@zanii/certify 0.0.0-stage → 0.5.0

package/dist/schemas/suite.schema.json

@@ -0,0 +1,138 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://zanii.agency/certify/schemas/suite.schema.json",
+    "title": "Zanii Certify test suite (spec/suites.md)",
+    "type": "object",
+    "required": ["v", "type", "id", "version", "visibility", "cases"],
+    "additionalProperties": false,
+    "properties": {
+        "v": { "const": 1 },
+        "type": { "const": "certify.suite" },
+        "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" },
+        "version": { "type": "integer", "minimum": 1 },
+        "visibility": { "enum": ["public", "held-out"] },
+        "profiles": { "$ref": "#/$defs/profileRefs" },
+        "rubrics": { "type": "array", "minItems": 1, "maxItems": 64, "items": { "$ref": "#/$defs/rubric" } },
+        "cases": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/case" } }
+    },
+    "$defs": {
+        "profileRefs": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "maxLength": 100, "pattern": "^[a-z0-9][a-z0-9-]{0,63}/[1-9][0-9]{0,8}$" } },
+        "teamPolicy": { "type": "object", "required": ["members", "require_distinct_owners"], "additionalProperties": false, "properties": { "members": { "type": "array", "minItems": 3, "maxItems": 64, "uniqueItems": true, "items": { "type": "object", "required": ["agent", "owner"], "additionalProperties": false, "properties": { "agent": { "anyOf": [{ "const": "$agent" }, { "type": "string", "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{40,60}$" }] }, "owner": { "type": "string", "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{40,60}$" } } } }, "require_distinct_owners": { "type": "boolean" }, "bind_run": { "type": "boolean" } } },
+        "scope": { "type": "string", "maxLength": 128, "pattern": "^(\\*|[a-z0-9_-]+(\\.[a-z0-9_-]+)*(\\.\\*)?)$" },
+        "arg": { "type": "string", "pattern": "^[A-Za-z0-9_]{1,64}$" },
+        "cert": { "type": "object", "required": ["v", "issuer", "subject", "scopes", "exp", "sig"], "additionalProperties": false, "properties": { "v": { "const": 1 }, "issuer": { "type": "string", "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{40,60}$" }, "subject": { "type": "string", "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{40,60}$" }, "scopes": { "type": "array", "minItems": 1, "maxItems": 64, "items": { "$ref": "#/$defs/scope" } }, "exp": { "type": "string", "minLength": 1, "maxLength": 64 }, "sig": { "type": "string", "pattern": "^ed25519:[0-9a-f]{128}$" } } },
+        "revocation": { "type": "object", "required": ["v", "type", "cert", "ts", "sig"], "additionalProperties": false, "properties": { "v": { "const": 1 }, "type": { "const": "revocation" }, "cert": { "$ref": "#/$defs/cert" }, "ts": { "type": "string", "minLength": 1, "maxLength": 64 }, "sig": { "type": "string", "pattern": "^ed25519:[0-9a-f]{128}$" } } },
+        "link": { "type": "object", "required": ["agent", "scopes", "spend_limit"], "additionalProperties": false, "properties": { "agent": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" }, "scopes": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "$ref": "#/$defs/scope" } }, "spend_limit": { "type": "object", "required": ["amount_minor", "currency"], "additionalProperties": false, "properties": { "amount_minor": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "currency": { "type": "string", "pattern": "^[A-Z]{3}$" } } } } },
+        "text": {
+            "type": "object",
+            "required": ["en", "ar"],
+            "additionalProperties": false,
+            "properties": {
+                "en": { "type": "string", "minLength": 1, "maxLength": 4000 },
+                "ar": { "type": "string", "minLength": 1, "maxLength": 4000 }
+            }
+        },
+        "rubric": {
+            "type": "object",
+            "required": ["id", "title", "pass", "fail"],
+            "additionalProperties": false,
+            "properties": {
+                "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" },
+                "title": { "$ref": "#/$defs/text" },
+                "pass": { "$ref": "#/$defs/text" },
+                "fail": { "$ref": "#/$defs/text" }
+            }
+        },
+        "case": {
+            "type": "object",
+            "required": ["id", "category", "lang", "turns", "check"],
+            "additionalProperties": false,
+            "properties": {
+                "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,95}$" },
+                "category": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" },
+                "profiles": { "$ref": "#/$defs/profileRefs" },
+                "lang": { "enum": ["en", "ar", "ar-gulf"] },
+                "turns": {
