agent-passport-system 3.3.0 → 4.0.0

package/dist/src/v2/audience-binding/verify.js

@@ -34,7 +34,9 @@ import { AUDIENCE_BINDING_PROFILE } from './types.js';
  * or a non-string member). Callers treat null as `audience_malformed`.
  */
 export function normalizeRecipients(aud) {
-    if (aud === undefined)
+    if (aud === undefined || aud === null)
+        return null;
+    if (typeof aud !== 'object')
         return null;
     if (aud.profile !== AUDIENCE_BINDING_PROFILE)
         return null;
@@ -83,9 +85,12 @@ export function checkAudience(proof, policy) {
             message: 'No recipientId in policy; audience membership cannot be evaluated.',
         };
     }
-    const aud = proof.aud;
+    // Optional chaining and the null check below keep this fail-closed on
+    // untrusted JSON: a null proof, or an explicit `aud: null` (which a JSON
+    // body can carry), is treated as unbound rather than throwing a TypeError.
+    const aud = proof?.aud;
     // Unbound proof.
-    if (aud === undefined) {
+    if (aud === undefined || aud === null) {
         if (policy.requireAudience === true) {
             return {
                 status: 'fail',

package/dist/src/v2/audience-binding/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/audience-binding/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAiBrD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAgC;IAClE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,GAAG,CAAC,OAAO,KAAK,wBAAwB;QAAE,OAAO,IAAI,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAgC,EAChC,WAAmB;IAEnB,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAqB,EACrB,MAAsB;IAEtB,wEAAwE;IACxE,gDAAgD;IAChD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,oEAAoE;SAC9E,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IAErB,iBAAiB;IACjB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,0BAA0B;gBAClC,cAAc,EAAE,MAAM,CAAC,WAAW;gBAClC,OAAO,EAAE,6DAA6D;aACvE,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,MAAM,CAAC,WAAW;YAClC,OAAO,EAAE,oEAAoE;SAC9E,CAAA;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oBAAoB;YAC5B,cAAc,EAAE,MAAM,CAAC,WAAW;YAClC,OAAO,EAAE,6EAA6E;SACvF,CAAA;IACH,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gBAAgB;YACxB,UAAU;YACV,cAAc,EAAE,MAAM,CAAC,WAAW;YAClC,OAAO,EAAE,mDAAmD;SAC7D,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,mBAAmB;QAC3B,UAAU;QACV,cAAc,EAAE,MAAM,CAAC,WAAW;QAClC,OAAO,EAAE,gEAAgE;KAC1E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAA6B;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAChE,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/audience-binding/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAiBrD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuC;IACzE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,GAAG,CAAC,OAAO,KAAK,wBAAwB;QAAE,OAAO,IAAI,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC,UAAU,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAgC,EAChC,WAAmB;IAEnB,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAqB,EACrB,MAAsB;IAEtB,wEAAwE;IACxE,gDAAgD;IAChD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,oEAAoE;SAC9E,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAA;IAEtB,iBAAiB;IACjB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,0BAA0B;gBAClC,cAAc,EAAE,MAAM,CAAC,WAAW;gBAClC,OAAO,EAAE,6DAA6D;aACvE,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,MAAM,CAAC,WAAW;YAClC,OAAO,EAAE,oEAAoE;SAC9E,CAAA;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oBAAoB;YAC5B,cAAc,EAAE,MAAM,CAAC,WAAW;YAClC,OAAO,EAAE,6EAA6E;SACvF,CAAA;IACH,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gBAAgB;YACxB,UAAU;YACV,cAAc,EAAE,MAAM,CAAC,WAAW;YAClC,OAAO,EAAE,mDAAmD;SAC7D,CAAA;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,mBAAmB;QAC3B,UAAU;QACV,cAAc,EAAE,MAAM,CAAC,WAAW;QAClC,OAAO,EAAE,gEAAgE;KAC1E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAA6B;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAChE,CAAC"}

package/dist/src/v2/offline-verifier/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AAMtE,MAAM,MAAM,YAAY,GAEpB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GAEnB,oBAAoB,GACpB,oBAAoB,GACpB,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,UAAU,GACV,aAAa,GACb,qBAAqB,CAAA;AAEzB;;8DAE8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,SAAS,YAAY,EAIvD,CAAA;AAID,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,sBAAsB,EAAE,MAAM,CAAA;IAC9B,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAA;IAC7B,sDAAsD;IACtD,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,0CAA0C;IAC1C,iBAAiB,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wDAAwD;IACxD,sBAAsB,EAAE,MAAM,CAAA;IAC9B,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,wBAAwB,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAA;IAC/B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,GAClB,mBAAmB,CAoDrB"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AAMtE,MAAM,MAAM,YAAY,GAEpB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GAEnB,oBAAoB,GACpB,oBAAoB,GACpB,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,UAAU,GACV,aAAa,GACb,qBAAqB,CAAA;AAEzB;;8DAE8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,SAAS,YAAY,EAIvD,CAAA;AAID,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,sBAAsB,EAAE,MAAM,CAAA;IAC9B,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAA;IAC7B,sDAAsD;IACtD,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,0CAA0C;IAC1C,iBAAiB,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wDAAwD;IACxD,sBAAsB,EAAE,MAAM,CAAA;IAC9B,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,wBAAwB,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAA;IAC/B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,GAClB,mBAAmB,CAyDrB"}

package/dist/src/v2/offline-verifier/context.js

@@ -34,6 +34,7 @@
 //     receipt is a signed declaration, not a causal proof.
