@vauban-org/agent-sdk 0.16.0

package/dist/proof/chain.js

@@ -0,0 +1,177 @@
+/**
+ * ProofChain — tamper-evident SHA-256 step chain for TRACE_V1.
+ *
+ * Coexists with the legacy Poseidon proof system in `./poseidon.ts`.
+ * This module targets the TRACE_V1 schema (sprint-561:a2/a4).
+ *
+ * buildChain  — builds a ProofChain from a finalized Trace.
+ * verifyChain — runs 7 integrity checks (R8-M4, CH9, AR6).
+ *
+ * rootHash binding (CH9):
+ *   rootHash = sha256(canonical({
+ *     lastStepHash,
+ *     totalSteps,
+ *     configHash,    ← anti config-swap
+ *     agentId,
+ *     agentVersion,
+ *     runId,
+ *   }))
+ *
+ * All-zeros prevStepHash sentinel for step[0]:
+ *   "0000000000000000000000000000000000000000000000000000000000000000"
+ *
+ * @module proof/chain
+ */
+import { canonicalize } from "../trace/canonical.js";
+import { sha256 } from "./sha256.js";
+// ─── Constants ────────────────────────────────────────────────────────────────
+/** All-zeros sentinel for prevStepHash of the first step. */
+export const GENESIS_PREV_HASH = "0000000000000000000000000000000000000000000000000000000000000000";
+// ─── computeStepHash ─────────────────────────────────────────────────────────
+/**
+ * SHA-256(canonical({ ...step fields (excluding stepHash), runId })).
+ *
+ * The stepHash field itself is excluded from its own digest to avoid
+ * circular dependency. runId is included explicitly even though it is
+ * already a step field — this is intentional for AR6 clarity.
+ */
+export async function computeStepHash(step, runId) {
+    const { stepHash: _excluded, ...stepWithoutHash } = step;
+    void _excluded;
+    const payload = { ...stepWithoutHash, runId };
+    return sha256(canonicalize(payload));
+}
+// ─── buildChain ──────────────────────────────────────────────────────────────
+/**
+ * Build a ProofChain from a finalized Trace.
+ *
+ * Recomputes stepHash for every step to produce the entries array,
+ * then computes rootHash = sha256(canonical({ lastStepHash, totalSteps,
+ * configHash, agentId, agentVersion, runId })).
+ *
+ * @throws If the trace has no steps.
+ */
+export async function buildChain(trace) {
+    if (trace.steps.length === 0) {
+        throw new Error("buildChain: trace must have at least one step");
+    }
+    const entries = [];
+    for (const step of trace.steps) {
+        const stepHash = await computeStepHash(step, trace.runId);
+        entries.push({ index: step.index, stepHash });
+    }
+    const lastStepHash = entries[entries.length - 1].stepHash;
+    const rootPayload = {
+        agentId: trace.agentId,
+        agentVersion: trace.agentVersion,
+        configHash: trace.configHash,
+        lastStepHash,
+        runId: trace.runId,
+        totalSteps: trace.totalSteps,
+    };
+    const rootHash = await sha256(canonicalize(rootPayload));
+    return { algorithm: "sha-256", entries, rootHash };
+}
+// ─── verifyChain ─────────────────────────────────────────────────────────────
+/**
+ * Verify a ProofChain against a Trace — 7 integrity checks.
+ *
+ * Checks (in order):
+ *   1. steps[i].index === i                    (monotone, anti-deletion)
+ *   2. steps.length === trace.totalSteps        (anti-truncation)
+ *   3. steps[i].runId === trace.runId for all i (anti-splice AR6)
+ *   4. recompute stepHash === step.stepHash     (data integrity)
+ *   5. steps[i].prevStepHash === steps[i-1].stepHash (chain linkage)
+ *   6. rootHash === recomputed rootHash         (root commitment CH9)
+ *   7. trace.configHash === sha256(canonical(trace.config)) (config anti-swap)
+ */
+export async function verifyChain(trace, chain) {
+    const receiptStatus = trace.receiptStatus;
+    // Check 2 — anti-truncation (check length before iterating)
+    if (trace.steps.length !== trace.totalSteps) {
+        return {
+            valid: false,
+            tamperedAt: -1,
+            reason: "totalSteps mismatch",
+            ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+        };
+    }
+    // Checks 1, 3, 4, 5 — per-step loop
+    const computedHashes = [];
+    for (let i = 0; i < trace.steps.length; i++) {
+        const step = trace.steps[i];
+        // Check 1 — monotone index
+        if (step.index !== i) {
+            return {
+                valid: false,
+                tamperedAt: i,
+                reason: "monotone violation",
+                ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+            };
+        }
+        // Check 3 — AR6 runId anti-splice
+        if (step.runId !== trace.runId) {
+            return {
+                valid: false,
+                tamperedAt: i,
+                reason: "runId mismatch",
+                ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+            };
+        }
+        // Check 4 — recompute stepHash
+        const recomputedHash = await computeStepHash(step, trace.runId);
+        if (recomputedHash !== step.stepHash) {
+            return {
+                valid: false,
+                tamperedAt: i,
+                reason: "step hash mismatch",
+                ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+            };
+        }
+        computedHashes.push(recomputedHash);
+        // Check 5 — chain linkage
+        const expectedPrev = i === 0 ? GENESIS_PREV_HASH : computedHashes[i - 1];
+        if (step.prevStepHash !== expectedPrev) {
+            return {
+                valid: false,
+                tamperedAt: i,
+                reason: "prev hash mismatch",
+                ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+            };
+        }
+    }
+    // Check 6 — root hash
+    const lastStepHash = computedHashes[computedHashes.length - 1];
+    const rootPayload = {
+        agentId: trace.agentId,
+        agentVersion: trace.agentVersion,
+        configHash: trace.configHash,
+        lastStepHash,
+        runId: trace.runId,
+        totalSteps: trace.totalSteps,
+    };
+    const recomputedRoot = await sha256(canonicalize(rootPayload));
+    if (chain.rootHash !== recomputedRoot) {
+        return {
+            valid: false,
+            tamperedAt: -1,
+            reason: "root hash mismatch",
+            ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+        };
+    }
+    // Check 7 — CH9 config hash
+    const recomputedConfigHash = await sha256(canonicalize(trace.config));
+    if (trace.configHash !== recomputedConfigHash) {
+        return {
+            valid: false,
+            tamperedAt: -1,
+            reason: "config hash mismatch",
+            ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+        };
+    }
+    return {
+        valid: true,
+        ...(receiptStatus !== undefined ? { receiptStatus } : {}),
+    };
+}
+//# sourceMappingURL=chain.js.map

package/dist/proof/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/proof/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwCrC,iFAAiF;AAEjF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAC5B,kEAAkE,CAAC;AAErE,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAe,EACf,KAAa;IAEb,MAAM,EACJ,QAAQ,EAAE,SAAS,EACnB,GAAG,eAAe,EACnB,GAAG,IAAI,CAAC;IACT,KAAK,SAAS,CAAC;IACf,MAAM,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,CAAC;IAC9C,OAAO,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAY;IAC3C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE1D,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IAEzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAY,EACZ,KAAiB;IAEjB,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAE1C,4DAA4D;IAC5D,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,CAAC,CAAC;YACd,MAAM,EAAE,qBAAqB;YAC7B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,2BAA2B;QAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,CAAC;gBACb,MAAM,EAAE,oBAAoB;gBAC5B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,CAAC;gBACb,MAAM,EAAE,gBAAgB;gBACxB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,cAAc,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,CAAC;gBACb,MAAM,EAAE,oBAAoB;gBAC5B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEpC,0BAA0B;QAC1B,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,CAAC;gBACb,MAAM,EAAE,oBAAoB;gBAC5B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,YAAY,GAAG,cAAc,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,CAAC,CAAC;YACd,MAAM,EAAE,oBAAoB;YAC5B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,oBAAoB,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,CAAC,CAAC;YACd,MAAM,EAAE,sBAAsB;YAC9B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/proof/fallback-adapter.d.ts

@@ -0,0 +1,50 @@
+/**
+ * FallbackAdapter — cascading TimestampPort composition.
+ *
+ * Pure cascade logic with no ASN.1 / wire-format knowledge.
+ * Adapters are tried in order; the first success wins.
+ * All failures aggregate into AllAdaptersFailedError.
+ *
+ * For verify(): the first adapter whose tsa URL matches the receipt is used.
+ * If none match, falls back to trying each in order.
+ *
+ * @module proof/fallback-adapter
+ */
+import type { SignedReceipt } from "../trace/schema.js";
+import type { TimestampPort } from "../ports/timestamp.js";
+/**
+ * Thrown when all adapters fail during a `request()` call.
+ * Aggregates individual errors for diagnostics.
+ */
+export declare class AllAdaptersFailedError extends AggregateError {
+    constructor(errors: Error[], message?: string);
+}
+/**
+ * FallbackAdapter — tries adapters in insertion order.
+ *
+ * Construction throws immediately if the adapters array is empty
+ * (fail-closed; never silently degrade to a misconfigured state).
+ */
+export declare class FallbackAdapter implements TimestampPort {
+    private readonly _adapters;
+    constructor(adapters: readonly TimestampPort[]);
+    /**
+     * Try each adapter in order. Returns the first successful receipt.
+     * Throws AllAdaptersFailedError if every adapter throws.
+     */
+    request(rootHash: string): Promise<SignedReceipt>;
+    /**
+     * Verify a receipt.
+     *
+     * Strategy: try the first adapter whose tsa URL matches receipt.tsa first
+     * (fast path). If none match (or the match fails), try all adapters in order
+     * and return the first successful result.
+     *
+     * Returns `{ valid: false }` only when all adapters declare invalid or throw.
+     */
+    verify(receipt: SignedReceipt, rootHash: string): Promise<{
+        valid: boolean;
+        reason?: string;
+    }>;
+}
+//# sourceMappingURL=fallback-adapter.d.ts.map

package/dist/proof/fallback-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback-adapter.d.ts","sourceRoot":"","sources":["../../src/proof/fallback-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,cAAc;gBAC5C,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,SAAsC;CAI3E;AAED;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;gBAEzC,QAAQ,EAAE,SAAS,aAAa,EAAE;IAU9C;;;OAGG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAcvD;;;;;;;;OAQG;IACG,MAAM,CACV,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAwChD"}

package/dist/proof/fallback-adapter.js

@@ -0,0 +1,99 @@
+/**
+ * FallbackAdapter — cascading TimestampPort composition.
+ *
+ * Pure cascade logic with no ASN.1 / wire-format knowledge.
+ * Adapters are tried in order; the first success wins.
+ * All failures aggregate into AllAdaptersFailedError.
+ *
+ * For verify(): the first adapter whose tsa URL matches the receipt is used.
+ * If none match, falls back to trying each in order.
+ *
+ * @module proof/fallback-adapter
+ */
+/**
+ * Thrown when all adapters fail during a `request()` call.
+ * Aggregates individual errors for diagnostics.
+ */
+export class AllAdaptersFailedError extends AggregateError {
+    constructor(errors, message = "All TimestampPort adapters failed") {
+        super(errors, message);
+        this.name = "AllAdaptersFailedError";
+    }
+}
+/**
+ * FallbackAdapter — tries adapters in insertion order.
+ *
+ * Construction throws immediately if the adapters array is empty
+ * (fail-closed; never silently degrade to a misconfigured state).
+ */
+export class FallbackAdapter {
+    _adapters;
+    constructor(adapters) {
+        if (adapters.length === 0) {
+            throw new Error("FallbackAdapter requires at least one adapter. " +
+                "Pass one or more TimestampPort implementations.");
+        }
+        this._adapters = adapters;
+    }
+    /**
+     * Try each adapter in order. Returns the first successful receipt.
+     * Throws AllAdaptersFailedError if every adapter throws.
+     */
+    async request(rootHash) {
+        const errors = [];
+        for (const adapter of this._adapters) {
+            try {
+                return await adapter.request(rootHash);
+            }
+            catch (err) {
+                errors.push(err instanceof Error ? err : new Error(String(err)));
+            }
+        }
+        throw new AllAdaptersFailedError(errors);
+    }
+    /**
+     * Verify a receipt.
+     *
+     * Strategy: try the first adapter whose tsa URL matches receipt.tsa first
+     * (fast path). If none match (or the match fails), try all adapters in order
+     * and return the first successful result.
+     *
+     * Returns `{ valid: false }` only when all adapters declare invalid or throw.
+     */
+    async verify(receipt, rootHash) {
+        // Fast-path: find an adapter that "owns" this receipt by TSA URL.
+        // Adapters expose their TSA URL via an optional `tsaUrl` property (duck-typed).
+        const matchingIdx = this._adapters.findIndex((a) => typeof a["tsaUrl"] ===
+            "string" &&
+            a["tsaUrl"] === receipt.tsa);
+        if (matchingIdx !== -1) {
+            try {
+                const result = await this._adapters[matchingIdx].verify(receipt, rootHash);
+                if (result.valid)
+                    return result;
+            }
+            catch {
+                // Fall through to full scan.
+            }
+        }
+        // Full scan: try each adapter.
+        let lastReason;
+        for (const adapter of this._adapters) {
+            try {
+                const result = await adapter.verify(receipt, rootHash);
+                if (result.valid)
+                    return result;
+                lastReason = result.reason;
+            }
+            catch (err) {
+                lastReason =
+                    err instanceof Error ? err.message : "adapter verify threw";
+            }
+        }
+        return {
+            valid: false,
+            reason: lastReason ?? "no adapter could verify receipt",
+        };
+    }
+}
+//# sourceMappingURL=fallback-adapter.js.map

package/dist/proof/fallback-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback-adapter.js","sourceRoot":"","sources":["../../src/proof/fallback-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,cAAc;IACxD,YAAY,MAAe,EAAE,OAAO,GAAG,mCAAmC;QACxE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACT,SAAS,CAA2B;IAErD,YAAY,QAAkC;QAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,iDAAiD;gBAC/C,iDAAiD,CACpD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,OAAsB,EACtB,QAAgB;QAEhB,kEAAkE;QAClE,gFAAgF;QAChF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAC1C,CAAC,CAAC,EAAE,EAAE,CACJ,OAAQ,CAAwC,CAAC,QAAQ,CAAC;YACxD,QAAQ;YACT,CAAwC,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,GAAG,CACtE,CAAC;QAEF,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,CACrD,OAAO,EACP,QAAQ,CACT,CAAC;gBACF,IAAI,MAAM,CAAC,KAAK;oBAAE,OAAO,MAAM,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,UAA8B,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACvD,IAAI,MAAM,CAAC,KAAK;oBAAE,OAAO,MAAM,CAAC;gBAChC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,UAAU;oBACR,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,UAAU,IAAI,iCAAiC;SACxD,CAAC;IACJ,CAAC;CACF"}

package/dist/proof/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Universal proof-layer entrypoint for the agent-sdk — sprint-483.
+ * Extended: sprint-521 Bloc 1 — Poseidon proof module.
+ *
+ * Re-exports the leaf builders so external consumers can compute or verify
+ * universal proof leaves WITHOUT depending on the command-center monolith.
+ *
+ * The implementation lives in command-center/src/proof/* and is re-exported
+ * via a thin shim. Cross-language parity is guaranteed by the same SHA-256
+ * + JCS test vectors (tests/proof/cross-lang-vectors.json).
+ *
+ * Usage:
+ *   import { mkProofLeaf, verifyProofInclusion } from "@vauban-org/agent-sdk/proof";
+ *
+ *   const leaf = mkProofLeaf("hitl_approval", row);
+ *   const ok = verifyProofInclusion(leaf.preimage_hash, proof, root);
+ */
+export declare function canonicalize(data: Record<string, unknown>): string;
+export declare function leafHash(data: Record<string, unknown>): string;
+export declare function verifyProofInclusion(leaf: string, proof: string[], root: string): boolean;
+export type UniversalSourceTable = "hitl_approval" | "agent_config_history" | "pending_agent_config_change" | "agent_run" | "outcome_ledger";
+export interface ProofLeaf {
+    preimage_hash: string;
+    leaf_felt: string;
+}
+export declare function mkProofLeaf(sourceTable: UniversalSourceTable, row: Record<string, unknown>): ProofLeaf;
+export type { CertState, LogSeverity, RunStep, RunProofCertificate, } from "./types.js";
+export { computeLeafHash, computeMerkleRoot, NULL_LEAF, } from "@vauban-org/proof-core";
+export type { VerifyResult } from "./verify.js";
+export { verifyProofCertificate } from "./verify.js";
+export type { LoadProofCertificateOptions } from "./load.js";
+export { loadProofCertificate } from "./load.js";
+export type { OtelSpan } from "./otel.js";
+export { toOtelSpan } from "./otel.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/proof/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAwBH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAElE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAE9D;AAYD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAOT;AAID,MAAM,MAAM,oBAAoB,GAC5B,eAAe,GACf,sBAAsB,GACtB,6BAA6B,GAC7B,WAAW,GACX,gBAAgB,CAAC;AAErB,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AA+FD,wBAAgB,WAAW,CACzB,WAAW,EAAE,oBAAoB,EACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,SAAS,CAKX;AAID,YAAY,EACV,SAAS,EACT,WAAW,EACX,OAAO,EACP,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,YAAY,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/proof/index.js

@@ -0,0 +1,161 @@
+/**
+ * Universal proof-layer entrypoint for the agent-sdk — sprint-483.
+ * Extended: sprint-521 Bloc 1 — Poseidon proof module.
+ *
+ * Re-exports the leaf builders so external consumers can compute or verify
+ * universal proof leaves WITHOUT depending on the command-center monolith.
+ *
+ * The implementation lives in command-center/src/proof/* and is re-exported
+ * via a thin shim. Cross-language parity is guaranteed by the same SHA-256
+ * + JCS test vectors (tests/proof/cross-lang-vectors.json).
+ *
+ * Usage:
+ *   import { mkProofLeaf, verifyProofInclusion } from "@vauban-org/agent-sdk/proof";
+ *
+ *   const leaf = mkProofLeaf("hitl_approval", row);
+ *   const ok = verifyProofInclusion(leaf.preimage_hash, proof, root);
+ */
+import { createHash } from "node:crypto";
+// ─── JCS canonical JSON (RFC 8785 subset) ────────────────────────────────────
+function normalize(value) {
+    if (value === null)
+        return null;
+    if (typeof value === "number") {
+        if (Object.is(value, -0))
+            return 0;
+        return value;
+    }
+    if (Array.isArray(value))
+        return value.map(normalize);
+    if (typeof value === "object") {
+        const obj = value;
+        const sorted = {};
+        for (const key of Object.keys(obj).sort()) {
+            sorted[key] = normalize(obj[key]);
+        }
+        return sorted;
+    }
+    return value;
+}
+export function canonicalize(data) {
+    return JSON.stringify(normalize(data));
+}
+export function leafHash(data) {
+    return createHash("sha256").update(canonicalize(data), "utf8").digest("hex");
+}
+// ─── Merkle proof verification ────────────────────────────────────────────────
+function hashPair(left, right) {
+    const [a, b] = left <= right ? [left, right] : [right, left];
+    return createHash("sha256")
+        .update(Buffer.from(a, "hex"))
+        .update(Buffer.from(b, "hex"))
+        .digest("hex");
+}
+export function verifyProofInclusion(leaf, proof, root) {
+    let current = leaf.startsWith("0x") ? leaf.slice(2) : leaf;
+    for (const sibling of proof) {
+        const sib = sibling.startsWith("0x") ? sibling.slice(2) : sibling;
+        current = hashPair(current, sib);
+    }
+    return current === root;
+}
+function req(row, field) {
+    const v = row[field];
+    if (v === undefined) {
+        throw new Error(`[proof] missing field "${field}"`);
+    }
+    return v;
+}
+function asISO(v, field) {
+    if (v instanceof Date)
+        return v.toISOString();
+    if (typeof v === "string")
+        return v;
+    throw new Error(`[proof] field "${field}" must be Date or ISO string`);
+}
+function asNullableISO(v, field) {
+    if (v === null || v === undefined)
+        return null;
+    return asISO(v, field);
+}
+function asInt(v, field) {
+    if (typeof v === "number" && Number.isInteger(v))
+        return v;
+    if (typeof v === "string" && /^-?\d+$/.test(v))
+        return Number.parseInt(v, 10);
+    if (typeof v === "bigint")
+        return Number(v);
+    throw new Error(`[proof] field "${field}" must be integer`);
+}
+function lower(v, field) {
+    if (typeof v !== "string") {
+        throw new Error(`[proof] field "${field}" must be string`);
+    }
+    return v.toLowerCase();
+}
+const CANONICALIZERS = {
+    hitl_approval: (row) => ({
+        id: String(req(row, "id")),
+        agent_id: String(req(row, "agent_id")),
+        decision: lower(req(row, "decision"), "decision"),
+        evidence_hash: String(req(row, "evidence_hash")),
+        resolved_at: asISO(req(row, "resolved_at"), "resolved_at"),
+    }),
+    agent_config_history: (row) => {
+        const patch = req(row, "patch");
+        if (typeof patch !== "object" || patch === null || Array.isArray(patch)) {
+            throw new Error(`[proof] patch must be object`);
+        }
+        return {
+            agent_id: String(req(row, "agent_id")),
+            patch: patch,
+            version: asInt(req(row, "version"), "version"),
+            changed_at: asISO(req(row, "changed_at"), "changed_at"),
+        };
+    },
+    agent_run: (row) => ({
+        id: String(req(row, "id")),
+        agent_id: String(req(row, "agent_id")),
+        status: lower(req(row, "status"), "status"),
+        evidence_hash: String(req(row, "evidence_hash")),
+        duration_ms: asInt(req(row, "duration_ms"), "duration_ms"),
+    }),
+    pending_agent_config_change: (row) => {
+        const patch = req(row, "proposed_patch");
+        if (typeof patch !== "object" || patch === null || Array.isArray(patch)) {
+            throw new Error(`[proof] proposed_patch must be object`);
+        }
+        return {
+            id: String(req(row, "id")),
+            agent_id: String(req(row, "agent_id")),
+            proposed_patch: patch,
+            status: lower(req(row, "status"), "status"),
+            resolved_at: asNullableISO(row.resolved_at, "resolved_at"),
+        };
+    },
+    outcome_ledger: (row) => {
+        const v = row.value_centimes;
+        if (typeof v === "number" && !Number.isInteger(v)) {
+            throw new Error(`[proof] outcome_ledger.value_centimes must be integer centimes`);
+        }
+        return {
+            id: String(req(row, "id")),
+            agent_id: String(req(row, "agent_id")),
+            outcome_type: lower(req(row, "outcome_type"), "outcome_type"),
+            value_centimes: asInt(req(row, "value_centimes"), "value_centimes"),
+            recorded_at: asISO(req(row, "recorded_at"), "recorded_at"),
+        };
+    },
+};
+export function mkProofLeaf(sourceTable, row) {
+    const fn = CANONICALIZERS[sourceTable];
+    if (!fn)
+        throw new Error(`[proof] unknown source: ${sourceTable}`);
+    const hash = leafHash(fn(row));
+    return { preimage_hash: hash, leaf_felt: `0x${hash}` };
+}
+export { computeLeafHash, computeMerkleRoot, NULL_LEAF, } from "@vauban-org/proof-core";
+export { verifyProofCertificate } from "./verify.js";
+export { loadProofCertificate } from "./load.js";
+export { toOtelSpan } from "./otel.js";
+//# sourceMappingURL=index.js.map

package/dist/proof/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/proof/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,gFAAgF;AAEhF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA6B;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAA6B;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,iFAAiF;AAEjF,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SAC7B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,KAAe,EACf,IAAY;IAEZ,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAClE,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAgBD,SAAS,GAAG,CAAC,GAA4B,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,CAAU,EAAE,KAAa;IACtC,IAAI,CAAC,YAAY,IAAI;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,8BAA8B,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,KAAa;IAC9C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,KAAK,CAAC,CAAU,EAAE,KAAa;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,mBAAmB,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,CAAU,EAAE,KAAa;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,cAAc,GAGhB;IACF,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC;QACjD,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC;KAC3D,CAAC;IACF,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtC,KAAK,EAAE,KAAgC;YACvC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC;YAC9C,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC;SACxD,CAAC;IACJ,CAAC;IACD,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAC3C,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC;KAC3D,CAAC;IACF,2BAA2B,EAAE,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtC,cAAc,EAAE,KAAgC;YAChD,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;YAC3C,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC;SAC3D,CAAC;IACJ,CAAC;IACD,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;QAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACtC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,cAAc,CAAC;YAC7D,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;YACnE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC;SAC3D,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,WAAW,CACzB,WAAiC,EACjC,GAA4B;IAE5B,MAAM,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;AACzD,CAAC;AAUD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/proof/load.d.ts

@@ -0,0 +1,27 @@
+/**
+ * loadProofCertificate — REST client for /api/runs/:runId/proof-certificate.
+ *
+ * Fetches a RunProofCertificate from the Command Center API.
+ * Auth is optional: if getToken is provided it is called and the result is
+ * sent as a Bearer token; otherwise the request is sent unauthenticated
+ * (the endpoint has a public read tier for finalized runs).
+ *
+ * sprint-521 Bloc 1.
+ */
+import type { RunProofCertificate } from "./types.js";
+export interface LoadProofCertificateOptions {
+    runId: string;
+    baseUrl: string;
+    getToken?: () => Promise<string>;
+}
+/**
+ * Fetch a RunProofCertificate from the Command Center REST API.
+ *
+ * @param opts.runId   - UUID of the agent run.
+ * @param opts.baseUrl - Base URL of the Command Center API (no trailing slash).
+ * @param opts.getToken - Optional async function returning a Bearer token.
+ * @returns Parsed RunProofCertificate.
+ * @throws Error with HTTP status and parsed body on 4xx/5xx responses.
+ */
+export declare function loadProofCertificate(opts: LoadProofCertificateOptions): Promise<RunProofCertificate>;
+//# sourceMappingURL=load.d.ts.map

package/dist/proof/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/proof/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,mBAAmB,CAAC,CA8B9B"}

package/dist/proof/load.js

@@ -0,0 +1,44 @@
+/**
+ * loadProofCertificate — REST client for /api/runs/:runId/proof-certificate.
+ *
+ * Fetches a RunProofCertificate from the Command Center API.
+ * Auth is optional: if getToken is provided it is called and the result is
+ * sent as a Bearer token; otherwise the request is sent unauthenticated
+ * (the endpoint has a public read tier for finalized runs).
+ *
+ * sprint-521 Bloc 1.
+ */
+/**
+ * Fetch a RunProofCertificate from the Command Center REST API.
+ *
+ * @param opts.runId   - UUID of the agent run.
+ * @param opts.baseUrl - Base URL of the Command Center API (no trailing slash).
+ * @param opts.getToken - Optional async function returning a Bearer token.
+ * @returns Parsed RunProofCertificate.
+ * @throws Error with HTTP status and parsed body on 4xx/5xx responses.
+ */
+export async function loadProofCertificate(opts) {
+    const { runId, baseUrl, getToken } = opts;
+    const url = `${baseUrl}/api/runs/${encodeURIComponent(runId)}/proof-certificate`;
+    const headers = {
+        Accept: "application/json",
+    };
+    if (getToken) {
+        const token = await getToken();
+        headers["Authorization"] = `Bearer ${token}`;
+    }
+    const response = await fetch(url, { headers });
+    if (!response.ok) {
+        let body;
+        try {
+            body = await response.text();
+        }
+        catch {
+            body = "(unreadable)";
+        }
+        throw new Error(`[agent-sdk/proof] loadProofCertificate: HTTP ${response.status} — ${body}`);
+    }
+    const data = (await response.json());
+    return data;
+}
+//# sourceMappingURL=load.js.map

package/dist/proof/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/proof/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAiC;IAEjC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,GAAG,OAAO,aAAa,kBAAkB,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAEjF,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gDAAgD,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC"}