@typedstandards/verify-core 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -9,4 +9,5 @@ export * from './trust-registry.ts';
 export * from './checks.ts';
 export * from './lifecycle.ts';
 export * from './rekor.ts';
+export * from './rekor-inclusion.ts';
 export * from './verify.ts';

package/dist/index.js

@@ -23,4 +23,5 @@ export * from "./trust-registry.js";
 export * from "./checks.js";
 export * from "./lifecycle.js";
 export * from "./rekor.js";
+export * from "./rekor-inclusion.js";
 export * from "./verify.js";

package/dist/rekor-inclusion.d.ts

@@ -0,0 +1,98 @@
+/**
+ * A pinned Rekor transparency-log public key — the OFFLINE trust anchor for
+ * check #8. A verifier with this key (and the carried proof + checkpoint) needs no
+ * network and no reference-implementation dependency to confirm log inclusion.
+ */
+export interface RekorLogAnchor {
+    /** The checkpoint/note signer name (the note's signature-line identity). */
+    origin: string;
+    /** The log id: hex SHA-256 of `publicKeyDer`. The note's 4-byte key hint is its
+     *  first 4 bytes; we match anchors on that. */
+    logId: string;
+    /** The log public key, base64 SPKI DER (as `/api/v1/log/publicKey` returns). */
+    publicKeyDer: string;
+    /** Signature curve. Only P-256 is used by the public-good instance today. */
+    curve: 'p256';
+}
+export declare const REKOR_LOG_ANCHORS: readonly RekorLogAnchor[];
+/** A Rekor inclusion proof, as carried in `verification.inclusionProof`. */
+export interface RekorInclusionProof {
+    /** The leaf index WITHIN the shard tree of size `treeSize` (NOT the global
+     *  `logIndex` of the entry). This is the index RFC 6962 folds the path against. */
+    logIndex: number;
+    /** The tree size the proof (and checkpoint) are relative to. */
+    treeSize: number;
+    /** The Merkle root the proof folds to, hex. */
+    rootHash: string;
+    /** The audit path: sibling hashes from leaf to root, hex. */
+    hashes: string[];
+    /** The signed checkpoint (Go note) committing to `rootHash` at `treeSize`. */
+    checkpoint: string;
+}
+export type RekorInclusionFailReason = 'leaf_index_out_of_range' | 'proof_wrong_length' | 'root_mismatch' | 'checkpoint_unparseable' | 'checkpoint_root_mismatch' | 'checkpoint_unknown_anchor' | 'checkpoint_signature_invalid';
+export interface RekorInclusionResult {
+    /** The entry body + audit path reproduce the proof's `rootHash` (RFC 6962). */
+    inclusionVerified: boolean;
+    /** The checkpoint commits to that same root/size AND its signature verifies
+     *  against a pinned anchor — i.e. a vouched-for log head, offline. */
+    checkpointVerified: boolean;
+    treeSize?: number;
+    leafIndex?: number;
+    /** The checkpoint origin whose pinned key verified the signature. */
+    origin?: string;
