@vantic/sdk 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @vantic/sdk — Vantic Protocol v0.1 reference implementation.
+ *
+ * Signed delegation envelopes and receipt chains for autonomous agent transactions.
+ * See ../spec/SPEC.md.
+ */
+export * from "./types.js";
+export { generateKeyPair, canonicalize, sha256Hex, signObject, verifyObjectSignature } from "./crypto.js";
+export { issueMandate, verifyMandateSignature, mandateHash, type IssueMandateParams } from "./envelope.js";
+export { issueReceipt, receiptHash, verifyReceiptSignature, nextPrevHash, type IssueReceiptParams } from "./receipt.js";
+export { verifyChain, authorize, counterpartyAllowed, type VerifyOptions } from "./verify.js";
+export { checkMandate, type ResourceRequirement, type GateResult } from "./gate.js";
+export { RevocationList } from "./revocation.js";
+export { AgentWallet, GuardViolation, type SpendExecutor, type AgentWalletOptions } from "./guard.js";
+export { guardTool, wrapMcpTool, type GuardedToolResponse, type GuardToolOptions, type McpTool, type McpToolResult, type WrapMcpOptions, } from "./adapters.js";
+export { didKeyFromRaw, rawFromDidKey, keyIdToDidKey, didKeyToKeyId, identifierToRaw, isDidKey, isKeyId, resolveDidKey, didWebToUrl, buildDidWebDocument, createResolver, base58Encode, base58Decode, type DIDDocument, type VerificationMethod, type DidResolver, } from "./did.js";
+export { issueSponsorCredential, verifySponsorCredential, type SponsorCredential, type CredentialProof, type IssueSponsorCredentialParams, type CredentialVerifyOptions, } from "./credential.js";
+export { handleMcp, startStdioServer, type JsonRpcRequest, type JsonRpcResponse } from "./mcp-server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACtG,OAAO,EACL,SAAS,EACT,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,QAAQ,EACR,OAAO,EACP,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * @vantic/sdk — Vantic Protocol v0.1 reference implementation.
+ *
+ * Signed delegation envelopes and receipt chains for autonomous agent transactions.
+ * See ../spec/SPEC.md.
+ */
+export * from "./types.js";
+export { generateKeyPair, canonicalize, sha256Hex, signObject, verifyObjectSignature } from "./crypto.js";
+export { issueMandate, verifyMandateSignature, mandateHash } from "./envelope.js";
+export { issueReceipt, receiptHash, verifyReceiptSignature, nextPrevHash } from "./receipt.js";
+export { verifyChain, authorize, counterpartyAllowed } from "./verify.js";
+export { checkMandate } from "./gate.js";
+export { RevocationList } from "./revocation.js";
+export { AgentWallet, GuardViolation } from "./guard.js";
+export { guardTool, wrapMcpTool, } from "./adapters.js";
+export { didKeyFromRaw, rawFromDidKey, keyIdToDidKey, didKeyToKeyId, identifierToRaw, isDidKey, isKeyId, resolveDidKey, didWebToUrl, buildDidWebDocument, createResolver, base58Encode, base58Decode, } from "./did.js";
+export { issueSponsorCredential, verifySponsorCredential, } from "./credential.js";
+export { handleMcp, startStdioServer } from "./mcp-server.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,WAAW,EAA2B,MAAM,eAAe,CAAC;AAC3G,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAA2B,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAA+C,MAAM,YAAY,CAAC;AACtG,OAAO,EACL,SAAS,EACT,WAAW,GAMZ,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,QAAQ,EACR,OAAO,EACP,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,YAAY,GAIb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAKxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAA6C,MAAM,iBAAiB,CAAC"}

package/dist/mcp-server.d.ts

@@ -0,0 +1,23 @@
+export interface JsonRpcRequest {
+    jsonrpc: "2.0";
+    id?: string | number | null;
+    method: string;
+    params?: any;
+}
+export interface JsonRpcResponse {
+    jsonrpc: "2.0";
+    id: string | number | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+    };
+}
+/**
+ * Pure MCP message handler. Returns a response, or null for notifications (no id / no reply).
+ * Testable without stdio.
+ */
+export declare function handleMcp(req: JsonRpcRequest): JsonRpcResponse | null;
+/** Start the stdio JSON-RPC loop (line-delimited). */
+export declare function startStdioServer(): void;
+//# sourceMappingURL=mcp-server.d.ts.map

