@ziffer-io/verify 0.1.0 → 0.2.0

package/dist/quorum.js

@@ -0,0 +1,566 @@
+/**
+ * §9.3 step 7b -- the AT-* quorum and §8.6b's AB-*, run in the CUSTOMER's own
+ * process against the CUSTOMER's own signed bundle.
+ *
+ * # Why this exists (ACP-406 gap 1)
+ *
+ * Until this module, a customer verifying a ZIFFER receipt checked the
+ * signature and the bindings and **trusted us for the approvals**: the header
+ * table in `verify.ts` said "7b -- NO, needs the attester registry". A
+ * compromised receipt-signing substrate could therefore emit a floor-HIGH
+ * receipt carrying fabricated `attestation_digests`, and every customer-side
+ * verifier would accept it. The registry is in the customer's OWN signed
+ * bundle -- the tree they already load for `policy_bundle_hash` -- so nothing
+ * about that trust was necessary. This is the third implementation of the
+ * step, after `reference/src/acp_executor.py::_verify_quorum` and
+ * `crates/acp-decision/src/quorum.rs`, and the clause names are theirs.
+ *
+ * # AT-9 is TWO requirements and they fail closed on disjoint inputs
+ *
+ * 1. The threshold is **recomputed** from the signed bundle's `quorum_k`
+ *    (PB-6) and never read from an attestation. Through v1.3.14 the reference
+ *    read `entries[0].required_count` -- asking the party under verification
+ *    how many signatures to demand -- and one compromised attester key signing
+ *    one object carrying `required_count: 1` executed a floor-HIGH action.
+ * 2. **Every** entry's `required_count` must equal `quorum_k`. That is a
+ *    CONSENT check (AT-3), not a threshold one: two humans approving while both
+ *    objects say `3` means they approved believing a third reviewer existed.
+ *
+ * Deleting (2) cannot lower a quorum; deleting (1) cannot detect an attester
+ * who signed under a different stated threshold. Keeping only (1) satisfies
+ * INV-1-HIGH while silently executing actions no attester agreed to.
+ *
+ * # What this CANNOT check customer-side, and why -- read before trusting a pass
+ *
+ * These are absences, not agreements. Each one is a step of §9.3 this package
+ * does not run, and each is disclosed here rather than approximated:
+ *
+ * - **Whether a quorum was required at all.** §9.3 step 7 recomputes the
+ *   floor-only risk from the bundle's `floors.json` and `risk_functions.json`;
+ *   this package does not grade, so it cannot know that a receipt carrying an
+ *   EMPTY attestation list should have carried a quorum. A receipt with no
+ *   attestations passes 7b vacuously (AB-1's own note covers the legitimate
+ *   LOW/MEDIUM case) and {@link verifyQuorum} returns `null` so the caller can
+ *   see that nothing was verified. **Reading `risk_level_floor_only` off the
+ *   receipt instead would be X1 -- the defect where a compromised issuer
+ *   asserting `LOW` suppressed attestation entirely** -- so it is not read.
+ * - **`obj.floor_only_risk` against the recomputed grade** (7b(iii), TR-8), for
+ *   the same reason: there is no recomputed grade here to compare against.
+ * - **Single-use of the recomputed `attestation_id`** (7b(v), CL-3). That needs
+ *   a linearizable Consumption Ledger and this package holds none. Replay
+ *   protection that forgets is not replay protection, so it is named rather
+ *   than half-built.
+ * - **HM-4 (f)'s stored signature counter** is `T` at this boundary: the caller
+ *   hands in what it stored and MUST persist what {@link QuorumOutcome}
+ *   returns. A caller passing an empty map every time has switched (f) off for
+ *   a credential that has signed before.
+ *
+ * # One deliberate NARROWING beyond both engine implementations
+ *
+ * AT-1 says role membership "is resolved against the attester registry", and
+ * neither engine implementation resolves it: `quorum.rs` records that
+ * `AttesterRole` is generated and read by nothing, and the Python reference has
+ * no role field at all. This one does, because the customer's registry carries
+ * `role` and their bundle is the authority on who may approve: an entry counts
+ * toward the quorum only if its attester's REGISTRY role is named in the
+ * object's `required_roles`. An empty list means the rule demanded a quorum and
+ * named no role, so any enrolled attester satisfies it (AT-1 as amended in
+ * v1.3.32, ACP-308) -- which is byte-for-byte the engine's behaviour, and is the
+ * case every ZIFFER deployment is in today except where the policy engine sets
+ * `["approver"]`.
+ *
+ * This is a NARROWER acceptance, never a wider one, and it is stated because a
+ * third implementation that refuses what the other two accept is a divergence
+ * even when it is the safer side. Its strength is bounded and that is disclosed
+ * too: `required_roles` is read from the OBJECT (class **B** -- signed by the
+ * attester, evidence of what they were shown), because the bundle names no
+ * per-rule role list for it to be recomputed from. A compromised issuer that
+ * writes an empty list degrades this check to the engine's behaviour and no
+ * further.