+    /** The matched anchor's key hint (hex), for display / provenance. */
+    keyHint?: string;
+    /** The first thing that failed, when not fully verified. */
+    reason?: RekorInclusionFailReason;
+}
+/**
+ * Fold an inclusion path to a root per RFC 6962 §2.1.1, verbatim. Returns the
+ * computed root, or `null` if the index is out of range or the path is the wrong
+ * length for the tree. Arithmetic is Number `%`/`Math.floor` (NOT 32-bit bitwise)
+ * so leaf indices and tree sizes above 2³¹ fold correctly.
+ */
+export declare function computeInclusionRoot(leafIndex: number, treeSize: number, leaf: Uint8Array, path: Uint8Array[]): Uint8Array | null;
+interface CheckpointSignature {
+    name: string;
+    keyHint: Uint8Array;
+    sig: Uint8Array;
+}
+interface ParsedCheckpoint {
+    origin: string;
+    treeSize: number;
+    rootHash: Uint8Array;
+    /** The exact bytes the signature covers: the note body + its trailing newline.
+     *  The blank-line separator before the signature lines is NOT signed (verified
+     *  against OpenSSL). */
+    signedBody: Uint8Array;
+    signatures: CheckpointSignature[];
+}
+/**
+ * Parse a Rekor checkpoint. Body = the lines before the first blank line:
+ * `<origin>\n<treeSize>\n<base64 rootHash>\n`. Signature lines follow the blank
+ * separator: `— <name> <base64(keyHint[4] ‖ DER-sig)>`. Returns `null` if the
+ * structure is not a parseable note.
+ */
+export declare function parseRekorCheckpoint(text: string): ParsedCheckpoint | null;
+/**
+ * Verify a checkpoint's signature against the pinned anchors. The note signs the
+ * SHA-256 of `signedBody`; the signature is DER ECDSA P-256. We select the anchor
+ * by the note's key hint (= log-id prefix) and signer name. `@noble`'s `verify`
+ * prehashes by default — we pass the message bytes and let it hash, equivalently
+ * to `{ prehash: false }` over `sha256(signedBody)` (both validated against OpenSSL).
+ */
+export declare function verifyCheckpointSignature(checkpoint: ParsedCheckpoint, anchors: readonly RekorLogAnchor[]): {
+    verified: boolean;
+    origin?: string;
+    keyHint?: string;
+};
+/**
+ * Verify Rekor log inclusion for an entry, OFFLINE. `entryBody` is the entry's
+ * canonical leaf bytes — Rekor's base64 `body`, or the raw bytes. `inclusionProof`
+ * is the carried `verification.inclusionProof`. Returns a graded verdict:
+ * `inclusionVerified` (the proof folds to its root) and `checkpointVerified` (that
+ * root is in a checkpoint a pinned log key signed). The strong property — "this
+ * entry is in a log the sigstore key vouches for" — is both being true.
+ */
+export declare function verifyRekorInclusion(entryBody: string | Uint8Array, inclusionProof: RekorInclusionProof, anchors?: readonly RekorLogAnchor[]): RekorInclusionResult;
+export {};