package/dist/mcp-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAoFA,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;CACd;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,eAAe,GAAG,IAAI,CAiCrE;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,IAAI,IAAI,CAwBvC"}

package/dist/mcp-server.js

@@ -0,0 +1,141 @@
+/**
+ * Vantic — an MCP server exposing stateless mandate-verification tools.
+ *
+ * Exposes Vantic's STATELESS verification primitives as MCP tools, so any MCP host
+ * (Claude Desktop, Cursor, agent frameworks) can check authority before an agent acts,
+ * with no code. Only safe operations are exposed — no private keys, no signing; key
+ * custody and receipt issuance stay client-side in the SDK.
+ *
+ * Zero dependencies: line-delimited JSON-RPC 2.0 over stdio (MCP stdio transport).
+ * As an MCP server, Vantic can be listed in MCP directories (the official registry,
+ * mcp.so, Smithery, awesome-mcp) so any MCP host can install it.
+ */
+import { authorize, verifyChain } from "./verify.js";
+import { resolveDidKey } from "./did.js";
+import { verifySponsorCredential } from "./credential.js";
+const SERVER_NAME = "vantic";
+const SERVER_VERSION = "0.1.0";
+const DEFAULT_PROTOCOL = "2025-06-18";
+const TOOLS = [
+    {
+        name: "mandate_authorize",
+        description: "Check whether a candidate agent action is authorized by a delegation envelope, given prior receipts. Returns a Verdict {ok, reasons, cumulativeSpend}. Call this BEFORE letting an agent spend.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                envelope: { type: "object", description: "The signed delegation envelope." },
+                priorReceipts: { type: "array", description: "Receipts already issued under this envelope (ordered).", items: { type: "object" } },
+                action: {
+                    type: "object",
+                    description: "The candidate action: { type, counterparty, amount (minor units), currency }.",
+                    properties: { type: { type: "string" }, counterparty: { type: "string" }, amount: { type: "number" }, currency: { type: "string" } },
+                    required: ["type", "counterparty", "amount", "currency"],
+                },
+            },
+            required: ["envelope", "action"],
+        },
+        run: (a) => authorize(a.envelope, a.priorReceipts ?? [], a.action),
+    },
+    {
+        name: "mandate_verify_chain",
+        description: "Verify an envelope and its full receipt chain (the dispute-evidence bundle). Returns a Verdict.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                envelope: { type: "object" },
+                receiptChain: { type: "array", items: { type: "object" } },
+            },
+            required: ["envelope"],
+        },
+        run: (a) => verifyChain(a.envelope, a.receiptChain ?? []),
+    },
+    {
+        name: "mandate_verify_credential",
+        description: "Verify a W3C sponsor Verifiable Credential (the human sponsor chain). Returns { ok, reasons }.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                credential: { type: "object" },
+                expectSubject: { type: "string", description: "Optional: require this subject DID." },
+            },
+            required: ["credential"],
+        },
+        run: (a) => verifySponsorCredential(a.credential, a.expectSubject ? { expectSubject: a.expectSubject } : {}),
+    },
+    {
+        name: "mandate_resolve_did",
+        description: "Resolve a did:key identifier to its W3C DID document.",
+        inputSchema: { type: "object", properties: { did: { type: "string" } }, required: ["did"] },
+        run: (a) => resolveDidKey(a.did),
+    },
+];
+/**
+ * Pure MCP message handler. Returns a response, or null for notifications (no id / no reply).
+ * Testable without stdio.
+ */
+export function handleMcp(req) {
+    const isNotification = req.id === undefined || req.id === null;
+    const reply = (result) => ({ jsonrpc: "2.0", id: req.id ?? null, result });
+    const fail = (code, message) => ({ jsonrpc: "2.0", id: req.id ?? null, error: { code, message } });
+    switch (req.method) {
+        case "initialize":
+            return reply({
+                protocolVersion: req.params?.protocolVersion ?? DEFAULT_PROTOCOL,
+                capabilities: { tools: {} },
+                serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },
+            });
+        case "notifications/initialized":
+            return null; // notification: no reply
+        case "ping":
+            return reply({});
+        case "tools/list":
+            return reply({ tools: TOOLS.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })) });
+        case "tools/call": {
+            const name = req.params?.name;
+            const tool = TOOLS.find((t) => t.name === name);
+            if (!tool)
+                return isNotification ? null : fail(-32602, `unknown tool: ${name}`);
+            try {
+                const out = tool.run(req.params?.arguments ?? {});
+                return reply({ content: [{ type: "text", text: JSON.stringify(out, null, 2) }] });
+            }
+            catch (e) {
+                return reply({ content: [{ type: "text", text: `error: ${e.message}` }], isError: true });
+            }
+        }
+        default:
+            if (isNotification)
+                return null;
+            return fail(-32601, `method not found: ${req.method}`);
+    }
+}
+/** Start the stdio JSON-RPC loop (line-delimited). */
+export function startStdioServer() {
+    let buffer = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+        buffer += chunk;
+        let idx;
+        while ((idx = buffer.indexOf("\n")) >= 0) {
+            const lineRaw = buffer.slice(0, idx);
+            buffer = buffer.slice(idx + 1);
+            const line = lineRaw.trim();
+            if (!line)
+                continue;
+            let req;
+            try {
+                req = JSON.parse(line);
+            }
+            catch {
+                process.stdout.write(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } }) + "\n");
+                continue;
+            }
+            const res = handleMcp(req);
+            if (res)
+                process.stdout.write(JSON.stringify(res) + "\n");
+        }
+    });
+    // eslint-disable-next-line no-console
+    console.error(`vantic MCP server ready (stdio) — tools: ${TOOLS.map((t) => t.name).join(", ")}`);
+}
+//# sourceMappingURL=mcp-server.js.map

