@typedstandards/verify-core 0.1.0 → 0.3.0

package/dist/asn1.d.ts

@@ -0,0 +1,36 @@
+export declare class Asn1Error extends Error {
+}
+export interface DerNode {
+    /** The identifier octet (e.g. 0x30 SEQUENCE, 0x02 INTEGER, 0xa0 [0]). */
+    tag: number;
+    constructed: boolean;
+    /** Offset of the identifier octet. */
+    start: number;
+    /** Offset where content begins (just past the length octets). */
+    contentStart: number;
+    /** Offset one past the last content octet. */
+    contentEnd: number;
+    /** Offset one past the whole TLV (= contentEnd). */
+    end: number;
+}
+/** Parse a single TLV at `pos`, with strict-DER bounds checks. */
+export declare function readNode(buf: Uint8Array, pos: number): DerNode;
+/** Parse every child TLV of a constructed node; require they exactly tile it. */
+export declare function children(buf: Uint8Array, node: DerNode): DerNode[];
+/** The content octets of a node (a view — copy before mutating). */
+export declare function content(buf: Uint8Array, node: DerNode): Uint8Array;
+/** The whole TLV (identifier + length + content) of a node (a view). */
+export declare function rawTlv(buf: Uint8Array, node: DerNode): Uint8Array;
+/** Assert a node's tag, returning it (for fluent parsing). */
+export declare function expectTag(node: DerNode, tag: number, label?: string): DerNode;
+/** Decode an OBJECT IDENTIFIER (tag 0x06) to its dotted-decimal string. */
+export declare function oidToString(buf: Uint8Array, node: DerNode): string;
+/**
+ * Decode a UTCTime (0x17) or GeneralizedTime (0x18) to epoch milliseconds. Only
+ * the `Z` (UTC) forms RFC 5280 / RFC 3161 mandate are accepted; local-time and
+ * offset forms are rejected. UTCTime two-digit years use the RFC 5280 1950–2049
+ * window.
+ */
+export declare function readTime(buf: Uint8Array, node: DerNode): number;
+/** First child whose tag matches, or undefined. */
+export declare function findChild(buf: Uint8Array, node: DerNode, tag: number): DerNode | undefined;

package/dist/asn1.js

@@ -0,0 +1,154 @@
+// Minimal, bounds-checked DER reader (civic-ai-tools-website#119 P2) — browser-safe.
+//
+// Just enough ASN.1/DER to parse RFC 3161 timestamp tokens (PKCS#7/CMS + TSTInfo)
+// and, later, X.509 certs — NOT a general ASN.1 library. A hand-rolled parser over
+// attacker-supplied bytes is itself an attack surface, so every read is bounds- and
+// shape-checked and the encoding is STRICT DER:
+//   - definite lengths only (indefinite `0x80` is rejected — it has no place in DER);
+//   - minimal length encoding (no `0x81 0x05`, no leading-zero padding);
+//   - lengths may not exceed the buffer; children must exactly tile their parent
+//     (no trailing garbage);
+//   - high-tag-number form is rejected (none of our structures use it).
+// Malformed input throws `Asn1Error` rather than reading out of bounds or looping.
+// Pure byte logic — no `node:*`, no `Buffer` (browser-safety guard covers this).
+export class Asn1Error extends Error {
+}
+// DER tag classes / numbers we accept in the length/tag header. Context tags used
+// by CMS/X.509 ([0], [1], …) are low-tag-number (0xa0, 0xa1, 0x80, …) so the
+// high-tag-number guard never rejects a well-formed token.
+const HIGH_TAG_NUMBER_MASK = 0x1f;
+const CONSTRUCTED_BIT = 0x20;
+const LONG_FORM_BIT = 0x80;
+/** Parse a single TLV at `pos`, with strict-DER bounds checks. */
+export function readNode(buf, pos) {
+    if (pos < 0 || pos + 1 > buf.length)
+        throw new Asn1Error('readNode past end of buffer');
+    const tag = buf[pos];
+    if ((tag & HIGH_TAG_NUMBER_MASK) === HIGH_TAG_NUMBER_MASK) {
+        throw new Asn1Error('high-tag-number form unsupported');
+    }
+    let i = pos + 1;
+    if (i >= buf.length)
+        throw new Asn1Error('truncated: missing length octet');
+    let len = buf[i++];
+    if (len & LONG_FORM_BIT) {
+        const n = len & 0x7f;
+        if (n === 0)
+            throw new Asn1Error('indefinite length not allowed in DER');
+        if (n > 4)
+            throw new Asn1Error('length octet count too large');
+        if (i + n > buf.length)
+            throw new Asn1Error('truncated long-form length');
+        if (buf[i] === 0x00)
+            throw new Asn1Error('non-minimal length (leading zero)');
+        len = 0;
+        for (let k = 0; k < n; k++)
+            len = len * 256 + buf[i++]; // *256 avoids 32-bit overflow
+        if (len < 0x80)
+            throw new Asn1Error('non-minimal length (should be short form)');
+    }
+    const contentStart = i;
+    const contentEnd = i + len;
+    if (contentEnd > buf.length)
+        throw new Asn1Error('content length exceeds buffer');
+    return {
+        tag,
+        constructed: (tag & CONSTRUCTED_BIT) !== 0,
+        start: pos,
+        contentStart,
+        contentEnd,
+        end: contentEnd,
+    };
+}
+/** Parse every child TLV of a constructed node; require they exactly tile it. */
+export function children(buf, node) {
+    if (!node.constructed)
+        throw new Asn1Error('children() on a primitive node');
+    const out = [];
+    let p = node.contentStart;
+    while (p < node.contentEnd) {
+        const child = readNode(buf, p);
+        if (child.end > node.contentEnd)
+            throw new Asn1Error('child overruns parent');
+        out.push(child);
+        p = child.end;
+    }
+    if (p !== node.contentEnd)
+        throw new Asn1Error('trailing bytes in constructed value');
+    return out;
+}
+/** The content octets of a node (a view — copy before mutating). */
+export function content(buf, node) {
+    return buf.subarray(node.contentStart, node.contentEnd);
+}
+/** The whole TLV (identifier + length + content) of a node (a view). */
+export function rawTlv(buf, node) {
+    return buf.subarray(node.start, node.end);
+}
+/** Assert a node's tag, returning it (for fluent parsing). */
+export function expectTag(node, tag, label = 'node') {
+    if (node.tag !== tag) {
+        throw new Asn1Error(`expected ${label} tag 0x${tag.toString(16)}, got 0x${node.tag.toString(16)}`);
+    }
+    return node;
+}
+/** Decode an OBJECT IDENTIFIER (tag 0x06) to its dotted-decimal string. */
+export function oidToString(buf, node) {
+    expectTag(node, 0x06, 'OID');
+    const b = content(buf, node);
+    if (b.length === 0)
+        throw new Asn1Error('empty OID');
+    if (b[b.length - 1] & 0x80)
+        throw new Asn1Error('truncated OID subidentifier');
+    const subids = [];
+    let acc = 0;
+    for (const byte of b) {
+        acc = acc * 128 + (byte & 0x7f);
+        if ((byte & 0x80) === 0) {
+            subids.push(acc);
+            acc = 0;
+        }
+    }
+    const first = subids[0];
+    const arc0 = Math.min(2, Math.floor(first / 40));
+    const arcs = [arc0, first - arc0 * 40, ...subids.slice(1)];
+    return arcs.join('.');
+}
+function asciiOf(bytes) {
+    let s = '';
+    for (const c of bytes) {
+        if (c < 0x20 || c > 0x7e)
+            throw new Asn1Error('non-ASCII byte in time string');
+        s += String.fromCharCode(c);
+    }
+    return s;
+}
+/**
+ * Decode a UTCTime (0x17) or GeneralizedTime (0x18) to epoch milliseconds. Only
+ * the `Z` (UTC) forms RFC 5280 / RFC 3161 mandate are accepted; local-time and
+ * offset forms are rejected. UTCTime two-digit years use the RFC 5280 1950–2049
+ * window.
+ */
+export function readTime(buf, node) {
+    const s = asciiOf(content(buf, node));
+    if (node.tag === 0x18) {
+        const m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d+)?Z$/.exec(s);
+        if (!m)
+            throw new Asn1Error('malformed GeneralizedTime');
+        const ms = m[7] ? Math.round(parseFloat('0' + m[7]) * 1000) : 0;
+        return Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6], ms);
+    }
+    if (node.tag === 0x17) {
+        const m = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(s);
+        if (!m)
+            throw new Asn1Error('malformed UTCTime');
+        const yy = +m[1];
+        const year = yy < 50 ? 2000 + yy : 1900 + yy;
+        return Date.UTC(year, +m[2] - 1, +m[3], +m[4], +m[5], +m[6]);
+    }
+    throw new Asn1Error(`not a time tag: 0x${node.tag.toString(16)}`);
+}
+/** First child whose tag matches, or undefined. */
+export function findChild(buf, node, tag) {
+    return children(buf, node).find((c) => c.tag === tag);
+}

