@zanii/core 0.2.0 → 0.3.0

package/README.md

@@ -1,64 +1,72 @@
-# @zanii/core
-
-The Zanii protocol as pure functions — **no I/O, no network, no trusted party.**
-Agent identities (`did:key`), scoped delegation certificates, signed action
-receipts, RFC 6962 Merkle transparency-log proofs, and self-contained audit
-bundles. Everything here is deterministic; use it to build proofs, or to
-**verify** them independently of any Zanii server.
-
-If you want to instrument a live agent (batching, HTTP ingest, tool wrapping),
-use [`@zanii/sdk`](https://www.npmjs.com/package/@zanii/sdk), which builds on
-this.
-
-```sh
-npm install @zanii/core
-```
-
-## Verify a receipt, offline
-
-```ts
-import {
-  generateKeypair,
-  createCert,
-  createReceipt,
-  hashPayload,
-  verifyReceipt,
-} from '@zanii/core';
-
-const owner = generateKeypair();
-const agent = generateKeypair();
-const cert = createCert(
-  { issuer: owner.did, subject: agent.did, scopes: ['crm.*'], exp: '2027-01-01T00:00:00Z' },
-  owner.privateKey,
-);
-const receipt = createReceipt(
-  {
-    agentId: agent.did,
-    delegation: [cert],
-    action: 'tool_call',
-    target: 'crm.lookup',
-    payloadHash: hashPayload(JSON.stringify({ email: 'a@b.co' })),
-    ts: new Date().toISOString(),
-    prev: null,
-  },
-  agent.privateKey,
-);
-
-// Checks the signature, the delegation chain, and that the action is in scope —
-// with no server and no trust.
-const result = verifyReceipt(receipt);
-if (!result.ok) throw new Error(result.error);
-```
-
-`verifyAuditBundle(bundle)` does the same for a complete exported history at
-once: every receipt's signature and Merkle inclusion, the per-agent hash chain,
-revocations, and on-chain anchor consistency.
-
-## Links
-
-- **Docs & concepts** — https://ledger.zanii.agency/docs
-- **Live transparency log** — https://ledger.zanii.agency
-
-## License
-
-Apache-2.0.
+# @zanii/core
+
+The Zanii protocol as pure functions — **no I/O, no network, no trusted party.**
+Agent identities (`did:key`), scoped delegation certificates, signed action
+receipts, RFC 6962 Merkle transparency-log proofs, and self-contained audit
+bundles. Everything here is deterministic; use it to build proofs, or to
+**verify** them independently of any Zanii server.
+
+If you want to instrument a live agent (batching, HTTP ingest, tool wrapping),
+use [`@zanii/sdk`](https://www.npmjs.com/package/@zanii/sdk), which builds on
+this.
+
+```sh
+npm install @zanii/core
+```
+
+## Verify a receipt, offline
+
+```ts
+import {
+  generateKeypair,
+  createCert,
+  createReceipt,
+  hashPayload,
+  verifyReceipt,
+} from '@zanii/core';
+
+const owner = generateKeypair();
+const agent = generateKeypair();
+const cert = createCert(
+  { issuer: owner.did, subject: agent.did, scopes: ['crm.*'], exp: '2027-01-01T00:00:00Z' },
+  owner.privateKey,
+);
+const receipt = createReceipt(
+  {
+    agentId: agent.did,
+    delegation: [cert],
+    action: 'tool_call',
+    target: 'crm.lookup',
+    payloadHash: hashPayload(JSON.stringify({ email: 'a@b.co' })),
+    ts: new Date().toISOString(),
+    prev: null,
+  },
+  agent.privateKey,
+);
+
+// Checks the signature, the delegation chain, and that the action is in scope —
+// with no server and no trust.
+const result = verifyReceipt(receipt);
+if (!result.ok) throw new Error(result.error);
+```
+
+`verifyAuditBundle(bundle)` does the same for a complete exported history at
+once: every receipt's signature and Merkle inclusion, the per-agent hash chain,
+revocations, and on-chain anchor consistency.
+
+## Links
+
+- **Docs & concepts** — https://ledger.zanii.agency/docs
+- **Live transparency log** — https://ledger.zanii.agency
+
+## Changelog
+
+- **0.3.0** — `saltedPayloadHash`/`verifyPayload`, `createConfirmation`/`verifyConfirmation`, `createCoSignature`/`verifyCoSignature`, and optional receipt provenance fields (`runtime_hash`/`model_id`/`manifest_hash`).
+- **0.2.0** — version bump in lockstep with the package family (no API changes).
+- **0.1.0** — initial release: `did:key` identity, scoped/expiring delegation, signed
+  hash-chained receipts, RFC 6962 Merkle inclusion + consistency proofs, signed tree
+  heads, audit-bundle verification, and cross-org (A2A) receipts.
+
+## License
+
+Apache-2.0.

package/dist/confirmation.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Owner confirmation of an irreversible action (SPEC §13 / Article VI).
+ *
+ * The human owner signs the exact action hash with their `did:key`. This is the
+ * cryptographic evidence a person confirmed — replacing an in-memory "yes" that
+ * proves nothing. Recorded as its own `action_confirmation` receipt so a dispute
+ * ("did the client actually approve this payment?") has a verifiable answer.
+ */
+export interface ActionConfirmation {
+    v: 1;
+    type: 'action_confirmation';
+    /** The owner's `did:key`. */
+    owner_id: string;
+    /** `sha256:…` hash of the exact action `{tool, args}` being confirmed. */
+    action_hash: string;
+    confirmed_at: string;
+    /** Ed25519 by the owner over JCS of the confirmation without `sig`. */
+    sig: string;
+}
+/** Owner signs an action hash. Only the owner's key can produce this. */
+export declare function createConfirmation(fields: {
+    ownerId: string;
+    actionHash: string;
+    confirmedAt: string;
+}, ownerPrivateKey: Uint8Array): ActionConfirmation;
+/** Verify a confirmation's signature against the owner DID it names. */
+export declare function verifyConfirmation(c: ActionConfirmation): boolean;
+//# sourceMappingURL=confirmation.d.ts.map

package/dist/confirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmation.d.ts","sourceRoot":"","sources":["../src/confirmation.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,qBAAqB,CAAC;IAC5B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACpE,eAAe,EAAE,UAAU,GAC1B,kBAAkB,CAUpB;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAWjE"}

package/dist/confirmation.js

@@ -0,0 +1,32 @@
+import { ed25519 } from '@noble/curves/ed25519';
+import { canonicalBytes, decodeSig, encodeSig } from './encoding.js';
+import { publicKeyFromDid } from './keys.js';
+/** Owner signs an action hash. Only the owner's key can produce this. */
+export function createConfirmation(fields, ownerPrivateKey) {
+    const unsigned = {
+        v: 1,
+        type: 'action_confirmation',
+        owner_id: fields.ownerId,
+        action_hash: fields.actionHash,
+        confirmed_at: fields.confirmedAt,
+    };
+    const sig = ed25519.sign(canonicalBytes(unsigned), ownerPrivateKey);
+    return { ...unsigned, sig: encodeSig(sig) };
+}
+/** Verify a confirmation's signature against the owner DID it names. */
+export function verifyConfirmation(c) {
+    if (c?.v !== 1 || c.type !== 'action_confirmation')
+        return false;
+    const pub = publicKeyFromDid(c.owner_id);
+    const sig = decodeSig(c.sig);
+    if (!pub || !sig)
+        return false;
+    const { sig: _omitted, ...unsigned } = c;
+    try {
+        return ed25519.verify(sig, canonicalBytes(unsigned), pub);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=confirmation.js.map

package/dist/confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmation.js","sourceRoot":"","sources":["../src/confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAsB7C,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAChC,MAAoE,EACpE,eAA2B;IAE3B,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAU;QACb,IAAI,EAAE,qBAA8B;QACpC,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,YAAY,EAAE,MAAM,CAAC,WAAW;KACjC,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,CAAqB;IACtD,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/cosign.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Infrastructure co-signature over an agent's receipt (SPEC §14 — segregation of duties).
+ *
+ * Gordon's Q1: the agent that does the task cannot be the sole party reporting it.
+ * "Connect" — the deterministic rails that are the only door to the outside world —
+ * holds its own `did:key` and co-signs every receipt. A second, independent signature
+ * from a party the agent can't control (and, later, that holds the provider
+ * credentials) makes acting-without-recording structurally catchable. Reconciliation
+ * (`reconcile`) covers anything that still slips around the rails.
+ *
+ * This is a signed artifact carried in a normal receipt — no server or schema change.
+ */
+export interface ReceiptCoSignature {
+    v: 1;
+    type: 'receipt_cosign';
+    /** The co-signer's `did:key` (Connect / the rails) — MUST differ from `agent_id`. */
+    cosigner_id: string;
+    /** Hash of the agent receipt being co-signed. */
+    receipt_hash: string;
+    /** The agent (the doer) whose receipt this is. */
+    agent_id: string;
+    cosigned_at: string;
+    sig: string;
+}
+/** Connect co-signs an agent's receipt. Only the co-signer's key can produce this. */
+export declare function createCoSignature(fields: {
+    cosignerId: string;
+    receiptHash: string;
+    agentId: string;
+    cosignedAt: string;
+}, cosignerPrivateKey: Uint8Array): ReceiptCoSignature;
+/**
+ * Verify a co-signature. Requires a valid signature by `cosigner_id` AND that the
+ * co-signer is a **distinct** party from the acting agent (segregation of duties).
+ */
+export declare function verifyCoSignature(c: ReceiptCoSignature): boolean;
+//# sourceMappingURL=cosign.d.ts.map

package/dist/cosign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosign.d.ts","sourceRoot":"","sources":["../src/cosign.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,gBAAgB,CAAC;IACvB,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACxF,kBAAkB,EAAE,UAAU,GAC7B,kBAAkB,CAWpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAYhE"}

package/dist/cosign.js

@@ -0,0 +1,38 @@
+import { ed25519 } from '@noble/curves/ed25519';
+import { canonicalBytes, decodeSig, encodeSig } from './encoding.js';
+import { publicKeyFromDid } from './keys.js';
+/** Connect co-signs an agent's receipt. Only the co-signer's key can produce this. */
+export function createCoSignature(fields, cosignerPrivateKey) {
+    const unsigned = {
+        v: 1,
+        type: 'receipt_cosign',
+        cosigner_id: fields.cosignerId,
+        receipt_hash: fields.receiptHash,
+        agent_id: fields.agentId,
+        cosigned_at: fields.cosignedAt,
+    };
+    const sig = ed25519.sign(canonicalBytes(unsigned), cosignerPrivateKey);
+    return { ...unsigned, sig: encodeSig(sig) };
+}
+/**
+ * Verify a co-signature. Requires a valid signature by `cosigner_id` AND that the
+ * co-signer is a **distinct** party from the acting agent (segregation of duties).
+ */
+export function verifyCoSignature(c) {
+    if (c?.v !== 1 || c.type !== 'receipt_cosign')
+        return false;
+    if (c.cosigner_id === c.agent_id)
+        return false; // doer must not co-sign itself
+    const pub = publicKeyFromDid(c.cosigner_id);
+    const sig = decodeSig(c.sig);
+    if (!pub || !sig)
+        return false;
+    const { sig: _omitted, ...unsigned } = c;
+    try {
+        return ed25519.verify(sig, canonicalBytes(unsigned), pub);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=cosign.js.map

package/dist/cosign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosign.js","sourceRoot":"","sources":["../src/cosign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AA2B7C,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAC/B,MAAwF,EACxF,kBAA8B;IAE9B,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAU;QACb,IAAI,EAAE,gBAAyB;QAC/B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,WAAW,EAAE,MAAM,CAAC,UAAU;KAC/B,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAqB;IACrD,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IAC/E,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -5,5 +5,7 @@ export { leafHash, merkleRoot, inclusionProof, verifyInclusion, consistencyProof
 export { createSTH, verifySTH, type SignedTreeHead } from './sth.js';
 export { buildA2ABody, signA2ABody, assembleA2AReceipt, a2aHash, bodyOf, verifyA2AReceipt, participantsOf, prevFor, type A2AReceipt, type A2ABody, type A2AParty, } from './a2a.js';
 export { verifyAuditBundle, type AuditBundle, type BundledReceipt, type BundledRevocation, type BundledAnchor, type BundleReport, type BundleCheck, } from './bundle.js';
-export { createReceipt, receiptHash, hashPayload, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, type Receipt, type VerifyResult, } from './receipt.js';
+export { createReceipt, receiptHash, hashPayload, saltedPayloadHash, verifyPayload, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, type Receipt, type VerifyResult, } from './receipt.js';
+export { createConfirmation, verifyConfirmation, type ActionConfirmation, } from './confirmation.js';
+export { createCoSignature, verifyCoSignature, type ReceiptCoSignature, } from './cosign.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -5,5 +5,7 @@ export { leafHash, merkleRoot, inclusionProof, verifyInclusion, consistencyProof
 export { createSTH, verifySTH } from './sth.js';
 export { buildA2ABody, signA2ABody, assembleA2AReceipt, a2aHash, bodyOf, verifyA2AReceipt, participantsOf, prevFor, } from './a2a.js';
 export { verifyAuditBundle, } from './bundle.js';
-export { createReceipt, receiptHash, hashPayload, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, } from './receipt.js';
+export { createReceipt, receiptHash, hashPayload, saltedPayloadHash, verifyPayload, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, } from './receipt.js';
+export { createConfirmation, verifyConfirmation, } from './confirmation.js';
+export { createCoSignature, verifyCoSignature, } from './cosign.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,aAAa,CAAC"}

package/dist/receipt.d.ts

@@ -8,6 +8,11 @@ export interface Receipt {
     payload_hash: string;
     ts: string;
     prev: string | null;
+    /** Optional provenance (SPEC §3). Present when set; covered by the signature. */
+    runtime_hash?: string;
+    model_id?: string;
+    /** Hash of the product's tool/scope manifest that governed this action. */
+    manifest_hash?: string;
     sig: string;
 }
 export interface VerifyResult {
@@ -15,6 +20,20 @@ export interface VerifyResult {
     error?: string;
 }
 export declare function hashPayload(payload: Uint8Array | string): string;
+/**
+ * Privacy-preserving payload commitment: `sha256(nonce ‖ payload)`. A bare
+ * `hashPayload` of a low-entropy payload ("phone X, amount 500") is dictionary-
+ * attackable from the public anchored log, and a linkable hash can itself be
+ * personal data (PDPL). The per-receipt `nonce` is kept operator-side (NOT in the
+ * receipt), so the on-chain value reveals nothing; keep it to later prove the
+ * payload with `verifyPayload`. If `nonce` is omitted a fresh 16-byte one is drawn.
+ */
+export declare function saltedPayloadHash(payload: Uint8Array | string, nonce?: string): {
+    payload_hash: string;
+    nonce: string;
+};
+/** Prove a payload matches a salted `payload_hash`, given the nonce kept at record time. */
+export declare function verifyPayload(payload: Uint8Array | string, nonce: string, payloadHash: string): boolean;
 export declare function createReceipt(fields: {
     agentId: string;
     delegation: DelegationCert[];
@@ -23,6 +42,10 @@ export declare function createReceipt(fields: {
     payloadHash: string;
     ts: string;
     prev: string | null;
+    /** Optional provenance — included in the signed receipt only when provided. */
+    runtimeHash?: string;
+    modelId?: string;
+    manifestHash?: string;
 }, agentPrivateKey: Uint8Array): Receipt;
 /** Hash of the full receipt (incl. sig) — what the next receipt's `prev` points to. */
 export declare function receiptHash(receipt: Receipt): string;

package/dist/receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,WAAW,OAAO;IACtB,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,EACD,eAAe,EAAE,UAAU,GAC1B,OAAO,CAcT;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAUhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzF,YAAY,CAwBd;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAO,GAC3D,YAAY,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CASzC"}
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,WAAW,OAAO;IACtB,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAGhE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQzC;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAMvG;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,EACD,eAAe,EAAE,UAAU,GAC1B,OAAO,CAiBT;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAUhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzF,YAAY,CAwBd;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAO,GAC3D,YAAY,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CASzC"}

package/dist/receipt.js

@@ -1,6 +1,6 @@
 import { ed25519 } from '@noble/curves/ed25519';
 import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
+import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';
 import { canonicalBytes, decodeSig, encodeSig, jcsHash } from './encoding.js';
 import { publicKeyFromDid } from './keys.js';
 import { scopesAllow, verifyChain } from './delegation.js';
@@ -8,6 +8,32 @@ export function hashPayload(payload) {
     const bytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
     return `sha256:${bytesToHex(sha256(bytes))}`;
 }
+/**
+ * Privacy-preserving payload commitment: `sha256(nonce ‖ payload)`. A bare
+ * `hashPayload` of a low-entropy payload ("phone X, amount 500") is dictionary-
+ * attackable from the public anchored log, and a linkable hash can itself be
+ * personal data (PDPL). The per-receipt `nonce` is kept operator-side (NOT in the
+ * receipt), so the on-chain value reveals nothing; keep it to later prove the
+ * payload with `verifyPayload`. If `nonce` is omitted a fresh 16-byte one is drawn.
+ */
+export function saltedPayloadHash(payload, nonce) {
+    const nonceHex = nonce ?? bytesToHex(randomBytes(16));
+    const nonceBytes = hexToBytes(nonceHex);
+    const payloadBytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
+    const combined = new Uint8Array(nonceBytes.length + payloadBytes.length);
+    combined.set(nonceBytes, 0);
+    combined.set(payloadBytes, nonceBytes.length);
+    return { payload_hash: `sha256:${bytesToHex(sha256(combined))}`, nonce: nonceHex };
+}
+/** Prove a payload matches a salted `payload_hash`, given the nonce kept at record time. */
+export function verifyPayload(payload, nonce, payloadHash) {
+    try {
+        return saltedPayloadHash(payload, nonce).payload_hash === payloadHash;
+    }
+    catch {
+        return false;
+    }
+}
 export function createReceipt(fields, agentPrivateKey) {
     if (Number.isNaN(Date.parse(fields.ts)))
         throw new Error(`invalid ts timestamp: ${fields.ts}`);
@@ -20,6 +46,9 @@ export function createReceipt(fields, agentPrivateKey) {
         payload_hash: fields.payloadHash,
         ts: fields.ts,
         prev: fields.prev,
+        ...(fields.runtimeHash ? { runtime_hash: fields.runtimeHash } : {}),
+        ...(fields.modelId ? { model_id: fields.modelId } : {}),
+        ...(fields.manifestHash ? { manifest_hash: fields.manifestHash } : {}),
     };
     const sig = ed25519.sign(canonicalBytes(unsigned), agentPrivateKey);
     return { ...unsigned, sig: encodeSig(sig) };

package/dist/receipt.js.map

@@ -1 +1 @@
-{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAC;AAmBhF,MAAM,UAAU,WAAW,CAAC,OAA4B;IACtD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,OAAO,UAAU,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAQC,EACD,eAA2B;IAE3B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAU;QACb,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,OAAwF,EAAE;IAE1F,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAChF,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAE3F,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAE1E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,EAAE,EAAE,EAAE;KACP,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAEzE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,eAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,OAAO,CAAC,MAAM,2BAA2B,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC3F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAmB,EACnB,OAA0D,EAAE;IAE5D,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7F,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAC;AAwBhF,MAAM,UAAU,WAAW,CAAC,OAA4B;IACtD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,OAAO,UAAU,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4B,EAC5B,KAAc;IAEd,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACzE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACrF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,OAA4B,EAAE,KAAa,EAAE,WAAmB;IAC5F,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAYC,EACD,eAA2B;IAE3B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAU;QACb,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,OAAwF,EAAE;IAE1F,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAChF,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAE3F,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAE1E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,EAAE,EAAE,EAAE;KACP,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAEzE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,eAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,OAAO,CAAC,MAAM,2BAA2B,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC3F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAmB,EACnB,OAA0D,EAAE;IAE5D,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7F,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/core",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Zanii protocol: verifiable identity, signed action receipts, Merkle transparency-log proofs. Pure, no I/O.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",

package/src/confirmation.ts

@@ -0,0 +1,53 @@
+import { ed25519 } from '@noble/curves/ed25519';
+import { canonicalBytes, decodeSig, encodeSig } from './encoding.js';
+import { publicKeyFromDid } from './keys.js';
+
+/**
+ * Owner confirmation of an irreversible action (SPEC §13 / Article VI).
+ *
+ * The human owner signs the exact action hash with their `did:key`. This is the
+ * cryptographic evidence a person confirmed — replacing an in-memory "yes" that
+ * proves nothing. Recorded as its own `action_confirmation` receipt so a dispute
+ * ("did the client actually approve this payment?") has a verifiable answer.
+ */
+export interface ActionConfirmation {
+  v: 1;
+  type: 'action_confirmation';
+  /** The owner's `did:key`. */
+  owner_id: string;
+  /** `sha256:…` hash of the exact action `{tool, args}` being confirmed. */
+  action_hash: string;
+  confirmed_at: string;
+  /** Ed25519 by the owner over JCS of the confirmation without `sig`. */
+  sig: string;
+}
+
+/** Owner signs an action hash. Only the owner's key can produce this. */
+export function createConfirmation(
+  fields: { ownerId: string; actionHash: string; confirmedAt: string },
+  ownerPrivateKey: Uint8Array,
+): ActionConfirmation {
+  const unsigned = {
+    v: 1 as const,
+    type: 'action_confirmation' as const,
+    owner_id: fields.ownerId,
+    action_hash: fields.actionHash,
+    confirmed_at: fields.confirmedAt,
+  };
+  const sig = ed25519.sign(canonicalBytes(unsigned), ownerPrivateKey);
+  return { ...unsigned, sig: encodeSig(sig) };
+}
+
+/** Verify a confirmation's signature against the owner DID it names. */
+export function verifyConfirmation(c: ActionConfirmation): boolean {
+  if (c?.v !== 1 || c.type !== 'action_confirmation') return false;
+  const pub = publicKeyFromDid(c.owner_id);
+  const sig = decodeSig(c.sig);
+  if (!pub || !sig) return false;
+  const { sig: _omitted, ...unsigned } = c;
+  try {
+    return ed25519.verify(sig, canonicalBytes(unsigned), pub);
+  } catch {
+    return false;
+  }
+}

package/src/cosign.ts

@@ -0,0 +1,63 @@
+import { ed25519 } from '@noble/curves/ed25519';
+import { canonicalBytes, decodeSig, encodeSig } from './encoding.js';
+import { publicKeyFromDid } from './keys.js';
+
+/**
+ * Infrastructure co-signature over an agent's receipt (SPEC §14 — segregation of duties).
+ *
+ * Gordon's Q1: the agent that does the task cannot be the sole party reporting it.
+ * "Connect" — the deterministic rails that are the only door to the outside world —
+ * holds its own `did:key` and co-signs every receipt. A second, independent signature
+ * from a party the agent can't control (and, later, that holds the provider
+ * credentials) makes acting-without-recording structurally catchable. Reconciliation
+ * (`reconcile`) covers anything that still slips around the rails.
+ *
+ * This is a signed artifact carried in a normal receipt — no server or schema change.
+ */
+export interface ReceiptCoSignature {
+  v: 1;
+  type: 'receipt_cosign';
+  /** The co-signer's `did:key` (Connect / the rails) — MUST differ from `agent_id`. */
+  cosigner_id: string;
+  /** Hash of the agent receipt being co-signed. */
+  receipt_hash: string;
+  /** The agent (the doer) whose receipt this is. */
+  agent_id: string;
+  cosigned_at: string;
+  sig: string;
+}
+
+/** Connect co-signs an agent's receipt. Only the co-signer's key can produce this. */
+export function createCoSignature(
+  fields: { cosignerId: string; receiptHash: string; agentId: string; cosignedAt: string },
+  cosignerPrivateKey: Uint8Array,
+): ReceiptCoSignature {
+  const unsigned = {
+    v: 1 as const,
+    type: 'receipt_cosign' as const,
+    cosigner_id: fields.cosignerId,
+    receipt_hash: fields.receiptHash,
+    agent_id: fields.agentId,
+    cosigned_at: fields.cosignedAt,
+  };
+  const sig = ed25519.sign(canonicalBytes(unsigned), cosignerPrivateKey);
+  return { ...unsigned, sig: encodeSig(sig) };
+}
+
+/**
+ * Verify a co-signature. Requires a valid signature by `cosigner_id` AND that the
+ * co-signer is a **distinct** party from the acting agent (segregation of duties).
+ */
+export function verifyCoSignature(c: ReceiptCoSignature): boolean {
+  if (c?.v !== 1 || c.type !== 'receipt_cosign') return false;
+  if (c.cosigner_id === c.agent_id) return false; // doer must not co-sign itself
+  const pub = publicKeyFromDid(c.cosigner_id);
+  const sig = decodeSig(c.sig);
+  if (!pub || !sig) return false;
+  const { sig: _omitted, ...unsigned } = c;
+  try {
+    return ed25519.verify(sig, canonicalBytes(unsigned), pub);
+  } catch {
+    return false;
+  }
+}

package/src/index.ts

@@ -48,9 +48,21 @@ export {
   createReceipt,
   receiptHash,
   hashPayload,
+  saltedPayloadHash,
+  verifyPayload,
   verifyReceipt,
   verifyReceiptSignature,
   verifyReceiptChain,
   type Receipt,
   type VerifyResult,
 } from './receipt.js';
+export {
+  createConfirmation,
+  verifyConfirmation,
+  type ActionConfirmation,
+} from './confirmation.js';
+export {
+  createCoSignature,
+  verifyCoSignature,
+  type ReceiptCoSignature,
+} from './cosign.js';

package/src/receipt.ts

@@ -1,6 +1,6 @@
 import { ed25519 } from '@noble/curves/ed25519';
 import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
+import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';
 import { canonicalBytes, decodeSig, encodeSig, jcsHash } from './encoding.js';
 import { publicKeyFromDid } from './keys.js';
 import { scopesAllow, verifyChain, type DelegationCert } from './delegation.js';
@@ -14,6 +14,11 @@ export interface Receipt {
   payload_hash: string;
   ts: string;
   prev: string | null;
+  /** Optional provenance (SPEC §3). Present when set; covered by the signature. */
+  runtime_hash?: string;
+  model_id?: string;
+  /** Hash of the product's tool/scope manifest that governed this action. */
+  manifest_hash?: string;
   sig: string;
 }
 
@@ -27,6 +32,36 @@ export function hashPayload(payload: Uint8Array | string): string {
   return `sha256:${bytesToHex(sha256(bytes))}`;
 }
 
+/**
+ * Privacy-preserving payload commitment: `sha256(nonce ‖ payload)`. A bare
+ * `hashPayload` of a low-entropy payload ("phone X, amount 500") is dictionary-
+ * attackable from the public anchored log, and a linkable hash can itself be
+ * personal data (PDPL). The per-receipt `nonce` is kept operator-side (NOT in the
+ * receipt), so the on-chain value reveals nothing; keep it to later prove the
+ * payload with `verifyPayload`. If `nonce` is omitted a fresh 16-byte one is drawn.
+ */
+export function saltedPayloadHash(
+  payload: Uint8Array | string,
+  nonce?: string,
+): { payload_hash: string; nonce: string } {
+  const nonceHex = nonce ?? bytesToHex(randomBytes(16));
+  const nonceBytes = hexToBytes(nonceHex);
+  const payloadBytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
+  const combined = new Uint8Array(nonceBytes.length + payloadBytes.length);
+  combined.set(nonceBytes, 0);
+  combined.set(payloadBytes, nonceBytes.length);
+  return { payload_hash: `sha256:${bytesToHex(sha256(combined))}`, nonce: nonceHex };
+}
+
+/** Prove a payload matches a salted `payload_hash`, given the nonce kept at record time. */
+export function verifyPayload(payload: Uint8Array | string, nonce: string, payloadHash: string): boolean {
+  try {
+    return saltedPayloadHash(payload, nonce).payload_hash === payloadHash;
+  } catch {
+    return false;
+  }
+}
+
 export function createReceipt(
   fields: {
     agentId: string;
@@ -36,6 +71,10 @@ export function createReceipt(
     payloadHash: string;
     ts: string;
     prev: string | null;
+    /** Optional provenance — included in the signed receipt only when provided. */
+    runtimeHash?: string;
+    modelId?: string;
+    manifestHash?: string;
   },
   agentPrivateKey: Uint8Array,
 ): Receipt {
@@ -49,6 +88,9 @@ export function createReceipt(
     payload_hash: fields.payloadHash,
     ts: fields.ts,
     prev: fields.prev,
+    ...(fields.runtimeHash ? { runtime_hash: fields.runtimeHash } : {}),
+    ...(fields.modelId ? { model_id: fields.modelId } : {}),
+    ...(fields.manifestHash ? { manifest_hash: fields.manifestHash } : {}),
   };
   const sig = ed25519.sign(canonicalBytes(unsigned), agentPrivateKey);
   return { ...unsigned, sig: encodeSig(sig) };