package/dist/mcp-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAI1D,MAAM,WAAW,GAAG,QAAQ,CAAC;AAC7B,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAStC,MAAM,KAAK,GAAc;IACvB;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,iMAAiM;QACnM,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;gBAC5E,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,wDAAwD,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAClI,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,+EAA+E;oBAC5F,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACpI,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC;iBACzD;aACF;YACD,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;SACjC;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAmB,EAAG,CAAC,CAAC,aAA2B,IAAI,EAAE,EAAE,CAAC,CAAC,MAAgB,CAAC;KACvG;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,iGAAiG;QAC9G,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAC3D;YACD,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,QAAmB,EAAG,CAAC,CAAC,YAA0B,IAAI,EAAE,CAAC;KACpF;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,gGAAgG;QAC7G,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;aACtF;YACD,QAAQ,EAAE,CAAC,YAAY,CAAC;SACzB;QACD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,UAA+B,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClI;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,uDAAuD;QACpE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;QAC3F,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,GAAa,CAAC;KAC3C;CACF,CAAC;AAeF;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAmB;IAC3C,MAAM,cAAc,GAAG,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAG,CAAC,MAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAe,EAAmB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAEpI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC;gBACX,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,IAAI,gBAAgB;gBAChE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE;aAC3D,CAAC,CAAC;QACL,KAAK,2BAA2B;YAC9B,OAAO,IAAI,CAAC,CAAC,yBAAyB;QACxC,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACnH,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;gBAClD,OAAO,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAW,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QACD;YACE,IAAI,cAAc;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB;IAC9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC;QAChB,IAAI,GAAW,CAAC;QAChB,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,GAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC3H,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,4CAA4C,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":""}

package/dist/mcp.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+/** Vantic MCP server entry point. Run: `npm run mcp` or `npx vantic-mcp`. */
+import { startStdioServer } from "./mcp-server.js";
+startStdioServer();
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":";AACA,6EAA6E;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,gBAAgB,EAAE,CAAC"}