package/dist/rekor-inclusion.js

@@ -0,0 +1,258 @@
+// Rekor transparency-log MERKLE-INCLUSION verification (spec §9.2 check #8, deep)
+// — browser-safe, OFFLINE-capable (civic-ai-tools-website#119 P1).
+//
+// `rekor.ts` does hash-PARITY: re-fetch the entry and compare the stored SHA-512
+// prehash. This module closes the cryptographic gap — it verifies, with no trust
+// in civicaitools.org and no network, that a Rekor entry is *included* in a log
+// the sigstore log key vouches for:
+//
+//   1. RFC 6962 §2.1.1 inclusion proof: leaf = SHA-256(0x00 ‖ entry-body); fold the
+//      audit path to a root; that root MUST equal the proof's `rootHash`.
+//   2. Checkpoint (a Go signed-note / "checkpoint" per the transparency-dev format):
+//      its committed root + tree size MUST equal the proof's, and its signature MUST
+//      verify against a PINNED Rekor log public key (the trust anchor) — selected by
+//      the note's 4-byte key hint, which is the first 4 bytes of the log id
+//      (SHA-256 of the key's DER).
+//
+// Everything is pure `@noble/hashes` (SHA-256 Merkle hashing) + `@noble/curves`
+// (ECDSA P-256 checkpoint signature). No `node:*`, no `Buffer`, no fetch — the
+// proof + checkpoint + entry body are supplied by the caller (carried in the
+// offline bundle per D2). The recipe here was validated byte-for-byte against a
+// real `rekor.sigstore.dev` entry (and cross-checked with OpenSSL) before shipping;
+// `__fixtures__/rekor-inclusion.json` is that entry, and the tests reproduce it.
+import { sha256 } from '@noble/hashes/sha2.js';
+import { p256 } from '@noble/curves/nist.js';
+import { base64ToBytes, hexToBytes, bytesToHex, utf8ToBytes } from "./primitives.js";
+// PROVENANCE (anchor pinning — spec §10.3). The active public-good Rekor shard
+// (`rekor.sigstore.dev`, tree id 1193050959916656506) signs its checkpoints with
+// this ECDSA P-256 key. Captured 2026-06-06 from
+// `https://rekor.sigstore.dev/api/v1/log/publicKey`; the SHA-256 of its DER is the
+// log id `c0d23d6a…`, which equals the `logID` every entry reports and the note's
+// key-hint prefix (independently corroborated by sigstore's TUF `trusted_root.json`,
+// which is the authoritative, rotation-aware source of this key set). Our packages
+// are all published to this active shard; older inactive shards carry their own
+// keys (their public keys are NOT served by `/api/v1/log` and must come from
+// `trusted_root.json`) — pinning those is a documented extension point, added here
+// when a package that predates the active shard needs offline check #8.
+export const REKOR_LOG_ANCHORS = [
+    {
+        origin: 'rekor.sigstore.dev',
+        logId: 'c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d',
+        publicKeyDer: 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==',
+        curve: 'p256',
+    },
+];
+// --- RFC 6962 Merkle hashing ----------------------------------------------
+/** Leaf hash: `SHA-256(0x00 ‖ leaf)` (RFC 6962 §2.1). */
+function leafHash(leaf) {
+    const buf = new Uint8Array(1 + leaf.length);
+    buf[0] = 0x00;
+    buf.set(leaf, 1);
+    return sha256(buf);
+}
+/** Interior node hash: `SHA-256(0x01 ‖ left ‖ right)` (RFC 6962 §2.1). */
+function nodeHash(left, right) {
+    const buf = new Uint8Array(1 + left.length + right.length);
+    buf[0] = 0x01;
+    buf.set(left, 1);
+    buf.set(right, 1 + left.length);
+    return sha256(buf);
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * Fold an inclusion path to a root per RFC 6962 §2.1.1, verbatim. Returns the
+ * computed root, or `null` if the index is out of range or the path is the wrong
+ * length for the tree. Arithmetic is Number `%`/`Math.floor` (NOT 32-bit bitwise)
+ * so leaf indices and tree sizes above 2³¹ fold correctly.
+ */
