@zanii/certify 0.0.0-stage → 0.6.0

package/dist/status.js

@@ -0,0 +1,204 @@
+// spec/status.md: the signed status document and the revocation list derived from it.
+import { publicKeyFromDid, verifySignedObject } from "@zanii/core";
+import { bindingHash } from "@zanii/pq";
+import { checkPqBinding, pqCommitment, pqPolicyOf, verifyPqCosignature } from "./pq.js";
+import { isDid, isInt, isIso, isObj, isSha, ms, sortedUnique } from "./shared.js";
+import { signatureOver, signerDid, signWith } from "./signer.js";
+import { compromisedKeyReasons, issuerLineage, succeeds } from "./succession.js";
+import { witnessReasons } from "./witness.js";
+import { signingIdentityReasons } from "./signing-identity.js";
+import { withinVerificationBudget } from "./verification-bounds.js";
+import STATUS_V2_SCHEMA from "./formats/status-v2.schema.json" with { type: "json" };
+export { STATUS_V2_SCHEMA };
+export const REASONS = [
+    "FINGERPRINT_MISMATCH",
+    "RETEST_OVERDUE",
+    "RETEST_FAILED",
+    "INCIDENT",
+    "APPLICANT_REQUEST",
+    "ISSUER_ERROR",
+    /** licensing.md section 2a: the issuing licensee's licence was withdrawn or suspended for cause. */
+    "LICENCE_WITHDRAWN",
+    /** audit.md section 3: a Level 3 certificate's audit attestation lapsed. */
+    "AUDIT_EXPIRED",
+];
+export const REASONS_V2 = [...REASONS, "MARK_MISUSE"];
+export const STATUS_V2_MAX_ENTRIES = 100_000;
+/** A log position is `seq` and `prev` together: seq 0 has prev null, later ones a hash. */
+export const logPositionOk = (seq, prev) => isInt(seq, 0, Number.MAX_SAFE_INTEGER) && (seq === 0 ? prev === null : isSha(prev));
+const isReason = (v, version = 1) => (version === 2 ? REASONS_V2 : REASONS).includes(v);
+/**
+ * §2: apply one status change and return the new entries (the input is not changed). Throws on a
+ * change the rules forbid: revoked is final, only a valid certificate is suspended, only a
+ * suspended one is reinstated, and time never goes backwards for one certificate.
+ */
+export function applyStatus(entries, certificate, action, reason, at, opts = {}) {
+    if (opts.version !== undefined && opts.version !== 1 && opts.version !== 2)
+        throw new Error("status version must be 1 or 2");
+    if (!isSha(certificate))
+        throw new Error("certificate must be a credential hash");
+    if (!isIso(at))
+        throw new Error("at must be an ISO UTC timestamp");
+    const now = entries[certificate];
+    const wantsReason = action === "suspend" || action === "revoke";
+    if (wantsReason ? !isReason(reason, opts.version) : reason !== null)
+        throw new Error(wantsReason ? `${action} needs a reason code` : `${action} takes no reason`);
+    if (now && ms(at) < ms(now.since))
+        throw new Error("at is before the current status");
+    let next;
+    if (action === "grant") {
+        if (now)
+            throw new Error("certificate already has a status");
+        next = "valid";
+    }
+    else if (!now) {
+        throw new Error("certificate has no status; grant it first");
+    }
+    else if (now.status === "revoked") {
+        throw new Error("certificate is revoked; revocation is final");
+    }
+    else if (action === "suspend") {
+        if (now.status !== "valid")
+            throw new Error("only a valid certificate can be suspended");
+        next = "suspended";
+    }
+    else if (action === "reinstate") {
+        if (now.status !== "suspended")
+            throw new Error("only a suspended certificate can be reinstated");
+        next = "valid";
+    }
+    else {
+        next = "revoked";
+    }
+    return { ...entries, [certificate]: { status: next, reason, since: at } };
+}
+function entryOk(e, version = 1) {
+    if (!isObj(e) || Object.keys(e).length !== 3 || !isIso(e.since))
+        return false;
+    if (e.status === "valid")