package/dist/receipt.d.ts

@@ -0,0 +1,24 @@
+import { type Action, type Mandate, type Outcome, type Receipt } from "./types.js";
+export interface IssueReceiptParams {
+    /** The signed envelope this action is taken under. */
+    envelope: Mandate;
+    /** Agent's PKCS#8 PEM private key — signs the receipt. Must match envelope.agent. */
+    agentPrivateKeyPem: string;
+    action: Action;
+    /** SHA-256 (hex) of the previous receipt in this envelope's chain, or null for the first. */
+    prevReceiptHash?: string | null;
+    outcome?: Outcome;
+    now?: Date;
+}
+/** Create and sign a receipt bound to `envelope`. */
+export declare function issueReceipt(params: IssueReceiptParams): Receipt;
+/** SHA-256 (hex) of the canonical signed receipt — the link for the next receipt in the chain. */
+export declare function receiptHash(receipt: Receipt): string;
+/** Verify the receipt's signature is a valid Ed25519 signature by its `agent`. */
+export declare function verifyReceiptSignature(receipt: Receipt): boolean;
+/**
+ * Convenience for building a chain: given prior receipts (in order), return the hash to
+ * put in the next receipt's `prevReceiptHash`.
+ */
+export declare function nextPrevHash(chain: Receipt[]): string | null;
+//# sourceMappingURL=receipt.d.ts.map

package/dist/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAMA,OAAO,EAAmB,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEpG,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,qFAAqF;IACrF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAehE;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEhE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI,CAG5D"}

package/dist/receipt.js

@@ -0,0 +1,41 @@
+/**
+ * Receipt: a signed, hash-chained record of an action taken under an envelope.
+ * See spec §5.
+ */
+import { canonicalize, newId, sha256Hex, signObject, verifyObjectSignature } from "./crypto.js";
+import { mandateHash } from "./envelope.js";
+import { MANDATE_VERSION } from "./types.js";
+/** Create and sign a receipt bound to `envelope`. */
+export function issueReceipt(params) {
+    const now = params.now ?? new Date();
+    const base = {
+        version: MANDATE_VERSION,
+        id: newId(),
+        mandateId: params.envelope.id,
+        mandateHash: mandateHash(params.envelope),
+        agent: params.envelope.agent,
+        action: params.action,
+        timestamp: now.toISOString(),
+        prevReceiptHash: params.prevReceiptHash ?? null,
+        outcome: params.outcome ?? "pending",
+    };
+    const signature = signObject(base, params.envelope.agent, params.agentPrivateKeyPem);
+    return { ...base, signature };
+}
+/** SHA-256 (hex) of the canonical signed receipt — the link for the next receipt in the chain. */
+export function receiptHash(receipt) {
+    return sha256Hex(canonicalize(receipt));
+}
+/** Verify the receipt's signature is a valid Ed25519 signature by its `agent`. */
+export function verifyReceiptSignature(receipt) {
+    return verifyObjectSignature(receipt, receipt.agent);
+}
+/**
+ * Convenience for building a chain: given prior receipts (in order), return the hash to
+ * put in the next receipt's `prevReceiptHash`.
+ */
+export function nextPrevHash(chain) {
+    const last = chain[chain.length - 1];
+    return last ? receiptHash(last) : null;
+}
+//# sourceMappingURL=receipt.js.map

package/dist/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAyD,MAAM,YAAY,CAAC;AAcpG,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAY;QACpB,OAAO,EAAE,eAAe;QACxB,EAAE,EAAE,KAAK,EAAE;QACX,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QAC/C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;KACrC,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAAC,IAA0C,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC3H,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO,qBAAqB,CAAC,OAA6C,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC"}

package/dist/revocation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Revocation — a simple in-memory revocation list for mandates.
+ *
+ * You maintain a list of revoked mandate ids and pass its `isRevoked` to verification via
+ * `VerifyOptions.isRevoked`; verification then rejects any revoked mandate. A production
+ * deployment backs this with a persisted / fetched status list (e.g. resolved from a
+ * mandate's `revocation.url`) — that transport is a v1.0 item (see ROADMAP).
+ */
+export declare class RevocationList {
+    private readonly revoked;
+    constructor(revokedMandateIds?: string[]);
+    /** Revoke a mandate by its id. */
+    revoke(mandateId: string): void;
+    /** Un-revoke a mandate (e.g. if added in error). */
+    restore(mandateId: string): void;
+    /** True if the mandate's id is revoked. Shape matches `VerifyOptions.isRevoked`. */
+    isRevoked: (mandate: {
+        id: string;
+    }) => boolean;
+    /** Number of revoked ids. */
+    get size(): number;
+}
+//# sourceMappingURL=revocation.d.ts.map

package/dist/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;gBAEjC,iBAAiB,GAAE,MAAM,EAAO;IAI5C,kCAAkC;IAClC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI/B,oDAAoD;IACpD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIhC,oFAAoF;IACpF,SAAS,GAAI,SAAS;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAG,OAAO,CAAiC;IAE/E,6BAA6B;IAC7B,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/revocation.js