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": 20,
+                    "items": {
+                        "type": "object",
+                        "required": ["role", "content"],
+                        "additionalProperties": false,
+                        "properties": {
+                            "role": { "enum": ["user", "assistant"] },
+                            "content": { "type": "string", "minLength": 1, "maxLength": 20000 }
+                        }
+                    }
+                },
+                "documents": {
+                    "type": "array",
+                    "maxItems": 10,
+                    "items": {
+                        "type": "object",
+                        "required": ["name", "text"],
+                        "additionalProperties": false,
+                        "properties": {
+                            "name": { "type": "string", "minLength": 1, "maxLength": 200 },
+                            "text": { "type": "string", "minLength": 1, "maxLength": 100000 }
+                        }
+                    }
+                },
+                "tools": {
+                    "type": "array",
+                    "maxItems": 64,
+                    "items": {
+                        "type": "object",
+                        "required": ["type", "function"],
+                        "additionalProperties": false,
+                        "properties": {
+                            "type": { "const": "function" },
+                            "function": {
+                                "type": "object",
+                                "required": ["name"],
+                                "properties": {
+                                    "name": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                                    "description": { "type": "string", "maxLength": 2000 },
+                                    "parameters": { "type": "object" }
+                                }
+                            }
+                        }
+                    }
+                },
+                "delegation": { "type": "object", "required": ["chain", "tools"], "additionalProperties": false, "properties": { "chain": { "type": "array", "minItems": 1, "maxItems": 8, "items": { "$ref": "#/$defs/link" } }, "tools": { "type": "array", "maxItems": 64, "items": { "type": "object", "required": ["name", "scope"], "additionalProperties": false, "properties": { "name": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" }, "scope": { "$ref": "#/$defs/scope" }, "amount": { "$ref": "#/$defs/arg" }, "currency": { "$ref": "#/$defs/arg" } } } }, "certs": { "type": "array", "minItems": 1, "maxItems": 8, "items": { "$ref": "#/$defs/cert" } }, "revocations": { "type": "array", "minItems": 1, "maxItems": 64, "items": { "$ref": "#/$defs/revocation" } } } },
+                "sub_agent": { "type": "object", "required": ["agent", "tool", "scopes"], "additionalProperties": false, "properties": { "agent": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" }, "tool": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" }, "scopes": { "$ref": "#/$defs/arg" }, "amount": { "$ref": "#/$defs/arg" } } },
+                "check": { "$ref": "#/$defs/check" }
+            }
+        },
+        "check": {
+            "type": "object",
+            "required": ["kind"],
+            "additionalProperties": false,
+            "properties": {
+                "kind": { "enum": ["not_contains", "contains_any", "tool_not_called", "max_tool_calls", "all", "judged", "within_delegation", "no_scope_escalation", "team_receipt"] },
+                "values": {
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": 64,
+                    "items": { "type": "string", "minLength": 1, "maxLength": 2000 }
+                },
+                "tools": {
+                    "type": "array",
+                    "minItems": 1,
+                    "maxItems": 64,
+                    "uniqueItems": true,
+                    "items": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" }
+                },
+                "n": { "type": "integer", "minimum": 0, "maximum": 1000 },
+                "checks": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "$ref": "#/$defs/check" } },
+                "rubric": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,63}$" },
+                "tool": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "threshold": { "type": "integer", "minimum": 1, "maximum": 64 },
+                "invocation": { "enum": ["required", "optional"] },
+                "policy": { "$ref": "#/$defs/teamPolicy" },
+                "finding": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{0,63}$" }
+            }
+        }
+    }
+}

