@zanii/certify 0.0.0-stage → 0.6.0

package/dist/identity.d.ts

@@ -0,0 +1,79 @@
+import { type OwnerAttestation, type OwnerDoc } from "@zanii/kyb";
+import { type Signer } from "./signer.ts";
+import { type AssuranceStatusPolicy } from "./assurance-status.ts";
+export interface AgentBinding {
+    v: 1;
+    type: "certify.agent-binding";
+    applicant: string;
+    legal_name: string;
+    domain: string;
+    /** attestationHash of the applicant owner's @zanii/kyb attestation. */
+    kyb: string;
+    agent: string;
+    bound_at: string;
+    valid_until: string;
+    signer: string;
+    sig: string;
+}
+export interface AgentBindingInput {
+    /** The applicant record id. */
+    applicant: string;
+    /** The owner's attestation; legal name and domain are taken from it. */
+    attestation: OwnerAttestation;
+    agent: string;
+    boundAt: string;
+    validUntil: string;
+}
+/** Section 2: the lab binds an agent DID to an applicant whose attestation verifies. */
+export declare function buildAgentBinding(f: AgentBindingInput, signer: Signer): Promise<AgentBinding>;
+/**
+ * Section 3: the applicant another binding in `bindings` (the lab's) holds `agent` for at `now`,
+ * or null. An agent DID is bound to one applicant at a time.
+ */
+export declare function boundElsewhere(bindings: readonly unknown[], agent: string, applicant: string, now: string): string | null;
+export interface AgentBindingVerifyOptions {
+    /** The lab DIDs that sign bindings (the issuer document's `dids`). */
+    signers?: readonly string[];
+    /** The owner's attestation the binding names. */
+    attestation?: OwnerAttestation;
+    /** The applicant domain's `.well-known/zanii-owner.json`. */
+    ownerDoc?: OwnerDoc | null;
+    now?: string;
+    /** The lab's other bindings: an agent bound to another applicant at `now` is refused. */
+    bindings?: readonly unknown[];
+    /** Require fresh purpose-bound lab status, including retained epoch/revocation evidence. */
+    bindingStatus?: AssuranceStatusPolicy;
+}
+/** Section 3: the binding's signature and fields, its validity at `now` and, when supplied, the two-way @zanii/kyb check. */
+export declare function verifyAgentBinding(doc: unknown, opts?: AgentBindingVerifyOptions): {
+    ok: boolean;
+    reasons: string[];
+};
+export interface KybProof {
+    v: 1;
+    type: "certify.kyb-proof";
+    /** The applicant record id the attestation is submitted for. */
+    applicant: string;
+    /** The lab's single-use challenge. */
+    nonce: string;
+    /** attestationHash of the attestation submitted with it. */
+    kyb: string;
+    /** The attestation's owner DID. */
+    signer: string;
+    sig: string;
+}
+/** Section 4: the owner key answers the lab's challenge for one applicant and one attestation. */
+export declare function buildKybProof(f: {
+    applicant: string;
+    nonce: string;
+    attestation: OwnerAttestation;
+}, ownerSigner: Signer): Promise<KybProof>;
+/** Section 4: the proof answers `nonce` for `applicant`, signed by the owner DID of `attestation`, naming it. */
+export declare function verifyKybProof(doc: unknown, opts: {
+    attestation: OwnerAttestation;
+    applicant: string;
+    nonce: string;
+}): {
+    ok: boolean;
+    reasons: string[];
+};