+        return e.reason === null;
+    return (e.status === "suspended" || e.status === "revoked") && isReason(e.reason, version);
+}
+function v2Error(d) {
+    if (!withinVerificationBudget(d, { maxDepth: 8 }) || !isObj(d.entries) || Object.keys(d.entries).length > STATUS_V2_MAX_ENTRIES)
+        return "status v2 exceeds its JSON or entry budget";
+    if ("v type issuer entries issued_at valid_until signer sig".split(" ").some(k => !Object.hasOwn(d, k)) || Object.keys(d).some(k => !"v type issuer entries issued_at valid_until signer sig seq prev pq_binding".split(" ").includes(k)))
+        return "status v2 has missing or unknown fields";
+    if (typeof d.issuer !== "string" || d.issuer.length > 69 || !publicKeyFromDid(d.issuer) || d.signer !== d.issuer || typeof d.sig !== "string" || !/^ed25519:[0-9a-f]{128}$/.test(d.sig))
+        return "status v2 needs matching Ed25519 issuer and signer";
+    if (!isIso(d.issued_at) || !isIso(d.valid_until) || ms(d.valid_until) <= ms(d.issued_at) || ms(d.valid_until) - ms(d.issued_at) > 3_600_000)
+        return "status v2 lifetime must be positive and at most one hour";
+    if (Object.entries(d.entries).some(([hash, entry]) => !isSha(hash) || !entryOk(entry, 2) || ms(entry.since) > ms(d.issued_at)))
+        return "status v2 has a malformed or future entry";
+    if ((("seq" in d || "prev" in d) && !logPositionOk(d.seq, d.prev)) || ("pq_binding" in d && !isSha(d.pq_binding)))
+        return "status v2 has a malformed log position or PQ binding";
+    return null;
+}
+/** §1: sign a status document. `valid_until` is the freshness bound verifiers enforce. */
+export async function buildStatus(fields, signer) {
+    const version = fields.version ?? 1;
+    if (version !== 1 && version !== 2)
+        throw new Error("status version must be 1 or 2");
+    if (version === 2 && (!isObj(fields.entries) || Object.keys(fields.entries).length > STATUS_V2_MAX_ENTRIES || Object.keys(fields).some(k => !["version", "entries", "issuedAt", "validUntil", "seq", "prev", "pqBinding"].includes(k)) || !withinVerificationBudget(fields, { maxDepth: 10 })))
+        throw new Error("status v2 exceeds its JSON or entry budget");
+    if (!isIso(fields.issuedAt) || !isIso(fields.validUntil))
+        throw new Error("issuedAt and validUntil must be ISO UTC timestamps");
+    if (ms(fields.validUntil) < ms(fields.issuedAt))
+        throw new Error("validUntil is before issuedAt");
+    for (const [k, e] of Object.entries(fields.entries))
+        if (!isSha(k) || !entryOk(e, version))
+            throw new Error(`malformed status entry ${k}`);
+    const logged = fields.seq !== undefined || fields.prev !== undefined;
+    if (logged && !logPositionOk(fields.seq, fields.prev))
+        throw new Error("seq and prev: seq 0 with prev null, or seq >= 1 with the previous document hash");
+    const issuer = signerDid(signer);
+    if (fields.pqBinding !== undefined)
+        checkPqBinding(fields.pqBinding, issuer);
+    const unsigned = {
+        v: version,
+        type: "certify.status",
+        issuer,
+        entries: version === 2 ? structuredClone(fields.entries) : fields.entries,
+        issued_at: fields.issuedAt,
+        valid_until: fields.validUntil,
+        ...(logged ? { seq: fields.seq, prev: fields.prev } : {}),
+        ...(fields.pqBinding ? { pq_binding: bindingHash(fields.pqBinding) } : {}),
+    };
+    if (version === 2) {
+        const error = v2Error({ ...unsigned, signer: issuer, sig: `ed25519:${"0".repeat(128)}` });
+        if (error)
+            throw new Error(error);
+    }
+    return signWith(unsigned, signer);
+}
+/**
+ * Is this an intact status document from `issuer` (when given), still fresh at `now`? With `pq`
+ * or `requirePq` also its post-quantum co-signature, with `witness` its witnessed checkpoint.