package/dist/scheme-authority.d.ts

@@ -0,0 +1,5 @@
+import { type SchemeLogsInput } from "./scheme-log.ts";
+export declare function schemeAuthority(log: SchemeLogsInput, owner: string | undefined, groups: Record<string, readonly unknown[]>): {
+    reasons: string[];
+    canceled: Set<string>;
+};

package/dist/scheme-authority.js

@@ -0,0 +1,15 @@
+// Optional complete, checkpoint-authenticated context for standalone authority consumers.
+import { jcsHash } from "@zanii/core";
+import { verifySchemeLogs } from "./scheme-log.js";
+import { isObj } from "./shared.js";
+import { withinVerificationBudget } from "./verification-bounds.js";
+export function schemeAuthority(log, owner, groups) {
+    if (!withinVerificationBudget({ log, groups }) || !isObj(log) || Object.keys(log).some(k => !["entries", "checkpoint", "previous", "witness", "appends", "ledgerReceipts"].includes(k)) || !Array.isArray(log?.entries) || log.entries.length > 10_000)
+        return { reasons: ["scheme authority context exceeds the verification budget"], canceled: new Set() };
+    const checked = verifySchemeLogs(log, { owner }), reasons = [...checked.reasons];
+    for (const [type, rows] of Object.entries(groups)) {
+        if (!Array.isArray(rows) || jcsHash(rows) !== jcsHash(log.entries.filter(e => isObj(e) && e.type === type)))
+            reasons.push(`supplied ${type} history differs from the authenticated scheme log`);
+    }
+    return { reasons, canceled: new Set(reasons.length ? [] : checked.canceled ?? []) };
+}

package/dist/scheme-entry.d.ts

@@ -0,0 +1,25 @@
+import { type LicenceState } from "./licence.ts";
+export declare const MAX_SCHEME_ENTRY_BYTES = 1048576;
+export interface SchemeEntryContext {
+    owner: string;
+    /** Already authenticated newest board and the head of this entry's type. */
+    board: Record<string, unknown> | null;
+    head: {
+        size: number;
+        hash: string;
+        effective_at: string | null;
+    } | null;
+    maxSignedEffective: string | null;
+    release: (hash: string) => Record<string, unknown> | undefined;
+    released: (subject: string) => boolean;
+    withdrawn: (release: string) => boolean;
+    licenceState: (hash: string) => LicenceState;
+    statusIssuers?: readonly string[];
+}
+export interface SchemeEntryCheck {
+    ok: boolean;
+    reasons: string[];
+    effectiveAt?: string;
+    licenceState?: LicenceState;
+}
+export declare function verifySchemeEntry(doc: unknown, c: SchemeEntryContext): SchemeEntryCheck;