package/dist/index.d.ts

@@ -9,4 +9,7 @@ export * from './trust-registry.ts';
 export * from './checks.ts';
 export * from './lifecycle.ts';
 export * from './rekor.ts';
+export * from './rekor-inclusion.ts';
+export * from './asn1.ts';
+export * from './rfc3161.ts';
 export * from './verify.ts';

package/dist/index.js

@@ -23,4 +23,7 @@ export * from "./trust-registry.js";
 export * from "./checks.js";
 export * from "./lifecycle.js";
 export * from "./rekor.js";
+export * from "./rekor-inclusion.js";
+export * from "./asn1.js";
+export * from "./rfc3161.js";
 export * from "./verify.js";

package/dist/rekor-inclusion.d.ts

@@ -0,0 +1,98 @@
+/**
+ * A pinned Rekor transparency-log public key — the OFFLINE trust anchor for
+ * check #8. A verifier with this key (and the carried proof + checkpoint) needs no
+ * network and no reference-implementation dependency to confirm log inclusion.
+ */
+export interface RekorLogAnchor {
+    /** The checkpoint/note signer name (the note's signature-line identity). */
+    origin: string;
+    /** The log id: hex SHA-256 of `publicKeyDer`. The note's 4-byte key hint is its
+     *  first 4 bytes; we match anchors on that. */
+    logId: string;
+    /** The log public key, base64 SPKI DER (as `/api/v1/log/publicKey` returns). */
+    publicKeyDer: string;
+    /** Signature curve. Only P-256 is used by the public-good instance today. */
+    curve: 'p256';
+}
+export declare const REKOR_LOG_ANCHORS: readonly RekorLogAnchor[];
+/** A Rekor inclusion proof, as carried in `verification.inclusionProof`. */
+export interface RekorInclusionProof {
+    /** The leaf index WITHIN the shard tree of size `treeSize` (NOT the global
+     *  `logIndex` of the entry). This is the index RFC 6962 folds the path against. */
+    logIndex: number;
+    /** The tree size the proof (and checkpoint) are relative to. */
+    treeSize: number;
+    /** The Merkle root the proof folds to, hex. */
+    rootHash: string;
+    /** The audit path: sibling hashes from leaf to root, hex. */
+    hashes: string[];
+    /** The signed checkpoint (Go note) committing to `rootHash` at `treeSize`. */
+    checkpoint: string;
+}
+export type RekorInclusionFailReason = 'leaf_index_out_of_range' | 'proof_wrong_length' | 'root_mismatch' | 'checkpoint_unparseable' | 'checkpoint_root_mismatch' | 'checkpoint_unknown_anchor' | 'checkpoint_signature_invalid';
+export interface RekorInclusionResult {
+    /** The entry body + audit path reproduce the proof's `rootHash` (RFC 6962). */
+    inclusionVerified: boolean;
+    /** The checkpoint commits to that same root/size AND its signature verifies
+     *  against a pinned anchor — i.e. a vouched-for log head, offline. */
+    checkpointVerified: boolean;
+    treeSize?: number;
+    leafIndex?: number;
+    /** The checkpoint origin whose pinned key verified the signature. */
+    origin?: string;
+    /** The matched anchor's key hint (hex), for display / provenance. */
+    keyHint?: string;
+    /** The first thing that failed, when not fully verified. */
+    reason?: RekorInclusionFailReason;
+}
+/**
+ * Fold an inclusion path to a root per RFC 6962 §2.1.1, verbatim. Returns the
+ * computed root, or `null` if the index is out of range or the path is the wrong
+ * length for the tree. Arithmetic is Number `%`/`Math.floor` (NOT 32-bit bitwise)
+ * so leaf indices and tree sizes above 2³¹ fold correctly.
+ */
+export declare function computeInclusionRoot(leafIndex: number, treeSize: number, leaf: Uint8Array, path: Uint8Array[]): Uint8Array | null;
+interface CheckpointSignature {
+    name: string;
+    keyHint: Uint8Array;
+    sig: Uint8Array;
+}
+interface ParsedCheckpoint {
+    origin: string;
+    treeSize: number;
+    rootHash: Uint8Array;
+    /** The exact bytes the signature covers: the note body + its trailing newline.
+     *  The blank-line separator before the signature lines is NOT signed (verified
+     *  against OpenSSL). */
+    signedBody: Uint8Array;
+    signatures: CheckpointSignature[];
+}
+/**
+ * Parse a Rekor checkpoint. Body = the lines before the first blank line:
+ * `<origin>\n<treeSize>\n<base64 rootHash>\n`. Signature lines follow the blank
+ * separator: `— <name> <base64(keyHint[4] ‖ DER-sig)>`. Returns `null` if the
+ * structure is not a parseable note.
+ */
+export declare function parseRekorCheckpoint(text: string): ParsedCheckpoint | null;
+/**
+ * Verify a checkpoint's signature against the pinned anchors. The note signs the
+ * SHA-256 of `signedBody`; the signature is DER ECDSA P-256. We select the anchor
+ * by the note's key hint (= log-id prefix) and signer name. `@noble`'s `verify`
+ * prehashes by default — we pass the message bytes and let it hash, equivalently
+ * to `{ prehash: false }` over `sha256(signedBody)` (both validated against OpenSSL).
+ */
+export declare function verifyCheckpointSignature(checkpoint: ParsedCheckpoint, anchors: readonly RekorLogAnchor[]): {
+    verified: boolean;
+    origin?: string;
+    keyHint?: string;
+};
+/**
+ * Verify Rekor log inclusion for an entry, OFFLINE. `entryBody` is the entry's
+ * canonical leaf bytes — Rekor's base64 `body`, or the raw bytes. `inclusionProof`
+ * is the carried `verification.inclusionProof`. Returns a graded verdict:
+ * `inclusionVerified` (the proof folds to its root) and `checkpointVerified` (that
+ * root is in a checkpoint a pinned log key signed). The strong property — "this
+ * entry is in a log the sigstore key vouches for" — is both being true.
+ */
+export declare function verifyRekorInclusion(entryBody: string | Uint8Array, inclusionProof: RekorInclusionProof, anchors?: readonly RekorLogAnchor[]): RekorInclusionResult;
+export {};