+export function computeInclusionRoot(leafIndex, treeSize, leaf, path) {
+    if (!Number.isInteger(leafIndex) || !Number.isInteger(treeSize))
+        return null;
+    if (leafIndex < 0 || leafIndex >= treeSize)
+        return null;
+    let fn = leafIndex; // node index of the running hash, within its tree level
+    let sn = treeSize - 1; // index of the last node at that level
+    let r = leaf;
+    for (const p of path) {
+        if (sn === 0)
+            return null; // path longer than the tree is deep — reject
+        if (fn % 2 === 1 || fn === sn) {
+            r = nodeHash(p, r);
+            if (fn % 2 === 0) {
+                // ascend past the all-right edge until the running node is a left child
+                do {
+                    fn = Math.floor(fn / 2);
+                    sn = Math.floor(sn / 2);
+                } while (fn % 2 === 0 && fn !== 0);
+            }
+        }
+        else {
+            r = nodeHash(r, p);
+        }
+        fn = Math.floor(fn / 2);
+        sn = Math.floor(sn / 2);
+    }
+    return sn === 0 ? r : null; // leftover path ⇒ wrong length
+}
+/**
+ * Parse a Rekor checkpoint. Body = the lines before the first blank line:
+ * `<origin>\n<treeSize>\n<base64 rootHash>\n`. Signature lines follow the blank
+ * separator: `— <name> <base64(keyHint[4] ‖ DER-sig)>`. Returns `null` if the
+ * structure is not a parseable note.
+ */
+export function parseRekorCheckpoint(text) {
+    const sep = text.indexOf('\n\n');
+    if (sep < 0)
+        return null;
+    const body = text.slice(0, sep);
+    const lines = body.split('\n');
+    if (lines.length < 3)
+        return null;
+    // line 0 is "<origin> - <treeId>"; the note signer name is the origin token.
+    const origin = lines[0].split(' - ')[0];
+    const treeSize = Number(lines[1]);
+    if (!Number.isInteger(treeSize))
+        return null;
+    let rootHash;
+    try {
+        rootHash = base64ToBytes(lines[2]);
+    }
+    catch {
+        return null;
+    }
+    if (rootHash.length !== 32)
+        return null;
+    const signatures = [];
+    for (const line of text.slice(sep + 2).split('\n')) {
+        if (!line.startsWith('— '))
+            continue; // em-dash + space
+        const parts = line.split(' ');
+        if (parts.length < 3)
+            continue;
+        let blob;
+        try {
+            blob = base64ToBytes(parts[parts.length - 1]);
+        }
+        catch {
+            continue;
+        }
+        if (blob.length < 5)
+            continue;
+        signatures.push({
+            name: parts.slice(1, -1).join(' '),
+            keyHint: blob.slice(0, 4),
+            sig: blob.slice(4),
+        });
+    }
+    return { origin, treeSize, rootHash, signedBody: utf8ToBytes(body + '\n'), signatures };
+}
+// An ECDSA P-256 public key in SPKI DER is a fixed 91-byte structure: a 26-byte
+// prefix (SEQUENCE → AlgorithmIdentifier{ id-ecPublicKey, prime256v1 } → BIT
+// STRING) then the 65-byte uncompressed point (0x04 ‖ X ‖ Y). Asserting the prefix
+// before slicing makes a malformed/foreign key throw rather than yield 65 arbitrary
+// bytes.
+const EC_P256_SPKI_PREFIX = Uint8Array.from([
+    0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01,
+    0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00,
+]);
+const EC_P256_SPKI_LENGTH = 91;
+function extractP256Point(publicKeyB64Der) {
+    const der = base64ToBytes(publicKeyB64Der);
+    if (der.length !== EC_P256_SPKI_LENGTH) {
+        throw new Error(`Unexpected P-256 SPKI length ${der.length}; expected ${EC_P256_SPKI_LENGTH}`);
+    }
+    for (let i = 0; i < EC_P256_SPKI_PREFIX.length; i++) {
+        if (der[i] !== EC_P256_SPKI_PREFIX[i]) {
+            throw new Error('Unexpected P-256 SPKI prefix; not a bare prime256v1 public key');