@@ -0,0 +1,30 @@
+/**
+ * Revocation — a simple in-memory revocation list for mandates.
+ *
+ * You maintain a list of revoked mandate ids and pass its `isRevoked` to verification via
+ * `VerifyOptions.isRevoked`; verification then rejects any revoked mandate. A production
+ * deployment backs this with a persisted / fetched status list (e.g. resolved from a
+ * mandate's `revocation.url`) — that transport is a v1.0 item (see ROADMAP).
+ */
+export class RevocationList {
+    revoked = new Set();
+    constructor(revokedMandateIds = []) {
+        for (const id of revokedMandateIds)
+            this.revoked.add(id);
+    }
+    /** Revoke a mandate by its id. */
+    revoke(mandateId) {
+        this.revoked.add(mandateId);
+    }
+    /** Un-revoke a mandate (e.g. if added in error). */
+    restore(mandateId) {
+        this.revoked.delete(mandateId);
+    }
+    /** True if the mandate's id is revoked. Shape matches `VerifyOptions.isRevoked`. */
+    isRevoked = (mandate) => this.revoked.has(mandate.id);
+    /** Number of revoked ids. */
+    get size() {
+        return this.revoked.size;
+    }
+}
+//# sourceMappingURL=revocation.js.map

package/dist/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,YAAY,oBAA8B,EAAE;QAC1C,KAAK,MAAM,EAAE,IAAI,iBAAiB;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,kCAAkC;IAClC,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAED,oDAAoD;IACpD,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,oFAAoF;IACpF,SAAS,GAAG,CAAC,OAAuB,EAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAE/E,6BAA6B;IAC7B,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Vantic Protocol v0.1 — core types.
+ * See ../../spec/SPEC.md for the normative definitions.
+ */
+export declare const MANDATE_VERSION: "mandate/0.1";
+export type MandateVersion = typeof MANDATE_VERSION;
+/** RFC 3339 / ISO 8601 timestamp, e.g. "2026-07-29T12:00:00.000Z". */
+export type ISO8601 = string;
+/** A key id of the form `key:<base64url raw ed25519 public key>`. */
+export type KeyId = string;
+export interface KeyPair {
+    /** Public key id: `key:<x>`. Safe to share; this is the agent/principal identifier. */
+    publicKey: KeyId;
+    /** The same key as a W3C `did:key:z...` identifier. Interchangeable with `publicKey`. */
+    did: string;
+    /** PKCS#8 PEM private key. Secret. */
+    privateKeyPem: string;
+}
+export interface Signature {
+    alg: "Ed25519";
+    /** Key id of the signer. */
+    by: KeyId;
+    /** base64url-encoded Ed25519 signature. */
+    value: string;
+}
+/** Rolling spend cap: at most `amount` minor units of `currency` per `windowSeconds`. */
+export interface BudgetLimit {
+    /** ISO 4217 currency code, e.g. "USD". */
+    currency: string;
+    /** Integer, in the currency's minor unit (e.g. cents). */
+    amount: number;
+    /** Rolling window length in seconds (e.g. 604800 = 7 days). */
+    windowSeconds: number;
+}
+/** All fields optional; an omitted field means "unconstrained on this dimension". */
+export interface Scope {
+    budget?: BudgetLimit;
+    /** Per-transaction ceiling, integer minor units. */
+    maxPerTransaction?: number;
+    /** Whitelist of allowed `action.type` values. */
+    allowedActions?: string[];
+    /**
+     * Whitelist of counterparty identifiers. Each entry is either an exact match
+     * (`"etsy.com"`) or a leading-wildcard domain suffix (`"*.shop.example"`).
+     */
+    allowedCounterparties?: string[];
+}
+export interface Mandate {
+    version: MandateVersion;
+    id: string;
+    /** The agent authorized to act. */
+    agent: KeyId;
+    /** The principal (human/org sponsor) granting authority. */
+    principal: KeyId;
+    issuedAt: ISO8601;
+    expiresAt: ISO8601;
+    scope: Scope;
+    revocation?: {
+        url?: string;
+    };
+    /** Present on issued envelopes; signed by `principal`. */
+    signature?: Signature;
+}
+export interface Action {
+    /** e.g. "purchase", "subscribe". Constrained by scope.allowedActions. */