package/dist/rekor-inclusion.js

@@ -0,0 +1,258 @@
+// Rekor transparency-log MERKLE-INCLUSION verification (spec §9.2 check #8, deep)
+// — browser-safe, OFFLINE-capable (civic-ai-tools-website#119 P1).
+//
+// `rekor.ts` does hash-PARITY: re-fetch the entry and compare the stored SHA-512
+// prehash. This module closes the cryptographic gap — it verifies, with no trust
+// in civicaitools.org and no network, that a Rekor entry is *included* in a log
+// the sigstore log key vouches for:
+//
+//   1. RFC 6962 §2.1.1 inclusion proof: leaf = SHA-256(0x00 ‖ entry-body); fold the
+//      audit path to a root; that root MUST equal the proof's `rootHash`.
+//   2. Checkpoint (a Go signed-note / "checkpoint" per the transparency-dev format):
+//      its committed root + tree size MUST equal the proof's, and its signature MUST
+//      verify against a PINNED Rekor log public key (the trust anchor) — selected by
+//      the note's 4-byte key hint, which is the first 4 bytes of the log id
+//      (SHA-256 of the key's DER).
+//
+// Everything is pure `@noble/hashes` (SHA-256 Merkle hashing) + `@noble/curves`
+// (ECDSA P-256 checkpoint signature). No `node:*`, no `Buffer`, no fetch — the
+// proof + checkpoint + entry body are supplied by the caller (carried in the
+// offline bundle per D2). The recipe here was validated byte-for-byte against a
+// real `rekor.sigstore.dev` entry (and cross-checked with OpenSSL) before shipping;
+// `__fixtures__/rekor-inclusion.json` is that entry, and the tests reproduce it.
+import { sha256 } from '@noble/hashes/sha2.js';
+import { p256 } from '@noble/curves/nist.js';
+import { base64ToBytes, hexToBytes, bytesToHex, utf8ToBytes } from "./primitives.js";
+// PROVENANCE (anchor pinning — spec §10.3). The active public-good Rekor shard
+// (`rekor.sigstore.dev`, tree id 1193050959916656506) signs its checkpoints with
+// this ECDSA P-256 key. Captured 2026-06-06 from
+// `https://rekor.sigstore.dev/api/v1/log/publicKey`; the SHA-256 of its DER is the
+// log id `c0d23d6a…`, which equals the `logID` every entry reports and the note's
+// key-hint prefix (independently corroborated by sigstore's TUF `trusted_root.json`,
+// which is the authoritative, rotation-aware source of this key set). Our packages
+// are all published to this active shard; older inactive shards carry their own
+// keys (their public keys are NOT served by `/api/v1/log` and must come from
+// `trusted_root.json`) — pinning those is a documented extension point, added here
+// when a package that predates the active shard needs offline check #8.
+export const REKOR_LOG_ANCHORS = [
+    {
+        origin: 'rekor.sigstore.dev',
+        logId: 'c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d',
+        publicKeyDer: 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==',
+        curve: 'p256',
+    },
+];
+// --- RFC 6962 Merkle hashing ----------------------------------------------
+/** Leaf hash: `SHA-256(0x00 ‖ leaf)` (RFC 6962 §2.1). */
+function leafHash(leaf) {
+    const buf = new Uint8Array(1 + leaf.length);
+    buf[0] = 0x00;
+    buf.set(leaf, 1);
+    return sha256(buf);
+}
+/** Interior node hash: `SHA-256(0x01 ‖ left ‖ right)` (RFC 6962 §2.1). */
+function nodeHash(left, right) {
+    const buf = new Uint8Array(1 + left.length + right.length);
+    buf[0] = 0x01;
+    buf.set(left, 1);
+    buf.set(right, 1 + left.length);
+    return sha256(buf);
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * Fold an inclusion path to a root per RFC 6962 §2.1.1, verbatim. Returns the
+ * computed root, or `null` if the index is out of range or the path is the wrong
+ * length for the tree. Arithmetic is Number `%`/`Math.floor` (NOT 32-bit bitwise)
+ * so leaf indices and tree sizes above 2³¹ fold correctly.
+ */
+export function computeInclusionRoot(leafIndex, treeSize, leaf, path) {
+    if (!Number.isInteger(leafIndex) || !Number.isInteger(treeSize))
+        return null;
+    if (leafIndex < 0 || leafIndex >= treeSize)
+        return null;
+    let fn = leafIndex; // node index of the running hash, within its tree level
+    let sn = treeSize - 1; // index of the last node at that level
+    let r = leaf;
+    for (const p of path) {
+        if (sn === 0)
+            return null; // path longer than the tree is deep — reject
+        if (fn % 2 === 1 || fn === sn) {
+            r = nodeHash(p, r);
+            if (fn % 2 === 0) {
+                // ascend past the all-right edge until the running node is a left child
+                do {
+                    fn = Math.floor(fn / 2);
+                    sn = Math.floor(sn / 2);
+                } while (fn % 2 === 0 && fn !== 0);
+            }
+        }
+        else {
+            r = nodeHash(r, p);
+        }
+        fn = Math.floor(fn / 2);
+        sn = Math.floor(sn / 2);
+    }
+    return sn === 0 ? r : null; // leftover path ⇒ wrong length
+}
+/**
+ * Parse a Rekor checkpoint. Body = the lines before the first blank line:
+ * `<origin>\n<treeSize>\n<base64 rootHash>\n`. Signature lines follow the blank
+ * separator: `— <name> <base64(keyHint[4] ‖ DER-sig)>`. Returns `null` if the
+ * structure is not a parseable note.
+ */
+export function parseRekorCheckpoint(text) {
+    const sep = text.indexOf('\n\n');
+    if (sep < 0)
+        return null;
+    const body = text.slice(0, sep);
+    const lines = body.split('\n');
+    if (lines.length < 3)
+        return null;
+    // line 0 is "<origin> - <treeId>"; the note signer name is the origin token.
+    const origin = lines[0].split(' - ')[0];
+    const treeSize = Number(lines[1]);
+    if (!Number.isInteger(treeSize))
+        return null;
+    let rootHash;
