entries.every(([, v]) => typeof v === 'string');
+}
+/**
+ * The envelope hash for a package, routed by the §8.2 detection rule:
+ *   - v0.1 (multihash `contentHash` present) → SHA-256 of the RFC 8785 JCS
+ *     canonicalization of the unsigned envelope.
+ *   - pre-v0.1 (no multihash `contentHash`) → SHA-256 of the legacy
+ *     insertion-order `JSON.stringify`, preserving byte-identical verification
+ *     of every package published before the JCS switch.
+ *
+ * The signature envelope is persisted on the database row, not inside the
+ * package object, so the package object already IS the unsigned envelope — there
+ * is no `sig` field to strip here. Used by BOTH the packager and the verifier so
+ * producer and verifier agree.
+ */
+export function computeEnvelopeHash(pkg) {
+    if (isMultihashContentHash(pkg['contentHash'])) {
+        return sha256Hex(jcs(pkg));
+    }
+    return sha256Hex(JSON.stringify(pkg));
+}
+/**
+ * SHA-256 of a package's off-log content, canonicalized per the named rule
+ * (spec §8.2). Symmetric across produce/verify: `contentHash` is stripped before
+ * hashing, so the result is identical whether the package already carries
+ * `contentHash` (verify) or does not yet (packager).
+ *
+ *   - legacy-json/v1        → the canonical-JSON package with `contentHash`
+ *     (and the sig envelope, which lives off-package here) omitted.
+ *   - dathere-ag-jupyter/v1 → the executed notebook object
+ *     (`extensions["org.civicaitools.notebook"]` and its rendered outputs).
+ */
+export function computeContentHashSha256(pkg, rule) {
+    if (rule === DATHERE_AG_JUPYTER_CANONICALIZATION) {
+        const extensions = pkg['extensions'];
+        const notebook = extensions?.[NOTEBOOK_EXTENSION_KEY];
+        if (notebook === undefined) {
+            throw new Error(`dathere-ag-jupyter/v1 content hash requires the ${NOTEBOOK_EXTENSION_KEY} extension`);
+        }
+        return sha256Hex(jcs(notebook));
+    }
+    // legacy-json/v1 (default): fingerprint the package minus contentHash.
+    const rest = { ...pkg };
+    delete rest['contentHash'];
+    return sha256Hex(jcs(rest));
+}

package/dist/checks.d.ts

@@ -0,0 +1,128 @@
+import { type BlobRefVerifyReason, type BlobFetchOptions } from './blob-ref.ts';
+import type { TrustRegistry } from './trust-registry.ts';
+/**
+ * Recompute a package's envelope hash, routed by the §8.2 detection rule: v0.1
+ * packages (multihash `contentHash` present) hash via RFC 8785 JCS; pre-v0.1
+ * packages hash via the legacy insertion-order `JSON.stringify`. Drives both
+ * check #1 (envelope integrity / `hashMatch`) and check #13 (`nodeId`).
+ */
+export declare function recomputePackageHash(pkg: Record<string, unknown>): string;
+export declare const CONTENT_CANONICALIZATION_STATUSES: readonly ["ok", "implicit", "unknown_canonicalization_rule"];
+export type ContentCanonicalizationStatus = (typeof CONTENT_CANONICALIZATION_STATUSES)[number];
+export interface ContentCanonicalizationResolution {
+    status: ContentCanonicalizationStatus;
+    /** The resolved canonicalization-rule URI — the explicit field value, or the
+     *  rule inferred from the content profile for pre-v0.1 packages. */
+    rule: string;
+}
+/**
+ * Check #3 — content-canonicalization rule resolution (spec §9.2). Reads the
+ * package's `contentCanonicalization` URI and resolves it against the local rule
+ * registry. A known URI → `ok`. An unrecognized URI →
+ * `unknown_canonicalization_rule` (renders; check #4 then cannot recompute). An
+ * absent field on a pre-v0.1 package → `implicit`, inferring the rule from
+ * contentProfile / producerProfile (datHere → dathere-ag-jupyter/v1; otherwise
+ * legacy-json/v1).
+ */
+export declare function resolveContentCanonicalization(pkg: Record<string, unknown>): ContentCanonicalizationResolution;
+export declare const CONTENT_HASH_STATUSES: readonly ["ok", "content_hash_mismatch", "contentHash_no_supported_algorithm", "unresolved_rule", "legacy_relabeled"];
+export type ContentHashStatus = (typeof CONTENT_HASH_STATUSES)[number];
+export interface ContentHashCheck {
+    status: ContentHashStatus;
+    /** Algorithm names listed in the package's multihash `contentHash`. */
+    algorithms?: string[];
+    /** The algorithm whose recomputed digest matched (status === 'ok'). */
+    matched?: string;
+    /** The multihash digest set the verifier reports for the package. For pre-v0.1
+     *  packages this is the legacy external single-SHA-256 relabeled as
+     *  `{ sha256: <hex> }` per §8.2. */
+    contentHash?: Record<string, string>;
+}
+/**
+ * Check #4 — content-hash verification (spec §9.2, §8.2).