+ *
+ * # Suite 12 classification -- R / B / T for every control input read here
+ *
+ * | input | class | why |
+ * | --- | :---: | --- |
+ * | `quorumK` | **R** | from the signed bundle, never an attestation (AT-9) |
+ * | attester keys and credentials | **R** | read out of the signed registry after the bundle's own signature checked; `rpId` above all, because HM-4 (c) compares the assertion's origin against THIS and an origin taken from the assertion would compare a value with itself |
+ * | `floor` | **R** | the signed manifest's `min_suite` (CR-4) |
+ * | `policyBundleHash`, `bundleEpoch` | **R** | the bundle the caller trusts; the object's copies are compared against them (7b(iii)) |
+ * | the eleven AT-1 fields | **B** | the attester signature covers the derived id, which covers the whole object |
+ * | `obj.proposal_hash` | **B** | and compared against the hash this verifier recomputed from the caller's own proposal bytes (Y1) |
+ * | `obj.required_count` | **B** | and compared against `quorumK` (AT-9's consent half) |
+ * | `obj.required_roles` | **B** | signed, and resolved against the registry; see the narrowing above for what it does NOT prove |
+ * | `entry.attester` | **B** | a name SELECTS a key; the signature establishes identity (ACK-4) |
+ * | `entry.attestation_id` | **R** | derived; a transmitted value is compared, never used (Y1b) |
+ * | `attestation_digests` | **B** | inside the signed receipt body (AB-5), and each entry's digest is recomputed from the received bytes (AB-1) |
+ * | `entry.kind` | **B** | bound by the entry digest under the receipt signature (AB-1). **NARROWED RESIDUAL, not closed**: the attester does not sign `kind`, so the ISSUER still chooses per entry whose signature counts as an approval |
+ * | `webauthnCounters` | **T** | the caller's stored counters; this package holds no ledger and says so above |
+ */
+import { createHash } from 'node:crypto';
+import { canon } from './canon.js';
+import { CLAUSE_ASSURANCE, CLAUSE_ATTESTATION_SUITE, CLAUSE_ATTESTER_SIG, CLAUSE_ATT_NONCE_SIZE, CLAUSE_BINDING, CLAUSE_CARDINALITY, CLAUSE_CONSENT, CLAUSE_DERIVED_ID, CLAUSE_DIGEST_DUP, CLAUSE_DIGEST_ORDER, CLAUSE_MALFORMED, CLAUSE_MEMBERSHIP, CLAUSE_NO_ATTESTATIONS, CLAUSE_NO_OBJECT, CLAUSE_OBJECT_SCHEMA, CLAUSE_OPERATOR_DISAGREE, CLAUSE_OPERATOR_SELF, CLAUSE_POLICY_BASIS, CLAUSE_QUORUM, CLAUSE_WEBAUTHN_ALG, CLAUSE_WEBAUTHN_COUNTER, CLAUSE_WIRE_TYPE, } from './clauses.js';
+import { parseInstant } from './instant.js';
+import { Refusal } from './refusal.js';
+import { hex, parseSig, verifyUnderSuite } from './sig.js';
+import { parseSuite, satisfiesFloor } from './suite.js';
+import { WEBAUTHN_ALGS, WEBAUTHN_PRIMITIVE, WebauthnRefusal, WEBAUTHN_AUTHENTICATOR_DATA, WEBAUTHN_CHALLENGE, WEBAUTHN_ORIGIN, WEBAUTHN_SIGNATURE, WEBAUTHN_TYPE, verifyWebauthn, } from './webauthn.js';
+import { b64Decode, isRecord, isWe4B64, NONCE128_BYTES, NONCE128_LEN, strField } from './wire.js';
+/**
+ * AT-8b: the Attestation Object schema is CLOSED. Exactly this field set, no
+ * more and no less.
+ *
+ * An unknown field is refused rather than ignored and a missing one is never
+ * defaulted (Z4). Normalising either would let an issuer add a field a future
+ * verifier reads, or drop one this verifier checks, without invalidating a
+ * signature that covers only what is present.
+ */
+export const AT1_FIELDS = [
+    'alg',
+    'att_nonce',
+    'bundle_epoch',
+    'context_snapshot_hash',
+    'expires_at',
+    'floor_only_risk',
+    'operator',
+    'policy_bundle_hash',
+    'proposal_hash',
+    'required_count',
+    'required_roles',
+];
+/** The four fields AB-1's preimage must carry, plus the one it may. */
+const ENTRY_REQUIRED = ['obj', 'kind', 'attester', 'sig'];
+const ENTRY_ALLOWED = [...ENTRY_REQUIRED, 'attestation_id'];
+/** AT-10's ladder. Ranked, unlike suites, whose floor is containment (CR-4). */
+const ASSURANCE_ORDER = ['AS0', 'AS1', 'AS2'];
+/**
+ * AT-8a -- `sha256:` over the canonical bytes, the reference's `h()`.
+ *
+ * The canonical encoding is `canon.ts`'s, which is the engine's
+ * `acp_executor.canon` / `receipt.rs::canon`. AT-8a names canonical CBOR and
+ * both engine implementations use canonical JSON here; this package reproduces
+ * what the engine actually signs, because a verifier that hashed a different
+ * preimage would refuse every genuine attestation. The divergence is the
+ * engine's and is recorded in `acp_executor.canon`'s own docstring.
+ */
+function digestOf(value) {
+    return `sha256:${hex(Uint8Array.from(createHash('sha256').update(canon(value)).digest()))}`;
+}
+/**
+ * AT-8a -- derive an Attestation Object's id from its canonical bytes.
+ * **Derived, never read**: the id names a binding, and a transmitted name for a
+ * binding is not evidence of one (Y1b).
+ */
+export function attestationId(obj) {
+    return digestOf(obj);
+}
+/**
+ * AB-1 -- the receipt's commitment to ONE attestation entry.
+ *
+ * ENTRY-SCOPED, NEVER OBJECT-SCOPED, and this is the whole trap.