+    try {
+        rootHash = base64ToBytes(lines[2]);
+    }
+    catch {
+        return null;
+    }
+    if (rootHash.length !== 32)
+        return null;
+    const signatures = [];
+    for (const line of text.slice(sep + 2).split('\n')) {
+        if (!line.startsWith('— '))
+            continue; // em-dash + space
+        const parts = line.split(' ');
+        if (parts.length < 3)
+            continue;
+        let blob;
+        try {
+            blob = base64ToBytes(parts[parts.length - 1]);
+        }
+        catch {
+            continue;
+        }
+        if (blob.length < 5)
+            continue;
+        signatures.push({
+            name: parts.slice(1, -1).join(' '),
+            keyHint: blob.slice(0, 4),
+            sig: blob.slice(4),
+        });
+    }
+    return { origin, treeSize, rootHash, signedBody: utf8ToBytes(body + '\n'), signatures };
+}
+// An ECDSA P-256 public key in SPKI DER is a fixed 91-byte structure: a 26-byte
+// prefix (SEQUENCE → AlgorithmIdentifier{ id-ecPublicKey, prime256v1 } → BIT
+// STRING) then the 65-byte uncompressed point (0x04 ‖ X ‖ Y). Asserting the prefix
+// before slicing makes a malformed/foreign key throw rather than yield 65 arbitrary
+// bytes.
+const EC_P256_SPKI_PREFIX = Uint8Array.from([
+    0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01,
+    0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00,
+]);
+const EC_P256_SPKI_LENGTH = 91;
+function extractP256Point(publicKeyB64Der) {
+    const der = base64ToBytes(publicKeyB64Der);
+    if (der.length !== EC_P256_SPKI_LENGTH) {
+        throw new Error(`Unexpected P-256 SPKI length ${der.length}; expected ${EC_P256_SPKI_LENGTH}`);
+    }
+    for (let i = 0; i < EC_P256_SPKI_PREFIX.length; i++) {
+        if (der[i] !== EC_P256_SPKI_PREFIX[i]) {
+            throw new Error('Unexpected P-256 SPKI prefix; not a bare prime256v1 public key');
+        }
+    }
+    return der.slice(EC_P256_SPKI_LENGTH - 65);
+}
+/**
+ * Verify a checkpoint's signature against the pinned anchors. The note signs the
+ * SHA-256 of `signedBody`; the signature is DER ECDSA P-256. We select the anchor
+ * by the note's key hint (= log-id prefix) and signer name. `@noble`'s `verify`
+ * prehashes by default — we pass the message bytes and let it hash, equivalently
+ * to `{ prehash: false }` over `sha256(signedBody)` (both validated against OpenSSL).
+ */
+export function verifyCheckpointSignature(checkpoint, anchors) {
+    for (const sig of checkpoint.signatures) {
+        const hint = bytesToHex(sig.keyHint);
+        const anchor = anchors.find((a) => a.logId.startsWith(hint) && a.origin === sig.name);
+        if (!anchor)
+            continue;
+        try {
+            const point = extractP256Point(anchor.publicKeyDer);
+            if (p256.verify(sig.sig, checkpoint.signedBody, point, { format: 'der' })) {
+                return { verified: true, origin: anchor.origin, keyHint: hint };
+            }
+        }
+        catch {
+            // malformed anchor key or signature ⇒ this anchor doesn't verify; try next.
+        }
+    }
+    return { verified: false };
+}
+/**
+ * Verify Rekor log inclusion for an entry, OFFLINE. `entryBody` is the entry's
+ * canonical leaf bytes — Rekor's base64 `body`, or the raw bytes. `inclusionProof`
+ * is the carried `verification.inclusionProof`. Returns a graded verdict:
+ * `inclusionVerified` (the proof folds to its root) and `checkpointVerified` (that
+ * root is in a checkpoint a pinned log key signed). The strong property — "this
+ * entry is in a log the sigstore key vouches for" — is both being true.
+ */
+export function verifyRekorInclusion(entryBody, inclusionProof, anchors = REKOR_LOG_ANCHORS) {
+    const base = {
+        inclusionVerified: false,
+        checkpointVerified: false,
+        treeSize: inclusionProof.treeSize,
+        leafIndex: inclusionProof.logIndex,
+    };
+    let body;
+    let proofRoot;
+    let path;
+    try {
+        body = typeof entryBody === 'string' ? base64ToBytes(entryBody) : entryBody;
+        proofRoot = hexToBytes(inclusionProof.rootHash);
+        path = inclusionProof.hashes.map((h) => hexToBytes(h));
+    }
+    catch {
+        return { ...base, reason: 'proof_wrong_length' };
+    }
+    const computed = computeInclusionRoot(inclusionProof.logIndex, inclusionProof.treeSize, leafHash(body), path);
+    if (computed === null) {
+        const inRange = inclusionProof.logIndex >= 0 && inclusionProof.logIndex < inclusionProof.treeSize;
+        return { ...base, reason: inRange ? 'proof_wrong_length' : 'leaf_index_out_of_range' };
+    }
+    if (!bytesEqual(computed, proofRoot)) {
+        return { ...base, reason: 'root_mismatch' };
+    }
+    base.inclusionVerified = true;
+    const checkpoint = parseRekorCheckpoint(inclusionProof.checkpoint);
+    if (!checkpoint)
+        return { ...base, reason: 'checkpoint_unparseable' };
+    if (!bytesEqual(checkpoint.rootHash, proofRoot) || checkpoint.treeSize !== inclusionProof.treeSize) {
+        return { ...base, reason: 'checkpoint_root_mismatch' };
+    }
+    const sig = verifyCheckpointSignature(checkpoint, anchors);
+    if (!sig.verified) {
+        const knownAnchor = checkpoint.signatures.some((s) => anchors.some((a) => a.logId.startsWith(bytesToHex(s.keyHint)) && a.origin === s.name));
+        return {
+            ...base,
+            reason: knownAnchor ? 'checkpoint_signature_invalid' : 'checkpoint_unknown_anchor',
+        };
+    }
+    return {
+        ...base,
+        checkpointVerified: true,
+        ...(sig.origin ? { origin: sig.origin } : {}),
+        ...(sig.keyHint ? { keyHint: sig.keyHint } : {}),
+    };
+}