+        }
+    }
+    return der.slice(EC_P256_SPKI_LENGTH - 65);
+}
+/**
+ * Verify a checkpoint's signature against the pinned anchors. The note signs the
+ * SHA-256 of `signedBody`; the signature is DER ECDSA P-256. We select the anchor
+ * by the note's key hint (= log-id prefix) and signer name. `@noble`'s `verify`
+ * prehashes by default — we pass the message bytes and let it hash, equivalently
+ * to `{ prehash: false }` over `sha256(signedBody)` (both validated against OpenSSL).
+ */
+export function verifyCheckpointSignature(checkpoint, anchors) {
+    for (const sig of checkpoint.signatures) {
+        const hint = bytesToHex(sig.keyHint);
+        const anchor = anchors.find((a) => a.logId.startsWith(hint) && a.origin === sig.name);
+        if (!anchor)
+            continue;
+        try {
+            const point = extractP256Point(anchor.publicKeyDer);
+            if (p256.verify(sig.sig, checkpoint.signedBody, point, { format: 'der' })) {
+                return { verified: true, origin: anchor.origin, keyHint: hint };
+            }
+        }
+        catch {
+            // malformed anchor key or signature ⇒ this anchor doesn't verify; try next.
+        }
+    }
+    return { verified: false };
+}
+/**
+ * Verify Rekor log inclusion for an entry, OFFLINE. `entryBody` is the entry's
+ * canonical leaf bytes — Rekor's base64 `body`, or the raw bytes. `inclusionProof`
+ * is the carried `verification.inclusionProof`. Returns a graded verdict:
+ * `inclusionVerified` (the proof folds to its root) and `checkpointVerified` (that
+ * root is in a checkpoint a pinned log key signed). The strong property — "this
+ * entry is in a log the sigstore key vouches for" — is both being true.
+ */
+export function verifyRekorInclusion(entryBody, inclusionProof, anchors = REKOR_LOG_ANCHORS) {
+    const base = {
+        inclusionVerified: false,
+        checkpointVerified: false,
+        treeSize: inclusionProof.treeSize,
+        leafIndex: inclusionProof.logIndex,
+    };
+    let body;
+    let proofRoot;
+    let path;
+    try {
+        body = typeof entryBody === 'string' ? base64ToBytes(entryBody) : entryBody;
+        proofRoot = hexToBytes(inclusionProof.rootHash);
+        path = inclusionProof.hashes.map((h) => hexToBytes(h));
+    }
+    catch {
+        return { ...base, reason: 'proof_wrong_length' };
+    }
+    const computed = computeInclusionRoot(inclusionProof.logIndex, inclusionProof.treeSize, leafHash(body), path);
+    if (computed === null) {
+        const inRange = inclusionProof.logIndex >= 0 && inclusionProof.logIndex < inclusionProof.treeSize;
+        return { ...base, reason: inRange ? 'proof_wrong_length' : 'leaf_index_out_of_range' };
+    }
+    if (!bytesEqual(computed, proofRoot)) {
+        return { ...base, reason: 'root_mismatch' };
+    }
+    base.inclusionVerified = true;
+    const checkpoint = parseRekorCheckpoint(inclusionProof.checkpoint);
+    if (!checkpoint)
+        return { ...base, reason: 'checkpoint_unparseable' };
+    if (!bytesEqual(checkpoint.rootHash, proofRoot) || checkpoint.treeSize !== inclusionProof.treeSize) {
+        return { ...base, reason: 'checkpoint_root_mismatch' };
+    }
+    const sig = verifyCheckpointSignature(checkpoint, anchors);
+    if (!sig.verified) {
+        const knownAnchor = checkpoint.signatures.some((s) => anchors.some((a) => a.logId.startsWith(bytesToHex(s.keyHint)) && a.origin === s.name));
+        return {
+            ...base,
+            reason: knownAnchor ? 'checkpoint_signature_invalid' : 'checkpoint_unknown_anchor',
+        };
+    }
+    return {
+        ...base,
+        checkpointVerified: true,
+        ...(sig.origin ? { origin: sig.origin } : {}),
+        ...(sig.keyHint ? { keyHint: sig.keyHint } : {}),
+    };
+}