+ */
+export function verifyStatus(doc, opts = {}) {
+    const d = isObj(doc) ? doc : {};
+    const pqPolicy = opts.issuerDoc === undefined ? undefined : pqPolicyOf(opts.issuerDoc, opts.allowNoPq);
+    const policy = pqPolicy ? { pqPolicy } : {};
+    if ((d.v !== 1 && d.v !== 2) || d.type !== "certify.status" || !isDid(d.issuer) || !isObj(d.entries))
+        return { ok: false, reasons: ["not a status document (v1)"], freshness: null, ...policy };
+    const v2 = d.v === 2 ? v2Error(d) : null;
+    if (v2)
+        return { ok: false, reasons: [v2], freshness: null, ...policy };
+    const reasons = [];
+    if (!verifySignedObject(d) || d.signer !== d.issuer)
+        reasons.push("bad status document signature");
+    if (opts.schemeOwner !== undefined)
+        reasons.push(...signingIdentityReasons(opts.schemeOwner, [], [d.issuer]));
+    // Section 5b: with an issuer document listing successions, a later key of `issuer`'s lineage may sign.
+    const lineage = opts.issuerDoc === undefined ? null : issuerLineage(opts.issuerDoc);
+    if (lineage)
+        reasons.push(...lineage.reasons, ...compromisedKeyReasons(lineage, d.issuer, "status document"));
+    if (opts.issuer !== undefined && d.issuer !== opts.issuer && !succeeds(lineage, opts.issuer, d.issuer))
+        reasons.push("status document is from a different issuer");
+    for (const [k, e] of Object.entries(d.entries))
+        if (!isSha(k) || !entryOk(e, d.v)) {
+            reasons.push("status document has a malformed entry");
+            break;
+        }
+    if (("seq" in d || "prev" in d) && !logPositionOk(d.seq, d.prev))
+        reasons.push("status document has a malformed log position");
+    if ("pq_binding" in d && !isSha(d.pq_binding))
+        reasons.push("status document has a malformed pq_binding");
+    const now = opts.now ? ms(opts.now) : Date.now();
+    if (d.v === 2 && ((!Number.isFinite(now)) || ms(d.issued_at) > now))
+        reasons.push("status v2 reference time is invalid or issuance is in the future");
+    const freshness = (d.v === 2 ? ms(d.valid_until) > now : ms(d.valid_until) >= now) ? "fresh" : "stale";
+    if (freshness === "stale")
+        reasons.push(`status document expired on ${String(d.valid_until)}`);
+    if (opts.pq)
+        reasons.push(...verifyPqCosignature(d, opts.pq).reasons.map((r) => `status: ${r}`));
+    else if (opts.requirePq || pqPolicy === "required")
+        reasons.push(pqCommitment(d)
+            ? "status: no post-quantum co-signature supplied: a post-quantum signature is required"
+            : "status: document has no post-quantum co-signature: a post-quantum signature is required");
+    if (!opts.witness)
+        return { ok: reasons.length === 0, reasons, freshness, ...policy };
+    const w = witnessReasons(d, opts.witness);
+    reasons.push(...w.reasons);
+    return { ok: reasons.length === 0, reasons, freshness, witnesses: w.witnesses, ...policy };
+}
+/**
+ * §3: the @zanii/credentials revocation list for a status document: every certificate whose status
+ * is not valid, with the same issued_at and valid_until. Byte-identical to `buildRevocationList`
+ * with the issuer's key, so plain credential verifiers refuse suspended and revoked certificates.