package/dist/rekor.d.ts

@@ -1,9 +1,14 @@
+import { type RekorInclusionResult } from './rekor-inclusion.ts';
 import type { FetchLike } from './types.ts';
 export interface RekorVerifyResult {
+    /** Hash-parity: the entry's recorded SHA-512 prehash matches the package. */
     verified: boolean;
     logIndex?: number;
     integratedTime?: number;
     logEntryUrl?: string;
+    /** Cryptographic Merkle-inclusion verdict (#119), when the fetched entry carries
+     *  an inclusion proof. Additive — `verified` (hash-parity) is unchanged. */
+    inclusion?: RekorInclusionResult;
 }
 /**
  * Verify that a Rekor transparency log entry is consistent with a published

package/dist/rekor.js

@@ -1,14 +1,15 @@
 // Rekor transparency-log check (spec §9.2 check #8) — browser-safe.
 //
-// Factored from the server `verify.ts`. The check depth is unchanged from what
-// the server does today: re-fetch the entry and compare the stored SHA-512 hash
-// (hash-PARITY). It does NOT cryptographically verify the Merkle inclusion proof
-// — that, and full offline verification against the log checkpoint, is
-// civic-ai-tools-website#119. Node swaps: the SHA-512 prehash uses `@noble/hashes`
+// Factored from the server `verify.ts`. This module does hash-PARITY: re-fetch the
+// entry and compare the stored SHA-512 hash. When the fetched entry carries an
+// inclusion proof it ALSO runs cryptographic Merkle-inclusion verification against
+// the pinned log key (`rekor-inclusion.ts`, civic-ai-tools-website#119 P1) — the
+// same offline check a carried bundle runs. Node swaps: the SHA-512 prehash uses `@noble/hashes`
 // (via `rekorHashForPackage`), the base64 body decode uses `atob` + `TextDecoder`
 // instead of `Buffer`, and the network fetch is injected.
 import { rekorHashForPackage } from "./signature.js";
 import { base64ToBytes } from "./primitives.js";
+import { verifyRekorInclusion, } from "./rekor-inclusion.js";
 /**
  * Verify that a Rekor transparency log entry is consistent with a published
  * package.
@@ -40,11 +41,17 @@ export async function verifyRekorEntry(entryId, packageHash, options = {}) {
         const recordedAlgo = body?.spec?.data?.hash?.algorithm;
         const expectedHash = rekorHashForPackage(packageHash);
         const verified = recordedAlgo === 'sha512' && recordedHash === expectedHash;
+        // Deepen #8 (civic-ai-tools-website#119): when the entry carries an inclusion
+        // proof, cryptographically verify Merkle inclusion against the pinned log key —
+        // the same offline check a carried bundle runs, here over the fetched entry.
+        const proof = entry.verification?.inclusionProof;
+        const inclusion = proof && entry.body ? verifyRekorInclusion(entry.body, proof) : undefined;
         return {
             verified,
             logIndex: entry.logIndex,
             integratedTime: entry.integratedTime,
             logEntryUrl: `https://search.sigstore.dev/?logIndex=${entry.logIndex}`,
+            ...(inclusion ? { inclusion } : {}),
         };
     }
     catch (err) {

package/dist/rfc3161.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A pinned TSA signing key — the OFFLINE trust anchor for check #7 (spec §10.3).
+ * Pinning the SIGNING key (not the long-lived root) is the P2a "acceptable v1":
+ * it must be re-pinned if FreeTSA rotates the signing cert. P2b anchors to the RSA
+ * root via the token's embedded chain, which removes the re-pin.
+ */
+export interface TsaAnchor {
+    name: string;
+    /** EC P-384 signing public key, base64 SPKI DER. */
+    signingKeyDer: string;
+    /** Signing cert validity window (ISO 8601, UTC). genTime must fall inside it. */
+    notBefore: string;
+    notAfter: string;
+}
+export declare const FREETSA_TSA_ANCHORS: readonly TsaAnchor[];
+export type Rfc3161FailReason = 'parse_error' | 'not_granted' | 'unexpected_content_type' | 'unexpected_algorithm' | 'no_message_digest' | 'content_not_bound' | 'no_anchor' | 'signature_invalid' | 'imprint_mismatch' | 'genTime_outside_validity';
+export interface Rfc3161VerifyResult {
+    /** All checks passed: a pinned TSA's signature binds this package hash to genTime. */
+    verified: boolean;
+    /** messageImprint.hashedMessage == the expected package hash (sha256). */
+    imprintMatches: boolean | null;
+    /** The TSA ECDSA-P384 signature over SHA-512(signedAttrs) verifies vs the anchor. */
+    signatureValid: boolean | null;
+    /** signedAttrs.messageDigest == SHA-512(TSTInfo) — the sig is bound to the TSTInfo. */
+    contentBound: boolean | null;
+    /** genTime within the pinned signing cert's validity window. */
+    withinValidity: boolean | null;
+    /** RFC 3161 genTime, epoch ms. */
+    genTime?: number;
+    /** The matched anchor name (when the signature verified). */
+    tsa?: string;
+    reason?: Rfc3161FailReason;
+}
+/**
+ * Verify an RFC 3161 timestamp token (base64) attests `expectedHashHex` (the package
+ * SHA-256), against the pinned TSA anchors. Returns a graded verdict; a parse failure
+ * or unknown anchor is reported (not thrown) so the caller can render it calmly,
+ * while a real cryptographic failure (`signature_invalid` / `imprint_mismatch` /
+ * `content_not_bound`) is the alarm signal.
+ */
+export declare function verifyRfc3161Timestamp(tokenB64: string, expectedHashHex: string, anchors?: readonly TsaAnchor[]): Rfc3161VerifyResult;