+ *
+ * v0.1 packages (multihash `contentHash` present): recompute the off-log
+ * content's digest under the resolved canonicalization rule for every listed
+ * algorithm this verifier supports, and confirm at least one matches.
+ *   - at least one supported algorithm matches → `ok`.
+ *   - a supported algorithm is present but none match → `content_hash_mismatch`.
+ *   - none of the listed algorithms are ones this verifier can compute →
+ *     `contentHash_no_supported_algorithm` (degrades; the value is preserved).
+ *   - the canonicalization rule could not be resolved (check #3 unknown) →
+ *     `unresolved_rule` (cannot recompute).
+ *
+ * pre-v0.1 packages (no multihash `contentHash`): the historical external
+ * single-SHA-256 is RELABELED as `{ sha256: <hex> }` per §8.2 rather than
+ * recomputed; its integrity is established by check #1, so check #4 reports
+ * `legacy_relabeled`.
+ */
+export declare function verifyContentHash(pkg: Record<string, unknown>, resolution: ContentCanonicalizationResolution, legacyExternalHash?: string): ContentHashCheck;
+export declare const TYPE_RESOLUTION_STATUSES: readonly ["ok", "implicit", "unknown_type"];
+export type TypeResolutionStatus = (typeof TYPE_RESOLUTION_STATUSES)[number];
+export interface TypeResolution {
+    status: TypeResolutionStatus;
+    /** The resolved type URI (the implicit `content/analysis/v1` when omitted). */
+    type: string;
+}
+/**
+ * Check #12 — `type` resolution. An absent field resolves to the implicit
+ * `content/analysis/v1` (pre-v0.1). An unrecognized URI reports `unknown_type`
+ * and renders as such — it does NOT fail verification.
+ */
+export declare function resolvePackageType(pkg: Record<string, unknown>): TypeResolution;
+export declare const SIGNER_IDENTITY_CHECK_STATUSES: readonly ["ok", "signer_identity_mismatch", "no_signer", "no_registry_identity"];
+export type SignerIdentityCheckStatus = (typeof SIGNER_IDENTITY_CHECK_STATUSES)[number];
+export interface SignerIdentityCheck {
+    status: SignerIdentityCheckStatus;
+    /** The `signer.identifier` claimed in the envelope, when present. */
+    claimed?: string;
+    /** The identifier the registry records for the signing `kid`, when present. */
+    registered?: string;
+}
+/**
+ * Check #14 — `signer.identifier` ↔ trust-registry `signerIdentity` cross-check
+ * (rules out a kid-swap-with-mismatched-identity attack). `signer_identity_mismatch`
+ * is fatal. Pre-v0.1 packages carry no envelope-side `signer` (`no_signer`) — the
+ * verifier derives the signer from the registry and skips the cross-check. A
+ * registry entry without a `signerIdentity` (legacy registry) yields
+ * `no_registry_identity`.
+ */
+export declare function checkSignerIdentity(pkg: Record<string, unknown>, kid: string | undefined, registry: TrustRegistry | undefined): SignerIdentityCheck;
+export declare const CAPTURE_METHOD_VOCAB_STATUSES: readonly ["ok", "captureMethod_unknown", "producerProfile_bundle_unresolved", "no_capture_method"];
+export type CaptureMethodVocabStatus = (typeof CAPTURE_METHOD_VOCAB_STATUSES)[number];
+export interface CaptureMethodVocabCheck {
+    status: CaptureMethodVocabStatus;
+    captureMethod?: string;
+    /** The resolved Producer Profile type whose vocabulary was consulted. */
+    profileType: string;
+}
+/**
+ * Check #15 — `captureMethod` per-profile vocabulary conformance. Resolves the
+ * package's Producer Profile (or its legacy-alias / pre-v0.1 fallback) and
+ * confirms `metadata.captureMethod` is in the declared vocabulary. A value not in
+ * the vocabulary reports `captureMethod_unknown` (rejects). An unresolvable
+ * profile bundle reports `producerProfile_bundle_unresolved` and degrades
+ * gracefully. A null captureMethod (pre-v0.1) is neutral (`no_capture_method`).
+ */
+export declare function checkCaptureMethodVocab(pkg: Record<string, unknown>): CaptureMethodVocabCheck;
+/** Field paths that the core verifier scans for BlobRef objects. */
+declare const BLOB_REF_FIELDS: readonly ["output", "trace", "skillMetadata.skillText"];
+export type BlobRefField = (typeof BLOB_REF_FIELDS)[number];
+export interface BlobRefVerification {
+    field: BlobRefField;
+    ref: string;
+    url: string;
+    size: number;
+    contentType: string;
+    ok: boolean;
+    reason?: BlobRefVerifyReason;
+}
+/**
+ * Walk the package JSON for BlobRef fields, fetch each referenced blob, and
+ * confirm the bytes hash to the advertised ref. Returns per-field verification
+ * results. Runs fetches in parallel with a per-blob 15 s timeout; failures are
+ * reported in the result rather than thrown. The fetcher is injected (defaults to
+ * `globalThis.fetch`).
+ */
+export declare function verifyPackageBlobRefs(pkg: Record<string, unknown>, options?: BlobFetchOptions): Promise<BlobRefVerification[]>;
+export {};