 // ══════════════════════════════════════════════════════════════════
 import { verifyActionReceipt } from '../accountability/verify/action.js';
+import { isRecord } from '../../core/is-record.js';
 /** The closed set of crypto-layer reasons, for callers that want to
  *  branch on which layer surfaced a rejection without re-running the
  *  verifier. Mirrors {@link RejectReason}'s crypto subset. */
@@ -53,6 +54,11 @@ export const CRYPTO_LAYER_REASONS = [
  * {@link ReceiptContext}.
  */
 export function verifyReceiptContext(receipt, ctx) {
+    // Null / undefined / non-object rejects at the crypto layer rather than
+    // throwing on a downstream property access.
+    if (!isRecord(receipt)) {
+        return { valid: false, reason: 'INVALID_CLAIM_TYPE' };
+    }
     const crypto = verifyActionReceipt(receipt);
     if (!crypto.valid) {
         return { valid: false, reason: crypto.reason };

package/dist/src/v2/offline-verifier/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,iDAAiD;AACjD,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,qDAAqD;AACrD,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,8BAA8B;AAC9B,gEAAgE;AAChE,iEAAiE;AACjE,kDAAkD;AAClD,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,2DAA2D;AAC3D,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAsBxE;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAA4B;IAC3D,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;CACpB,CAAA;AAmCD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAsB,EAAE,CAAA;IAChE,CAAC;IAED,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,GAAG,CAAC,uBAAuB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,8DAA8D;IAC9D,IAAI,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,GAAG,CAAC,wBAAwB,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACjD,CAAC;IAED,mEAAmE;IACnE,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC7C,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,iDAAiD;AACjD,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,qDAAqD;AACrD,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,8BAA8B;AAC9B,gEAAgE;AAChE,iEAAiE;AACjE,kDAAkD;AAClD,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,2DAA2D;AAC3D,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAsBlD;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAA4B;IAC3D,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;CACpB,CAAA;AAmCD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,GAAmB;IAEnB,wEAAwE;IACxE,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAsB,EAAE,CAAA;IAChE,CAAC;IAED,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,GAAG,CAAC,uBAAuB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,8DAA8D;IAC9D,IAAI,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,GAAG,CAAC,wBAAwB,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACjD,CAAC;IAED,mEAAmE;IACnE,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC7C,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/src/v2/offline-verifier/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC;mEACmE;AACnE,MAAM,WAAW,uBAAuB;IACtC;;;8DAG0D;IAC1D,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC/B,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,sBAAsB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAA;IACpC,sDAAsD;IACtD,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtC;AAED;2CAC2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC;;sEAEkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,uBAAuB,CAAA;CACrC;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEtD,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,OAAO,CAAA;IACpB,0EAA0E;IAC1E,cAAc,EAAE,OAAO,CAAA;IACvB;mBACe;IACf,YAAY,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,kDAAkD;IAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IACtC;;uEAEmE;IACnE,UAAU,EAAE,kBAAkB,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,oBAAyB,GAC9B,mBAAmB,CA2ErB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC;mEACmE;AACnE,MAAM,WAAW,uBAAuB;IACtC;;;8DAG0D;IAC1D,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC/B,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,sBAAsB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAA;IACpC,sDAAsD;IACtD,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtC;AAED;2CAC2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC;;sEAEkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,uBAAuB,CAAA;CACrC;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEtD,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,OAAO,CAAA;IACpB,0EAA0E;IAC1E,cAAc,EAAE,OAAO,CAAA;IACvB;mBACe;IACf,YAAY,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,kDAAkD;IAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IACtC;;uEAEmE;IACnE,UAAU,EAAE,kBAAkB,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,oBAAyB,GAC9B,mBAAmB,CAkGrB"}

package/dist/src/v2/offline-verifier/verify.js

@@ -41,6 +41,7 @@
 //     the underlying outcome. A receipt is a signed declaration.