+ * {@link attestationId} already exists and is `h(obj)` -- reusing it here is the
+ * obvious move and it is wrong. {@link AT1_FIELDS} is closed over the OBJECT: it
+ * contains no `kind`, no `attester` and no `sig`. Quorum composition reads
+ * `kind` and `attester` from the ENTRY and the attester signs neither, so an
+ * object-scoped digest lets an attacker on the transport path flip `kind` from
+ * `confirmation` to `approval` while every digest still matches.
+ *
+ * The two identifiers MUST NOT be merged: `attestation_id` is what a ledger
+ * consumes for single-use under CL-3, because the same object replayed inside a
+ * different entry is still a replay. This digest is what the receipt authorised,
+ * byte for byte.
+ */
+export function entryDigest(entry) {
+    if (!isRecord(entry)) {
+        throw new Refusal(CLAUSE_MEMBERSHIP, 'attestation entry is not a map');
+    }
+    const present = Object.keys(entry);
+    const missing = ENTRY_REQUIRED.filter((k) => !present.includes(k));
+    const extra = present.filter((k) => !ENTRY_ALLOWED.includes(k));
+    if (missing.length > 0 || extra.length > 0) {
+        throw new Refusal(CLAUSE_MEMBERSHIP, `entry schema violation missing=${JSON.stringify(missing)} extra=${JSON.stringify(extra)}`);
+    }
+    return digestOf(entry);
+}
+function intField(obj, name, clause) {
+    const raw = obj[name];
+    if (typeof raw !== 'number' || !Number.isSafeInteger(raw) || raw < 0) {
+        throw new Refusal(clause, `attestation object field ${name} is not an integer`);
+    }
+    return raw;
+}
+function requiredStr(obj, name, clause) {
+    const v = strField(obj, name);
+    if (v === null) {
+        throw new Refusal(clause, `attestation object field ${name} is not a string`);
+    }
+    return v;
+}
+/** The HM-4 step names that travel out as the refusal's clause. */
+const HM4_STEPS = [
+    WEBAUTHN_TYPE,
+    WEBAUTHN_CHALLENGE,
+    WEBAUTHN_ORIGIN,
+    WEBAUTHN_AUTHENTICATOR_DATA,
+    WEBAUTHN_SIGNATURE,
+];
+/**
+ * HM-3 and HM-4 (a)-(e) over one entry, returning the counter (f) compares.
+ *
+ * **HM-3 IS CHECKED BEFORE ANY BYTE OF THE ASSERTION IS EXAMINED.** `alg` is an
+ * AT-1 field and therefore signature-covered (CR-5), but that only proves the
+ * ISSUER chose it: the registry is what says which kind of key this identity
+ * holds. Parsing attacker-supplied bytes under the wrong algorithm is work done
+ * on the attacker's behalf.
+ */
+function verifyWebauthnEntry(cred, objAlg, sig, messageId) {
+    if (objAlg !== cred.alg) {
+        throw new Refusal(CLAUSE_WEBAUTHN_ALG, `HM-3: attestation alg ${objAlg} is not the registered alg ${cred.alg}`);
+    }
+    // HM-3: EXACTLY the one primitive. A map carrying `webauthn` beside
+    // `classical` would be a human leg with a machine leg stapled to it, which is
+    // not a stronger signature -- it is two different claims about who decided,
+    // and CR-3's conjunction has nothing to say about a pair that names two
+    // holders.
+    const keys = isRecord(sig) ? Object.keys(sig) : [];
+    const encoded = isRecord(sig) ? sig[WEBAUTHN_PRIMITIVE] : undefined;
+    if (keys.length !== 1 || keys[0] !== WEBAUTHN_PRIMITIVE || typeof encoded !== 'string') {
+        throw new Refusal(CLAUSE_MALFORMED, 'HM-3: a webauthn entry carries exactly the one primitive `webauthn`');
+    }
+    // WE-4, and the `b64:` prefix is PART OF THE VALUE -- the same rule
+    // `att_nonce` is held to, one field over.
+    if (!isWe4B64(encoded)) {
+        throw new Refusal(CLAUSE_MALFORMED, 'HM-3/WE-4: the assertion is not `b64:` + RFC 4648 sec 4 base64 with padding');
+    }
+    const raw = b64Decode(encoded.slice('b64:'.length));
+    if (raw === null) {
+        throw new Refusal(CLAUSE_MALFORMED, 'HM-3: assertion is not base64');
+    }
+    try {
+        return verifyWebauthn(cred.alg, cred.publicKey, new TextEncoder().encode(messageId), cred.rpId, raw);
+    }
+    catch (e) {
+        if (!(e instanceof WebauthnRefusal))
+            throw e;
+        // The step's NAME becomes the clause, and HM-4 travels in the message. One
+        // clause for all six failures would give six distinguishable faults one
+        // name, and the cross-implementation comparison is on exactly this field.
+        //
+        // `Malformed` and `RegistryKeyWeak` fold together into `Malformed`: the
+        // assertion or the credential is not this shape at all. `RegistryKeyWeak`
+        // should be unreachable here because the bundle loader refuses such a key at
+        // enrolment -- it is folded in rather than left to fall through, because a
+        // branch that produced no refusal would let the caller continue as though
+        // the leg had verified.
+        if (HM4_STEPS.includes(e.refusalName))
+            throw new Refusal(e.refusalName, e.detail);
+        throw new Refusal(CLAUSE_MALFORMED, `${e.refusalName}: ${e.detail}`);
+    }
+}
+/** The registry's `role` for an identity, or null. */
+function roleOf(cred) {
+    return cred.role;
+}
+/**
+ * §9.3 step 7b over the attestations travelling beside one receipt.