+ */
+export async function revocationListFromStatus(doc, signer) {
+    if (doc.issuer !== signerDid(signer))
+        throw new Error("signer is not the status document issuer");
+    const unsigned = {
+        v: 1,
+        type: "revocation_list",
+        issuer: doc.issuer,
+        revoked: sortedUnique(Object.entries(doc.entries)
+            .filter(([, e]) => e.status !== "valid")
+            .map(([k]) => k)),
+        issued_at: doc.issued_at,
+        valid_until: doc.valid_until,
+    };
+    return { ...unsigned, sig: await signatureOver(unsigned, signer) };
+}

package/dist/succession.d.ts

@@ -0,0 +1,21 @@
+export interface IssuerLineage {
+    ok: boolean;
+    reasons: string[];
+    /** Oldest to newest issuer DID, ending at the issuer document's current DID. */
+    lineage: string[];
+    /** Each DID retired by a compromise succession, and its `compromised_at`. */
+    compromised: Record<string, string>;
+}
+/**
+ * Section 5a: the issuer document's succession chain (`successions`, signed by its `owner`), or
+ * null when it lists none. Every link is a valid @zanii/succession signed by the owner, a planned
+ * one (rotation, retirement) also by the old key, and the links run from the oldest issuer DID to
+ * `dids[0]`.
+ */
+export declare function issuerLineage(issuerDoc: unknown): IssuerLineage | null;
+/** Does a valid lineage lead from `from` to the later key `to`? */
+export declare const succeeds: (lin: IssuerLineage | null, from: unknown, to: unknown) => boolean;
+/** Current status authority cannot come from a compromised key, even with a backdated timestamp. */
+export declare const compromisedKeyReasons: (lin: IssuerLineage | null, did: unknown, what: string) => string[];
+/** The reason, when `did` was retired by a compromise and signed something dated at or after it. */
+export declare function afterCompromise(lin: IssuerLineage | null, did: unknown, at: unknown, what: string): string[];

package/dist/succession.js

@@ -0,0 +1,67 @@
+// spec/certificate.md section 5a: issuer key succession. The issuer document lists the
+// @zanii/succession documents from each old issuer DID to the next, signed by the lab owner key;
+// a verifier follows them from the key that signed a certificate to the key that signs status now.
+import { verifyLineage, verifySuccession } from "@zanii/succession";
+import { isDid, isIso, isObj, ms } from "./shared.js";
+import { signingIdentityReasons } from "./signing-identity.js";
+const MAX_SUCCESSIONS = 64;
+/**
+ * Section 5a: the issuer document's succession chain (`successions`, signed by its `owner`), or
+ * null when it lists none. Every link is a valid @zanii/succession signed by the owner, a planned
+ * one (rotation, retirement) also by the old key, and the links run from the oldest issuer DID to
+ * `dids[0]`.
+ */
+export function issuerLineage(issuerDoc) {
+    const doc = isObj(issuerDoc) ? issuerDoc : {};
+    if (doc.owner !== undefined) {
+        const reasons = signingIdentityReasons(doc.owner, doc.dids ?? [], doc.status_dids ?? []);
+        if (reasons.length)
+            return { ok: false, reasons, lineage: [], compromised: {} };
+    }
+    const list = doc.successions;
+    if (list === undefined || (Array.isArray(list) && list.length === 0))
+        return null;
+    const fail = (r) => ({ ok: false, reasons: [`issuer succession: ${r}`], lineage: [], compromised: {} });
+    if (!Array.isArray(list) || list.length > MAX_SUCCESSIONS)
+        return fail(`successions must be a list of at most ${MAX_SUCCESSIONS}`);
+    if (!isDid(doc.owner))
+        return fail("the issuer document names no owner for its successions");
+    const current = Array.isArray(doc.dids) ? doc.dids[0] : undefined;
+    if (!isDid(current))
+        return fail("the issuer document names no current issuer DID");
+    const reasons = [];
+    const compromised = {};
+    list.forEach((s, i) => {
+        if (!isObj(s) || !isObj(s.body) || !Array.isArray(s.signatures) || !s.signatures.every(isObj))
+            return reasons.push(`link ${i}: not a succession (v1)`);
+        const check = verifySuccession(s);
+        if (!check.ok)
+            return reasons.push(...check.reasons.map((r) => `link ${i}: ${r}`));
+        const b = s.body;
+        if (b.owner !== doc.owner)
+            reasons.push(`link ${i} is not signed by the issuer document's owner`);
+        if (b.reason === "compromise" && !isIso(b.compromised_at))
+            reasons.push(`link ${i}: compromised_at must be an ISO UTC timestamp`);
+        else if (b.reason === "compromise")
+            compromised[b.predecessor] = b.compromised_at;
+        else if (!check.cosigned)
+            reasons.push(`link ${i}: a planned succession must be countersigned by the old key`);
+    });
+    if (reasons.length)
+        return { ok: false, reasons: reasons.map((r) => `issuer succession: ${r}`), lineage: [], compromised: {} };
+    const lin = verifyLineage(list, current);
+    if (!lin.ok)
+        return { ok: false, reasons: lin.reasons.map((r) => `issuer succession: ${r}`), lineage: [], compromised: {} };
+    return { ok: true, reasons: [], lineage: lin.lineage, compromised };
+}
+/** Does a valid lineage lead from `from` to the later key `to`? */
+export const succeeds = (lin, from, to) => !!lin?.ok && typeof from === "string" && typeof to === "string" && lin.lineage.indexOf(from) >= 0 && lin.lineage.indexOf(to) > lin.lineage.indexOf(from);
+/** Current status authority cannot come from a compromised key, even with a backdated timestamp. */
+export const compromisedKeyReasons = (lin, did, what) => lin?.ok && typeof did === "string" && Object.hasOwn(lin.compromised, did) ? [`${what} is signed by a compromised issuer key`] : [];
+/** The reason, when `did` was retired by a compromise and signed something dated at or after it. */
+export function afterCompromise(lin, did, at, what) {
+    const t = lin?.ok && typeof did === "string" ? lin.compromised[did] : undefined;
+    if (t === undefined)
+        return [];
+    return ms(at) >= ms(t) || Number.isNaN(ms(at)) ? [`${what} was signed by the issuer key after its compromise at ${t}`] : [];
+}

package/dist/suite.d.ts

@@ -0,0 +1,261 @@
+import { type DelegationCert, type RevocationRecord } from "@zanii/core";
+import { type ProfileCheck } from "./profile.ts";
+import scenariosSchema from "./schemas/scenarios.schema.json";
+import suiteSchema from "./schemas/suite.schema.json";
+import { type SandboxDelegationPolicy } from "./sandbox-delegation.ts";
+import { type NormalizationPolicy } from "./normalization.ts";
+import { type TrajectorySuite } from "./trajectory.ts";
+export interface TeamReceiptPolicy {
+    /** Explicitly trusted participants and their delegation-root owner keys; $agent denotes the tested agent. */
+    members: {
+        agent: string;
+        owner: string;
+    }[];
+    require_distinct_owners: boolean;
+    /** Defaults true for explicit policies; legacy receipts retain their existing task field. */
+    bind_run?: boolean;
+}
+export type Check = {
+    kind: "not_contains" | "contains_any";
+    values: string[];
+    finding?: string;
+} | {
+    kind: "tool_not_called";
+    tools: string[];
+    finding?: string;
+} | {
+    kind: "max_tool_calls";
+    n: number;
+    finding?: string;
+} | {
+    kind: "all";
+    checks: Check[];
+    finding?: string;
+} | {
+    kind: "judged";
+    rubric: string;
+    finding?: string;
+} | {
+    kind: "within_delegation" | "no_scope_escalation";
+    finding?: string;
+} | {
+    kind: "team_receipt";
+    tool: string;
+    threshold: number;
+    invocation?: "required" | "optional";
+    policy?: TeamReceiptPolicy;
+    finding?: string;
+};
+/** Section 2b: one link of the delegation chain the agent under test acts at the end of. */
+export interface DelegationLink {
+    agent: string;
+    scopes: string[];
+    spend_limit: {
+        amount_minor: number;
+        currency: string;
+    };
+}
+/** Section 2b: the chain, and the scope each offered tool needs (and which argument carries a spend). */
+export interface Delegation {
+    chain: DelegationLink[];
+    tools: {
+        name: string;
+        scope: string;
+        amount?: string;
+        currency?: string;
+    }[];
+    /** Section 2b.1: the signed chain, one @zanii/core `createCert` per link, root first. */
+    certs?: DelegationCert[];
+    /** Section 2b.1: @zanii/core `createRevocation` records of certificates of the chain. */
+    revocations?: RevocationRecord[];
+    /** Runtime-generated sandbox policy authenticating the declared spend budget and full case chain. */
+    authorization?: SandboxDelegationPolicy;
+}
+/** Section 2b: the tool through which the agent hands work to a sub-agent, and its argument names. */
+export interface SubAgent {
+    agent: string;
+    tool: string;
+    scopes: string;
+    amount?: string;
+}
+/** A tool call: its name, or its name and parsed arguments (the multi-agent checks read arguments). */
+export type ToolCall = string | {
+    name: string;
+    arguments?: unknown;
+};
+type Text = {
+    en: string;
+    ar: string;
+};
+/** Section 2a: what a reviewer judges a `judged` trial against. */
+export interface Rubric {
+    id: string;
+    title: Text;
+    pass: Text;
+    fail: Text;
+}
+export interface SuiteCase {
+    id: string;
+    profiles?: string[];
+    category: string;
+    lang: "en" | "ar" | "ar-gulf";
+    turns: {
+        role: "user" | "assistant";
+        content: string;
+    }[];
+    documents?: {
+        name: string;
+        text: string;
+    }[];
+    tools?: {
+        type: "function";
+        function: {
+            name: string;
+            description?: string;
+            parameters?: object;
+        };
+    }[];
+    delegation?: Delegation;
+    sub_agent?: SubAgent;
+    check: Check;
+}
+export interface Suite {
+    v: 1;
+    type: "certify.suite";
+    id: string;
+    version: number;
+    visibility: "public" | "held-out";
+    profiles?: string[];
+    rubrics?: Rubric[];
+    cases: SuiteCase[];
+}
+/** spec/scenarios.md: an anonymised incident (or a practice story) as a replayable multi-turn case. */
+export interface Scenario extends SuiteCase {
+    title: Text;
+    source: {
+        kind: "incident" | "practice";
+        note: Text;
+        observed?: string;
+        blackbox?: {
+            source: string;
+            label?: string;
+            calls?: number;
+            expect: {
+                finding_codes: Record<string, number>;
+            };
+        };
+    };
+}
+export interface ScenarioLibrary {
+    v: 1;
+    type: "certify.scenarios";
+    id: string;
+    version: number;
+    visibility: "public" | "held-out";
+    profiles?: string[];
+    rubrics?: Rubric[];
+    scenarios: Scenario[];
+}
+export interface CheckResult {
+    passed: boolean;
+    /** Sorted, distinct finding codes of the failed checks; empty when passed. */
+    findings: string[];
+}
+/** Section 2: the finding a failed check reports when it names none. */
+export declare const DEFAULT_FINDINGS: {
+    readonly not_contains: "TEXT_FORBIDDEN";
+    readonly contains_any: "TEXT_REQUIRED_MISSING";
+    readonly tool_not_called: "TOOL_FORBIDDEN_CALLED";
+    readonly max_tool_calls: "TOOL_CALLS_OVER_LIMIT";
+    readonly judged: "JUDGED_FAIL";
+    readonly within_delegation: "DELEGATION_EXCEEDED";
+    readonly no_scope_escalation: "SCOPE_ESCALATION";
+    readonly team_receipt: "TEAM_RECEIPT_MISSING";
+};
+/** Section 2: format controls removed, NFKC, then tatweel and Arabic diacritics removed, then lowercased. */
+export declare function normaliseText(s: string, opts?: {
+    policy?: NormalizationPolicy;
+}): string;
+/** Section 2a: the result of a judged trial from the reviewer's outcome. */
+export declare function judgementResult(check: Check, outcome: "pass" | "fail"): CheckResult;
+/**
+ * Section 2b: what the agent under test may do at the end of the chain: the first link's scopes,
+ * each later link keeping only the scopes its delegator holds (`@zanii/core` `verifyChain`), and
+ * the smallest spend limit of the chain.
+ */
+export declare function effectiveDelegation(d: Delegation): {
+    scopes: string[];
+    spend_limit: {
+        amount_minor: number;
+        currency: string;
+    };
+};
+/** What the run tells the multi-agent checks (sections 2b, 2b.1 and 2b.2). */
+export interface CheckContext {
+    /** Selected by the run's trusted configuration, never an agent-supplied version hint. */
+    normalizationPolicy?: NormalizationPolicy;
+    delegation?: Delegation;
+    sub_agent?: SubAgent;
+    /** Section 2b.1: the DID of the agent under test, where a signed chain must end. */
+    agent?: string;
+    /** Section 2b.1: the time of the run (ISO), at which the signed chain must be in force. */
+    at?: string;
+    /** Section 2b.2: the DIDs of the agent team under test. */
+    team?: readonly string[];
+    /** Section 2b.2: the team's @zanii/swarm co-signed receipts the run returned. */
+    receipts?: readonly unknown[];
+    /** Section 2b.2: the end of the run window (ISO); with `at`, a receipt's `ts` must lie between them. */
+    until?: string;
+    /** Section 2b.2: the applicant's owner DID, a delegation root team signers may hold besides the case's. */
+    owner?: string;
+    run?: string;
+    case_id?: string;
+    /** Independently derived lab sandbox root, never a key returned by the tested agent. */
+    sandbox_root?: string;
+}
+/** New explicit team policies can bind otherwise unchanged swarm receipts to one run and case. */
+export declare function teamReceiptTask(tool: string, context: {
+    run: string;
+    case_id: string;
+}): string;
+/**
+ * Section 2b.1: a signed chain (`delegation.certs`) checked with @zanii/core `verifyChain` for the
+ * agent under test at the run's time, revocations applied: `{ok, error, scopes}`, the scopes it
+ * grants, none when it does not verify.
+ */
+export declare function verifyCaseDelegation(d: Delegation, agent: string, at: string): {
+    ok: boolean;
+    error: string | null;
+    scopes: string[];
+};
+/**
+ * Section 2: evaluate one check on the agent's final reply and the tools it called. The
+ * multi-agent checks (section 2b) also read the calls' arguments and the case's `delegation` and
+ * `sub_agent` (`context`).
+ */
+export declare function runCheck(check: Check, reply: string | null, toolCalls: readonly ToolCall[], context?: CheckContext): CheckResult;
+/**
+ * Section 1: a suite is valid when it matches the schema, its case ids are distinct, every case
+ * ends on a user turn, every check carries exactly the field its kind needs, a tool a check forbids
+ * is one the case offers, and (when `categories` is given) every case's category is in it.
+ */
+export declare function validateSuite(suite: unknown, categories?: readonly string[]): ProfileCheck;
+/**
+ * scenarios.md section 2: a library is valid when it matches the schema and its scenarios keep the
+ * case rules of suites.md section 1; an incident's Blackbox finding codes are finding codes with
+ * counts from 1 to 1 000 000.
+ */
+export declare function validateScenarios(library: unknown, categories?: readonly string[]): ProfileCheck;
+/** scenarios.md section 3: the cases a library's scenarios run as (title and source dropped). */
+export declare function scenarioCases(library: ScenarioLibrary): SuiteCase[];
+export type SuiteDocument = Suite | ScenarioLibrary | TrajectorySuite;
+/** Explicit additive dispatch; validateSuite keeps its original v1-only contract. */
+export declare function validateSuiteDocument(value: unknown, categories?: readonly string[]): ProfileCheck;
+/** Keep complete case objects, including trajectory fixtures, through maps/snapshots. */
+export declare const casesOf: (doc: SuiteDocument) => SuiteCase[];
+/**
+ * Section 3: `jcsHash` of `{v: 1, suites}` with every loaded suite and scenario library sorted by
+ * id. Throws when one is invalid, or when two share an id or a case (scenario) id.
+ */
+export declare function suiteSnapshot(suites: readonly unknown[]): string;
+export { scenariosSchema, suiteSchema };