 // ══════════════════════════════════════════════════════════════════
 import { verifyActionReceipt } from '../accountability/verify/action.js';
+import { isRecord } from '../../core/is-record.js';
 import { verifyReceiptContext, } from './context.js';
 import { buildDescriptor } from './descriptor.js';
 /**
@@ -57,6 +58,28 @@ import { buildDescriptor } from './descriptor.js';
  * read beyond what the caller supplies in {@link ReceiptContext}.
  */
 export function verifyOffline(receipt, opts = {}) {
+    // ── 0. input guard ──
+    // Null / undefined / non-object (attacker-deliverable JSON `null`) rejects
+    // at the crypto layer rather than throwing on the receipt.signer_did access
+    // used to seed the descriptor below. The descriptor is still emitted so a
+    // relying party always gets a mechanical-facts view, even on this rejection.
+    if (!isRecord(receipt)) {
+        const descriptor = buildDescriptor({
+            receiptId: '',
+            signatures: [
+                { signerId: '', role: 'action_signer', claim: 'outcome', valid: false },
+            ],
+        });
+        return {
+            verdict: 'reject',
+            cryptoValid: false,
+            contextChecked: false,
+            contextValid: false,
+            reason: 'INVALID_CLAIM_TYPE',
+            rejectedAtLayer: 'crypto',
+            descriptor,
+        };
+    }
     // ── 1. crypto layer ──
     const crypto = verifyActionReceipt(receipt);
     const cryptoValid = crypto.valid;

package/dist/src/v2/offline-verifier/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,+DAA+D;AAC/D,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,yEAAyE;AACzE,qEAAqE;AACrE,wDAAwD;AACxD,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,wBAAwB;AACxB,EAAE;AACF,8BAA8B;AAC9B,sEAAsE;AACtE,kEAAkE;AAClE,0EAA0E;AAC1E,qEAAqE;AACrE,8BAA8B;AAC9B,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,iEAAiE;AACjE,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAGxE,OAAO,EACL,oBAAoB,GAGrB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAwDjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsB,EACtB,IAAI,GAAyB,EAAE;IAE/B,wBAAwB;IACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAA;IAEhC,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,aAAa,GAAqB;QACtC,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,WAAW;KACnB,CAAA;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,IAAI,EAAE,CAAA;IACzD,MAAM,UAAU,GAAuB,CAAC,aAAa,EAAE,GAAG,eAAe,CAAC,CAAA;IAE1E,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,UAAU;QACV,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB;QACzD,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB;QACnD,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW;KAC1C,CAAC,CAAA;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAsB;YACrC,eAAe,EAAE,QAAQ;YACzB,UAAU;SACX,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,oEAAoE;QACpE,qEAAqE;QACrE,gCAAgC;QAChC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,UAAU;SACX,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,eAAe,EAAE,SAAS;YAC1B,UAAU;SACX,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,IAAI;QAClB,UAAU;KACX,CAAA;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,+DAA+D;AAC/D,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,yEAAyE;AACzE,qEAAqE;AACrE,wDAAwD;AACxD,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,wBAAwB;AACxB,EAAE;AACF,8BAA8B;AAC9B,sEAAsE;AACtE,kEAAkE;AAClE,0EAA0E;AAC1E,qEAAqE;AACrE,8BAA8B;AAC9B,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,iEAAiE;AACjE,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAGlD,OAAO,EACL,oBAAoB,GAGrB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAwDjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsB,EACtB,IAAI,GAAyB,EAAE;IAE/B,uBAAuB;IACvB,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,SAAS,EAAE,EAAE;YACb,UAAU,EAAE;gBACV,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE;aACxE;SACF,CAAC,CAAA;QACF,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,oBAAoB;YAC5B,eAAe,EAAE,QAAQ;YACzB,UAAU;SACX,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAA;IAEhC,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,aAAa,GAAqB;QACtC,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,WAAW;KACnB,CAAA;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,IAAI,EAAE,CAAA;IACzD,MAAM,UAAU,GAAuB,CAAC,aAAa,EAAE,GAAG,eAAe,CAAC,CAAA;IAE1E,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,UAAU;QACV,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB;QACzD,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB;QACnD,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW;KAC1C,CAAC,CAAA;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAsB;YACrC,eAAe,EAAE,QAAQ;YACzB,UAAU;SACX,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,oEAAoE;QACpE,qEAAqE;QACrE,gCAAgC;QAChC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,UAAU;SACX,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,eAAe,EAAE,SAAS;YAC1B,UAAU;SACX,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,IAAI;QAClB,UAAU;KACX,CAAA;AACH,CAAC"}

package/dist/src/verification/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAIhE;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE;IACL,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;0EAIsE;IACtE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B,GACA,kBAAkB,CAiGpB;AAED,wBAAgB,eAAe,CAAC,gBAAgB,SAAM,GAAG,SAAS,CAOjE;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAKT"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAIhE;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE;IACL,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;0EAIsE;IACtE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B,GACA,kBAAkB,CAwGpB;AAED,wBAAgB,eAAe,CAAC,gBAAgB,SAAM,GAAG,SAAS,CAOjE;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAKT"}

package/dist/src/verification/verify.js

@@ -3,6 +3,7 @@
 // Passport Verification — validate signatures and integrity
 import { verify } from '../crypto/keys.js';
 import { canonicalize } from '../core/canonical.js';
+import { isRecord } from '../core/is-record.js';
 import { isExpired } from '../core/passport.js';
 import { randomBytes } from 'node:crypto';
 import { v4 as uuidv4 } from 'uuid';
@@ -15,6 +16,12 @@ import { v4 as uuidv4 } from 'uuid';
 export function verifyPassport(signed, opts) {
     const errors = [];
     const warnings = [];
+    // Null / undefined / non-object (attacker-deliverable JSON `null`) rejects
+    // with the missing-fields verdict rather than throwing on the property
+    // access below.