package/dist/identity.js

@@ -0,0 +1,146 @@
+// spec/identity.md: the applicant's legal identity (@zanii/kyb: the domain's
+// `.well-known/zanii-owner.json` and the owner's signed attestation) and the lab-signed binding of
+// each agent DID to that applicant.
+import { verifySignedObject } from "@zanii/core";
+import { attestationHash, verifyOwnerAttestation, verifyOwnerBinding } from "@zanii/kyb";
+import { DOMAIN } from "./certificate.js";
+import { isDid, isIso, isObj, isSha, ms } from "./shared.js";
+import { signWith } from "./signer.js";
+import { verifyAssuranceStatus } from "./assurance-status.js";
+import { withinVerificationBudget } from "./verification-bounds.js";
+const RECORD_ID = /^[a-z]{3}_[a-z2-7]{24}$/;
+function bindingError(b) {
+    if (typeof b.applicant !== "string" || !RECORD_ID.test(b.applicant))
+        return "applicant must be a record id";
+    if (typeof b.legal_name !== "string" || b.legal_name.length < 1 || b.legal_name.length > 200)
+        return "legal_name must be 1 to 200 characters";
+    if (typeof b.domain !== "string" || !DOMAIN.test(b.domain))
+        return "domain must be a lower-case DNS name";
+    if (!isSha(b.kyb))
+        return "kyb must be an attestation hash";
+    if (!isDid(b.agent))
+        return "agent must be a did:key";
+    if (!isIso(b.bound_at) || !isIso(b.valid_until) || !(ms(b.valid_until) > ms(b.bound_at)))
+        return "bound_at and valid_until must be ISO timestamps, valid_until after bound_at";
+    return null;
+}
+/** Section 2: the lab binds an agent DID to an applicant whose attestation verifies. */
+export async function buildAgentBinding(f, signer) {
+    if (!verifyOwnerAttestation(f.attestation))
+        throw new Error("the KYB attestation is not validly signed by its DID");
+    const unsigned = {
+        v: 1,
+        type: "certify.agent-binding",
+        applicant: f.applicant,
+        legal_name: f.attestation.entity.name,
+        domain: f.attestation.domain,
+        kyb: attestationHash(f.attestation),
+        agent: f.agent,
+        bound_at: f.boundAt,
+        valid_until: f.validUntil,
+    };
+    const err = bindingError(unsigned);
+    if (err)
+        throw new Error(err);
+    return signWith(unsigned, signer);
+}
+const inForce = (b, now) => ms(b.bound_at) <= now && now < ms(b.valid_until);
+/**
+ * Section 3: the applicant another binding in `bindings` (the lab's) holds `agent` for at `now`,
+ * or null. An agent DID is bound to one applicant at a time.
+ */
+export function boundElsewhere(bindings, agent, applicant, now) {
+    const t = ms(now);
+    for (const b of bindings)
+        if (isObj(b) && b.agent === agent && b.applicant !== applicant && verifySignedObject(b) && inForce(b, t))
+            return String(b.applicant);
+    return null;
+}
+/** Section 3: the binding's signature and fields, its validity at `now` and, when supplied, the two-way @zanii/kyb check. */
+export function verifyAgentBinding(doc, opts = {}) {
+    if (opts.bindingStatus !== undefined && (!withinVerificationBudget({ doc, opts }, { maxBytes: 4_194_304 }) || !isObj(opts.bindingStatus)))
+        return { ok: false, reasons: ["strict binding evidence exceeds its JSON budget or has an invalid status policy"] };
+    const b = isObj(doc) ? doc : {};
+    if (b.v !== 1 || b.type !== "certify.agent-binding" || Object.keys(b).length !== 11)
+        return { ok: false, reasons: ["not an agent binding (v1)"] };
+    const reasons = [];
+    if (!verifySignedObject(b))
+        reasons.push("bad agent binding signature");
+    const err = bindingError(b);
+    if (err)
+        reasons.push(`agent binding is malformed: ${err}`);
+    if (!opts.signers)
+        reasons.push("no trusted signers supplied: the signer was NOT checked");
+    else if (!opts.signers.includes(b.signer))
+        reasons.push("agent binding signer is not a trusted lab key");
+    const now = opts.now ? ms(opts.now) : Date.now();
+    if (opts.bindingStatus !== undefined)
+        reasons.push(...verifyAssuranceStatus(opts.bindingStatus.document, { ...opts.bindingStatus, purpose: "agent-binding", artifact: doc, now: opts.now ?? new Date(now).toISOString() }).reasons);
+    if (now < ms(b.bound_at))
+        reasons.push("agent binding is not yet in force");
+    if (now >= ms(b.valid_until))
+        reasons.push(`agent binding expired on ${String(b.valid_until)}`);
+    const a = opts.attestation;
+    if (!a)
+        reasons.push("no KYB attestation supplied: the applicant identity was NOT checked");
+    else {
+        if (attestationHash(a) !== b.kyb)
+            reasons.push("the KYB attestation is not the one the binding names");
+        else if (a.domain !== b.domain || a.entity?.name !== b.legal_name)
+            reasons.push("the KYB attestation names another domain or legal name");
+        if (opts.ownerDoc === undefined)
+            reasons.push("no owner document supplied: the domain side was NOT checked");
+        else
+            reasons.push(...verifyOwnerBinding(a, opts.ownerDoc).reasons.map((r) => `kyb: ${r}`));
+    }
+    if (opts.bindings && typeof b.agent === "string") {
+        const other = boundElsewhere(opts.bindings, b.agent, String(b.applicant), opts.now ?? new Date().toISOString());
+        if (other)
+            reasons.push(`agent is already bound to applicant ${other}`);
+    }
+    return { ok: reasons.length === 0, reasons };
+}
+const NONCE = /^[A-Za-z0-9_-]{16,128}$/;
+function proofError(p) {
+    if (typeof p.applicant !== "string" || !RECORD_ID.test(p.applicant))
+        return "applicant must be a record id";
+    if (typeof p.nonce !== "string" || !NONCE.test(p.nonce))
+        return "nonce must be 16 to 128 base64url characters";
+    if (!isSha(p.kyb))
+        return "kyb must be an attestation hash";
+    return null;
+}
+/** Section 4: the owner key answers the lab's challenge for one applicant and one attestation. */
+export async function buildKybProof(f, ownerSigner) {
+    if (!verifyOwnerAttestation(f.attestation))
+        throw new Error("the KYB attestation is not validly signed by its DID");
+    const unsigned = { v: 1, type: "certify.kyb-proof", applicant: f.applicant, nonce: f.nonce, kyb: attestationHash(f.attestation) };
+    const err = proofError(unsigned);
+    if (err)
+        throw new Error(err);
+    const proof = (await signWith(unsigned, ownerSigner));
+    if (proof.signer !== f.attestation.did)
+        throw new Error("the proof is signed by the attestation's owner key");
+    return proof;
+}
+/** Section 4: the proof answers `nonce` for `applicant`, signed by the owner DID of `attestation`, naming it. */
+export function verifyKybProof(doc, opts) {
+    const p = isObj(doc) ? doc : {};
+    if (p.v !== 1 || p.type !== "certify.kyb-proof" || Object.keys(p).length !== 7)
+        return { ok: false, reasons: ["not a KYB proof (v1)"] };
+    const reasons = [];
+    if (!verifySignedObject(p))
+        reasons.push("bad KYB proof signature");
+    const err = proofError(p);
+    if (err)
+        reasons.push(`KYB proof is malformed: ${err}`);
+    if (p.signer !== opts.attestation?.did)
+        reasons.push("the KYB proof is not signed by the attestation's owner DID");
+    if (!isObj(opts.attestation) || p.kyb !== attestationHash(opts.attestation))
+        reasons.push("the KYB proof names another attestation");
+    if (p.applicant !== opts.applicant)
+        reasons.push("the KYB proof is for another applicant");
+    if (p.nonce !== opts.nonce)
+        reasons.push("the KYB proof answers another challenge");
+    return { ok: reasons.length === 0, reasons };
+}

package/dist/impartiality.d.ts

@@ -0,0 +1,47 @@
+export interface Staff {
+    testers: readonly string[];
+    /** Null only at Level 1 (automated, no human review). */
+    reviewer: string | null;
+    decider: string;
+    /** Section 3a: the person handling an appeal or complaint, when one is checked. */
+    handler?: string | null;
+}
+export declare const REFUSALS: readonly ["DECIDER_IS_REVIEWER", "DECIDER_IS_TESTER", "DECIDER_CONFLICTED", "REVIEWER_CONFLICTED", "REVIEWER_IS_TESTER", "DECIDER_COOLING_OFF", "REVIEWER_COOLING_OFF", "TESTER_COOLING_OFF", "HANDLER_COOLING_OFF"];
+export type Refusal = (typeof REFUSALS)[number];
+/** Section 3a: one period a person worked on an applicant's product (`to` null while it lasts). */
+export interface Engagement {
+    staff: string;
+    applicant: string;
+    from: string;
+    to: string | null;
+}
+export interface CoolingOff {
+    /** The applicant whose work is being staffed. */
+    applicant: string;
+    engagements: readonly Engagement[];
+    now: string;
+}
+export declare const COOLING_OFF_YEARS = 2;
+/**
+ * Why this staffing must be refused, in REFUSALS order; empty when it may proceed. `conflicted`
+ * lists every person (DID) with a declared conflict on the applicant; `coolingOff`, when given,
+ * the engagement history the two-year rule reads.
+ */
+export declare function staffRefusals(staff: Staff, conflicted: readonly string[], coolingOff?: CoolingOff): Refusal[];
+/** governance.md section 3b: one committee seat, internal or external, held from `from` until `to` (null: still held). */
+export interface CommitteeMember {
+    did: string;
+    external: boolean;
+    from: string;
+    to: string | null;
+}
+export declare const COMMITTEE_MIN_EXTERNAL = 2;
+/**
+ * governance.md section 3b: may the committee act at `now`? At least two active external members.
+ * `external` lists them, sorted.
+ */
+export declare function committeeQuorum(members: readonly CommitteeMember[], now: string): {
+    ok: boolean;
+    reasons: string[];
+    external: string[];
+};