package/dist/rfc3161.js

@@ -0,0 +1,240 @@
+// RFC 3161 timestamp verification (spec §9.2 check #7, deep) — browser-safe.
+//
+// `verifyEvidence` today does PRESENCE for #7 (`!!rfc3161Timestamp`). This closes
+// the cryptographic gap for the FreeTSA profile our producer uses (#119 P2a): it
+// parses the RFC 3161 token (a PKCS#7/CMS SignedData over a TSTInfo) and verifies,
+// OFFLINE, that a trusted TSA attested the package hash at a point in time:
+//   1. messageImprint.hashedMessage == the package hash (sha256), so the token is
+//      ABOUT this package;
+//   2. signedAttrs.messageDigest == SHA-512(TSTInfo), so the signature is BOUND to
+//      that TSTInfo;
+//   3. the TSA's ECDSA-P384 signature over SHA-512(signedAttrs) verifies against the
+//      PINNED FreeTSA signing key (the trust anchor);
+//   4. genTime falls within that signing cert's validity window.
+//
+// SCOPE (P2a): FreeTSA uses an EC P-384 signing cert and `ecdsa-with-SHA512`, so the
+// TSA-signature check is pure `@noble` ECDSA — no WebCrypto/RSA. The anchor is the
+// PINNED signing-cert public key (re-pin on rotation — documented below). P2b adds
+// full embedded-cert chain validation to FreeTSA's RSA root (which removes the
+// re-pin), and generalizes EKU/validity from the certs themselves. The recipe here
+// was validated byte-for-byte against a real freetsa.org token (cross-checked with
+// OpenSSL `ts -verify`) before shipping; `__fixtures__/rfc3161-token.json` is that
+// token and the tests reproduce it offline.
+import { p384 } from '@noble/curves/nist.js';
+import { sha512 } from '@noble/hashes/sha2.js';
+import { base64ToBytes, bytesToHex } from "./primitives.js";
+import { Asn1Error, readNode, children, content, rawTlv, oidToString, readTime, } from "./asn1.js";
+// --- OIDs ------------------------------------------------------------------
+const OID_SIGNED_DATA = '1.2.840.113549.1.7.2';
+const OID_CT_TSTINFO = '1.2.840.113549.1.9.16.1.4';
+const OID_SHA256 = '2.16.840.1.101.3.4.2.1';
+const OID_SHA512 = '2.16.840.1.101.3.4.2.3';
+const OID_ECDSA_SHA512 = '1.2.840.10045.4.3.4';
+const OID_ATTR_MESSAGE_DIGEST = '1.2.840.113549.1.9.4';
+// PROVENANCE (anchor pinning — spec §10.3). FreeTSA's online TSA (`freetsa.org/tsr`)
+// signs with this EC P-384 key (cert serial C2E986160DA8E9CD, OU=TSA, EKU
+// id-kp-timeStamping, valid 2026-02-15 → 2040-02-02). Captured 2026-06-07 from
+// `https://freetsa.org/files/tsa.crt`; a live token verified against it with both
+// `@noble` (here) and OpenSSL `ts -verify` against FreeTSA's published CA. The cert
+// chains to FreeTSA's self-signed RSA-4096 root (OU=Root CA) — pinning that root and
+// validating the embedded chain is P2b.
+export const FREETSA_TSA_ANCHORS = [
+    {
+        name: 'freetsa.org',
+        signingKeyDer: 'MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEohXhobLWy4cYsdKOFALpjUsB1FJTntwwb7PH2LOfNMAA1ufaKhkgsdeW6etU0pl5MC5tSVuPF52yy4sz+mbY3L7IVdx/bs9m0ud7IA14YNcC2yIQLa2gvnxwsrR3rlWr',
+        notBefore: '2026-02-15T19:44:22Z',
+        notAfter: '2040-02-02T19:44:22Z',
+    },
+];
+// EC P-384 SPKI DER is a fixed 120-byte structure: a 23-byte prefix (SEQUENCE →
+// AlgorithmIdentifier{ id-ecPublicKey, secp384r1 } → BIT STRING) then the 97-byte
+// uncompressed point (0x04 ‖ X ‖ Y).
+const EC_P384_SPKI_PREFIX = Uint8Array.from([
+    0x30, 0x76, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01,
+    0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22, 0x03, 0x62, 0x00,
+]);
+const EC_P384_SPKI_LENGTH = 120;
+function extractP384Point(publicKeyB64Der) {
+    const der = base64ToBytes(publicKeyB64Der);
+    if (der.length !== EC_P384_SPKI_LENGTH) {
+        throw new Asn1Error(`Unexpected P-384 SPKI length ${der.length}`);
+    }
+    for (let i = 0; i < EC_P384_SPKI_PREFIX.length; i++) {
+        if (der[i] !== EC_P384_SPKI_PREFIX[i])
+            throw new Asn1Error('Unexpected P-384 SPKI prefix');
+    }
+    return der.slice(EC_P384_SPKI_LENGTH - 97);
+}
+/** The AlgorithmIdentifier's OID (its first child). */
+function algorithmOid(buf, alg) {
+    return oidToString(buf, children(buf, alg)[0]);
+}
+/** Navigate TimeStampResp → ContentInfo → SignedData → { TSTInfo, signerInfo }. */
+function parseToken(buf) {
+    const resp = readNode(buf, 0);
+    const respKids = children(buf, resp);
+    // PKIStatusInfo.status: 0 granted, 1 grantedWithMods; anything else ⇒ no token.
+    const status = children(buf, respKids[0])[0];
+    const statusVal = content(buf, status);
+    if (statusVal.length !== 1 || statusVal[0] > 1)
+        throw new Asn1Error('PKIStatus not granted');
+    const contentInfo = respKids[1];
+    if (!contentInfo)
+        throw new Asn1Error('no timeStampToken');
+    const ciKids = children(buf, contentInfo);
+    if (oidToString(buf, ciKids[0]) !== OID_SIGNED_DATA)
+        throw new Asn1Error('not signedData');
+    const signedData = children(buf, ciKids[1])[0]; // [0] EXPLICIT → SignedData
+    const sd = children(buf, signedData);
+    const encap = sd.find((c) => c.tag === 0x30); // first SEQUENCE = encapContentInfo
+    const signerInfos = sd.filter((c) => c.tag === 0x31).pop(); // last SET = signerInfos
+    if (!encap || !signerInfos)
+        throw new Asn1Error('malformed SignedData');
+    const encapKids = children(buf, encap);
+    if (oidToString(buf, encapKids[0]) !== OID_CT_TSTINFO)
+        throw new Asn1Error('eContent not TSTInfo');
+    const tstOctet = children(buf, encapKids[1])[0]; // [0] EXPLICIT → OCTET STRING
+    if (tstOctet.tag !== 0x04)
+        throw new Asn1Error('TSTInfo not an OCTET STRING');
+    const tstInfo = buf.slice(tstOctet.contentStart, tstOctet.contentEnd);
+    const signerInfo = children(buf, signerInfos)[0];
+    const si = children(buf, signerInfo);