+    if (!isRecord(signed)) {
+        return { valid: false, errors: ['Missing passport or signature'], warnings };
+    }
     // Check required fields
     if (!signed.passport || !signed.signature) {
         return { valid: false, errors: ['Missing passport or signature'], warnings };

package/dist/src/verification/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,4DAA4D;AAE5D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,IAQC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IAEtC,iCAAiC;IACjC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACzE,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAI,MAAc,CAAC,eAAe,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAA;QACrE,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,CAAA;QAChG,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,MAAM,aAAa,GAAG,YAAY,CAAC;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAG,MAAc,CAAC,QAAQ;aACnC,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,eAAe,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,IAAI,EAAE,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,6BAA6B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACrD,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3C,CAAC;IAED,oBAAoB;IACpB,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,cAAc,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW;YAC/C,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,4BAA4B,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,gBAAgB,GAAG,GAAG;IACpD,OAAO;QACL,WAAW,EAAE,MAAM,EAAE;QACrB,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,YAAoB,EACpB,YAAoB;IAEpB,eAAe;IACf,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5D,kCAAkC;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;AAC5D,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,4DAA4D;AAE5D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,IAQC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,2EAA2E;IAC3E,uEAAuE;IACvE,gBAAgB;IAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC9E,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IAEtC,iCAAiC;IACjC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACzE,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAI,MAAc,CAAC,eAAe,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAA;QACrE,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,CAAA;QAChG,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,MAAM,aAAa,GAAG,YAAY,CAAC;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAG,MAAc,CAAC,QAAQ;aACnC,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,eAAe,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,IAAI,EAAE,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,6BAA6B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACrD,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3C,CAAC;IAED,oBAAoB;IACpB,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,cAAc,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW;YAC/C,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,4BAA4B,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,gBAAgB,GAAG,GAAG;IACpD,OAAO;QACL,WAAW,EAAE,MAAM,EAAE;QACrB,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,YAAoB,EACpB,YAAoB;IAEpB,eAAe;IACf,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5D,kCAAkC;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;AAC5D,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-passport-system",
-  "version": "3.3.0",
-  "description": "Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Verifier hot path p50 = 420ns bare-metal Linux EPYC 7313P (§13.1 canonical environment per spec), 347ns AWS c7i.2xlarge, 292ns Mac M3. Gateway enforcement, monotonic narrowing, cascade revocation, Bayesian reputation, wallet binding, unified four-axis attribution primitive, per-period attribution settlement, data lifecycle, mutual authentication, Wave 1 accountability primitives (action, authority-boundary, custody, contestability, bundle), evidentiary type safety (claim/evidence registry, claim verifier with forbidden-substitution detection, contestation cascade). 4,026 tests.",
+  "version": "4.0.0",
+  "description": "Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Verifier hot path p50 = 420ns bare-metal Linux EPYC 7313P (§13.1 canonical environment per spec), 347ns AWS c7i.2xlarge, 292ns Mac M3. Gateway enforcement, monotonic narrowing, cascade revocation, Bayesian reputation, wallet binding, unified four-axis attribution primitive, per-period attribution settlement, data lifecycle, mutual authentication, Wave 1 accountability primitives (action, authority-boundary, custody, contestability, bundle), evidentiary type safety (claim/evidence registry, claim verifier with forbidden-substitution detection, contestation cascade). 4,098 tests.",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -20,7 +20,7 @@
   },
   "scripts": {
     "build": "tsc && chmod +x dist/src/cli/index.js",
-    "test": "npx tsx --test tests/passport.test.ts tests/adversarial.ts tests/v2.0-integration.ts tests/contract.test.ts tests/agora.test.ts tests/values.test.ts tests/delegation.test.ts tests/attribution.test.ts tests/policy.test.ts tests/canonical.test.ts tests/coordination.test.ts tests/commerce.test.ts tests/enforcement.test.ts tests/routing.test.ts tests/did-vc.test.ts tests/a2a.test.ts tests/principal.test.ts tests/adversarial-paper.test.ts tests/property-delegation.test.ts tests/property-canonical.test.ts tests/intent.test.ts tests/reputation-authority.test.ts tests/cross-chain.test.ts tests/encrypted-messaging.test.ts tests/obligations.test.ts tests/execution-envelope.test.ts tests/adversarial-causal-chain.test.ts tests/governance.test.ts tests/feasibility.test.ts tests/identity.test.ts tests/precedent.test.ts tests/reanchor.test.ts tests/escalation.test.ts tests/oracle-witness.test.ts tests/messaging-audit.test.ts tests/policy-conflict.test.ts tests/data-source.test.ts tests/decision-semantics.test.ts tests/interop-vectors.test.ts tests/v2-bridge.test.ts tests/v2-full.test.ts tests/key-storage.test.ts tests/qntm-bridge.test.ts tests/agent-json-bridge.test.ts tests/did-resolution-conformance.test.ts tests/decision-equivalence.test.ts tests/data-lifecycle.test.ts tests/campaign7-composition.test.ts tests/entity-verification.test.ts tests/conformance.test.ts tests/governance-block.test.ts tests/aps-txt.test.ts tests/governance-360.test.ts tests/storage-backend.test.ts tests/receipt-bundle.test.ts tests/reputation-confidence.test.ts tests/governance-consumer.test.ts tests/charter.test.ts tests/institutional-governance-phase2.test.ts tests/data-source-attribution.test.ts tests/canonical-jcs.test.ts tests/temporal-spread.test.ts tests/fidelity-pressure.test.ts tests/denial-domains.test.ts tests/data-narrowing.test.ts tests/governance-posture.test.ts tests/anchor-state.test.ts tests/issuer-signature.test.ts tests/openshell-adapter.test.ts tests/attestation.test.ts tests/execution-attestation.test.ts tests/bilateral-receipt.test.ts tests/proof-namespace.test.ts tests/ecosystem-features.test.ts tests/persistent-passport.test.ts tests/security-av.test.ts tests/audit-fixes.test.ts tests/did-interop.test.ts tests/identity-bridge.test.ts tests/vc-wrapper.test.ts tests/identity-pipeline.test.ts tests/cross-protocol/sint-crossverify.test.ts tests/action-ref.test.ts tests/external-action-ref.test.ts tests/freshness.test.ts tests/evidence-grade.test.ts tests/key-rotation.test.ts tests/governance-regression.test.ts tests/posture-overlay.test.ts tests/feasibility-gateway.test.ts tests/trust-adapters.test.ts tests/evaluation-context.test.ts tests/health.test.ts tests/composio-adapter.test.ts tests/interop/ietf-envelope.test.ts tests/interop/signet-combined.test.ts tests/interop/moltrust-attestation.test.ts tests/interop/cross-protocol-vectors.test.ts tests/interop/receipt-chaining.test.ts tests/ibac-adapter.test.ts tests/langchain-adapter.test.ts tests/crewai-adapter.test.ts tests/mcp-adapter.test.ts tests/a2a-adapter.test.ts tests/gonka-adapter.test.ts tests/cross-algo-mismatch.test.ts tests/credential-lifecycle.test.ts tests/behavioral-memory.test.ts tests/telemetry-scope.test.ts tests/idempotency.test.ts tests/v2/wallet-binding.test.ts tests/v2/wallet-binding-fixture.test.ts tests/v2/credential-check-policy.test.ts tests/v2/delegation-escalation.test.ts tests/v2/attribution-consent.test.ts tests/v2/attribution-integration.test.ts tests/v2/attribution-primitive.test.ts tests/v2/attribution-primitive-integration.test.ts tests/v2/build-b-fractional-weights.test.ts tests/v2/build-b-cross-language.test.ts tests/v2/build-c-settlement.test.ts tests/v2/build-c-cross-language.test.ts tests/v2/build-c-end-to-end.test.ts tests/v2/provisional-statement.test.ts tests/temporal-decay.test.ts tests/confidence-breakdown.test.ts tests/behavioral-fingerprint.test.ts tests/session-boundary.test.ts tests/probe-identity.test.ts tests/v2/cognitive-attestation/envelope.test.ts tests/v2/cognitive-attestation/verify.test.ts tests/v2/cognitive-attestation/adversarial.test.ts tests/v2/mutual-auth/handshake.test.ts tests/v2/mutual-auth/adversarial.test.ts tests/v2/mutual-auth/conformance.test.ts tests/property-bilateral-receipt.test.ts tests/v2/instruction-provenance/conformance.test.ts tests/v2/instruction-provenance/adversarial.test.ts tests/v2/identity-composition-error.test.ts tests/v2/claim-evidence-types.test.ts tests/v2/claim-verifier.test.ts tests/v2/downstream-taint.test.ts tests/v2/payment-rails/nano.test.ts tests/v2/payment-rails/governance.test.ts tests/v2/payment-rails/ap2.test.ts tests/v2/payment-rails/x402.test.ts tests/v2/payment-rails/conformance/harness.test.ts tests/v2/payment-rails/binding-harness.test.ts tests/v2/payment-rails/stripe-issuing-primitives.test.ts tests/v2/payment-rails/acp.test.ts tests/v2/payment-rails/cycles.test.ts tests/v2/payment-rails/mpp.test.ts tests/v2/payment-rails/scope-resolution.test.ts tests/v2/payment-rails/accountability-bundle.test.ts tests/v2/payment-rails/did-uri-signing.test.ts tests/v2/payment-rails/cross-receipt-chain.test.ts src/v2/accountability/__tests__/action.test.ts src/v2/accountability/__tests__/authority-boundary.test.ts src/v2/accountability/__tests__/bundle.test.ts src/v2/accountability/__tests__/contestability.test.ts src/v2/accountability/__tests__/custody.test.ts src/v2/accountability/__tests__/fixtures.test.ts src/v2/cognitive_attestation/__tests__/cognitive_attestation.test.ts src/v2/delegation/__tests__/responsibility_anchor.test.ts src/v2/memory_provenance/__tests__/memory_provenance.test.ts src/v2/cross_issuer_attestation/__tests__/cross_issuer_attestation.test.ts src/v2/behavioral_drift_window/__tests__/behavioral_drift_window.test.ts tests/tool-registry-integrity.test.ts tests/v2/transport/rfc9421/request-binding.test.ts tests/v2/verifier-hardening.test.ts tests/v2/key-resolution/resolver.test.ts src/v2/feasibility/__tests__/feasibility.test.ts tests/oauth-rfc8693-bridge.test.ts tests/conformance/conformance-negatives.test.ts tests/v2/policy-bundle/policy-bundle.test.ts src/v2/scope-registry/__tests__/scope-registry.test.ts tests/check-many-parity.test.ts tests/cross-impl/jcs-equivalence.test.ts tests/remote-signer.test.ts tests/v2/assurance/descriptor.test.ts tests/v2/audience-binding/audience-binding.test.ts tests/v2/hash-pointer/bbs-composition.test.ts tests/v2/hash-pointer/profile.test.ts tests/v2/human-oversight/human-oversight.test.ts tests/v2/offline-verifier/conformance-runner.test.ts tests/v2/offline-verifier/middleware.test.ts tests/v2/offline-verifier/verify.test.ts tests/v2/payment-rails/cycles-evidence-resolution.test.ts tests/v2/payment-rails/cycles-evidence-authority.test.ts tests/v2/revocation-enforcement.test.ts tests/v2/trust-policy/trust-policy.test.ts src/v2/context-provenance/__tests__/roundtrip.test.ts src/v2/context-provenance/__tests__/disclosure.test.ts src/v2/context-provenance/__tests__/known-answer.test.ts src/v2/context-provenance/__tests__/conformance.test.ts src/v2/context-provenance/__tests__/adversarial.test.ts src/v2/context-provenance/__tests__/parity.test.ts src/v2/context-provenance/__tests__/cross-lang-parity.test.ts tests/v2/verification-source.test.ts tests/v2/producer-attestation.test.ts tests/delegation-currency-narrowing.test.ts tests/delegation-temporal-narrowing.test.ts tests/oauth-id-jag-bridge.test.ts tests/v2/regulated-action/conformance.test.ts tests/commerce-spend-accumulation.test.ts tests/delegation-spend-unit-narrowing.test.ts tests/delegation-parent-verify.test.ts tests/commerce-currency-gate.test.ts tests/v2/composition-check/conformance.test.ts src/v2/word_handles/__tests__/word_handles.test.ts src/v2/read_fidelity_receipt/__tests__/read_fidelity_receipt.test.ts tests/jurisdiction-selection.test.ts tests/v2/bilateral-pair/bilateral-pair.test.ts tests/evidence-bundle.test.ts",
+    "test": "npx tsx --test tests/passport.test.ts tests/adversarial.ts tests/v2.0-integration.ts tests/contract.test.ts tests/agora.test.ts tests/values.test.ts tests/delegation.test.ts tests/attribution.test.ts tests/policy.test.ts tests/canonical.test.ts tests/coordination.test.ts tests/commerce.test.ts tests/enforcement.test.ts tests/routing.test.ts tests/did-vc.test.ts tests/a2a.test.ts tests/principal.test.ts tests/adversarial-paper.test.ts tests/property-delegation.test.ts tests/property-canonical.test.ts tests/intent.test.ts tests/reputation-authority.test.ts tests/cross-chain.test.ts tests/encrypted-messaging.test.ts tests/obligations.test.ts tests/execution-envelope.test.ts tests/adversarial-causal-chain.test.ts tests/governance.test.ts tests/feasibility.test.ts tests/identity.test.ts tests/precedent.test.ts tests/reanchor.test.ts tests/escalation.test.ts tests/oracle-witness.test.ts tests/messaging-audit.test.ts tests/policy-conflict.test.ts tests/data-source.test.ts tests/decision-semantics.test.ts tests/interop-vectors.test.ts tests/v2-bridge.test.ts tests/v2-full.test.ts tests/key-storage.test.ts tests/qntm-bridge.test.ts tests/agent-json-bridge.test.ts tests/did-resolution-conformance.test.ts tests/decision-equivalence.test.ts tests/data-lifecycle.test.ts tests/campaign7-composition.test.ts tests/entity-verification.test.ts tests/conformance.test.ts tests/governance-block.test.ts tests/aps-txt.test.ts tests/governance-360.test.ts tests/storage-backend.test.ts tests/receipt-bundle.test.ts tests/reputation-confidence.test.ts tests/governance-consumer.test.ts tests/charter.test.ts tests/institutional-governance-phase2.test.ts tests/data-source-attribution.test.ts tests/canonical-jcs.test.ts tests/temporal-spread.test.ts tests/fidelity-pressure.test.ts tests/denial-domains.test.ts tests/data-narrowing.test.ts tests/governance-posture.test.ts tests/anchor-state.test.ts tests/issuer-signature.test.ts tests/openshell-adapter.test.ts tests/attestation.test.ts tests/execution-attestation.test.ts tests/bilateral-receipt.test.ts tests/proof-namespace.test.ts tests/ecosystem-features.test.ts tests/persistent-passport.test.ts tests/security-av.test.ts tests/audit-fixes.test.ts tests/did-interop.test.ts tests/identity-bridge.test.ts tests/vc-wrapper.test.ts tests/identity-pipeline.test.ts tests/cross-protocol/sint-crossverify.test.ts tests/action-ref.test.ts tests/external-action-ref.test.ts tests/freshness.test.ts tests/evidence-grade.test.ts tests/key-rotation.test.ts tests/governance-regression.test.ts tests/posture-overlay.test.ts tests/feasibility-gateway.test.ts tests/trust-adapters.test.ts tests/evaluation-context.test.ts tests/health.test.ts tests/composio-adapter.test.ts tests/interop/ietf-envelope.test.ts tests/interop/signet-combined.test.ts tests/interop/moltrust-attestation.test.ts tests/interop/cross-protocol-vectors.test.ts tests/interop/receipt-chaining.test.ts tests/ibac-adapter.test.ts tests/langchain-adapter.test.ts tests/crewai-adapter.test.ts tests/mcp-adapter.test.ts tests/a2a-adapter.test.ts tests/gonka-adapter.test.ts tests/cross-algo-mismatch.test.ts tests/credential-lifecycle.test.ts tests/behavioral-memory.test.ts tests/telemetry-scope.test.ts tests/idempotency.test.ts tests/v2/wallet-binding.test.ts tests/v2/wallet-binding-fixture.test.ts tests/v2/credential-check-policy.test.ts tests/v2/delegation-escalation.test.ts tests/v2/attribution-consent.test.ts tests/v2/attribution-integration.test.ts tests/v2/attribution-primitive.test.ts tests/v2/attribution-primitive-integration.test.ts tests/v2/build-b-fractional-weights.test.ts tests/v2/build-b-cross-language.test.ts tests/v2/build-c-settlement.test.ts tests/v2/build-c-cross-language.test.ts tests/v2/build-c-end-to-end.test.ts tests/v2/provisional-statement.test.ts tests/temporal-decay.test.ts tests/confidence-breakdown.test.ts tests/behavioral-fingerprint.test.ts tests/session-boundary.test.ts tests/probe-identity.test.ts tests/v2/cognitive-attestation/envelope.test.ts tests/v2/cognitive-attestation/verify.test.ts tests/v2/cognitive-attestation/adversarial.test.ts tests/v2/mutual-auth/handshake.test.ts tests/v2/mutual-auth/adversarial.test.ts tests/v2/mutual-auth/conformance.test.ts tests/property-bilateral-receipt.test.ts tests/v2/instruction-provenance/conformance.test.ts tests/v2/instruction-provenance/adversarial.test.ts tests/v2/identity-composition-error.test.ts tests/v2/claim-evidence-types.test.ts tests/v2/claim-verifier.test.ts tests/v2/downstream-taint.test.ts tests/v2/payment-rails/nano.test.ts tests/v2/payment-rails/governance.test.ts tests/v2/payment-rails/ap2.test.ts tests/v2/payment-rails/x402.test.ts tests/v2/payment-rails/conformance/harness.test.ts tests/v2/payment-rails/binding-harness.test.ts tests/v2/payment-rails/stripe-issuing-primitives.test.ts tests/v2/payment-rails/acp.test.ts tests/v2/payment-rails/cycles.test.ts tests/v2/payment-rails/mpp.test.ts tests/v2/payment-rails/scope-resolution.test.ts tests/v2/payment-rails/accountability-bundle.test.ts tests/v2/payment-rails/did-uri-signing.test.ts tests/v2/payment-rails/cross-receipt-chain.test.ts src/v2/accountability/__tests__/action.test.ts src/v2/accountability/__tests__/authority-boundary.test.ts src/v2/accountability/__tests__/bundle.test.ts src/v2/accountability/__tests__/contestability.test.ts src/v2/accountability/__tests__/custody.test.ts src/v2/accountability/__tests__/fixtures.test.ts src/v2/cognitive_attestation/__tests__/cognitive_attestation.test.ts src/v2/delegation/__tests__/responsibility_anchor.test.ts src/v2/memory_provenance/__tests__/memory_provenance.test.ts src/v2/cross_issuer_attestation/__tests__/cross_issuer_attestation.test.ts src/v2/behavioral_drift_window/__tests__/behavioral_drift_window.test.ts tests/tool-registry-integrity.test.ts tests/v2/transport/rfc9421/request-binding.test.ts tests/v2/verifier-hardening.test.ts tests/v2/key-resolution/resolver.test.ts src/v2/feasibility/__tests__/feasibility.test.ts tests/oauth-rfc8693-bridge.test.ts tests/conformance/conformance-negatives.test.ts tests/v2/policy-bundle/policy-bundle.test.ts src/v2/scope-registry/__tests__/scope-registry.test.ts tests/check-many-parity.test.ts tests/cross-impl/jcs-equivalence.test.ts tests/remote-signer.test.ts tests/v2/assurance/descriptor.test.ts tests/v2/audience-binding/audience-binding.test.ts tests/v2/hash-pointer/bbs-composition.test.ts tests/v2/hash-pointer/profile.test.ts tests/v2/human-oversight/human-oversight.test.ts tests/v2/offline-verifier/conformance-runner.test.ts tests/v2/offline-verifier/middleware.test.ts tests/v2/offline-verifier/verify.test.ts tests/v2/payment-rails/cycles-evidence-resolution.test.ts tests/v2/payment-rails/cycles-evidence-authority.test.ts tests/v2/revocation-enforcement.test.ts tests/v2/trust-policy/trust-policy.test.ts src/v2/context-provenance/__tests__/roundtrip.test.ts src/v2/context-provenance/__tests__/disclosure.test.ts src/v2/context-provenance/__tests__/known-answer.test.ts src/v2/context-provenance/__tests__/conformance.test.ts src/v2/context-provenance/__tests__/adversarial.test.ts src/v2/context-provenance/__tests__/parity.test.ts src/v2/context-provenance/__tests__/cross-lang-parity.test.ts tests/v2/verification-source.test.ts tests/v2/producer-attestation.test.ts tests/delegation-currency-narrowing.test.ts tests/delegation-temporal-narrowing.test.ts tests/oauth-id-jag-bridge.test.ts tests/v2/regulated-action/conformance.test.ts tests/commerce-spend-accumulation.test.ts tests/delegation-spend-unit-narrowing.test.ts tests/delegation-parent-verify.test.ts tests/commerce-currency-gate.test.ts tests/v2/composition-check/conformance.test.ts src/v2/word_handles/__tests__/word_handles.test.ts src/v2/read_fidelity_receipt/__tests__/read_fidelity_receipt.test.ts tests/jurisdiction-selection.test.ts tests/v2/bilateral-pair/bilateral-pair.test.ts tests/evidence-bundle.test.ts tests/v2/verifier-null-guards.test.ts tests/merkle-domain-separation.test.ts tests/threshold-verify-before-count.test.ts",
     "test:interop": "npx tsx --test tests/interop/ietf-envelope.test.ts tests/interop/signet-combined.test.ts tests/interop/moltrust-attestation.test.ts tests/interop/cross-protocol-vectors.test.ts tests/interop/receipt-chaining.test.ts",
     "test:quick": "tsx --test tests/passport.test.ts",
     "test:fixtures": "tsx fixtures/bilateral-delegation/test-canonicalize.ts",