package/dist/impartiality.js

@@ -0,0 +1,85 @@
+// spec/impartiality.md section 3: the refusal rules the software enforces; section 3a the
+// two-year cooling-off; spec/governance.md section 3b the committee quorum.
+import { isDid, ms } from "./shared.js";
+export const REFUSALS = [
+    "DECIDER_IS_REVIEWER",
+    "DECIDER_IS_TESTER",
+    "DECIDER_CONFLICTED",
+    "REVIEWER_CONFLICTED",
+    "REVIEWER_IS_TESTER",
+    "DECIDER_COOLING_OFF",
+    "REVIEWER_COOLING_OFF",
+    "TESTER_COOLING_OFF",
+    "HANDLER_COOLING_OFF",
+];
+export const COOLING_OFF_YEARS = 2;
+/** `t` plus whole calendar years in UTC (29 February moves to 1 March), in ms; NaN when not a timestamp. */
+const yearsAfter = (t, years) => {
+    const v = ms(t);
+    if (Number.isNaN(v))
+        return v;
+    const d = new Date(v);
+    d.setUTCFullYear(d.getUTCFullYear() + years);
+    return d.getTime();
+};
+/**
+ * Section 3a: is `did` within two years of the end of an engagement with the applicant (or in
+ * one)? An engagement whose dates are not timestamps counts, so malformed history refuses.
+ */
+function cooling(did, c, now) {
+    if (!c || !did)
+        return false;
+    return c.engagements.some((e) => {
+        if (e.staff !== did || e.applicant !== c.applicant)
+            return false;
+        const until = e.to === null ? Number.POSITIVE_INFINITY : yearsAfter(e.to, COOLING_OFF_YEARS);
+        return !(ms(e.from) > now) && !(now >= until);
+    });
+}
+/**
+ * Why this staffing must be refused, in REFUSALS order; empty when it may proceed. `conflicted`
+ * lists every person (DID) with a declared conflict on the applicant; `coolingOff`, when given,
+ * the engagement history the two-year rule reads.
+ */
+export function staffRefusals(staff, conflicted, coolingOff) {
+    const out = [];
+    if (staff.reviewer !== null && staff.decider === staff.reviewer)
+        out.push("DECIDER_IS_REVIEWER");
+    if (staff.testers.includes(staff.decider))
+        out.push("DECIDER_IS_TESTER");
+    if (conflicted.includes(staff.decider))
+        out.push("DECIDER_CONFLICTED");
+    if (staff.reviewer !== null && conflicted.includes(staff.reviewer))
+        out.push("REVIEWER_CONFLICTED");
+    if (staff.reviewer !== null && staff.testers.includes(staff.reviewer))
+        out.push("REVIEWER_IS_TESTER");
+    if (coolingOff === undefined)
+        return out;
+    const now = ms(coolingOff.now);
+    if (Number.isNaN(now) || typeof coolingOff.applicant !== "string" || !Array.isArray(coolingOff.engagements))
+        throw new Error("coolingOff needs an applicant, engagements and an ISO now");
+    if (cooling(staff.decider, coolingOff, now))
+        out.push("DECIDER_COOLING_OFF");
+    if (cooling(staff.reviewer, coolingOff, now))
+        out.push("REVIEWER_COOLING_OFF");
+    if (staff.testers.some((t) => cooling(t, coolingOff, now)))
+        out.push("TESTER_COOLING_OFF");
+    if (cooling(staff.handler, coolingOff, now))
+        out.push("HANDLER_COOLING_OFF");
+    return out;
+}
+export const COMMITTEE_MIN_EXTERNAL = 2;
+/** The members holding their seat at `now` (`from` at or before it, `to` after it or null). */
+const active = (members, now) => members.filter((m) => isDid(m?.did) && ms(m.from) <= now && (m.to === null || now < ms(m.to)));
+/**
+ * governance.md section 3b: may the committee act at `now`? At least two active external members.
+ * `external` lists them, sorted.
+ */
+export function committeeQuorum(members, now) {
+    const t = ms(now);
+    if (Number.isNaN(t) || !Array.isArray(members))
+        throw new Error("committeeQuorum needs members and an ISO now");
+    const external = [...new Set(active(members, t).filter((m) => m.external === true).map((m) => m.did))].sort((a, b) => (a < b ? -1 : 1));
+    const ok = external.length >= COMMITTEE_MIN_EXTERNAL;
+    return { ok, reasons: ok ? [] : [`the committee has ${external.length} active external members; at least ${COMMITTEE_MIN_EXTERNAL} are needed`], external };
+}

package/dist/index.d.ts

@@ -0,0 +1,61 @@
+export { BEACON_INTERVAL_MS, type BeaconHandle, type BeaconOptions, type BeaconResult, startBeacon, } from "./beacon-client.ts";
+export { AUDIT_OUTCOMES, auditLapsed, type AuditAttestation, type AuditCheck, type AuditInput, type AuditOutcome, buildAuditAttestation, CONTROL, verifyAuditAttestation, } from "./audit.ts";
+export { type ApplianceAttestation, type ApplianceCheck, applianceChallenge, type ApplianceEnrolment, type ApplianceExport, type ApplianceExportInput, type ApplianceUpdate, buildApplianceEnrolment, buildApplianceExport, buildApplianceUpdate, type EvidenceHead, labKeyId, openApplianceExport, type SealedTranscripts, sealTranscripts, verifyApplianceExport, verifyApplianceUpdate, } from "./appliance.ts";
+export { type Board, type BoardBody, type BoardCheck, type BoardInput, type BodySignature, boardBody, bodySignature, buildBoard, buildRelease, RELEASE_KINDS, type Release, type ReleaseBody, type ReleaseInput, type ReleaseKind, type ReleaseSubject, releaseBody, requireRelease, signersOf, verifyBoardAppend, verifyBoardLog, verifyRelease, verifyReleaseAppend, verifyReleaseLog, buildReleaseWithdrawal, type ReleaseWithdrawal, type ReleaseWithdrawalBody, type ReleaseWithdrawalInput, releaseWithdrawalBody, verifyWithdrawalLog, WITHDRAWAL_REASONS, type WithdrawalReason, withdrawalFlags, withSignatures, } from "./board.ts";
+export { type BodyRegister, type BodyRegisterBody, type BodyRegisterInput, type BodyRegisterOptions, bodyRegisterAt, bodyRegisterBody, buildBodyRegister, type RegisteredBody, trustedBodiesAt, verifyBodyRegisterLog, } from "./register.ts";
+export { buildSchemeAppend, SCHEME_LOG_TYPES, type SchemeAppend, type SchemeAppendStatement, type SchemeLogsCheck, type SchemeLogsInput, schemeAppendStatement, schemeCheckpoint, schemeConsistencyProof, schemeInclusionProof, verifySchemeInclusion, verifySchemeLogs, } from "./scheme-log.ts";
+export { MAX_SCHEME_ENTRY_BYTES, verifySchemeEntry, type SchemeEntryContext, type SchemeEntryCheck } from "./scheme-entry.ts";
+export { verifySchemeEffectiveTime, type SchemeTimingPolicy, type SchemeTimingCode, type SchemeTimingCheck } from "./scheme-timing.ts";
+export { withinVerificationBudget } from "./verification-bounds.ts";
+export { buildSchemeTransition, verifySchemeTransition, verifySchemeTransitionProposal, type SchemeTransition, type SchemeTransitionBody, type SchemeTransitionContext, type SchemeTransitionAnchor } from "./scheme-transition.ts";
+export { buildSchemeAppendFromStatement, verifySchemeAppend } from "./scheme-log.ts";
+export { FEED_SNAPSHOT_CHUNK_ENTRIES, MAX_FEED_SNAPSHOT_BYTES, MAX_FEED_SNAPSHOT_CHUNK_BYTES, feedSnapshotFrontier, buildFeedSnapshot, verifyFeedSnapshot, feedSnapshotCursor, feedSnapshotChunkHash, verifyFeedSnapshotChunk, type FeedSnapshotNode, type FeedSnapshotManifest, type FeedSnapshotHeader, type FeedSnapshotCursor, type FeedSnapshotChunk } from "./feed-snapshot.ts";
+export { buildFeedPage, type FederatedFeed, type FeedCheck, type FeedConflict, type FeedEntry, type FeedPage, type FeedPageInput, type FeedCursor, feedCheckpoint, MAX_FEED_ENTRIES, MAX_FEED_PAGE_BYTES, type MergedRegistry, mergeFeeds, verifyFeed, verifyFeedPage, } from "./federation.ts";
+export { buildLicence, buildLicenceStatus, buildRoyaltyStatement, certificateListHash, countersignRoyaltyStatement, LICENCE_ACTIONS, LICENCE_REASONS, type Licence, type LicenceAction, type LicenceCheck, type LicenceInput, type LicenceOptions, type LicenceReason, type LicenceScope, type LicenceState, type LicenceStatus, licenceCoverage, licenceReasons, licensedKey, licenceStateAt, MAX_ROYALTY_MINOR, MAX_STATEMENT_CERTIFICATES, type RoyaltyStatement, type RoyaltyStatementBody, type RoyaltyStatementInput, verifyLicence, verifyLicenceLog, verifyRoyaltyStatement, } from "./licence.ts";
+export { type AttestedBeaconCheck, type BeaconAttestation, type BeaconCheck, type BeaconReport, beaconChallenge, buildBeacon, MAX_SKEW_SECONDS, NONCE, verifyAttestedBeacon, verifyBeacon, } from "./beacon.ts";
+export { type BundleInput, type ApplianceExecution, type ApplianceExportIdentity, type ApplianceExportBundle, type ApplianceExportBundleInput, bundleHash, buildBundle, buildApplianceExportBundle, type CategoryCount, type CategoryResult, type Evidence, type ResultBundle, type Assessment, } from "./bundle.ts";
+export { applianceExecution, applianceExportIdentity } from "./appliance-execution.ts";
+export { type CertificateCheck, type CertificateInput, type CertificateVerifyOptions, type CertifyClaim, type PqPolicy, CONFLICTS, type Conflict, certificateScope, claimReasons, issueCertificate, LEVELS, type Level, pickScheme, SCHEME, SCHEME_LEVELS, SCHEMES, type Scheme, SURVEILLANCE, VALIDITY_DAYS, verifyCertificate, } from "./certificate.ts";
+export { buildFingerprint, checkFingerprint, type Fingerprint, type FingerprintInput, promptSha256, sha256Bytes, toolsSha256, } from "./fingerprint.ts";
+export { COMMITTEE_MIN_EXTERNAL, type CommitteeMember, committeeQuorum, COOLING_OFF_YEARS, type CoolingOff, type Engagement, REFUSALS, type Refusal, type Staff, staffRefusals, } from "./impartiality.ts";
+export { AUDIENCES, type Audience, buildEvidenceShare, discloseEvidenceField, type EvidenceShare, type EvidenceShareInput, GCC_IDENTIFIERS, REDACTION_KINDS, redactEvidence, type RedactionKind, type RedactOptions, type SharedEntry, verifyEvidenceShare, } from "./evidence-share.ts";
+export { type AgentBinding, type AgentBindingInput, type AgentBindingVerifyOptions, boundElsewhere, buildAgentBinding, buildKybProof, type KybProof, verifyAgentBinding, verifyKybProof, } from "./identity.ts";
+export { issuerLineage, type IssuerLineage } from "./succession.ts";
+export { buildGatewayEnrolment, buildLiveEvidence, type GatewayAttestation, type GatewayEnrolment, type GatewayEnrolmentInput, type LiveEvidenceVerifyOptions, verifyGatewayEnrolment, LIVE_DEFAULTS, LIVE_TRIGGERS, type LiveEvidence, type LiveEvidenceInput, type LiveThresholds, type LiveTrigger, liveEvidenceTriggers, verifyLiveEvidence, } from "./live-evidence.ts";
+export { checkPqBinding, type PqCosignature, pqCommitment, pqCosign, pqPolicyOf, verifyPqCosignature } from "./pq.ts";
+export { clauseMapSchema, type ProfileCheck, profileSchema, schemaErrors, validateClauseMap, validateProfile, } from "./profile.ts";
+export { type CategoryScore, type Overall, overallVerdict, type ProfileCategoryRule, type ScoredResult, scoreCategory, type Verdict, } from "./scoring.ts";
+export { activeRotation, buildRotation, type Rotation, type RotationCheck, type RotationInput, type SuiteRef, verifyRotationLog, verifyRotationRecord, } from "./rotation.ts";
+export { type Check, type CheckContext, type CheckResult, casesOf, DEFAULT_FINDINGS, type Delegation, type DelegationLink, effectiveDelegation, judgementResult, normaliseText, type Rubric, runCheck, type Scenario, type ScenarioLibrary, scenarioCases, scenariosSchema, type Suite, type SubAgent, type SuiteCase, suiteSchema, type ToolCall, suiteSnapshot, validateScenarios, validateSuite, verifyCaseDelegation, } from "./suite.ts";
+export { keySigner, type Signer, signerDid, signWith } from "./signer.ts";
+export { applyStatus, buildStatus, type CertificateStatus, REASONS, REASONS_V2, STATUS_V2_SCHEMA, STATUS_V2_MAX_ENTRIES, type StatusVersion, type Reason, revocationListFromStatus, type StatusAction, type StatusCheck, type StatusDocument, type StatusEntries, type StatusEntry, type StatusVerifyOptions, type StatusWitness, verifyStatus, logPositionOk, } from "./status.ts";
+export { type CertificateVcCheck, certificateToVc, VC_STATUS_TYPE, VC_TYPE, verifyCertificateVc, } from "./vc.ts";
+export { statusCheckpoint, statusConsistencyProof, statusInclusionProof, verifyStatusLog, } from "./witness.ts";
+export { type AccreditationExport, buildAccreditationExport, buildFilingPack, buildGovernanceOutcome, buildSigningKeyApproval, CASE_KINDS, type CaseKind, type CertifyRiskFacts, type CertifyRiskProfile, certifyRiskProfile, type FilingPack, type FilingPackInput, type GovernanceCheck, type GovernanceOutcome, type GovernanceOutcomeInput, governanceOutcomeBody, OUTCOMES, RISK_NOTE, type RiskProfileInput, type SignedRiskProfile, type SigningKeyApproval, type SigningKeyApprovalInput, signingKeyApprovalBody, signRiskProfile, verifyRiskProfile, verifyAccreditationExport, verifyFilingPack, verifyGovernanceOutcome, verifySigningKeyApproval, } from "./governance.ts";
+export { AWS_NITRO_ROOT_PEM, AWS_NITRO_ROOT_SHA256, AWS_NITRO_GOV_ROOT_PEM, AWS_NITRO_GOV_ROOT_SHA256, checkNitroAttestation, NITRO_MAX_AGE_SECONDS, NITRO_MAX_SKEW_SECONDS, type NitroCheck, type NitroDocument, type NitroOptions, type NitroPartition, type NitroQuoteOptions, nitroMeasurement, nitroQuoteVerifier, nitroRootForPartition, parseNitroDocument, sigStructure, verifyNitroDocument } from "./nitro.ts";
+export { canonicalBytes, jcsHash } from "@zanii/core";
+export { buildRuntimeRelease, buildRuntimePolicy, buildRuntimeApproval, buildRuntimeProof, buildRuntimeChallengeRequest, buildRuntimeLease, buildRuntimeAction, buildRuntimeLeaseRequest, buildRuntimeMandate, verifyRuntimeRelease, verifyRuntimePolicy, verifyRuntimeApproval, verifyRuntimeProof, verifyRuntimeChallengeRequest, verifyRuntimeLease, verifyRuntimeAction, verifyRuntimeLeaseRequest, verifyRuntimeMandate, runtimeReleaseHash, runtimePolicyHash, runtimeRequestHash, type RuntimeRelease, type RuntimePolicy, type RuntimeApproval, type RuntimeProof, type RuntimeChallengeRequest, type RuntimeLease, type RuntimeAction, type RuntimeLeaseRequest, type RuntimeMandate, type RuntimeCheck, type RuntimeTrustOptions, type RuntimeReleaseOptions, type RuntimeApprovalOptions, type RuntimeProofOptions, type RuntimeChallengeOptions, type RuntimeLeaseOptions, type RuntimeActionOptions, type RuntimeLeaseRequestOptions, type RuntimeMandateOptions, } from "./runtime.ts";
+export { runtimeNitroBindingHash, verifyRuntimeNitroDocument, RUNTIME_NITRO_MAX_BYTES, RUNTIME_NITRO_MAX_SKEW_SECONDS, type RuntimeNitroBinding, type RuntimeNitroOptions, type RuntimeNitroCheck } from "./runtime-nitro.ts";
+export { createRuntimeGateway, type RuntimeGatewayOptions } from "./runtime-gateway.ts";
+export { createRuntimeReporter, type RuntimeReporterOptions, type RuntimeAttestationBinding, type RuntimeReportResult } from "./runtime-client.ts";
+export { buildRuntimeKnowledgeSnapshot, runtimeKnowledgeProof, runtimeKnowledgeProofs, verifyRuntimeKnowledgeChunk, type RuntimeKnowledgeMetadata, type RuntimeKnowledgeSnapshot, type RuntimeKnowledgeProof, type RuntimeKnowledgeOptions, } from "./runtime-knowledge.ts";
+export { resolveIssuerDetailed, fetchJsonBounded, type JsonFetchResult, type IssuerResolution, type IssuerResolutionCode, type ResolutionOptions, type ResolutionFailure } from "./issuer-resolution.ts";
+export { isIssuerPolicy, issuerPolicyCheck, releasePolicyReasons, type IssuerPolicy, type ReleaseVerificationPolicy } from "./verification-policy.ts";
+export { buildSandboxDelegationPolicy, verifySandboxDelegationPolicy, type SandboxDelegationPolicy, type SandboxDelegationContext } from "./sandbox-delegation.ts";
+export { teamReceiptTask, type TeamReceiptPolicy } from "./suite.ts";
+export { BITSTRING_STATUS_SLOTS, buildBitstringStatusList, bitstringStatusEntry, verifyBitstringStatusList, verifyBitstringStatusEntry, certificateToBitstringVc, verifyCertificateBitstringVc, type BitstringPurpose, type BitstringStatusEntry, type BitstringStatusListInput, type BitstringStatusTrust } from "./bitstring-status.ts";
+export { reconcileRoyaltyStatementFeed, type RoyaltyFeedOptions, type RoyaltyFeedCheck } from "./royalty-reconciliation.ts";
+export { buildLicenceOwnerRotation, verifyLicenceOwnerHistory, licenceOwnerCheckpoint, licenceOwnerProof, licenceOwnerProofs, verifyLicenceWithOwnerHistory, isLicenceOwnerCheckpoint, isLicenceOwnerRotation, type LicenceOwnerRotation, type OwnerLicenceProof, type LicenceOwnerHistoryPolicy, type LicenceOwnerHistoryCheck } from "./licence-owner.ts";
+export { verifyLicenceOwnerEntry, type LicenceOwnerEntryContext, type LicenceOwnerEntryCheck } from "./licence-owner-entry.ts";
+export { buildSchemeTextBundle, schemeTextBundleHash, verifySchemeTextBundle, SCHEME_TEXT_MAX_BYTES, type SchemeTextBundle, type SchemeTextFile } from "./scheme-text.ts";
+export { certificateToCurrentIssuerVc, verifyCurrentIssuerCertificateVc, type CurrentIssuerVcOptions, type CurrentIssuerVcTrust } from "./current-issuer-vc.ts";
+export { buildAssuranceRevocation, buildAssuranceStatus, verifyAssuranceStatus, type AssurancePurpose, type AssuranceRevocation, type AssuranceStatus, type AssuranceAuthority, type AssuranceStatusPolicy, type AssuranceStatusOptions } from "./assurance-status.ts";
+export { buildAuditRenewal, verifyAuditRenewal, type AuditRenewal, type AuditRenewalPolicy, type AuditRenewalOptions } from "./audit-renewal.ts";
+export { liveEvidenceFreshnessReasons } from "./live-evidence.ts";
+export { signingIdentityReasons } from "./signing-identity.ts";
+export { normalizationPolicyReasons, runtimeNormalizationVersion, type NormalizationPolicy } from "./normalization.ts";
+export { schemaDialectErrors } from "./schema-dialect.ts";
+export { type Credential, credentialHash, type RevocationList } from "@zanii/credentials";
+export { TRANSCRIPT_TURNS_BYTES, transcriptTurnsHash, validateTranscriptProvenance, type TranscriptProvenance } from "./transcript-provenance.ts";
+export { validateSuiteDocument, type SuiteDocument } from "./suite.ts";
+export { TRAJECTORY_LIMITS, trajectorySchema, isTrajectoryCase, validateTrajectorySuite, validateTrajectoryTrace, validateTrajectoryArguments, parseTrajectoryArguments, trajectoryTools, resolveTrajectoryRef, trajectoryConditions, trajectoryStateHash, trajectoryCaseHash, trajectorySuiteHash, checkTrajectory, type TrajectoryScalar, type TrajectoryState, type TrajectoryRef, type TrajectoryCondition, type TrajectoryEffect, type TrajectoryArgument, type TrajectoryRule, type TrajectoryTool, type TrajectoryBudget, type TrajectoryCase, type TrajectorySuite, type TrajectoryCall, type TrajectoryEvent, type TrajectoryTrace, type TrajectoryCheck } from "./trajectory.ts";

package/dist/index.js

@@ -0,0 +1,63 @@
+// @zanii/certify: the Zanii Certify formats (spec/). Byte-identical with Python zanii-certify.
+export { BEACON_INTERVAL_MS, startBeacon, } from "./beacon-client.js";
+export { AUDIT_OUTCOMES, auditLapsed, buildAuditAttestation, CONTROL, verifyAuditAttestation, } from "./audit.js";
+export { applianceChallenge, buildApplianceEnrolment, buildApplianceExport, buildApplianceUpdate, labKeyId, openApplianceExport, sealTranscripts, verifyApplianceExport, verifyApplianceUpdate, } from "./appliance.js";
+export { boardBody, bodySignature, buildBoard, buildRelease, RELEASE_KINDS, releaseBody, requireRelease, signersOf, verifyBoardAppend, verifyBoardLog, verifyRelease, verifyReleaseAppend, verifyReleaseLog, buildReleaseWithdrawal, releaseWithdrawalBody, verifyWithdrawalLog, WITHDRAWAL_REASONS, withdrawalFlags, withSignatures, } from "./board.js";
+export { bodyRegisterAt, bodyRegisterBody, buildBodyRegister, trustedBodiesAt, verifyBodyRegisterLog, } from "./register.js";
+export { buildSchemeAppend, SCHEME_LOG_TYPES, schemeAppendStatement, schemeCheckpoint, schemeConsistencyProof, schemeInclusionProof, verifySchemeInclusion, verifySchemeLogs, } from "./scheme-log.js";
+export { MAX_SCHEME_ENTRY_BYTES, verifySchemeEntry } from "./scheme-entry.js";
+export { verifySchemeEffectiveTime } from "./scheme-timing.js";
+export { withinVerificationBudget } from "./verification-bounds.js";
+export { buildSchemeTransition, verifySchemeTransition, verifySchemeTransitionProposal } from "./scheme-transition.js";
+export { buildSchemeAppendFromStatement, verifySchemeAppend } from "./scheme-log.js";
+export { FEED_SNAPSHOT_CHUNK_ENTRIES, MAX_FEED_SNAPSHOT_BYTES, MAX_FEED_SNAPSHOT_CHUNK_BYTES, feedSnapshotFrontier, buildFeedSnapshot, verifyFeedSnapshot, feedSnapshotCursor, feedSnapshotChunkHash, verifyFeedSnapshotChunk } from "./feed-snapshot.js";
+export { buildFeedPage, feedCheckpoint, MAX_FEED_ENTRIES, MAX_FEED_PAGE_BYTES, mergeFeeds, verifyFeed, verifyFeedPage, } from "./federation.js";
+export { buildLicence, buildLicenceStatus, buildRoyaltyStatement, certificateListHash, countersignRoyaltyStatement, LICENCE_ACTIONS, LICENCE_REASONS, licenceCoverage, licenceReasons, licensedKey, licenceStateAt, MAX_ROYALTY_MINOR, MAX_STATEMENT_CERTIFICATES, verifyLicence, verifyLicenceLog, verifyRoyaltyStatement, } from "./licence.js";
+export { beaconChallenge, buildBeacon, MAX_SKEW_SECONDS, NONCE, verifyAttestedBeacon, verifyBeacon, } from "./beacon.js";
+export { bundleHash, buildBundle, buildApplianceExportBundle, } from "./bundle.js";
+export { applianceExecution, applianceExportIdentity } from "./appliance-execution.js";
+export { CONFLICTS, certificateScope, claimReasons, issueCertificate, LEVELS, pickScheme, SCHEME, SCHEME_LEVELS, SCHEMES, SURVEILLANCE, VALIDITY_DAYS, verifyCertificate, } from "./certificate.js";
+export { buildFingerprint, checkFingerprint, promptSha256, sha256Bytes, toolsSha256, } from "./fingerprint.js";
+export { COMMITTEE_MIN_EXTERNAL, committeeQuorum, COOLING_OFF_YEARS, REFUSALS, staffRefusals, } from "./impartiality.js";
+export { AUDIENCES, buildEvidenceShare, discloseEvidenceField, GCC_IDENTIFIERS, REDACTION_KINDS, redactEvidence, verifyEvidenceShare, } from "./evidence-share.js";
+export { boundElsewhere, buildAgentBinding, buildKybProof, verifyAgentBinding, verifyKybProof, } from "./identity.js";
+export { issuerLineage } from "./succession.js";
+export { buildGatewayEnrolment, buildLiveEvidence, verifyGatewayEnrolment, LIVE_DEFAULTS, LIVE_TRIGGERS, liveEvidenceTriggers, verifyLiveEvidence, } from "./live-evidence.js";
+export { checkPqBinding, pqCommitment, pqCosign, pqPolicyOf, verifyPqCosignature } from "./pq.js";
+export { clauseMapSchema, profileSchema, schemaErrors, validateClauseMap, validateProfile, } from "./profile.js";
+export { overallVerdict, scoreCategory, } from "./scoring.js";
+export { activeRotation, buildRotation, verifyRotationLog, verifyRotationRecord, } from "./rotation.js";
+export { casesOf, DEFAULT_FINDINGS, effectiveDelegation, judgementResult, normaliseText, runCheck, scenarioCases, scenariosSchema, suiteSchema, suiteSnapshot, validateScenarios, validateSuite, verifyCaseDelegation, } from "./suite.js";
+export { keySigner, signerDid, signWith } from "./signer.js";
+export { applyStatus, buildStatus, REASONS, REASONS_V2, STATUS_V2_SCHEMA, STATUS_V2_MAX_ENTRIES, revocationListFromStatus, verifyStatus, logPositionOk, } from "./status.js";
+export { certificateToVc, VC_STATUS_TYPE, VC_TYPE, verifyCertificateVc, } from "./vc.js";
+export { statusCheckpoint, statusConsistencyProof, statusInclusionProof, verifyStatusLog, } from "./witness.js";
+export { buildAccreditationExport, buildFilingPack, buildGovernanceOutcome, buildSigningKeyApproval, CASE_KINDS, certifyRiskProfile, governanceOutcomeBody, OUTCOMES, RISK_NOTE, signingKeyApprovalBody, signRiskProfile, verifyRiskProfile, verifyAccreditationExport, verifyFilingPack, verifyGovernanceOutcome, verifySigningKeyApproval, } from "./governance.js";
+export { AWS_NITRO_ROOT_PEM, AWS_NITRO_ROOT_SHA256, AWS_NITRO_GOV_ROOT_PEM, AWS_NITRO_GOV_ROOT_SHA256, checkNitroAttestation, NITRO_MAX_AGE_SECONDS, NITRO_MAX_SKEW_SECONDS, nitroMeasurement, nitroQuoteVerifier, nitroRootForPartition, parseNitroDocument, sigStructure, verifyNitroDocument } from "./nitro.js";
+export { canonicalBytes, jcsHash } from "@zanii/core";
+export { buildRuntimeRelease, buildRuntimePolicy, buildRuntimeApproval, buildRuntimeProof, buildRuntimeChallengeRequest, buildRuntimeLease, buildRuntimeAction, buildRuntimeLeaseRequest, buildRuntimeMandate, verifyRuntimeRelease, verifyRuntimePolicy, verifyRuntimeApproval, verifyRuntimeProof, verifyRuntimeChallengeRequest, verifyRuntimeLease, verifyRuntimeAction, verifyRuntimeLeaseRequest, verifyRuntimeMandate, runtimeReleaseHash, runtimePolicyHash, runtimeRequestHash, } from "./runtime.js";
+export { runtimeNitroBindingHash, verifyRuntimeNitroDocument, RUNTIME_NITRO_MAX_BYTES, RUNTIME_NITRO_MAX_SKEW_SECONDS } from "./runtime-nitro.js";
+export { createRuntimeGateway } from "./runtime-gateway.js";
+export { createRuntimeReporter } from "./runtime-client.js";
+export { buildRuntimeKnowledgeSnapshot, runtimeKnowledgeProof, runtimeKnowledgeProofs, verifyRuntimeKnowledgeChunk, } from "./runtime-knowledge.js";
+export { resolveIssuerDetailed, fetchJsonBounded } from "./issuer-resolution.js";
+export { isIssuerPolicy, issuerPolicyCheck, releasePolicyReasons } from "./verification-policy.js";
+export { buildSandboxDelegationPolicy, verifySandboxDelegationPolicy } from "./sandbox-delegation.js";
+export { teamReceiptTask } from "./suite.js";
+export { BITSTRING_STATUS_SLOTS, buildBitstringStatusList, bitstringStatusEntry, verifyBitstringStatusList, verifyBitstringStatusEntry, certificateToBitstringVc, verifyCertificateBitstringVc } from "./bitstring-status.js";
+export { reconcileRoyaltyStatementFeed } from "./royalty-reconciliation.js";
+export { buildLicenceOwnerRotation, verifyLicenceOwnerHistory, licenceOwnerCheckpoint, licenceOwnerProof, licenceOwnerProofs, verifyLicenceWithOwnerHistory, isLicenceOwnerCheckpoint, isLicenceOwnerRotation } from "./licence-owner.js";
+export { verifyLicenceOwnerEntry } from "./licence-owner-entry.js";
+export { buildSchemeTextBundle, schemeTextBundleHash, verifySchemeTextBundle, SCHEME_TEXT_MAX_BYTES } from "./scheme-text.js";
+export { certificateToCurrentIssuerVc, verifyCurrentIssuerCertificateVc } from "./current-issuer-vc.js";
+export { buildAssuranceRevocation, buildAssuranceStatus, verifyAssuranceStatus } from "./assurance-status.js";
+export { buildAuditRenewal, verifyAuditRenewal } from "./audit-renewal.js";
+export { liveEvidenceFreshnessReasons } from "./live-evidence.js";
+export { signingIdentityReasons } from "./signing-identity.js";
+export { normalizationPolicyReasons, runtimeNormalizationVersion } from "./normalization.js";
+export { schemaDialectErrors } from "./schema-dialect.js";
+export { credentialHash } from "@zanii/credentials";
+// Draft public-practice trajectory extension; existing v1 formats/certification scope are unchanged.
+export { TRANSCRIPT_TURNS_BYTES, transcriptTurnsHash, validateTranscriptProvenance } from "./transcript-provenance.js";
+export { validateSuiteDocument } from "./suite.js";
+export { TRAJECTORY_LIMITS, trajectorySchema, isTrajectoryCase, validateTrajectorySuite, validateTrajectoryTrace, validateTrajectoryArguments, parseTrajectoryArguments, trajectoryTools, resolveTrajectoryRef, trajectoryConditions, trajectoryStateHash, trajectoryCaseHash, trajectorySuiteHash, checkTrajectory } from "./trajectory.js";

package/dist/issuer-authorization.d.ts

@@ -0,0 +1,4 @@
+export declare function issuerArtifactAuthorization(artifact: {
+    signer: string;
+    issued_at: string;
+}, current: string, document: unknown, owner: string, domain: string, at: string): string[];

package/dist/issuer-authorization.js

@@ -0,0 +1,52 @@
+// One bounded authority policy for current-key wrappers and historical assurance artifacts.
+import { publicKeyFromDid } from "@zanii/core";
+import { isInt, isIso, isObj, ms } from "./shared.js";
+import { afterCompromise, compromisedKeyReasons, issuerLineage, succeeds } from "./succession.js";
+import { withinVerificationBudget } from "./verification-bounds.js";
+const did = (v) => typeof v === "string" && v.length <= 69 && publicKeyFromDid(v) !== null;
+export function issuerArtifactAuthorization(artifact, current, document, owner, domain, at) {
+    if (!withinVerificationBudget(document, { maxBytes: 1_048_576 }))
+        return ["issuer authorization exceeds its JSON budget"];
+    if (!did(owner) || !did(current) || !isIso(at) || typeof domain !== "string" || domain.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || domain.trim() !== domain
+        || !isObj(document) || document.v !== 1 || document.owner !== owner || document.domain !== domain
+        || !Array.isArray(document.dids) || document.dids.length < 1 || document.dids.length > 64 || document.dids[0] !== current || !Array.from(document.dids).every(did) || document.dids.includes(owner))
+        return ["current issuer wrapper requires independently pinned owner, domain and current key"];
+    if (!did(artifact.signer) || !isIso(artifact.issued_at) || ms(artifact.issued_at) > ms(at))
+        return ["invalid artifact signer or issuance time"];
+    const links = document.successions ?? [];
+    if (!Array.isArray(links) || links.length > 64)
+        return ["invalid or oversized issuer authorization history"];
+    const windows = document.activation_windows ?? [], policy = document.rotation_policy;
+    if (!Array.isArray(windows) || windows.length !== links.length || (links.length && (!isInt(document.cache_max_age_s, 1, 300) || !isObj(policy)
+        || !isInt(policy.overlap_s, 600, 86_400) || !isInt(policy.refresh_within_s, 1, document.cache_max_age_s))))
+        return ["issuer activation windows and bounded published rotation policy are required"];
+    for (const [i, link] of links.entries()) {
+        if (!isObj(link) || Object.keys(link).length !== 2 || !isObj(link.body) || Object.keys(link.body).length > 9 || Object.keys(link.body).some((k) => !["v", "type", "predecessor", "successor", "owner", "reason", "ts", "note", "compromised_at"].includes(k))
+            || link.body.v !== 1 || link.body.type !== "succession" || !["rotation", "retirement", "compromise"].includes(String(link.body.reason))
+            || !isIso(link.body.ts) || ms(link.body.ts) > ms(at) || (i && ms(link.body.ts) < ms(links[i - 1].body.ts))
+            || !did(link.body.owner) || !did(link.body.predecessor) || !did(link.body.successor)
+            || (link.body.note !== undefined && (typeof link.body.note !== "string" || link.body.note.length > 1000))
+            || (link.body.compromised_at !== undefined && (!isIso(link.body.compromised_at) || ms(link.body.compromised_at) > ms(link.body.ts)))
+            || !Array.isArray(link.signatures) || link.signatures.length < 1 || link.signatures.length > 2 || !Array.from(link.signatures).every((s) => isObj(s) && Object.keys(s).length === 2 && did(s.did) && typeof s.sig === "string" && s.sig.length === 136))
+            return ["invalid, future or unbounded issuer authorization link"];
+        const window = windows[i], announced = ms(link.body.ts);
+        if (!isObj(window) || Object.keys(window).length !== 2 || window.successor !== link.body.successor || !isIso(window.active_from)
+            || ms(window.active_from) > ms(at) || (i && ms(window.active_from) < ms(windows[i - 1].active_from)) || ms(window.active_from) < announced + (link.body.reason === "compromise" ? 0 : Number(document.cache_max_age_s) * 2000)
+            || ms(window.active_from) - announced > 86_400_000)
+            return ["issuer activation window is missing, future or outside published bounds"];
+    }
+    const lineage = issuerLineage(document);
+    if (lineage && !lineage.ok)
+        return lineage.reasons;
+    if (artifact.signer !== current && !succeeds(lineage, artifact.signer, current))
+        return ["current signing key is not an authorized successor of the original issuer"];
+    const reasons = [...compromisedKeyReasons(lineage, current, "current issuer wrapper"), ...afterCompromise(lineage, artifact.signer, artifact.issued_at, "artifact")];
+    for (const [i, link] of links.entries()) {
+        const activated = windows[i].active_from;
+        if (link.body.successor === artifact.signer && ms(artifact.issued_at) < ms(activated))
+            reasons.push("artifact predates its issuer activation");
+        if (link.body.predecessor === artifact.signer && link.body.reason !== "compromise" && ms(artifact.issued_at) >= ms(activated))
+            reasons.push("artifact was issued after its issuer retirement");
+    }
+    return reasons;
+}

package/dist/issuer-resolution.d.ts

@@ -0,0 +1,25 @@
+import type { ResolvedIssuer } from "@zanii/credentials";
+export type IssuerResolutionCode = "invalid_input" | "dns" | "tls" | "timeout" | "network" | "http" | "document" | "key_missing" | "too_large" | "busy";
+export interface ResolutionFailure {
+    ok: false;
+    code: IssuerResolutionCode;
+    status?: number;
+}
+export type IssuerResolution = {
+    ok: true;
+    issuer: ResolvedIssuer;
+    document: Record<string, unknown>;
+} | ResolutionFailure;
+export interface ResolutionOptions {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    maxBytes?: number;
+}
+export type JsonFetchResult = {
+    ok: true;
+    document: unknown;
+} | ResolutionFailure;
+/** A single deadline covers headers and body, including injected transports that ignore AbortSignal. */
+export declare function fetchJsonBounded(url: string, opts?: ResolutionOptions): Promise<JsonFetchResult>;
+/** Unlike the legacy null resolver, distinguishes a failed fetch from a document that omits the key. */
+export declare function resolveIssuerDetailed(did: string, domain: string, opts?: ResolutionOptions): Promise<IssuerResolution>;