package/dist/scheme-entry.js

@@ -0,0 +1,85 @@
+// One authenticated extension of a previously verified semantic prefix. The caller commits the
+// entry and its returned state atomically; lookups must contain ONLY that verified prefix.
+import { jcsHash, verifySignedObject } from "@zanii/core";
+import { boardFieldError, boardSignedReasons, isBoard, isRelease, isWithdrawal, releaseFieldError, signersOf, subjectKey, withdrawalFieldError } from "./board.js";
+import { licenceStatusFieldError } from "./licence.js";
+import { isBodyRegister, registerFieldError } from "./register.js";
+import { isObj, ms } from "./shared.js";
+import { signingIdentityReasons } from "./signing-identity.js";
+import { withinVerificationBudget } from "./verification-bounds.js";
+export const MAX_SCHEME_ENTRY_BYTES = 1_048_576;
+export function verifySchemeEntry(doc, c) {
+    const reasons = [];
+    const out = (extra = {}) => ({ ok: reasons.length === 0, reasons, ...extra });
+    if (!withinVerificationBudget(doc, { maxBytes: MAX_SCHEME_ENTRY_BYTES, maxNodes: 100_000 }))
+        return { ok: false, reasons: ["scheme entry exceeds the JSON verification budget"] };
+    if (!isObj(doc))
+        return { ok: false, reasons: ["not a scheme log entry"] };
+    const board = Boolean(isBoard(doc)), release = Boolean(isRelease(doc)), withdrawal = Boolean(isWithdrawal(doc)), register = Boolean(isBodyRegister(doc));
+    const status = doc.v === 1 && doc.type === "certify.licence-status" && Object.keys(doc).length === ("for_cause" in doc || "effective_at" in doc ? 12 : 10);
+    if (!board && !release && !withdrawal && !register && !status)
+        return { ok: false, reasons: ["not a scheme log entry (v1)"] };
+    if (c.statusIssuers !== undefined)
+        reasons.push(...signingIdentityReasons(c.owner, [], c.statusIssuers));
+    const err = board ? boardFieldError(doc) : release ? releaseFieldError(doc) : withdrawal ? withdrawalFieldError(doc) : register ? registerFieldError(doc) : licenceStatusFieldError(doc);
+    if (err) {
+        reasons.push(`entry is malformed: ${err}`);
+        return out();
+    }
+    const count = c.head?.size ?? 0;
+    if (!Number.isSafeInteger(count) || count < 0 || doc.seq !== count)
+        reasons.push(`entry is not at position ${count}`);
+    if (doc.prev !== (c.head?.hash ?? null))
+        reasons.push("entry does not name the previous entry of its type");
+    const effectiveAt = (status ? doc.at : doc.effective_from);
+    if (c.head?.effective_at && !(board || register ? ms(effectiveAt) > ms(c.head.effective_at) : ms(effectiveAt) >= ms(c.head.effective_at)))
+        reasons.push(board ? "board does not take effect after the previous board" : register ? "register does not take effect after the previous register" : "entry takes effect before the previous entry");
+    if (board) {
+        if (doc.owner !== c.owner)
+            reasons.push("the board log is not the trusted scheme owner's");
+        if (count && !c.board)
+            reasons.push("the authenticated previous board is missing");
+        if (c.maxSignedEffective && !(ms(effectiveAt) > ms(c.maxSignedEffective)))
+            reasons.push("the board does not take effect after every board-signed entry appended before it");
+        const allowed = count === 0 ? [c.owner] : (c.board?.members ?? []);
+        const need = count === 0 ? 1 : Number(c.board?.threshold ?? 1);
+        const signatures = signersOf(doc, allowed);
+        if (!signatures.wellFormed)
+            reasons.push("board carries a signature that is malformed, invalid or not by an authorised signer");
+        if (signatures.signers.length < need)
+            reasons.push(`board is signed by ${signatures.signers.length} of the ${need} previous board members required`);
+    }
+    else if (status) {
+        if (!verifySignedObject(doc) || doc.signer !== c.owner)
+            reasons.push("licence status entry is not signed by the scheme owner");
+        const previous = c.licenceState(doc.licence);
+        const allowed = doc.action === "suspend" ? previous === "active" : doc.action === "reinstate" ? previous === "suspended" : previous !== "withdrawn";
+        if (!allowed)
+            reasons.push(`entry cannot ${String(doc.action)} a licence that is ${previous}`);
+        return out({ effectiveAt, licenceState: doc.action === "suspend" ? "suspended" : doc.action === "reinstate" ? "active" : "withdrawn" });
+    }
+    else {
+        if (!c.board)
+            reasons.push("a board-signed entry is appended before any board");
+        else if (doc.board !== jcsHash(c.board))
+            reasons.push("entry is not signed by the newest board when it was appended");
+        else
+            reasons.push(...boardSignedReasons(doc, [c.board], release ? "release" : withdrawal ? "withdrawal" : "body register"));
+        if (release && c.released(subjectKey(doc.subject)))
+            reasons.push(`entry releases ${subjectKey(doc.subject)} again`);
+        if (withdrawal) {
+            const prior = c.release(doc.release);
+            if (!prior)
+                reasons.push("withdrawal names a release that is not in the release log");
+            else {
+                if (subjectKey(prior.subject) !== subjectKey(doc.subject))
+                    reasons.push("withdrawal subject is not the release's subject");
+                if (!(ms(effectiveAt) >= ms(prior.effective_from)))
+                    reasons.push("withdrawal takes effect before the release");
+            }
+            if (c.withdrawn(doc.release))
+                reasons.push("withdrawal withdraws a release again");
+        }
+    }
+    return out({ effectiveAt });
+}

package/dist/scheme-history.d.ts

@@ -0,0 +1,5 @@
+import { type SchemeAppendStatement, type SchemeLogsInput } from "./scheme-log.ts";
+export declare function schemeHistoryReasons(input: SchemeLogsInput, owner: string | undefined, statusIssuers?: readonly string[], prepared?: readonly SchemeAppendStatement[]): {
+    reasons: string[];
+    canceled: string[];
+};

package/dist/scheme-history.js

@@ -0,0 +1,87 @@
+// Transition-aware semantic replay. The enclosing verifier authenticates the final checkpoint.
+import { jcsHash, receiptHash } from "@zanii/core";
+import {} from "./licence.js";
+import { verifySchemeEntry } from "./scheme-entry.js";
+import {} from "./scheme-log.js";
+import { schemePrefixStatements } from "./scheme-merkle.js";
+import { verifySchemeTransition } from "./scheme-transition.js";
+import { isObj, ms } from "./shared.js";
+import { withinVerificationBudget } from "./verification-bounds.js";
+export function schemeHistoryReasons(input, owner, statusIssuers, prepared) {
+    if (!owner || !Array.isArray(input.entries) || input.entries.length > 10_000 || !withinVerificationBudget(input))
+        return { reasons: ["transition-aware scheme history needs a trusted owner and at most 10000 bounded entries"], canceled: [] };
+    const reasons = [], canceled = new Set(), records = new Map();
+    const heads = new Map(), states = new Map();
+    const withdrawals = new Map();
+    const subjects = new Set();
+    let board = null, maximum = null;
+    const receipts = new Map((Array.isArray(input.ledgerReceipts) ? input.ledgerReceipts : []).filter(isObj).map((r) => [receiptHash(r), r]));
+    const statements = prepared ?? schemePrefixStatements(input.entries, owner);
+    const active = (hash) => canceled.has(hash) ? undefined : records.get(hash);
+    const withdrawn = (hash) => { const digest = withdrawals.get(hash); return digest !== undefined && !canceled.has(digest); };
+    const rebuildEffective = () => {
+        maximum = null;
+        for (const [type, head] of heads) {
+            if (!["certify.release", "certify.release-withdrawal", "certify.body-register"].includes(type))
+                continue;
+            head.effective_at = null;
+        }
+        for (const [hash, e] of records)
+            if (!canceled.has(hash) && ["certify.release", "certify.release-withdrawal", "certify.body-register"].includes(e.type)) {
+                const at = e.effective_from;
+                if (!maximum || ms(at) > ms(maximum))
+                    maximum = at;
+                heads.get(e.type).effective_at = at;
+            }
+    };
+    const anchor = (index) => {
+        const append = input.appends?.[index];
+        const receipt = isObj(append) ? receipts.get(append.ledger_receipt) : undefined;
+        return statements[index] ? { statement: statements[index], append, receipt } : undefined;
+    };
+    for (let i = 0; i < input.entries.length; i++) {
+        const e = input.entries[i];
+        if (!isObj(e)) {
+            reasons.push(`entry ${i} is not a scheme entry`);
+            break;
+        }
+        if (e.type === "certify.board-transition") {
+            const next = input.entries[i + 1];
+            const previous = input.appends?.[i - 1];
+            const checked = verifySchemeTransition(e, { owner, board, nextBoard: next, index: i, previousAt: isObj(previous) ? previous.anchored_at : "", entry: active, anchor: anchor(i), nextAnchor: i + 1 < input.entries.length ? anchor(i + 1) : undefined });
+            reasons.push(...checked.reasons.map((r) => `entry ${i}: ${r}`));
+            if (!checked.ok)
+                break;
+            for (const hash of checked.canceled)
+                canceled.add(hash);
+            // A canceled release cannot leave an uncanceled withdrawal referring to it.
+            for (const [hash, prior] of records)
+                if (!canceled.has(hash) && prior.type === "certify.release-withdrawal" && canceled.has(prior.release))
+                    reasons.push(`entry ${i}: dependent future withdrawal must be explicitly canceled with its release`);
+            rebuildEffective();
+            records.set(jcsHash(e), e);
+            continue;
+        }
+        const check = verifySchemeEntry(e, { owner, board, head: heads.get(e.type) ?? null, maxSignedEffective: maximum, statusIssuers,
+            release: active, released: (subject) => subjects.has(subject), withdrawn, licenceState: (hash) => states.get(hash) ?? "active" });
+        reasons.push(...check.reasons.map((r) => `entry ${i}: ${r}`));
+        if (!check.ok)
+            break;
+        const hash = jcsHash(e), type = e.type;
+        records.set(hash, e);
+        heads.set(type, { size: Number(e.seq) + 1, hash, effective_at: check.effectiveAt });
+        if (type === "certify.board")
+            board = e;
+        if (type === "certify.release") {
+            const s = e.subject;
+            subjects.add(`${s.kind} ${s.ref}`);
+        }
+        if (type === "certify.release-withdrawal")
+            withdrawals.set(e.release, hash);
+        if (type === "certify.licence-status")
+            states.set(e.licence, check.licenceState);
+        if (["certify.release", "certify.release-withdrawal", "certify.body-register"].includes(type) && (!maximum || ms(check.effectiveAt) > ms(maximum)))
+            maximum = check.effectiveAt;
+    }
+    return { reasons, canceled: reasons.length ? [] : [...canceled].sort() };
+}

package/dist/scheme-log.d.ts

@@ -0,0 +1,98 @@
+import { type Receipt, type SignedTreeHead } from "@zanii/core";
+import { type Signer } from "./signer.ts";
+export declare const SCHEME_LOG_TYPES: readonly ["certify.board", "certify.release", "certify.licence-status", "certify.release-withdrawal", "certify.body-register", "certify.board-transition"];
+/** Section 2: the owner's signed tree head over the scheme log (leaf i = entry i). */
+export declare function schemeCheckpoint(entries: readonly unknown[], ts: string, signer: Signer): Promise<SignedTreeHead>;
+/** Section 2: the inclusion proof of entry `index` in the checkpoint over `entries`, hex. */
+export declare const schemeInclusionProof: (entries: readonly unknown[], index: number) => string[];
+/** Section 2: the proof that the log over `entries` extends its first `fromSize` entries, hex. */
+export declare const schemeConsistencyProof: (entries: readonly unknown[], fromSize: number) => string[];
+/** Section 2: one entry is at `index` of a checkpoint signed by the owner (a light client's check). */
+export declare function verifySchemeInclusion(entry: unknown, index: number, checkpoint: unknown, proof: unknown, opts?: {
+    owner?: string;
+}): {
+    ok: boolean;
+    reasons: string[];
+};
+/** Section 3: what the ledger receipt of an append commits to (`payload_hash` = jcsHash of it, `payload_encoding: jcs`). */
+export interface SchemeAppendStatement {
+    v: 1;
+    type: "certify.scheme-append";
+    /** The scheme owner's DID, the log id. */
+    log: string;
+    index: number;
+    /** jcsHash of the entry appended. */
+    entry: string;
+    /** The log after the append: index + 1 entries and their Merkle root. */
+    size: number;
+    root: string;
+}
+export type SchemeAppend = SchemeAppendStatement & {
+    /** receiptHash of the Zanii ledger receipt that anchors the append. */
+    ledger_receipt: string;
+    /** The ledger receipt's `ts`: the append time. */
+    anchored_at: string;
+    signer: string;
+    sig: string;
+};
+/** Section 3: the statement for entry `index` of `entries` (the server records it on the ledger). */
+export declare function schemeAppendStatement(entries: readonly unknown[], index: number, owner: string): SchemeAppendStatement;
+/** Section 3: the owner's append receipt for entry `index`, bound to the ledger receipt that anchors it. */
+export declare function buildSchemeAppend(entries: readonly unknown[], index: number, ledgerReceipt: Receipt, signer: Signer): Promise<SchemeAppend>;
+/** The bounded equivalent when the caller maintains authenticated Merkle subtrees. */
+export declare function buildSchemeAppendFromStatement(statement: SchemeAppendStatement, ledgerReceipt: Receipt, signer: Signer): Promise<SchemeAppend>;
+/** One append against the authenticated entry/tree prefix; no history arrays are needed. */
+export declare function verifySchemeAppend(statement: SchemeAppendStatement, entry: unknown, append: unknown, receipt: unknown, opts?: {
+    previousAt?: string | null;
+    ledger?: string | null;
+}): {
+    ok: boolean;
+    reasons: string[];
+};
+export interface SchemeLogsInput {
+    /** The scheme log in append order. */
+    entries: readonly unknown[];
+    /** The owner's newest checkpoint, over all of `entries`. */
+    checkpoint: unknown;
+    /** Checkpoints this verifier saw before, each with the consistency proof from it to `checkpoint`. */
+    previous?: readonly {
+        checkpoint: unknown;
+        proof: unknown;
+    }[];
+    /** Require `checkpoint` co-signed by k trusted witnesses. */
+    witness?: {
+        cosignatures: readonly unknown[];
+        trusted: readonly string[];
+        k: number;
+    };
+    /** One append receipt per entry. */
+    appends?: readonly unknown[];
+    /** The Zanii ledger receipts the appends name: each append time is then the ledger's. */
+    ledgerReceipts?: readonly unknown[];
+}
+export interface SchemeLogsCheck {
+    ok: boolean;
+    reasons: string[];
+    size: number;
+    /** Entries whose append is bound to a supplied ledger receipt. */
+    anchored: number;
+    /** With `appends`: each entry's append time. */
+    appended?: string[];
+    /** With `witness`: the trusted witnesses that co-signed the checkpoint. */
+    witnesses?: string[];
+    /** Transition-aware logs only: authenticated cancellation hashes; empty on any refusal. */
+    canceled?: string[];
+}
+/**
+ * Section 4: the scheme log verifies: each kind of entry forms its own log (governance-board.md,
+ * licensing.md, body-register.md); the append rules hold in leaf order (each board-signed entry by
+ * the newest board appended before it, each later board taking effect after every board-signed
+ * entry before it); the checkpoint is the owner's over exactly these entries and extends every
+ * previous one; with `witness`, k trusted witnesses co-signed it; with `appends`, each entry has the
+ * owner's append receipt with append times never going back; with `ledgerReceipts`, each append is
+ * bound to its ledger receipt.
+ */
+export declare function verifySchemeLogs(input: SchemeLogsInput, opts?: {
+    owner?: string;
+    statusIssuers?: readonly string[];
+}): SchemeLogsCheck;