+    const signedAttrs = si.find((c) => c.tag === 0xa0);
+    const signature = si.find((c) => c.tag === 0x04);
+    if (!signedAttrs || !signature)
+        throw new Asn1Error('signerInfo missing signedAttrs/signature');
+    // SignerInfo has three SEQUENCEs: sid (issuerAndSerialNumber), digestAlgorithm,
+    // signatureAlgorithm. The digest alg is the LAST 0x30 before signedAttrs (the sid
+    // also precedes it); the signature alg is the first 0x30 after.
+    const seqs = si.filter((c) => c.tag === 0x30);
+    const digestAlg = seqs.filter((c) => c.end <= signedAttrs.start).pop();
+    const signatureAlg = seqs.find((c) => c.start >= signedAttrs.end);
+    if (!digestAlg || !signatureAlg)
+        throw new Asn1Error('signerInfo missing algorithm ids');
+    return {
+        tstInfo,
+        signedAttrs,
+        digestAlgOid: algorithmOid(buf, digestAlg),
+        signatureAlgOid: algorithmOid(buf, signatureAlg),
+        signature: content(buf, signature),
+    };
+}
+/** The OCTET STRING value of the messageDigest signed attribute. */
+function messageDigestAttr(buf, signedAttrs) {
+    for (const attr of children(buf, signedAttrs)) {
+        const kids = children(buf, attr);
+        if (oidToString(buf, kids[0]) === OID_ATTR_MESSAGE_DIGEST) {
+            const value = children(buf, kids[1])[0]; // SET OF → OCTET STRING
+            return content(buf, value);
+        }
+    }
+    return null;
+}
+/** Pull { hashedMessage, hashAlgOid, genTime } out of a TSTInfo. */
+function parseTstInfo(tst) {
+    const root = readNode(tst, 0);
+    const kids = children(tst, root); // version, policy, messageImprint, serial, genTime, …
+    const messageImprint = kids[2];
+    const miKids = children(tst, messageImprint);
+    const hashAlgOid = algorithmOid(tst, miKids[0]);
+    const hashedMessage = content(tst, miKids[1]);
+    const genTimeNode = kids.find((c) => c.tag === 0x18);
+    if (!genTimeNode)
+        throw new Asn1Error('TSTInfo missing genTime');
+    return { hashedMessage, hashAlgOid, genTime: readTime(tst, genTimeNode) };
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * Verify an RFC 3161 timestamp token (base64) attests `expectedHashHex` (the package
+ * SHA-256), against the pinned TSA anchors. Returns a graded verdict; a parse failure
+ * or unknown anchor is reported (not thrown) so the caller can render it calmly,
+ * while a real cryptographic failure (`signature_invalid` / `imprint_mismatch` /
+ * `content_not_bound`) is the alarm signal.
+ */
+export function verifyRfc3161Timestamp(tokenB64, expectedHashHex, anchors = FREETSA_TSA_ANCHORS) {
+    let buf;
+    let token;
+    let tst;
+    let mdAttr;
+    try {
+        buf = base64ToBytes(tokenB64);
+        token = parseToken(buf);
+        tst = parseTstInfo(token.tstInfo);
+        mdAttr = messageDigestAttr(buf, token.signedAttrs);
+    }
+    catch {
+        return {
+            verified: false,
+            imprintMatches: null,
+            signatureValid: null,
+            contentBound: null,
+            withinValidity: null,
+            reason: 'parse_error',
+        };
+    }
+    const base = {
+        verified: false,
+        imprintMatches: null,
+        signatureValid: null,
+        contentBound: null,
+        withinValidity: null,
+        genTime: tst.genTime,
+    };
+    // FreeTSA profile (P2a): SHA-512 digest + ECDSA-with-SHA-512 signature.
+    if (token.digestAlgOid !== OID_SHA512 || token.signatureAlgOid !== OID_ECDSA_SHA512) {
+        return { ...base, reason: 'unexpected_algorithm' };
+    }
+    // (1) message imprint is about THIS package (sha256).
+    const imprintMatches = tst.hashAlgOid === OID_SHA256 && bytesToHex(tst.hashedMessage) === expectedHashHex.toLowerCase();
+    base.imprintMatches = imprintMatches;
+    if (!imprintMatches)
+        return { ...base, reason: 'imprint_mismatch' };
+    // (2) the signature is bound to this TSTInfo via the messageDigest attribute.
+    if (!mdAttr)
+        return { ...base, reason: 'no_message_digest' };
+    const contentBound = bytesEqual(mdAttr, sha512(token.tstInfo));
+    base.contentBound = contentBound;
+    if (!contentBound)
+        return { ...base, reason: 'content_not_bound' };
+    // (3) ECDSA-P384 signature over SHA-512(signedAttrs re-tagged [0] → SET) verifies
+    // against a pinned anchor key. (`@noble` prehashes with SHA-384 by default, so we
+    // hash with SHA-512 ourselves and pass `prehash: false`.)
+    const signedBytes = Uint8Array.from(rawTlv(buf, token.signedAttrs));
+    signedBytes[0] = 0x31; // [0] IMPLICIT (0xa0) → SET OF (0x31) for the signature input
+    const digest = sha512(signedBytes);
+    let matched;
+    for (const anchor of anchors) {
+        try {
+            const point = extractP384Point(anchor.signingKeyDer);
+            if (p384.verify(token.signature, digest, point, { format: 'der', prehash: false })) {
+                matched = anchor;
+                break;
+            }
+        }
+        catch {
+            // malformed anchor key ⇒ try the next
+        }
+    }
+    base.signatureValid = !!matched;
+    if (!matched) {
+        // Distinguish "no pinned key vouches for this token" (calm — unknown TSA) from a
+        // signature that fails under a known key. Here, none verified ⇒ no_anchor.
+        return { ...base, reason: 'no_anchor' };
+    }
+    base.tsa = matched.name;
+    // (4) genTime within the pinned signing cert's validity window.
+    const notBefore = Date.parse(matched.notBefore);
+    const notAfter = Date.parse(matched.notAfter);
+    const withinValidity = tst.genTime >= notBefore && tst.genTime <= notAfter;
+    base.withinValidity = withinValidity;
+    if (!withinValidity)
+        return { ...base, reason: 'genTime_outside_validity' };
+    return { ...base, verified: true };
+}

package/dist/verify.d.ts

@@ -1,3 +1,5 @@
+import { type RekorInclusionProof, type RekorInclusionResult } from './rekor-inclusion.ts';
+import { type Rfc3161VerifyResult } from './rfc3161.ts';
 import { type KeyTrustResult, type TrustRegistry } from './trust-registry.ts';
 import { type ContentCanonicalizationResolution, type ContentHashCheck, type TypeResolution, type SignerIdentityCheck, type CaptureMethodVocabCheck, type BlobRefVerification } from './checks.ts';
 import { type LifecycleResolution } from './lifecycle.ts';
@@ -40,6 +42,13 @@ export interface VerifyInput {
     rfc3161Timestamp?: string | null;
     /** Rekor entry id (#8 hash-parity, needs a fetcher). */
     rekorEntryId?: string | null;
+    /** Carried Rekor inclusion proof (#8 deep, civic-ai-tools-website#119). When
+     *  supplied with `rekorEntryBody`, Merkle inclusion is verified OFFLINE against
+     *  the pinned log key — no fetch, no civicaitools.org dependency. */
+    rekorInclusionProof?: RekorInclusionProof | null;
+    /** The Rekor entry's canonical leaf bytes (its base64 `body`), carried so the
+     *  inclusion proof can be folded offline (D2). */
+    rekorEntryBody?: string | null;
     /** Lifecycle STATE from the sidecar (#10 state-depth). Ignored when the caller
      *  supplies `deps.lifecycleResolution`. */
     lifecycle?: CommitmentLifecycleState | null;
@@ -76,8 +85,16 @@ export interface VerifyResult {
         logEntryUrl?: string;
     } | null;
     rekorIntegratedTime?: number;
+    /** Cryptographic Merkle-inclusion verdict (#119): null when no proof was
+     *  available, else the graded result (`inclusionVerified` / `checkpointVerified`).
+     *  Additive to `rekorVerified` (hash-parity). */
+    rekorInclusion: RekorInclusionResult | null;
     hasRekor: boolean;
     hasTimestamp: boolean;
+    /** Cryptographic RFC 3161 TSA verdict (#119 P2a): null when no token was present,
+     *  else the graded result (signature vs pinned TSA anchor, message-imprint match,
+     *  genTime-in-validity). Additive to `hasTimestamp` (presence). */
+    rfc3161: Rfc3161VerifyResult | null;
     keyTrust: KeyTrustResult | null;
     blobRefsVerified: boolean | null;
     blobRefs: BlobRefVerification[];

package/dist/verify.js

@@ -14,14 +14,20 @@
 // sidecar (`buildCommitmentView`) so WS3 can wire sidecar → verifyEvidence with
 // no glue. The server route adapts its DB row to the same shape.
 //
-// Check depth matches the current server exactly: fully client-side for
-// #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; PRESENCE for #7 (RFC 3161); hash-PARITY
-// for #8 (Rekor); lifecycle STATE for #10 unless the caller supplies a deeper
-// resolution. The deeper offline crypto (TSA chain, Merkle inclusion, independent
-// lifecycle-chain verification) is civic-ai-tools-website#119.
+// Check depth: fully client-side for #1/#2/#3/#4/#5/#6/#9/#12/#13/#14/#15; #7 (RFC
+// 3161) is PRESENCE (`hasTimestamp`) AND, when a token is present, cryptographic TSA
+// verification against the pinned FreeTSA anchor (civic-ai-tools-website#119 P2a —
+// ECDSA-P384 over the signed TSTInfo, message-imprint match, genTime-in-validity);
+// #8 (Rekor) is hash-PARITY AND, when an inclusion proof is available (carried for
+// offline, or on the fetched entry), cryptographic Merkle inclusion against the
+// pinned log key (#119 P1); lifecycle STATE for #10 unless the caller supplies a
+// deeper resolution. Remaining deeper crypto: TSA full cert-chain #7 (#119 P2b),
+// independent lifecycle-chain #10 (#119 P3).
 import { recomputePackageHash } from "./checks.js";
 import { verifySignature } from "./signature.js";
 import { verifyRekorEntry } from "./rekor.js";
+import { verifyRekorInclusion, } from "./rekor-inclusion.js";
+import { verifyRfc3161Timestamp } from "./rfc3161.js";
 import { verifyKeyTrust, legacyEmbeddedKeyTrust, } from "./trust-registry.js";
 import { resolveContentCanonicalization, verifyContentHash, resolvePackageType, checkSignerIdentity, checkCaptureMethodVocab, verifyPackageBlobRefs, } from "./checks.js";
 import { resolveLifecycleFromLegacyColumns, } from "./lifecycle.js";
@@ -55,10 +61,14 @@ export async function verifyEvidence(input, deps) {
         signatureValid = verifySignature(packageHash, input.signature.signature, input.signature.publicKey, input.signature.algorithm);
     }
     const hasSigning = !!input.signature || !!input.signatureMalformed;
-    // Step 3 — Rekor (check #8, hash-parity). Also yields integratedTime for #5.
+    // Step 3 — Rekor (check #8). Hash-parity (online) yields integratedTime for #5;
+    // Merkle inclusion (#119) is verified cryptographically. The carried proof + body
+    // verify inclusion OFFLINE (no fetch); otherwise the online fetch's entry carries
+    // the proof. Carried-offline takes precedence — it is the zero-dependency property.
     let rekorVerified = null;
     let rekorDetails = null;
     let rekorIntegratedTime;
+    let rekorInclusion = null;
     if (input.rekorEntryId && packageHash) {
         const rekorResult = await verifyRekorEntry(input.rekorEntryId, packageHash, { fetch: deps.fetch });
         rekorVerified = rekorResult.verified;
@@ -69,6 +79,18 @@ export async function verifyEvidence(input, deps) {
                 logEntryUrl: rekorResult.logEntryUrl,
             };
         }
+        if (rekorResult.inclusion)
+            rekorInclusion = rekorResult.inclusion;
+    }
+    if (input.rekorInclusionProof && input.rekorEntryBody) {
+        rekorInclusion = verifyRekorInclusion(input.rekorEntryBody, input.rekorInclusionProof);
+    }
+    // Step 3c — RFC 3161 timestamp (check #7, deep). Presence is `hasTimestamp`; when a
+    // token + package hash are present, cryptographically verify the TSA signature over
+    // the timestamped hash against the pinned TSA anchor (#119 P2a). Pure/offline.
+    let rfc3161 = null;
+    if (input.rfc3161Timestamp && packageHash) {
+        rfc3161 = verifyRfc3161Timestamp(input.rfc3161Timestamp, packageHash);
     }
     // Step 3b — blob references embedded in the package (check #9).
     let blobRefs = [];
@@ -119,8 +141,10 @@ export async function verifyEvidence(input, deps) {
         rekorVerified,
         rekorDetails,
         ...(rekorIntegratedTime !== undefined ? { rekorIntegratedTime } : {}),
+        rekorInclusion,
         hasRekor: !!input.rekorEntryId,
         hasTimestamp: !!input.rfc3161Timestamp,
+        rfc3161,
         keyTrust,
         blobRefsVerified,
         blobRefs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Portable, browser-safe verification core for Typed Standards evidence packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -9,7 +9,8 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     },
     "./package.json": "./package.json"
   },
@@ -26,6 +27,7 @@
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node --test --experimental-strip-types \"src/**/*.test.ts\"",
+    "prepare": "npm run build",
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {