@uwmd/core 1.1.0

package/dist/integrity-canonical.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Produce a canonical JSON serialization of `value` per RFC 8785 with the
+ * uw-md exclusions described above.
+ *
+ * Behavior:
+ *   - Object keys sorted by code-unit comparison.
+ *   - Strings JSON-escaped per RFC 8785 §3.2.2.
+ *   - Numbers serialized per RFC 8785 §3.2.2.3 (ECMAScript ToString) with
+ *     special-cases: integers render without decimals; non-finite numbers
+ *     throw (JSON cannot represent them).
+ *   - `undefined` values inside objects are dropped (mirrors JSON.stringify).
+ *   - `_meta.content_hash` and `_meta.signature` are stripped before hashing.
+ */
+export declare function canonicalize(value: unknown): string;
+/** RFC 8785 serialization without block-integrity field exclusions. */
+export declare function canonicalizeExact(value: unknown): string;
+//# sourceMappingURL=integrity-canonical.d.ts.map

package/dist/integrity-canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity-canonical.d.ts","sourceRoot":"","sources":["../src/integrity-canonical.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAExD"}

package/dist/integrity-canonical.js

@@ -0,0 +1,124 @@
+// JCS-style canonical JSON serialization for content_hash computation.
+// Protocol §V.9 — "Canonical block JSON"
+//
+// Implements RFC 8785 (JCS) with one extension: the keys `content_hash` and
+// `signature` inside any nested `_meta` object are removed before hashing.
+// This keeps hash computation idempotent across multiple round trips through
+// the cascade.
+//
+// Pure, dependency-free, deterministic across Node and modern browsers.
+const PRESERVE_KEYS_REMOVED = ['content_hash', 'signature'];
+/**
+ * Produce a canonical JSON serialization of `value` per RFC 8785 with the
+ * uw-md exclusions described above.
+ *
+ * Behavior:
+ *   - Object keys sorted by code-unit comparison.
+ *   - Strings JSON-escaped per RFC 8785 §3.2.2.
+ *   - Numbers serialized per RFC 8785 §3.2.2.3 (ECMAScript ToString) with
+ *     special-cases: integers render without decimals; non-finite numbers
+ *     throw (JSON cannot represent them).
+ *   - `undefined` values inside objects are dropped (mirrors JSON.stringify).
+ *   - `_meta.content_hash` and `_meta.signature` are stripped before hashing.
+ */
+export function canonicalize(value) {
+    return serialize(stripExcludedKeys(value));
+}
+/** RFC 8785 serialization without block-integrity field exclusions. */
+export function canonicalizeExact(value) {
+    return serialize(value);
+}
+function stripExcludedKeys(input) {
+    if (input === null || typeof input !== 'object')
+        return input;
+    if (Array.isArray(input))
+        return input.map(stripExcludedKeys);
+    const out = {};
+    const isMeta = looksLikeMeta(input);
+    for (const [k, v] of Object.entries(input)) {
+        if (isMeta && PRESERVE_KEYS_REMOVED.includes(k))
+            continue;
+        out[k] = stripExcludedKeys(v);
+    }
+    return out;
+}
+/**
+ * Heuristic: an object is "meta-shaped" if it carries any of the canonical
+ * meta fields. We strip the excluded keys from every meta-shaped sub-object,
+ * not only the top-level `_meta`, so that nested provenance (e.g. inside
+ * field_overrides) hashes consistently.
+ */
+function looksLikeMeta(obj) {
+    return ('section' in obj &&
+        'version' in obj &&
+        'source' in obj);
+}
+function serialize(value) {
+    if (value === null)
+        return 'null';
+    if (value === undefined)
+        return 'null'; // JSON has no undefined; treat as null
+    switch (typeof value) {
+        case 'boolean':
+            return value ? 'true' : 'false';
+        case 'number':
+            return serializeNumber(value);
+        case 'string':
+            return serializeString(value);
+        case 'object':
+            if (Array.isArray(value)) {
+                return `[${value.map(serialize).join(',')}]`;
+            }
+            return serializeObject(value);
+        default:
+            throw new Error(`canonicalize: cannot serialize value of type ${typeof value}`);
+    }
+}
+function serializeObject(obj) {
+    const keys = Object.keys(obj).sort();
+    const parts = [];
+    for (const k of keys) {
+        const v = obj[k];
+        if (v === undefined)
+            continue;
+        parts.push(`${serializeString(k)}:${serialize(v)}`);
+    }
+    return `{${parts.join(',')}}`;
+}
+function serializeNumber(n) {
+    if (!Number.isFinite(n)) {
+        throw new Error(`canonicalize: cannot serialize non-finite number ${n}`);
+    }
+    // ECMAScript ToString already produces RFC 8785-compatible output for
+    // finite numbers, except that we want -0 to render as "0".
+    if (Object.is(n, -0))
+        return '0';
+    return String(n);
+}
+const ESCAPE_MAP = {
+    8: '\\b',
+    9: '\\t',
+    10: '\\n',
+    12: '\\f',
+    13: '\\r',
+    34: '\\"',
+    92: '\\\\',
+};
+function serializeString(s) {
+    let out = '"';
+    for (let i = 0; i < s.length; i++) {
+        const code = s.charCodeAt(i);
+        const escaped = ESCAPE_MAP[code];
+        if (escaped !== undefined) {
+            out += escaped;
+            continue;
+        }
+        if (code < 0x20) {
+            out += `\\u${code.toString(16).padStart(4, '0')}`;
+            continue;
+        }
+        out += s[i];
+    }
+    return `${out}"`;
+}
+//# sourceMappingURL=integrity-canonical.js.map

package/dist/integrity-canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity-canonical.js","sourceRoot":"","sources":["../src/integrity-canonical.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yCAAyC;AACzC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,eAAe;AACf,EAAE;AACF,wEAAwE;AAExE,MAAM,qBAAqB,GAAG,CAAC,cAAc,EAAE,WAAW,CAAU,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAgC,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,IAAK,qBAA2C,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,SAAS;QACjF,GAAG,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO,CACL,SAAS,IAAI,GAAG;QAChB,SAAS,IAAI,GAAG;QAChB,QAAQ,IAAI,GAAG,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,uCAAuC;IAC/E,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,QAAQ;YACX,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC/C,CAAC;YACD,OAAO,eAAe,CAAC,KAAgC,CAAC,CAAC;QAC3D;YACE,MAAM,IAAI,KAAK,CAAC,gDAAgD,OAAO,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,GAA2B;IACzC,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,KAAK;IACR,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,MAAM;CACX,CAAC;AAEF,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,IAAI,OAAO,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YAChB,GAAG,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC"}

package/dist/integrity.d.ts

@@ -0,0 +1,54 @@
+import type { ParsedUWFile, UWBlock } from './types.js';
+import type { EditPolicy } from './protocol.js';
+/**
+ * SHA-256 of the canonicalized JSON of `value`. Returns the lowercase hex
+ * digest. Async to support Web Crypto on browsers without Node's `crypto`.
+ */
+export declare function sha256Hex(value: unknown): Promise<string>;
+/** SHA-256 of an exact UTF-8 string, without JSON canonicalization. */
+export declare function sha256TextHex(text: string): Promise<string>;
+/**
+ * Compute the content_hash for a block. Strips the block's own
+ * `_meta.content_hash` and `_meta.signature` before hashing (handled by the
+ * canonicalizer).
+ */
+export declare function computeBlockHash(block: UWBlock): Promise<string>;
+export type IntegrityCode = 'INT-01' | 'INT-02' | 'INT-03' | 'INT-04' | 'POL-01' | 'POL-02';
+export interface IntegrityIssue {
+    code: IntegrityCode;
+    severity: 'error' | 'warning';
+    message: string;
+    section?: string;
+    expected?: string;
+    actual?: string;
+}
+export interface IntegrityResult {
+    ok: boolean;
+    issues: IntegrityIssue[];
+    chains_verified: number;
+    chains_with_hashes: number;
+}
+/**
+ * For every supersede chain in the parsed file:
+ *   - If at least one block in the chain carries `_meta.content_hash`, every
+ *     block in the chain MUST carry one (else INT-03 warning).
+ *   - Each block's recomputed hash MUST equal the stamped `content_hash`
+ *     (else INT-04 warning).
+ *   - Each non-root block's `parent_hash` MUST equal the prior block's
+ *     `content_hash` (else INT-01 error).
+ *
+ * A chain with no hashes at all yields no findings and is not counted in
+ * `chains_verified`.
+ */
+export declare function verifyChain(parsed: ParsedUWFile): Promise<IntegrityResult>;
+/**
+ * Cross-check `_meta.actor` and the operation that produced the block against
+ * BUILTIN_EDIT_POLICIES.
+ *
+ * - POL-01: actor not authorized for the section per its EditPolicy.
+ * - POL-02: section_replace used where the policy mandates section_supersede
+ *   (heuristic: if `supersede_on_edit` and there are no superseded prior
+ *   versions yet `version > 1`, the prior was overwritten not appended).
+ */
+export declare function verifyProvenance(parsed: ParsedUWFile, policies?: readonly EditPolicy[]): IntegrityResult;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../src/integrity.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKhD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/D;AAED,uEAAuE;AACvE,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBjE;AAWD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAKtE;AAID,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5F,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CA2EhF;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,YAAY,EACpB,QAAQ,GAAE,SAAS,UAAU,EAA0B,GACtD,eAAe,CA0CjB"}

package/dist/integrity.js

@@ -0,0 +1,244 @@
+// Integrity layer: content_hash + parent_hash chains, provenance verification
+// Protocol §V.9 / §V.10 — "Block integrity"
+//
+// Design notes:
+//   - Opt-in: a file with no hashes parses, validates, and verifies as
+//     `ok: true, chains_with_hashes: 0`.
+//   - The chain walk is per-section: each section's supersede sequence is its
+//     own chain. Cross-section chains are intentionally not modeled in v1.
+//   - SHA-256 implementation is split between Node (`createHash`) and Web
+//     Crypto (`crypto.subtle`). The browser entry point binds the latter via
+//     subpath export when adopters import from `@uwmd/core/browser`.
+import { canonicalize } from './integrity-canonical.js';
+import { BUILTIN_EDIT_POLICIES } from './protocol.js';
+// ─── Hashing ─────────────────────────────────────────────────────────────────
+/**
+ * SHA-256 of the canonicalized JSON of `value`. Returns the lowercase hex
+ * digest. Async to support Web Crypto on browsers without Node's `crypto`.
+ */
+export async function sha256Hex(value) {
+    return sha256TextHex(canonicalize(value));
+}
+/** SHA-256 of an exact UTF-8 string, without JSON canonicalization. */
+export async function sha256TextHex(text) {
+    const bytes = new TextEncoder().encode(text);
+    const g = globalThis;
+    const isNode = !!g.process?.versions?.node;
+    if (isNode) {
+        const mod = (await import('node:crypto'));
+        return mod.createHash('sha256').update(bytes).digest('hex');
+    }
+    const subtle = g.crypto?.subtle;
+    if (!subtle)
+        throw new Error('integrity.sha256TextHex: no crypto provider available.');
+    const digest = await subtle.digest('SHA-256', bytes);
+    return bytesToHex(new Uint8Array(digest));
+}
+function bytesToHex(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i++) {
+        const b = bytes[i] ?? 0;
+        out += b.toString(16).padStart(2, '0');
+    }
+    return out;
+}
+/**
+ * Compute the content_hash for a block. Strips the block's own
+ * `_meta.content_hash` and `_meta.signature` before hashing (handled by the
+ * canonicalizer).
+ */
+export async function computeBlockHash(block) {
+    // The canonical scope is the block CONTENT including meta, since meta
+    // carries the cascade-relevant provenance. The two excluded keys are
+    // stripped by the canonicalizer.
+    return sha256Hex({ ...block.content, _meta: block.meta });
+}
+// ─── Chain verification ──────────────────────────────────────────────────────
+/**
+ * For every supersede chain in the parsed file:
+ *   - If at least one block in the chain carries `_meta.content_hash`, every
+ *     block in the chain MUST carry one (else INT-03 warning).
+ *   - Each block's recomputed hash MUST equal the stamped `content_hash`
+ *     (else INT-04 warning).
+ *   - Each non-root block's `parent_hash` MUST equal the prior block's
+ *     `content_hash` (else INT-01 error).
+ *
+ * A chain with no hashes at all yields no findings and is not counted in
+ * `chains_verified`.
+ */
+export async function verifyChain(parsed) {
+    const issues = [];
+    let chainsWithHashes = 0;
+    let chainsVerified = 0;
+    for (const sectionId of Object.keys(parsed.sections)) {
+        // Build the chain: prior (superseded) blocks first, then current head.
+        const prior = parsed.superseded[sectionId] ?? [];
+        const head = currentBlock(parsed, sectionId);
+        if (!head)
+            continue;
+        const chain = [...prior, head];
+        const hasAnyHash = chain.some((b) => typeof b.meta.content_hash === 'string');
+        if (!hasAnyHash)
+            continue;
+        chainsWithHashes++;
+        let chainOK = true;
+        let prevHash = null;
+        for (let i = 0; i < chain.length; i++) {
+            const block = chain[i];
+            const stamped = block.meta.content_hash;
+            // INT-03: partial chain
+            if (typeof stamped !== 'string') {
+                issues.push({
+                    code: 'INT-03',
+                    severity: 'warning',
+                    section: sectionId,
+                    message: `Block v${block.meta.version} of '${sectionId}' has no content_hash but other blocks in the chain do.`,
+                });
+                chainOK = false;
+                continue;
+            }
+            // INT-04: hash mismatch
+            const recomputed = await computeBlockHash(block);
+            if (recomputed !== stamped) {
+                issues.push({
+                    code: 'INT-04',
+                    severity: 'warning',
+                    section: sectionId,
+                    message: `Block v${block.meta.version} of '${sectionId}' content_hash does not recompute.`,
+                    expected: recomputed,
+                    actual: stamped,
+                });
+                chainOK = false;
+            }
+            // INT-01: parent hash mismatch
+            if (i > 0) {
+                const parent = block.meta.parent_hash;
+                if (parent !== prevHash) {
+                    issues.push({
+                        code: 'INT-01',
+                        severity: 'error',
+                        section: sectionId,
+                        message: `Block v${block.meta.version} of '${sectionId}' parent_hash does not match prior block.`,
+                        expected: prevHash ?? '<null>',
+                        actual: parent ?? '<missing>',
+                    });
+                    chainOK = false;
+                }
+            }
+            prevHash = stamped;
+        }
+        if (chainOK)
+            chainsVerified++;
+    }
+    const errors = issues.filter((i) => i.severity === 'error').length;
+    return {
+        ok: errors === 0,
+        issues,
+        chains_verified: chainsVerified,
+        chains_with_hashes: chainsWithHashes,
+    };
+}
+// ─── Provenance verification ─────────────────────────────────────────────────
+/**
+ * Cross-check `_meta.actor` and the operation that produced the block against
+ * BUILTIN_EDIT_POLICIES.
+ *
+ * - POL-01: actor not authorized for the section per its EditPolicy.
+ * - POL-02: section_replace used where the policy mandates section_supersede
+ *   (heuristic: if `supersede_on_edit` and there are no superseded prior
+ *   versions yet `version > 1`, the prior was overwritten not appended).
+ */
+export function verifyProvenance(parsed, policies = BUILTIN_EDIT_POLICIES) {
+    const issues = [];
+    for (const sectionId of Object.keys(parsed.sections)) {
+        const head = currentBlock(parsed, sectionId);
+        if (!head)
+            continue;
+        const policy = matchPolicy(head.meta.source, policies);
+        if (!policy)
+            continue;
+        // POL-01: authority check
+        const actorClass = classifyActor(head.meta.actor, head.meta.source);
+        if (!authorityAllows(policy.authority, actorClass)) {
+            issues.push({
+                code: 'POL-01',
+                severity: 'error',
+                section: sectionId,
+                message: `Actor '${head.meta.actor}' (class '${actorClass}') not authorized to write '${sectionId}' (policy authority '${policy.authority}').`,
+            });
+        }
+        // POL-02: replace-where-supersede-required
+        if (policy.supersede_on_edit &&
+            head.meta.version > 1 &&
+            (parsed.superseded[sectionId]?.length ?? 0) === 0) {
+            issues.push({
+                code: 'POL-02',
+                severity: 'error',
+                section: sectionId,
+                message: `Section '${sectionId}' (source pattern '${policy.source_pattern}') requires supersede_on_edit but version ${head.meta.version} has no superseded prior versions.`,
+            });
+        }
+    }
+    const errors = issues.filter((i) => i.severity === 'error').length;
+    return {
+        ok: errors === 0,
+        issues,
+        chains_verified: 0,
+        chains_with_hashes: 0,
+    };
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function currentBlock(parsed, sectionId) {
+    const entry = parsed.sections[sectionId];
+    if (!entry)
+        return null;
+    if ('annotation' in entry)
+        return entry;
+    // Multi-variant sections: integrity is per-variant; pick the first variant
+    // for now. Fuller treatment is RFC 0009.
+    const variants = Object.values(entry);
+    return variants[0] ?? null;
+}
+function matchPolicy(source, policies) {
+    for (const p of policies) {
+        if (globMatch(p.source_pattern, source))
+            return p;
+    }
+    return null;
+}
+function globMatch(pattern, value) {
+    // Tiny glob: supports trailing `*` and exact matches. Mirrors editor.ts.
+    if (pattern === value)
+        return true;
+    if (pattern.endsWith('/*')) {
+        const prefix = pattern.slice(0, -1); // keep the '/'
+        return value.startsWith(prefix);
+    }
+    if (pattern.endsWith('*')) {
+        const prefix = pattern.slice(0, -1);
+        return value.startsWith(prefix);
+    }
+    return false;
+}
+function classifyActor(actor, source) {
+    if (source.startsWith('system/') || source.startsWith('institution/'))
+        return 'system';
+    if (source.startsWith('agent/') || actor.startsWith('agent/'))
+        return 'agent';
+    return 'human';
+}
+function authorityAllows(authority, actor) {
+    switch (authority) {
+        case 'either':
+            return actor === 'agent' || actor === 'human';
+        case 'agent_only':
+            return actor === 'agent';
+        case 'human_only':
+            return actor === 'human';
+        case 'system_only':
+            return actor === 'system';
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=integrity.js.map

package/dist/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../src/integrity.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4CAA4C;AAC5C,EAAE;AACF,gBAAgB;AAChB,uEAAuE;AACvE,yCAAyC;AACzC,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,qEAAqE;AAErE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAc;IAC5C,OAAO,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAK7C,MAAM,CAAC,GAAG,UAGT,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAA0B,CAAC;QACnE,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAc;IACnD,sEAAsE;IACtE,qEAAqE;IACrE,iCAAiC;IACjC,OAAO,SAAS,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAsBD,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAoB;IACpD,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,uEAAuE;QACvE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAc,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,gBAAgB,EAAE,CAAC;QAEnB,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;YAExC,wBAAwB;YACxB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,SAAS,yDAAyD;iBAChH,CAAC,CAAC;gBACH,OAAO,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,wBAAwB;YACxB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,SAAS,oCAAoC;oBAC1F,QAAQ,EAAE,UAAU;oBACpB,MAAM,EAAE,OAAO;iBAChB,CAAC,CAAC;gBACH,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YAED,+BAA+B;YAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;gBACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,SAAS;wBAClB,OAAO,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,SAAS,2CAA2C;wBACjG,QAAQ,EAAE,QAAQ,IAAI,QAAQ;wBAC9B,MAAM,EAAE,MAAM,IAAI,WAAW;qBAC9B,CAAC,CAAC;oBACH,OAAO,GAAG,KAAK,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;QACD,IAAI,OAAO;YAAE,cAAc,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,MAAM,KAAK,CAAC;QAChB,MAAM;QACN,eAAe,EAAE,cAAc;QAC/B,kBAAkB,EAAE,gBAAgB;KACrC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,WAAkC,qBAAqB;IAEvD,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,0BAA0B;QAC1B,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,aAAa,UAAU,+BAA+B,SAAS,wBAAwB,MAAM,CAAC,SAAS,KAAK;aAC/I,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,IACE,MAAM,CAAC,iBAAiB;YACxB,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC;YACrB,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,EACjD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,YAAY,SAAS,sBAAsB,MAAM,CAAC,cAAc,6CAA6C,IAAI,CAAC,IAAI,CAAC,OAAO,oCAAoC;aAC5K,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,MAAM,KAAK,CAAC;QAChB,MAAM;QACN,eAAe,EAAE,CAAC;QAClB,kBAAkB,EAAE,CAAC;KACtB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,MAAoB,EAAE,SAAiB;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,YAAY,IAAK,KAAgB;QAAE,OAAO,KAAgB,CAAC;IAC/D,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAA+B;IAClE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,yEAAyE;IACzE,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;QACpD,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID,SAAS,aAAa,CAAC,KAAa,EAAE,MAAc;IAClD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvF,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkC,EAAE,KAAiB;IAC5E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,CAAC;QAChD,KAAK,YAAY;YACf,OAAO,KAAK,KAAK,OAAO,CAAC;QAC3B,KAAK,YAAY;YACf,OAAO,KAAK,KAAK,OAAO,CAAC;QAC3B,KAAK,aAAa;YAChB,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC5B;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/modules.d.ts

@@ -0,0 +1,24 @@
+import { type ModuleLoadResult, type ModuleManifest, type ProtocolError, type ViewerTier } from './protocol.js';
+export interface ModuleRegistry {
+    modules: readonly ModuleManifest[];
+    byId: ReadonlyMap<string, ModuleManifest>;
+    byAssetClass: ReadonlyMap<string, readonly ModuleManifest[]>;
+    calculationsByAssetClass(asset_class: string): ModuleManifest[];
+}
+export interface LoadModuleOptions {
+    hostTier?: ViewerTier;
+    protocolVersion?: string;
+    formatVersion?: string;
+    alreadyLoaded?: readonly ModuleManifest[];
+}
+export interface CreateModuleRegistryOptions extends LoadModuleOptions {
+    modules: readonly ModuleManifest[];
+}
+export declare class ModuleRegistryError extends Error {
+    readonly errors: readonly ProtocolError[];
+    constructor(errors: readonly ProtocolError[]);
+}
+export declare function loadModuleManifest(candidate: unknown, opts?: LoadModuleOptions): ModuleLoadResult;
+export declare function createModuleRegistry(opts: CreateModuleRegistryOptions): ModuleRegistry;
+export declare function getModuleCalculationsForAssetClass(registry: ModuleRegistry, asset_class: string): import("./protocol.js").ModuleCalcDecl[];
+//# sourceMappingURL=modules.d.ts.map

package/dist/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AASA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AAmCvB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC;IAC7D,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,EAAE,CAAC;CACjE;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,2BAA4B,SAAQ,iBAAiB;IACpE,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CACpC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;gBAE9B,MAAM,EAAE,SAAS,aAAa,EAAE;CAK7C;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,OAAO,EAClB,IAAI,GAAE,iBAAsB,GAC3B,gBAAgB,CAMlB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,cAAc,CAuCtF;AAED,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,MAAM,4CAKpB"}