+    type: string;
+    /** Counterparty identifier (domain or id). Constrained by scope.allowedCounterparties. */
+    counterparty: string;
+    /** Integer, minor units of `currency`. */
+    amount: number;
+    currency: string;
+    description?: string;
+}
+export type Outcome = "pending" | "settled" | "failed" | "disputed";
+export interface Receipt {
+    version: MandateVersion;
+    id: string;
+    mandateId: string;
+    /** SHA-256 (hex) of the canonical signed envelope this receipt acts under. */
+    mandateHash: string;
+    agent: KeyId;
+    action: Action;
+    timestamp: ISO8601;
+    /** SHA-256 (hex) of the previous receipt in this envelope's chain; null for the first. */
+    prevReceiptHash: string | null;
+    outcome: Outcome;
+    /** Present on issued receipts; signed by `agent`. */
+    signature?: Signature;
+}
+/** Result of a verification or authorization check. */
+export interface Verdict {
+    ok: boolean;
+    /** Human-readable failure reasons; empty iff ok. */
+    reasons: string[];
+    /** Spend within the budget window at evaluation time (minor units), if a budget is set. */
+    cumulativeSpend?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe,EAAG,aAAsB,CAAC;AACtD,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC;AAEpD,sEAAsE;AACtE,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,qEAAqE;AACrE,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC;AAE3B,MAAM,WAAW,OAAO;IACtB,uFAAuF;IACvF,SAAS,EAAE,KAAK,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,SAAS,CAAC;IACf,4BAA4B;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qFAAqF;AACrF,MAAM,WAAW,KAAK;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,KAAK,EAAE,KAAK,CAAC;IACb,4DAA4D;IAC5D,SAAS,EAAE,KAAK,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEpE,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,0FAA0F;IAC1F,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,oDAAoD;IACpD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * Vantic Protocol v0.1 — core types.
+ * See ../../spec/SPEC.md for the normative definitions.
+ */
+export const MANDATE_VERSION = "mandate/0.1";
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAsB,CAAC"}

package/dist/verify.d.ts

@@ -0,0 +1,24 @@
+import type { Action, Mandate, Receipt, Verdict } from "./types.js";
+export interface VerifyOptions {
+    /** Evaluation time. Defaults to now. */
+    now?: Date;
+    /** Pluggable revocation check. Return true if the mandate is revoked. */
+    isRevoked?: (env: Mandate) => boolean;
+    /** Tolerance (seconds) applied to issuedAt/expiresAt to absorb clock differences. Default 0. */
+    clockSkewSeconds?: number;
+}
+/** Counterparty matcher: exact match or leading-wildcard domain suffix (`*.shop.example`). */
+export declare function counterpartyAllowed(allowed: string[] | undefined, counterparty: string): boolean;
+/**
+ * Full verification of an envelope and its ordered receipt chain (spec §6).
+ * This is what a verifier runs on a dispute-evidence bundle.
+ */
+export declare function verifyChain(env: Mandate, receipts: Receipt[], opts?: VerifyOptions): Verdict;
+/**
+ * Pre-transaction authorization (the gateway path). Given the envelope, the prior
+ * receipt chain, and a candidate action, decide whether the agent may proceed.
+ * Validates the envelope, the existing chain, the candidate's static scope, and the
+ * budget *including* the candidate.
+ */
+export declare function authorize(env: Mandate, priorReceipts: Receipt[], candidate: Action, opts?: VerifyOptions): Verdict;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAS,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,yEAAyE;IACzE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;IACtC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAUhG;AA4CD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CA6BhG;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,aAAa,EAAE,OAAO,EAAE,EACxB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAuBT"}