package/dist/rekor.d.ts

@@ -1,9 +1,14 @@
+import { type RekorInclusionResult } from './rekor-inclusion.ts';
 import type { FetchLike } from './types.ts';
 export interface RekorVerifyResult {
+    /** Hash-parity: the entry's recorded SHA-512 prehash matches the package. */
     verified: boolean;
     logIndex?: number;
     integratedTime?: number;
     logEntryUrl?: string;
+    /** Cryptographic Merkle-inclusion verdict (#119), when the fetched entry carries
+     *  an inclusion proof. Additive — `verified` (hash-parity) is unchanged. */
+    inclusion?: RekorInclusionResult;
 }
 /**
  * Verify that a Rekor transparency log entry is consistent with a published

package/dist/rekor.js

@@ -1,14 +1,15 @@
 // Rekor transparency-log check (spec §9.2 check #8) — browser-safe.
 //
-// Factored from the server `verify.ts`. The check depth is unchanged from what
-// the server does today: re-fetch the entry and compare the stored SHA-512 hash
-// (hash-PARITY). It does NOT cryptographically verify the Merkle inclusion proof
-// — that, and full offline verification against the log checkpoint, is
-// civic-ai-tools-website#119. Node swaps: the SHA-512 prehash uses `@noble/hashes`
+// Factored from the server `verify.ts`. This module does hash-PARITY: re-fetch the
+// entry and compare the stored SHA-512 hash. When the fetched entry carries an
+// inclusion proof it ALSO runs cryptographic Merkle-inclusion verification against
+// the pinned log key (`rekor-inclusion.ts`, civic-ai-tools-website#119 P1) — the
+// same offline check a carried bundle runs. Node swaps: the SHA-512 prehash uses `@noble/hashes`
 // (via `rekorHashForPackage`), the base64 body decode uses `atob` + `TextDecoder`
 // instead of `Buffer`, and the network fetch is injected.
 import { rekorHashForPackage } from "./signature.js";
 import { base64ToBytes } from "./primitives.js";
+import { verifyRekorInclusion, } from "./rekor-inclusion.js";
 /**
  * Verify that a Rekor transparency log entry is consistent with a published
  * package.
@@ -40,11 +41,17 @@ export async function verifyRekorEntry(entryId, packageHash, options = {}) {
         const recordedAlgo = body?.spec?.data?.hash?.algorithm;
         const expectedHash = rekorHashForPackage(packageHash);
         const verified = recordedAlgo === 'sha512' && recordedHash === expectedHash;
+        // Deepen #8 (civic-ai-tools-website#119): when the entry carries an inclusion
+        // proof, cryptographically verify Merkle inclusion against the pinned log key —
+        // the same offline check a carried bundle runs, here over the fetched entry.
+        const proof = entry.verification?.inclusionProof;
+        const inclusion = proof && entry.body ? verifyRekorInclusion(entry.body, proof) : undefined;
         return {
             verified,
             logIndex: entry.logIndex,
             integratedTime: entry.integratedTime,
             logEntryUrl: `https://search.sigstore.dev/?logIndex=${entry.logIndex}`,
+            ...(inclusion ? { inclusion } : {}),
         };
     }
     catch (err) {

package/dist/verify.d.ts

@@ -1,3 +1,4 @@
+import { type RekorInclusionProof, type RekorInclusionResult } from './rekor-inclusion.ts';
 import { type KeyTrustResult, type TrustRegistry } from './trust-registry.ts';
 import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type CaptureMethodVocabCheck, type BlobRefVerification } from './checks.ts';
 import { type LifecycleResolution } from './lifecycle.ts';
@@ -40,6 +41,13 @@ export interface VerifyInput {
     rfc3161Timestamp?: string | null;
     /** Rekor entry id (#8 hash-parity, needs a fetcher). */
     rekorEntryId?: string | null;
+    /** Carried Rekor inclusion proof (#8 deep, civic-ai-tools-website#119). When
+     *  supplied with `rekorEntryBody`, Merkle inclusion is verified OFFLINE against
+     *  the pinned log key — no fetch, no civicaitools.org dependency. */
+    rekorInclusionProof?: RekorInclusionProof | null;
+    /** The Rekor entry's canonical leaf bytes (its base64 `body`), carried so the
+     *  inclusion proof can be folded offline (D2). */
+    rekorEntryBody?: string | null;
     /** Lifecycle STATE from the sidecar (#10 state-depth). Ignored when the caller
      *  supplies `deps.lifecycleResolution`. */
     lifecycle?: CommitmentLifecycleState | null;
@@ -76,6 +84,10 @@ export interface VerifyResult {
         logEntryUrl?: string;
     } | null;
     rekorIntegratedTime?: number;
+    /** Cryptographic Merkle-inclusion verdict (#119): null when no proof was
+     *  available, else the graded result (`inclusionVerified` / `checkpointVerified`).
+     *  Additive to `rekorVerified` (hash-parity). */
+    rekorInclusion: RekorInclusionResult | null;
     hasRekor: boolean;
     hasTimestamp: boolean;
     keyTrust: KeyTrustResult | null;

package/dist/verify.js

@@ -14,14 +14,17 @@
 // sidecar (`buildCommitmentView`) so WS3 can wire sidecar → verifyEvidence with
 // no glue. The server route adapts its DB row to the same shape.
 //
-// Check depth matches the current server exactly: fully client-side for
-// #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; PRESENCE for #7 (RFC 3161); hash-PARITY
-// for #8 (Rekor); lifecycle STATE for #10 unless the caller supplies a deeper
-// resolution. The deeper offline crypto (TSA chain, Merkle inclusion, independent
-// lifecycle-chain verification) is civic-ai-tools-website#119.
+// Check depth: fully client-side for #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; PRESENCE
+// for #7 (RFC 3161); #8 (Rekor) is hash-PARITY AND, when an inclusion proof is
+// available (carried for offline, or on the fetched entry), cryptographic Merkle
+// inclusion against the pinned log key (civic-ai-tools-website#119 P1); lifecycle
+// STATE for #10 unless the caller supplies a deeper resolution. The remaining
+// deeper offline crypto (TSA chain #7, independent lifecycle-chain #10) is #119
+// P2 / P3.
 import { recomputePackageHash } from "./checks.js";
 import { verifySignature } from "./signature.js";
 import { verifyRekorEntry } from "./rekor.js";
+import { verifyRekorInclusion, } from "./rekor-inclusion.js";
 import { verifyKeyTrust, legacyEmbeddedKeyTrust, } from "./trust-registry.js";
 import { resolveContentCanonicalization, verifyContentHash, resolvePackageType, checkSignerIdentity, checkCaptureMethodVocab, verifyPackageBlobRefs, } from "./checks.js";
 import { resolveLifecycleFromLegacyColumns, } from "./lifecycle.js";
@@ -55,10 +58,14 @@ export async function verifyEvidence(input, deps) {
         signatureValid = verifySignature(packageHash, input.signature.signature, input.signature.publicKey, input.signature.algorithm);
     }
     const hasSigning = !!input.signature || !!input.signatureMalformed;
-    // Step 3 — Rekor (check #8, hash-parity). Also yields integratedTime for #5.
+    // Step 3 — Rekor (check #8). Hash-parity (online) yields integratedTime for #5;
+    // Merkle inclusion (#119) is verified cryptographically. The carried proof + body
+    // verify inclusion OFFLINE (no fetch); otherwise the online fetch's entry carries
+    // the proof. Carried-offline takes precedence — it is the zero-dependency property.
     let rekorVerified = null;
     let rekorDetails = null;
     let rekorIntegratedTime;
+    let rekorInclusion = null;
     if (input.rekorEntryId && packageHash) {
         const rekorResult = await verifyRekorEntry(input.rekorEntryId, packageHash, { fetch: deps.fetch });
         rekorVerified = rekorResult.verified;
@@ -69,6 +76,11 @@ export async function verifyEvidence(input, deps) {
                 logEntryUrl: rekorResult.logEntryUrl,
             };
         }
+        if (rekorResult.inclusion)
+            rekorInclusion = rekorResult.inclusion;
+    }
+    if (input.rekorInclusionProof && input.rekorEntryBody) {
+        rekorInclusion = verifyRekorInclusion(input.rekorEntryBody, input.rekorInclusionProof);
     }
     // Step 3b — blob references embedded in the package (check #9).
     let blobRefs = [];
@@ -119,6 +131,7 @@ export async function verifyEvidence(input, deps) {
         rekorVerified,
         rekorDetails,
         ...(rekorIntegratedTime !== undefined ? { rekorIntegratedTime } : {}),
+        rekorInclusion,
         hasRekor: !!input.rekorEntryId,
         hasTimestamp: !!input.rfc3161Timestamp,
         keyTrust,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Portable, browser-safe verification core for Typed Standards evidence packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -26,6 +26,7 @@
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node --test --experimental-strip-types \"src/**/*.test.ts\"",
+    "prepare": "npm run build",
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {