@zanii/certify 0.0.0-stage → 0.6.0

package/dist/audit.js

@@ -0,0 +1,112 @@
+// spec/audit.md: the control audit attestation a Level 3 certificate references by hash, signed by
+// the accredited certification body that ran the audit.
+import { jcsHash, verifySignedObject } from "@zanii/core";
+import { isDid, isIso, isObj, ms, sortedUnique } from "./shared.js";
+import { signerDid, signWith } from "./signer.js";
+export const AUDIT_OUTCOMES = ["conforming", "minor_nonconformities", "major_nonconformities"];
+/** A clause or Annex A control id, by number only (`8.2`, `A.6.2.4`). */
+export const CONTROL = /^(A\.)?[0-9]{1,3}(\.[0-9]{1,3}){0,4}$/;
+const STANDARD = /^[A-Za-z0-9][A-Za-z0-9 ./:_-]{0,99}$/;
+const COUNTRY = /^[A-Z]{2}$/;
+const text = (v, max) => typeof v === "string" && v.length >= 1 && v.length <= max;
+/** Section 1's field rules; the first broken rule, or null. `controls` must already be sorted. */
+function fieldError(a) {
+    const ap = isObj(a.applicant) ? a.applicant : {};
+    const sc = isObj(a.scope) ? a.scope : {};
+    if (!isDid(a.holder))
+        return "holder must be a did:key";
+    if (!isObj(a.applicant) || Object.keys(ap).length !== 2 || !text(ap.name, 200) || typeof ap.country !== "string" || !COUNTRY.test(ap.country))
+        return "applicant needs a name (1-200) and an ISO 3166-1 alpha-2 country";
+    if (!isObj(a.scope) || Object.keys(sc).length !== 2 || !text(sc.en, 500) || !text(sc.ar, 500))
+        return "scope needs en and ar text (1-500)";
+    if (typeof a.standard !== "string" || !STANDARD.test(a.standard))
+        return "standard is not a standard reference";
+    const c = a.controls;
+    if (!Array.isArray(c) || c.length < 1 || c.length > 500 || !c.every((x) => typeof x === "string" && CONTROL.test(x)))
+        return "controls must be 1-500 clause ids by number";
+    if (sortedUnique(c).join("\n") !== c.join("\n"))
+        return "controls must be sorted and distinct";
+    if (!isIso(a.audited_at) || !isIso(a.valid_until) || !isIso(a.issued_at))
+        return "dates must be ISO UTC timestamps";
+    if (ms(a.valid_until) <= ms(a.audited_at) || ms(a.issued_at) < ms(a.audited_at))
+        return "valid_until must be after audited_at, issued_at not before it";
+    if (!AUDIT_OUTCOMES.includes(a.outcome))
+        return "unknown outcome";
+    return null;
+}
+/** Sign an audit attestation as the certification body (`signer` holds the body's key). */
+export async function buildAuditAttestation(fields, signer) {
+    const unsigned = {
+        v: 1,
+        type: "certify.audit-attestation",
+        body: signerDid(signer),
+        holder: fields.holder,
+        applicant: fields.applicant,
+        scope: fields.scope,
+        standard: fields.standard,
+        controls: Array.isArray(fields.controls) ? sortedUnique(fields.controls) : fields.controls,
+        audited_at: fields.auditedAt,
+        valid_until: fields.validUntil,
+        outcome: fields.outcome,
+        issued_at: fields.issuedAt,
+    };
+    const err = fieldError(unsigned);
+    if (err)
+        throw new Error(err);
+    return signWith(unsigned, signer);
+}
+/**
+ * Verify an audit attestation: signed by its body, well formed, from a body in `trustedBodies`,
+ * still valid at `now`, not a major nonconformity, and (with `certificate`) for that certificate's
+ * holder and applicant, referenced by its `claim.audit` and dated no later than its issue.
+ */
+export function verifyAuditAttestation(att, opts = {}) {
+    const a = isObj(att) ? att : {};
+    if (a.v !== 1 || a.type !== "certify.audit-attestation" || !isDid(a.body) || Object.keys(a).length !== 14)
+        return { ok: false, reasons: ["not an audit attestation (v1)"] };
+    const reasons = [];
+    if (!verifySignedObject(a) || a.signer !== a.body)
+        reasons.push("bad audit attestation signature");
+    const err = fieldError(a);
+    if (err)
+        reasons.push(`audit attestation is malformed: ${err}`);
+    if (!opts.trustedBodies)
+        reasons.push("no trusted certification bodies supplied: the audit body was NOT checked");
+    else if (!opts.trustedBodies.includes(a.body))
+        reasons.push("audit body is not a trusted certification body");
+    const now = opts.now ? ms(opts.now) : Date.now();
+    if (ms(a.valid_until) < now)
+        reasons.push(`audit attestation expired on ${String(a.valid_until)}`);
+    if (a.outcome === "major_nonconformities")
+        reasons.push("audit outcome is major_nonconformities");
+    const cert = opts.certificate;
+    if (cert) {
+        const claim = isObj(cert.claim) ? cert.claim : {};
+        const ca = isObj(claim.applicant) ? claim.applicant : {};
+        const ap = isObj(a.applicant) ? a.applicant : {};
+        if (a.holder !== cert.holder)
+            reasons.push("audit attestation is for a different agent");
+        if (ap.name !== ca.name || ap.country !== ca.country)
+            reasons.push("audit attestation is for a different applicant");
+        if (claim.audit !== jcsHash(a))
+            reasons.push("certificate does not reference this audit attestation");
+        if (ms(a.audited_at) > ms(cert.issued_at))
+            reasons.push("audit is dated after the certificate");
+    }
+    return { ok: reasons.length === 0, reasons };
+}
+/**
+ * Section 3: has the audit attestation of a Level 3 certificate lapsed at `now`? Surveillance then
+ * suspends the certificate with reason AUDIT_EXPIRED. False below Level 3; throws when `audit` is
+ * not the attestation the certificate references.
+ */
+export function auditLapsed(certificate, audit, now) {
+    if (!isIso(now))
+        throw new Error("now must be an ISO timestamp");
+    const claim = isObj(certificate?.claim) ? certificate.claim : {};
+    if (claim.level !== 3)
+        return false;
+    if (claim.audit !== jcsHash(audit))
+        throw new Error("the certificate does not reference this audit attestation");
+    return !(ms(audit.valid_until) >= ms(now));
+}

package/dist/beacon-client.d.ts

@@ -0,0 +1,40 @@
+import { type Credential } from "@zanii/credentials";
+import type { Fingerprint } from "./fingerprint.ts";
+import type { Signer } from "./signer.ts";
+export declare const BEACON_INTERVAL_MS = 300000;
+type FingerprintValue = string | Fingerprint;
+export interface BeaconOptions {
+    /** The lab origin, for example `https://lab.zanii.agency`; reports go to `/v1/beacon`. */
+    url: string;
+    /** The certificate, or its certificate hash. */
+    certificate: Credential | string;
+    /** Holds the agent's key (the certificate holder). */
+    signer: Signer;
+    /** The fingerprint the agent runs now, or a function returning it (read at every report). */
+    fingerprint: FingerprintValue | (() => FingerprintValue | Promise<FingerprintValue>);
+    /** Default 300 000 (five minutes); 1 000 to 2 147 483 647. */
+    intervalMs?: number;
+    fetch?: typeof fetch;
+    /** Optional agent-bound admission credential; never use a management API key. */
+    transportKey?: string;
+    /** Called when a started report finishes, including failures; busy rejections are returned only. */
+    onResult?: (result: BeaconResult) => void;
+}
+export interface BeaconResult {
+    /** True when the lab accepted the report (202). */
+    ok: boolean;
+    /** The HTTP status; 0 when the request did not complete. */
+    status: number;
+    /** The lab's JSON reply (`{accepted, match, action}` or `{error, code}`), or null. */
+    body: unknown;
+    /** Set when the request did not complete or the report could not be built. */
+    error?: string;
+}
+export interface BeaconHandle {
+    /** Send one report now; a concurrent underlying report returns a busy failure. */
+    send: () => Promise<BeaconResult>;
+    stop: () => void;
+}
+/** Start reporting: one report now, then one every `intervalMs`. */
+export declare function startBeacon(opts: BeaconOptions): BeaconHandle;
+export {};

package/dist/beacon-client.js

@@ -0,0 +1,151 @@
+// spec/beacon.md section 4: the client a certified agent runs in production. It signs a beacon
+// report with the agent's key and posts it to the lab (api.md 4.3), now and then every interval.
+import { randomBytes } from "node:crypto";
+import { credentialHash } from "@zanii/credentials";
+import { buildBeacon } from "./beacon.js";
+import { isSha } from "./shared.js";
+import { machineTransportHeaders, redactTransportText } from "./transport-key.js";
+export const BEACON_INTERVAL_MS = 300_000;
+const MIN_INTERVAL_MS = 1_000;
+const MAX_INTERVAL_MS = 2_147_483_647;
+const TIMEOUT_MS = 10_000;
+const MAX_RESPONSE_BYTES = 32 * 1024;
+/** Start reporting: one report now, then one every `intervalMs`. */
+export function startBeacon(opts) {
+    const endpoint = new URL("/v1/beacon", opts.url);
+    if ((endpoint.protocol !== "https:" && endpoint.protocol !== "http:") || endpoint.username || endpoint.password)
+        throw new Error("url must be http(s) without credentials");
+    const transportKey = opts.transportKey, transportHeaders = machineTransportHeaders(endpoint, transportKey);
+    const certificate = typeof opts.certificate === "string" ? opts.certificate : credentialHash(opts.certificate);
+    if (!isSha(certificate))
+        throw new Error("certificate must be a certificate or its hash");
+    const intervalMs = opts.intervalMs ?? BEACON_INTERVAL_MS;
+    if (!Number.isSafeInteger(intervalMs) || intervalMs < MIN_INTERVAL_MS || intervalMs > MAX_INTERVAL_MS)
+        throw new Error(`intervalMs must be an integer from ${MIN_INTERVAL_MS} to ${MAX_INTERVAL_MS}`);
+    const doFetch = opts.fetch ?? fetch;
+    let running = false, automatic = true;
+    let timer = null, controller = null;
+    const failure = (error) => ({ ok: false, status: 0, body: null, error: redactTransportText(error instanceof Error ? error.message : String(error), transportKey) });
+    const notify = (result) => {
+        try {
+            void Promise.resolve(opts.onResult?.(result)).catch(() => { });
+        }
+        catch { /* Observers cannot interrupt reporting. */ }
+    };
+    const check = (signal) => { if (signal.aborted)
+        throw signal.reason; };
+    async function report(signal) {
+        check(signal);
+        const fp = typeof opts.fingerprint === "function" ? await opts.fingerprint() : opts.fingerprint;
+        check(signal);
+        const report = await buildBeacon({
+            certificate,
+            fingerprint: typeof fp === "string" ? fp : fp.id,
+            ...(typeof fp === "string" ? {} : { fingerprintManifest: fp }),
+            observedAt: new Date().toISOString(),
+            nonce: randomBytes(18).toString("base64url"),
+        }, opts.signer);
+        check(signal);
+        const res = await doFetch(endpoint.href, {
+            method: "POST",
+            redirect: "error", credentials: "omit",
+            headers: { "content-type": "application/json; charset=utf-8", ...transportHeaders },
+            body: JSON.stringify(report),
+            signal,
+        });
+        if (signal.aborted) {
+            void res.body?.cancel().catch(() => { });
+            check(signal);
+        }
+        if (res.redirected || (res.url && new URL(res.url).origin !== endpoint.origin)) {
+            void res.body?.cancel().catch(() => { });
+            throw new Error("beacon endpoint redirected the request");
+        }
+        const length = res.headers.get("content-length");
+        if (length && (!/^\d+$/.test(length) || Number(length) > MAX_RESPONSE_BYTES)) {
+            void res.body?.cancel().catch(() => { });
+            throw new Error("beacon response exceeds 32KiB");
+        }
+        const reader = res.body?.getReader(), bytes = new Uint8Array(MAX_RESPONSE_BYTES);
+        const cancelled = () => { void reader?.cancel().catch(() => { }); };
+        signal.addEventListener("abort", cancelled, { once: true });
+        let size = 0, reads = 0;
+        try {
+            if (reader)
+                for (;;) {
+                    const part = await reader.read();
+                    check(signal);
+                    if (part.done)
+                        break;
+                    if (size + part.value.byteLength > MAX_RESPONSE_BYTES)
+                        throw new Error("beacon response exceeds 32KiB");
+                    bytes.set(part.value, size);
+                    size += part.value.byteLength;
+                    if (++reads % 64 === 0)
+                        await new Promise((resolve) => setImmediate(resolve));
+                    check(signal);
+                }
+        }
+        catch (error) {
+            cancelled();
+            throw error;
+        }
+        finally {
+            signal.removeEventListener("abort", cancelled);
+            reader?.releaseLock();
+        }
+        let body = null;
+        try {
+            body = JSON.parse(redactTransportText(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)), transportKey));
+        }
+        catch { /* Non-JSON replies retain their HTTP status. */ }
+        return { ok: res.status === 202, status: res.status, body };
+    }
+    function schedule() {
+        if (automatic && !running) {
+            timer = setTimeout(() => { timer = null; void send(); }, intervalMs);
+            timer.unref();
+        }
+    }
+    function send() {
+        if (running)
+            return Promise.resolve(failure("beacon report is busy"));
+        if (timer) {
+            clearTimeout(timer);
+            timer = null;
+        }
+        running = true;
+        const control = new AbortController();
+        controller = control;
+        let finish, settled = false;
+        const result = new Promise((resolve) => { finish = resolve; });
+        const settle = (value) => { if (!settled) {
+            settled = true;
+            finish(value);
+            notify(value);
+        } };
+        const abort = () => settle(failure(control.signal.reason));
+        control.signal.addEventListener("abort", abort, { once: true });
+        const deadline = setTimeout(() => control.abort(new Error("beacon report exceeded its 10000ms deadline")), TIMEOUT_MS);
+        control.signal.addEventListener("abort", () => clearTimeout(deadline), { once: true });
+        const cleanup = () => {
+            clearTimeout(deadline);
+            control.signal.removeEventListener("abort", abort);
+            controller = null;
+            running = false;
+            schedule();
+        };
+        // Keep the slot until callbacks actually settle, even when timeout already returned a failure.
+        void report(control.signal).then((value) => { cleanup(); settle(value); }, (error) => { cleanup(); settle(failure(error)); });
+        return result;
+    }
+    void send();
+    return { send, stop: () => {
+            automatic = false;
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            controller?.abort(new Error("beacon reporting stopped"));
+        } };
+}

package/dist/beacon.d.ts

@@ -0,0 +1,84 @@
+import { type QuoteVerifier } from "@zanii/attest";
+import { type Credential } from "@zanii/credentials";
+import { type Signer } from "./signer.ts";
+import { type Fingerprint } from "./fingerprint.ts";
+export declare const NONCE: RegExp;
+/** Section 3: how far a report's observed_at may run ahead of the verifier's clock. */
+export declare const MAX_SKEW_SECONDS = 300;
+export interface BeaconReport {
+    v: 1;
+    type: "certify.beacon";
+    agent: string;
+    certificate: string;
+    fingerprint: string;
+    /** Optional original manifest; its recomputed id must equal fingerprint. */
+    fingerprint_manifest?: Fingerprint;
+    observed_at: string;
+    nonce: string;
+    /** Section 5: the platform's attestation of the code that produced this report. */
+    attestation?: BeaconAttestation;
+    signer: string;
+    sig: string;
+}
+/** Section 5: a @zanii/attest Attestation in its wire form (attestationHash's field names). */
+export interface BeaconAttestation {
+    v: 1;
+    /** `nitro`, `sgx`, `tdx`, `sev-snp`, `tpm`, ... the root of trust. */
+    platform: string;
+    /** The code measurement (PCR digest, MRENCLAVE, ...). */
+    measurement: string;
+    /** Hash of the raw quote, which the platform verifier checks. */
+    quote_hash: string;
+    /** `beaconChallenge` of this report: the report data the quote binds. */
+    nonce: string;
+    attested_at: string;
+}
+/** Section 5: the challenge an attested report's quote binds: the report's own fields, hashed. */
+export declare const beaconChallenge: (f: {
+    certificate: string;
+    fingerprint: string;
+    observedAt: string;
+    nonce: string;
+}) => string;
+/** Sign a beacon report as the agent (`signer` holds the agent's key). */
+export declare function buildBeacon(fields: {
+    certificate: string;
+    fingerprint: string;
+    observedAt: string;
+    nonce: string;
+    attestation?: BeaconAttestation;
+    fingerprintManifest?: Fingerprint;
+}, signer: Signer): Promise<BeaconReport>;
+export interface BeaconCheck {
+    /** The report is authentic, well formed, not from the future and (when given) for this certificate. */
+    ok: boolean;
+    reasons: string[];
+    /** Whether the reported fingerprint is the certified one; null without a certificate. */
+    match: boolean | null;
+}
+/**
+ * Verify a beacon report. With `certificate`, also check it names that certificate and its holder
+ * and say whether the fingerprint matches. `maxAgeSeconds` refuses old reports (replay window).
+ */
+export declare function verifyBeacon(report: unknown, opts?: {
+    certificate?: Credential;
+    now?: string;
+    maxAgeSeconds?: number;
+}): BeaconCheck;
+export interface AttestedBeaconCheck extends BeaconCheck {
+    /** true: the platform verifier verified the quote (and the measurement is listed); false: it
+     * refused it, or the measurement is not listed; null: no attestation or no verifier, NOT verified. */
+    attested: boolean | null;
+}
+/**
+ * Section 5: `verifyBeacon`, then the report's attestation through the injected platform
+ * verifier (@zanii/attest `verifyAttestation`). Honest by default: without `verifyQuote` the
+ * attestation is not verified (`attested: null`) and the report counts as self-reported.
+ */
+export declare function verifyAttestedBeacon(report: unknown, opts?: {
+    certificate?: Credential;
+    now?: string;
+    maxAgeSeconds?: number;
+    verifyQuote?: QuoteVerifier;
+    measurements?: readonly string[];
+}): Promise<AttestedBeaconCheck>;

package/dist/beacon.js

@@ -0,0 +1,106 @@
+// spec/beacon.md: the production agent reports its current fingerprint, signed by its own DID.
+import { verifyAttestation } from "@zanii/attest";
+import { credentialHash } from "@zanii/credentials";
+import { jcsHash, verifySignedObject } from "@zanii/core";
+import { isDid, isIso, isObj, isSha, ms } from "./shared.js";
+import { signerDid, signWith } from "./signer.js";
+import { checkFingerprint } from "./fingerprint.js";
+export const NONCE = /^[A-Za-z0-9_-]{16,128}$/;
+/** Section 3: how far a report's observed_at may run ahead of the verifier's clock. */
+export const MAX_SKEW_SECONDS = 300;
+const PLATFORM = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const MEASUREMENT = /^[A-Za-z0-9:._+/=-]{1,256}$/;
+/** Section 5: the challenge an attested report's quote binds: the report's own fields, hashed. */
+export const beaconChallenge = (f) => jcsHash({ v: 1, type: "certify.beacon-challenge", certificate: f.certificate, fingerprint: f.fingerprint, observed_at: f.observedAt, nonce: f.nonce });
+function attestationOk(a, b) {
+    if (!isObj(a) || Object.keys(a).length !== 6 || a.v !== 1)
+        return false;
+    const challenge = beaconChallenge({ certificate: String(b.certificate), fingerprint: String(b.fingerprint), observedAt: String(b.observed_at), nonce: String(b.nonce) });
+    return (typeof a.platform === "string" && PLATFORM.test(a.platform) &&
+        typeof a.measurement === "string" && MEASUREMENT.test(a.measurement) &&
+        isSha(a.quote_hash) && a.nonce === challenge && isIso(a.attested_at) &&
+        Math.abs(ms(a.attested_at) - ms(b.observed_at)) <= MAX_SKEW_SECONDS * 1000);
+}
+/** Sign a beacon report as the agent (`signer` holds the agent's key). */
+export async function buildBeacon(fields, signer) {
+    if (!isSha(fields.certificate))
+        throw new Error("certificate must be a credential hash");
+    if (!isSha(fields.fingerprint))
+        throw new Error("fingerprint must be a fingerprint id");
+    if (!isIso(fields.observedAt))
+        throw new Error("observedAt must be an ISO UTC timestamp");
+    if (!NONCE.test(fields.nonce))
+        throw new Error("nonce must be 16-128 of [A-Za-z0-9_-]");
+    if (fields.fingerprintManifest !== undefined && (!checkFingerprint(fields.fingerprintManifest) || fields.fingerprintManifest.id !== fields.fingerprint))
+        throw new Error("beacon fingerprint manifest is malformed or does not match the reported fingerprint");
+    const unsigned = {
+        v: 1,
+        type: "certify.beacon",
+        agent: signerDid(signer),
+        certificate: fields.certificate,
+        fingerprint: fields.fingerprint,
+        ...(fields.fingerprintManifest !== undefined ? { fingerprint_manifest: { ...fields.fingerprintManifest } } : {}),
+        observed_at: fields.observedAt,
+        nonce: fields.nonce,
+        ...(fields.attestation !== undefined ? { attestation: fields.attestation } : {}),
+    };
+    if (fields.attestation !== undefined && !attestationOk(fields.attestation, unsigned))
+        throw new Error("attestation is malformed or does not bind this report's beaconChallenge");
+    return signWith(unsigned, signer);
+}
+/**
+ * Verify a beacon report. With `certificate`, also check it names that certificate and its holder
+ * and say whether the fingerprint matches. `maxAgeSeconds` refuses old reports (replay window).
+ */
+export function verifyBeacon(report, opts = {}) {
+    const b = isObj(report) ? report : {};
+    if (b.v !== 1 || b.type !== "certify.beacon" || !isDid(b.agent) || Object.keys(b).length !== 9 + Number("attestation" in b) + Number("fingerprint_manifest" in b))
+        return { ok: false, reasons: ["not a beacon report (v1)"], match: null };
+    const reasons = [];
+    if (!verifySignedObject(b))
+        reasons.push("bad beacon signature");
+    if (b.signer !== b.agent)
+        reasons.push("beacon is not signed by its agent");
+    if (!isSha(b.certificate) || !isSha(b.fingerprint) || !isIso(b.observed_at) || typeof b.nonce !== "string" || !NONCE.test(b.nonce))
+        reasons.push("beacon has a malformed field");
+    if ("attestation" in b && !attestationOk(b.attestation, b))
+        reasons.push("beacon attestation is malformed or does not bind the report");
+    if ("fingerprint_manifest" in b && (!checkFingerprint(b.fingerprint_manifest) || b.fingerprint_manifest.id !== b.fingerprint))
+        reasons.push("beacon fingerprint manifest is malformed or does not match the reported fingerprint");
+    const now = opts.now ? ms(opts.now) : Date.now();
+    const at = ms(b.observed_at);
+    if (at > now + MAX_SKEW_SECONDS * 1000)
+        reasons.push("beacon observed_at is in the future");
+    if (opts.maxAgeSeconds !== undefined && at < now - opts.maxAgeSeconds * 1000)
+        reasons.push("beacon is older than the accepted window");
+    let match = null;
+    if (opts.certificate) {
+        if (b.certificate !== credentialHash(opts.certificate))
+            reasons.push("beacon names a different certificate");
+        if (b.agent !== opts.certificate.holder)
+            reasons.push("beacon agent is not the certificate holder");
+        match = b.fingerprint === opts.certificate.claim?.fingerprint;
+    }
+    return { ok: reasons.length === 0, reasons, match };
+}
+/**
+ * Section 5: `verifyBeacon`, then the report's attestation through the injected platform
+ * verifier (@zanii/attest `verifyAttestation`). Honest by default: without `verifyQuote` the
+ * attestation is not verified (`attested: null`) and the report counts as self-reported.
+ */
+export async function verifyAttestedBeacon(report, opts = {}) {
+    const base = verifyBeacon(report, opts);
+    const a = isObj(report) ? report.attestation : undefined;
+    if (!base.ok || !isObj(a) || !opts.verifyQuote)
+        return { ...base, attested: null };
+    const r = await verifyAttestation({ v: 1, platform: String(a.platform), measurement: String(a.measurement), quoteHash: String(a.quote_hash), nonce: String(a.nonce), attestedAt: String(a.attested_at) }, { verifyQuote: opts.verifyQuote });
+    const reasons = [...base.reasons];
+    let attested = r.quoteVerified === true;
+    if (!attested)
+        reasons.push("beacon attestation quote verification failed");
+    else if (opts.measurements && !opts.measurements.includes(String(a.measurement))) {
+        attested = false;
+        reasons.push("beacon attestation measurement is not a certified measurement");
+    }
+    return { ok: reasons.length === 0, reasons, match: base.match, attested };
+}

package/dist/bitstring-status.d.ts

@@ -0,0 +1,56 @@
+import { type Credential } from "@zanii/credentials";
+import { type VerifiableCredential } from "@zanii/vc";
+import { type Signer } from "./signer.ts";
+import { type CertificateVcCheck } from "./vc.ts";
+export declare const BITSTRING_STATUS_SLOTS = 131072;
+export type BitstringPurpose = "revocation" | "suspension";
+export interface BitstringStatusEntry {
+    id: string;
+    type: "BitstringStatusListEntry";
+    statusPurpose: BitstringPurpose;
+    statusListIndex: string;
+    statusListCredential: string;
+}
+export interface BitstringStatusListInput {
+    id: string;
+    purpose: BitstringPurpose;
+    entries: readonly {
+        index: number;
+        value: boolean;
+    }[];
+    validFrom: string;
+    validUntil: string;
+    created: string;
+    previous?: VerifiableCredential;
+}
+export interface BitstringStatusTrust {
+    issuers: readonly string[];
+    now: string;
+}
+declare const entryShape: (s: unknown) => s is BitstringStatusEntry;
+export { entryShape as isBitstringStatusEntry };
+export declare function bitstringStatusEntry(input: {
+    index: number;
+    list: string;
+    purpose: BitstringPurpose;
+}): BitstringStatusEntry;
+export declare function buildBitstringStatusList(input: BitstringStatusListInput, signer: Signer): Promise<VerifiableCredential>;
+export declare function verifyBitstringStatusList(doc: unknown, opts: BitstringStatusTrust): {
+    ok: boolean;
+    reasons: string[];
+    bits: Uint8Array | null;
+};
+export declare function verifyBitstringStatusEntry(entry: unknown, doc: unknown, opts: BitstringStatusTrust): {
+    ok: boolean;
+    reasons: string[];
+    value: boolean | null;
+};
+export declare function certificateToBitstringVc(cert: Credential, signer: Signer, opts: {
+    created: string;
+    index: number;
+    revocationList: string;
+    suspensionList: string;
+}): Promise<VerifiableCredential>;
+export declare function verifyCertificateBitstringVc(vc: unknown, opts?: {
+    at?: string;
+}): CertificateVcCheck;