+ *
+ * @param policy   the customer's own signed-bundle quorum policy.
+ * @param basis    the values recomputed by `verifyReceipt` before this runs.
+ * @param entries  `receipt.attestations`, as parsed JSON.
+ * @param digests  `receipt.attestation_digests`, as parsed JSON.
+ * @returns the outcome, or `null` when no attestations travelled and none were
+ *          committed to -- the vacuous LOW/MEDIUM case of AB-1's own note.
+ *          `null` means "nothing was verified", never "a quorum held": see the
+ *          module header on why this package cannot tell that a quorum was
+ *          REQUIRED.
+ * @throws  {@link Refusal} with the engine's clause names.
+ */
+export function verifyQuorum(policy, basis, entries, digests) {
+    // The shapes first, so a malformed carrier is named rather than iterated.
+    // The engine tolerates a non-list `attestations` by falling back to `[]`
+    // (`receipt.get("attestations") or []`); refusing it is a NARROWER
+    // acceptance and is pinned by a test, because a truthy non-list there would
+    // be iterated by the reference into per-character entries.
+    if (entries !== undefined && entries !== null && !Array.isArray(entries)) {
+        throw new Refusal(CLAUSE_MEMBERSHIP, 'attestations is not a list');
+    }
+    const list = Array.isArray(entries) ? entries : [];
+    const digestsAbsent = digests === undefined || digests === null;
+    // The vacuous case, and it is AB-1's own note: a LOW/MEDIUM receipt carries
+    // no quorum and commits to none. Checked BEFORE the digest type check only
+    // when the field is genuinely absent -- a field that is PRESENT and not a
+    // list of strings is a malformed receipt whatever its length would have been.
+    if (list.length === 0 && digestsAbsent)
+        return null;
+    let signed;
+    if (Array.isArray(digests) && digests.every((d) => typeof d === 'string')) {
+        signed = digests.filter((d) => typeof d === 'string');
+    }
+    else {
+        // An absent list refuses under AB-1's TYPE check exactly as the reference's
+        // `isinstance` does: `None` never short-circuits to "no digests to check".
+        throw new Refusal(CLAUSE_MEMBERSHIP, 'attestation_digests is not a list of strings');
+    }
+    if (list.length === 0 && signed.length === 0)
+        return null;
+    if (list.length === 0) {
+        // An empty entry list beside a populated digest list is a MISSING QUORUM,
+        // not a cardinality mismatch, and the operator must be told which. The
+        // engine puts this first for the same reason.
+        throw new Refusal(CLAUSE_NO_ATTESTATIONS, 'receipt commits to attestations that did not arrive');
+    }
+    // AB-3: duplicates refused HERE and explicitly, BEFORE the ordering check --
+    // the reference's order, which matters on an input wrong in both ways. In an
+    // Executor holding a Consumption Ledger this check is masked by CL-3 and
+    // kills no mutant (a positive-path obligation); this package has no ledger,
+    // and here it is the only thing standing between a duplicated digest and a
+    // quorum counted twice.
+    const distinct = new Set(signed);
+    if (distinct.size !== signed.length) {
+        throw new Refusal(CLAUSE_DIGEST_DUP, 'duplicate attestation digests');
+    }
+    // AB-2: ONE canonical ordering, strictly ascending over the UTF-8 bytes of
+    // the digest strings INCLUDING the `sha256:` prefix -- the prefix is part of
+    // the value, never decoration. Without it the same quorum yields two
+    // canonical encodings of one receipt, hence two receipt identities.
+    for (let i = 1; i < signed.length; i += 1) {
+        const prev = signed[i - 1];
+        const cur = signed[i];
+        if (prev === undefined || cur === undefined)
+            continue; // unreachable; index in range
+        if (!(prev < cur)) {
+            throw new Refusal(CLAUSE_DIGEST_ORDER, 'attestation_digests is not sorted');
+        }
+    }
+    // AB-4: cardinality in BOTH directions. Membership alone lets an attacker
+    // WITHHOLD entries -- every digest they do send still matches, and the quorum
+    // silently shrinks. Counting from the digest list instead would be reading
+    // the size of the quorum off the receipt: AT-3's defect, one layer down.
+    if (list.length !== signed.length) {
+        throw new Refusal(CLAUSE_CARDINALITY, `${list.length} attestations received against ${signed.length} signed digests`);
+    }
+    // HM-4 (f)'s working copy, seeded from what the caller stored and advanced as
+    // entries are accepted, so two entries in ONE receipt made by one credential
+    // are held to the same "strictly greater" rule that two receipts are. Without
+    // the local copy the second would be compared against the stored value the
+    // first already passed, and a replayed assertion beside its original would
+    // count twice toward the quorum.
+    const counters = new Map(policy.webauthnCounters ?? new Map());
+    const claimed = new Map();
+    const approvals = new Set();
+    const operators = new Set();
+    for (const raw of list) {
+        // AB-1: membership, checked FIRST and recomputed from the received bytes
+        // (§9.3 step 7b(0)). Before the signature, so an entry the receipt never
+        // committed to is refused before the verifier spends work on
+        // attacker-supplied material.
+        const digest = entryDigest(raw);
+        if (!distinct.has(digest)) {
+            throw new Refusal(CLAUSE_MEMBERSHIP, "attestation is not in the receipt's signed digest list");
+        }
+        // `entryDigest` has already proved this is a record with the four fields.
+        const entry = isRecord(raw) ? raw : {};
+        const obj = entry['obj'];
+        if (!isRecord(obj)) {
+            throw new Refusal(CLAUSE_NO_OBJECT, 'attestation carries no object (v1.3.2 form)');
+        }
+        // AT-8b: CLOSED schema. Exact field set, never normalised.
+        const presentFields = Object.keys(obj);
+        const missing = AT1_FIELDS.filter((k) => !presentFields.includes(k));
+        const extra = presentFields.filter((k) => !AT1_FIELDS.includes(k));
+        if (missing.length > 0 || extra.length > 0) {
+            throw new Refusal(CLAUSE_OBJECT_SCHEMA, `object schema violation missing=${JSON.stringify(missing)} extra=${JSON.stringify(extra)}`);
+        }
+        // WE-4 then AT-1, in that order and never the other way round: an
+        // `att_nonce` wrong in both ways must stop at the same rule in every
+        // implementation. AT-8b above closes the field SET and says nothing about
+        // the spelling of a value, so this sits one layer beneath it -- and the id
+        // derived below is SHA-256 over the canonical bytes of the whole object, so
+        // `b64:AAAA==` and `AAAA==` would be TWO IDS FOR ONE OBJECT.
+        const nonce = strField(obj, 'att_nonce') ?? '';
+        if (!isWe4B64(nonce)) {
+            throw new Refusal(CLAUSE_WIRE_TYPE, `att_nonce ${JSON.stringify(obj['att_nonce'])} is not b64: + RFC 4648 sec 4 base64 with padding`);
+        }
+        if (nonce.length !== NONCE128_LEN) {
+            throw new Refusal(CLAUSE_ATT_NONCE_SIZE, `att_nonce is not ${NONCE128_BYTES * 8}-bit`);
+        }
+        // (i) The id is DERIVED from the canonical object, and it is also the
+        // message the attester signed. Deriving it before the signature check is
+        // what makes the signature cover the whole object rather than a digest
+        // somebody else chose.
+        const aid = attestationId(obj);
+        // CR-5: `alg` is an AT-1 field, so the suite is signature-covered.
+        const alg = requiredStr(obj, 'alg', CLAUSE_ATTESTATION_SUITE);
+        const attester = strField(entry, 'attester') ?? '';
+        const registered = policy.attesters.get(attester);
+        // §8.6c: IS THIS LEG A PERSON'S? Answered from the registry entry OR from
+        // the object's declared suite, and then the two are required to agree
+        // (HM-3), because either one alone decides nothing. Taking it from the
+        // object would let a compromised issuer route a machine's entry down the
+        // human path; taking it from the registry would let an object claiming
+        // `hybrid-ed25519-mldsa65` be verified as an assertion. The DISAGREEMENT is
+        // the refusal.
+        const human = registered?.kind === 'webauthn' || WEBAUTHN_ALGS.includes(alg);
+        if (human) {
+            if (registered === undefined || registered.kind !== 'webauthn') {
+                throw new Refusal(CLAUSE_WEBAUTHN_ALG, `HM-3: ${attester} is not a registered human attester, but the object claims ${alg}`);
+            }
+            // CR-8: NO SUITE FLOOR HERE, and its absence IS the clause rather than an
+            // omission. `min_suite` is CR-4 containment over MACHINE suites, and no
+            // authenticator in existence produces a post-quantum signature -- so
+            // comparing a human leg against a hybrid floor would refuse every person
+            // §8.6c exists to admit. What HM-6 says the classical leg costs is paid
+            // elsewhere: AB-1 digests this whole entry, assertion bytes included, into
+            // the receipt body a hybrid key signs, and §11 anchors that.
+            const counter = verifyWebauthnEntry(registered, alg, entry['sig'], aid);
+            // HM-4 (f). Strictly greater whenever EITHER is non-zero, so a credential
+            // whose authenticator does not implement a counter (both zero, forever)
+            // still verifies -- the WebAuthn specification permits that, and refusing
+            // it would refuse a class of real hardware.
+            const stored = counters.get(registered.credentialId) ?? 0;
+            if ((stored !== 0 || counter !== 0) && counter <= stored) {
+                throw new Refusal(CLAUSE_WEBAUTHN_COUNTER, `HM-4 (f): signature counter ${counter} for credential ${registered.credentialId.slice(0, 16)} did not advance past ${stored}: the credential is cloned, or the assertion is a replay`);
+            }
+            counters.set(registered.credentialId, counter);
+            claimed.set(registered.credentialId, counter);
+        }
+        else {
+            // CR-4 by CONTAINMENT. An UNKNOWN suite refuses here under CR-4 rather
+            // than CR-1, matching `Bundle.suite_ok`, which returns False for a name it
+            // does not know; the receipt path spells the same condition CR-1 and the
+            // comparison across implementations is on refusal NAMES, so the reference
+            // wins.
+            const suite = parseSuite(alg);
+            if (suite === null || !satisfiesFloor(suite, basis.floor)) {
+                throw new Refusal(CLAUSE_ATTESTATION_SUITE, `attestation suite ${alg} below bundle floor`);
+            }
+            if (registered === undefined || registered.kind !== 'hybrid') {
+                // An identity absent from the signed registry is not an attester
+                // (ACK-4): a name nobody enrolled must not be able to satisfy
+                // INV-1-HIGH.
+                throw new Refusal(CLAUSE_ATTESTER_SIG, 'attester signature invalid');
+            }
+            let bad = true;
+            try {
+                // The machine parse HERE and not earlier: the shape a signature must
+                // have is the shape its SUITE requires, and the suite is only settled
+                // once the branch above has established that this leg is a machine's.
+                const parts = parseSig(entry['sig'], alg);
+                bad = verifyUnderSuite(suite, registered, new TextEncoder().encode(aid), parts) !== null;
+            }
+            catch (e) {
+                // A shape complaint from `parseSig` is a bad ATTESTER signature here,
+                // not a bad receipt signature: the engine remaps the same way, and a
+                // `9.3-1` escaping this loop would name the wrong artifact.
+                if (!(e instanceof Refusal))
+                    throw e;
+                bad = true;
+            }
+            if (bad)
+                throw new Refusal(CLAUSE_ATTESTER_SIG, 'attester signature invalid');
+        }
+        // (ii) THE BINDING. Y1: a genuine signature over an object bound to a
+        // DIFFERENT proposal is a valid attestation to something else.
+        if (requiredStr(obj, 'proposal_hash', CLAUSE_BINDING) !== basis.proposalHash) {
+            throw new Refusal(CLAUSE_BINDING, 'attestation bound to a DIFFERENT proposal');
+        }
+        // (iii) The policy basis the attester was shown, against the bundle the
+        // CALLER trusts. `floor_only_risk` is NOT compared -- see the module header:
+        // there is no recomputed grade in this package to compare it against, and
+        // comparing it against the receipt's own assertion would be X1.
+        if (requiredStr(obj, 'policy_bundle_hash', CLAUSE_POLICY_BASIS) !== policy.policyBundleHash ||
+            intField(obj, 'bundle_epoch', CLAUSE_POLICY_BASIS) !== policy.bundleEpoch) {
+            throw new Refusal(CLAUSE_POLICY_BASIS, 'attestation policy basis mismatch');
+        }
+        // (iii) AT-9's SECOND requirement: CONSENT, not threshold. This is not how
+        // the quorum size is obtained -- that is `quorumK` below, and this field is
+        // never consulted for it. A first pass at the engine's fix DELETED this
+        // check, arguing the threshold is already bound transitively through
+        // `policy_bundle_hash`. The argument was sound and the conclusion wrong: it
+        // considered only attacks that LOWER the threshold, and raising the stated
+        // count is an attack on consent, not on the invariant.
+        const stated = intField(obj, 'required_count', CLAUSE_CONSENT);
+        if (stated !== policy.quorumK) {
+            throw new Refusal(CLAUSE_CONSENT, `attester signed for quorum ${stated}, bundle requires ${policy.quorumK}`);
+        }
+        // (iii) Freshness of the object itself, against the receipt's issuance.
+        // PARSED, never compared as strings: two RFC 3339 strings compare
+        // lexicographically and would agree with this check for every canonical
+        // value and then disagree on the first one that was not (ACP-167).
+        const objExp = parseInstant(requiredStr(obj, 'expires_at', CLAUSE_POLICY_BASIS));
+        if (objExp === null) {
+            throw new Refusal(CLAUSE_POLICY_BASIS, 'attestation object field expires_at is not an RFC 3339 UTC instant');
+        }
+        if (objExp < basis.receiptIssuedAt) {
+            throw new Refusal(CLAUSE_POLICY_BASIS, 'attestation expired before issuance');
+        }
+        // (iii-a) The operator comes from the VERIFIED object (Y4), never from the
+        // receipt body -- a body/object disagreement must not be resolved in favour
+        // of the body.
+        operators.add(requiredStr(obj, 'operator', CLAUSE_POLICY_BASIS));
+        // (v) Y1b: the derived id is authoritative. A transmitted id is permitted to
+        // be absent and refused when it disagrees. Still load-bearing against a
+        // COMPROMISED issuer, which chooses the digest list: a garbage
+        // `attestation_id` inside a correctly-digested entry passes membership, and
+        // only this recomputation catches it.
+        const transmitted = entry['attestation_id'];
+        if (transmitted !== undefined && transmitted !== aid) {
+            throw new Refusal(CLAUSE_DERIVED_ID, 'transmitted attestation_id != derived id');
+        }
+        // (iv) AT-10: the key that signed is held the way approver keys must be
+        // held -- both sides from the SIGNED BUNDLE, never from the entry. Every
+        // check above this line verifies a signature, and a signature says only that
+        // a key was used: a private key in a config file on a build host satisfied
+        // all of them. Before any count, approvals and confirmations alike, matching
+        // the engine's position exactly so a multi-defect entry refuses at the same
+        // clause in every implementation.
+        const level = policy.assurances.get(attester) ?? 'AS0';
+        const have = ASSURANCE_ORDER.indexOf(level);
+        const need = ASSURANCE_ORDER.indexOf(policy.minAssurance);
+        if (have < 0 || need < 0) {
+            // P-4 applied to the ladder itself, not only to its members: a level
+            // outside the ladder has no rank, and ranking it anywhere would be
+            // guessing on the permissive side half the time.
+            throw new Refusal(CLAUSE_ASSURANCE, `assurance level outside the AS0..AS2 ladder: enrolled ${level}, floor ${policy.minAssurance}`);
+        }
+        if (have < need) {
+            throw new Refusal(CLAUSE_ASSURANCE, `attester ${attester} enrolled at ${level}, bundle floor is ${policy.minAssurance}`);
+        }
+        // The `kind` routing disclosed in the module header. Distinct ATTESTERS,
+        // not distinct entries: the set is what AT-3 counts.
+        //
+        // AT-1's role resolution is the narrowing the header states: an empty
+        // `required_roles` means any enrolled attester satisfies it (v1.3.32), and a
+        // non-empty one is resolved against the REGISTRY's role for this identity,
+        // never against a role the entry supplies.
+        if (entry['kind'] === 'approval') {
+            const wanted = obj['required_roles'];
+            if (!Array.isArray(wanted)) {
+                throw new Refusal(CLAUSE_OBJECT_SCHEMA, 'attestation object field required_roles is not a list');
+            }
+            const role = roleOf(registered);
+            if (wanted.length === 0 || (role !== null && wanted.includes(role))) {
+                approvals.add(attester);
+            }
+        }
+    }
+    if (operators.size !== 1) {
+        throw new Refusal(CLAUSE_OPERATOR_DISAGREE, 'attestations disagree on operator');
+    }
+    const operator = [...operators][0];
+    if (operator === undefined) {
+        throw new Refusal(CLAUSE_OPERATOR_DISAGREE, 'attestations disagree on operator');
+    }
+    // AT-9's FIRST requirement. Reading the threshold from the signed bundle
+    // rather than from an entry raises nothing, so no mutant can score this line
+    // -- it is DEFENCE IN DEPTH, and the engine records the same thing rather
+    // than dressing it up as a control. The branch that CAN refuse is below.
+    if (approvals.size < policy.quorumK) {
+        throw new Refusal(CLAUSE_QUORUM, `quorum ${approvals.size} < ${policy.quorumK}`);
+    }
+    // AT-2 distinctness: the proposer never counts toward their own quorum.
+    if (approvals.has(operator)) {
+        throw new Refusal(CLAUSE_OPERATOR_SELF, 'operator counted toward own quorum');
+    }
+    return { operator, approvals: [...approvals].sort(), webauthnCounters: claimed };
+}
+//# sourceMappingURL=quorum.js.map

package/dist/quorum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quorum.js","sourceRoot":"","sources":["../src/quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAc,MAAM,YAAY,CAAC;AACpE,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,2BAA2B,EAC3B,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAElG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C,KAAK;IACL,WAAW;IACX,cAAc;IACd,uBAAuB;IACvB,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,oBAAoB;IACpB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,uEAAuE;AACvE,MAAM,cAAc,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;AAC7E,MAAM,aAAa,GAAsB,CAAC,GAAG,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAE/E,gFAAgF;AAChF,MAAM,eAAe,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAyGjE;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,UAAU,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,OAAO,CACf,iBAAiB,EACjB,kCAAkC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B,EAAE,IAAY,EAAE,MAAc;IAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,4BAA4B,IAAI,oBAAoB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,IAAY,EAAE,MAAc;IAC7E,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,4BAA4B,IAAI,kBAAkB,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mEAAmE;AACnE,MAAM,SAAS,GAAsB;IACnC,aAAa;IACb,kBAAkB;IAClB,eAAe;IACf,2BAA2B;IAC3B,kBAAkB;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,IAAsB,EACtB,MAAc,EACd,GAAY,EACZ,SAAiB;IAEjB,IAAI,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,OAAO,CACf,mBAAmB,EACnB,yBAAyB,MAAM,8BAA8B,IAAI,CAAC,GAAG,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,WAAW;IACX,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvF,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,0CAA0C;IAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC;QACH,OAAO,cAAc,CACnB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,SAAS,EACd,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACnC,IAAI,CAAC,IAAI,EACT,GAAG,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,YAAY,eAAe,CAAC;YAAE,MAAM,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,wBAAwB;QACxB,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAClF,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAS,MAAM,CAAC,IAAwB;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAoB,EACpB,KAAoB,EACpB,OAAgB,EAChB,OAAgB;IAEhB,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,4EAA4E;IAC5E,2DAA2D;IAC3D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,aAAa,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC;IAEhE,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa;QAAE,OAAO,IAAI,CAAC;IAEpD,IAAI,MAAgB,CAAC;IACrB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,0EAA0E;QAC1E,uEAAuE;QACvE,8CAA8C;QAC9C,MAAM,IAAI,OAAO,CAAC,sBAAsB,EAAE,qDAAqD,CAAC,CAAC;IACnG,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IACxE,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,oEAAoE;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,8BAA8B;QACrF,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,OAAO,CACf,kBAAkB,EAClB,GAAG,IAAI,CAAC,MAAM,kCAAkC,MAAM,CAAC,MAAM,iBAAiB,CAC/E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,gBAAgB,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,8BAA8B;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,wDAAwD,CAAC,CAAC;QACjG,CAAC;QACD,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACrF,CAAC;QAED,2DAA2D;QAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,OAAO,CACf,oBAAoB,EACpB,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,aAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,mDAAmD,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,oBAAoB,cAAc,GAAG,CAAC,MAAM,CAAC,CAAC;QACzF,CAAC;QAED,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAE/B,mEAAmE;QACnE,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAElD,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,eAAe;QACf,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7E,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/D,MAAM,IAAI,OAAO,CACf,mBAAmB,EACnB,SAAS,QAAQ,8DAA8D,GAAG,EAAE,CACrF,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,yEAAyE;YACzE,wEAAwE;YACxE,2EAA2E;YAC3E,6DAA6D;YAC7D,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;YAExE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,4CAA4C;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACzD,MAAM,IAAI,OAAO,CACf,uBAAuB,EACvB,+BAA+B,OAAO,mBAAmB,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,MAAM,0DAA0D,CACvL,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,2EAA2E;YAC3E,yEAAyE;YACzE,0EAA0E;YAC1E,QAAQ;YACR,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,OAAO,CAAC,wBAAwB,EAAE,qBAAqB,GAAG,qBAAqB,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7D,iEAAiE;gBACjE,8DAA8D;gBAC9D,cAAc;gBACd,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,GAAG,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,qEAAqE;gBACrE,sEAAsE;gBACtE,sEAAsE;gBACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC1C,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;YAC3F,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,sEAAsE;gBACtE,qEAAqE;gBACrE,4DAA4D;gBAC5D,IAAI,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACrC,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;YACD,IAAI,GAAG;gBAAE,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;QAChF,CAAC;QAED,sEAAsE;QACtE,+DAA+D;QAC/D,IAAI,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7E,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QAED,wEAAwE;QACxE,6EAA6E;QAC7E,0EAA0E;QAC1E,gEAAgE;QAChE,IACE,WAAW,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,KAAK,MAAM,CAAC,gBAAgB;YACvF,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,mBAAmB,CAAC,KAAK,MAAM,CAAC,WAAW,EACzE,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC9E,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,qEAAqE;QACrE,4EAA4E;QAC5E,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,OAAO,CACf,cAAc,EACd,8BAA8B,MAAM,qBAAqB,MAAM,CAAC,OAAO,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,OAAO,CACf,mBAAmB,EACnB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;QAChF,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,eAAe;QACf,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAEjE,6EAA6E;QAC7E,wEAAwE;QACxE,+DAA+D;QAC/D,4EAA4E;QAC5E,sCAAsC;QACtC,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;QACnF,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,kCAAkC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;QACvD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACzB,qEAAqE;YACrE,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,yDAAyD,KAAK,WAAW,MAAM,CAAC,YAAY,EAAE,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,YAAY,QAAQ,gBAAgB,KAAK,qBAAqB,MAAM,CAAC,YAAY,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,qDAAqD;QACrD,EAAE;QACF,sEAAsE;QACtE,6EAA6E;QAC7E,2EAA2E;QAC3E,2CAA2C;QAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,OAAO,CACf,oBAAoB,EACpB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACpE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,OAAO,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,OAAO,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;IACnF,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,SAAS,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,UAAU,SAAS,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,wEAAwE;IACxE,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,OAAO,CAAC,oBAAoB,EAAE,oCAAoC,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC"}

package/dist/sig.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The CR-2 signature carrier and the CR-3 conjunctive verification, shared by
+ * the receipt gate (`verify.ts`) and the attestation loop (`quorum.ts`).
+ *
+ * One home, for the reason `quorum.rs` gives when it calls
+ * `crate::decide::parse_sig` rather than writing its own: the shape a signature
+ * must have is the shape its SUITE requires, and a second parser is a second
+ * answer to "which primitives satisfy this suite". The refusal each function
+ * raises is the RECEIPT's clause (`9.3-1`); the quorum catches it and re-raises
+ * under `9.3-7b-i`, exactly as the engine does, because a bad attester
+ * signature and a bad receipt signature are different findings.
+ */
+import { type HybridError, type Primitive, type PrimitiveVerdict, type Suite } from './suite.js';
+/** FIPS 204 ML-DSA-65 public key length. */
+export declare const MLDSA65_PK_LEN = 1952;
+/** FIPS 204 ML-DSA-65 signature length. */
+export declare const MLDSA65_SIG_LEN = 3309;
+/** Lowercase hex of a byte string. */
+export declare function hex(bytes: Uint8Array): string;
+/** Decode a hex signature leg, refusing exactly as `decide.rs`'s `unhex`. */
+export declare function unhex(s: string): Uint8Array;
+/** One primitive's signature as presented on the wire. */
+export interface SignaturePart {
+    readonly primitive: Primitive;
+    readonly bytes: Uint8Array;
+}
+/**
+ * Parse a wire `sig` object into the parts the CR-3 combiner verifies --
+ * `decide.rs::parse_sig`, including its rule that the key set must be EXACTLY
+ * the suite's. Three attacks live in the difference: a scalar `sig` (format
+ * confusion is a downgrade in disguise), a missing primitive (the stripped
+ * leg), and an extra undeclared primitive (an accepted code path the attacker
+ * chose). An unknown primitive name is refused rather than dropped -- a dropped
+ * part would let a suite be satisfied by the parts that remain.
+ */
+export declare function parseSig(sig: unknown, alg: string): SignaturePart[];
+/**
+ * Verify one ML-DSA-65 signature. Never throws; length checks first, exactly as
+ * `primitives.rs` -- a malformed input is `invalid`, never `unsupported`: one is
+ * a statement about the signature, the other about this build, and reporting one
+ * as the other sends the investigation to the wrong place.
+ */
+export declare function verifyMlDsa65(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): PrimitiveVerdict;
+/** A hybrid identity's two public halves -- both, because CR-3 is conjunctive. */
+export interface HybridPublicKey {
+    readonly classical: Uint8Array;
+    readonly pq: Uint8Array;
+}
+/**
+ * CR-3 over a declared suite: every primitive the suite names must be present
+ * and must verify. Returns null on success, the `HybridError` name on refusal.
+ *
+ * The suite is a PARAMETER, exactly as in Rust: a caller that decides how many
+ * primitives a hybrid signature needs can be persuaded to decide "one".
+ */
+export declare function verifyUnderSuite(suite: Suite, key: HybridPublicKey, message: Uint8Array, parts: readonly SignaturePart[]): HybridError | null;
+//# sourceMappingURL=sig.d.ts.map