agent-passport-system 3.3.1 → 4.0.0

package/dist/src/v2/accountability/verify/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/bundle.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,2BAA2B;AAC3B,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAe/D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;IAC/F,IAAI,OAAO,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IACvE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/bundle.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,2BAA2B;AAC3B,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AACrD,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAe/D,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;IAC/F,IAAI,OAAO,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IACvE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/src/v2/accountability/verify/contestability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contestability.d.ts","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/contestability.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,qBAAqB,EAKtB,MAAM,4BAA4B,CAAA;AAEnC,MAAM,MAAM,iCAAiC,GACzC,oBAAoB,GACpB,6BAA6B,GAC7B,wBAAwB,GACxB,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,GACrB,mBAAmB,GACnB,8BAA8B,CAAA;AAElC,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,iCAAiC,CAAA;CAC3C;AAsCD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,qBAAqB,GAC7B,iCAAiC,CAsEnC"}
+{"version":3,"file":"contestability.d.ts","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/contestability.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EAKtB,MAAM,4BAA4B,CAAA;AAEnC,MAAM,MAAM,iCAAiC,GACzC,oBAAoB,GACpB,6BAA6B,GAC7B,wBAAwB,GACxB,gBAAgB,GAChB,wBAAwB,GACxB,qBAAqB,GACrB,mBAAmB,GACnB,8BAA8B,CAAA;AAElC,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,iCAAiC,CAAA;CAC3C;AAsCD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,qBAAqB,GAC7B,iCAAiC,CA2EnC"}

package/dist/src/v2/accountability/verify/contestability.js

@@ -15,6 +15,7 @@
 // ══════════════════════════════════════════════════════════════════
 import { createHash } from 'node:crypto';
 import { canonicalizeJCS } from '../../../core/canonical-jcs.js';
+import { isRecord } from '../../../core/is-record.js';
 import { verify } from '../../../crypto/keys.js';
 const VALID_STANDING = [
     'data_subject',
@@ -49,6 +50,11 @@ function withoutControllerResponse(receipt) {
     return rest;
 }
 export function verifyContestabilityReceipt(receipt) {
+    // Null / undefined / non-object rejects as a wrong claim type rather than
+    // throwing on the property access below.
+    if (!isRecord(receipt)) {
+        return { valid: false, reason: 'INVALID_CLAIM_TYPE' };
+    }
     if (receipt.claim_type !== 'aps:contestability:v1') {
         return { valid: false, reason: 'INVALID_CLAIM_TYPE' };
     }

package/dist/src/v2/accountability/verify/contestability.js.map

@@ -1 +1 @@
-{"version":3,"file":"contestability.js","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/contestability.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,uCAAuC;AACvC,qEAAqE;AACrE,iBAAiB;AACjB,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,8DAA8D;AAC9D,8EAA8E;AAC9E,qFAAqF;AACrF,+EAA+E;AAC/E,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAwBhD,MAAM,cAAc,GAA6B;IAC/C,cAAc;IACd,aAAa;IACb,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,SAAS;IACT,WAAW;CACZ,CAAA;AAED,MAAM,YAAY,GAA+B;IAC/C,UAAU;IACV,QAAQ;IACR,aAAa;IACb,cAAc;IACd,SAAS;IACT,cAAc;CACf,CAAA;AAED,MAAM,YAAY,GAA6B;IAC7C,OAAO;IACP,cAAc;IACd,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,WAAW;CACZ,CAAA;AAED;4BAC4B;AAC5B,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAC1D,OAAO,IAA6B,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAA8B;IAE9B,IAAI,OAAO,CAAC,UAAU,KAAK,uBAAuB,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,CAAA;IACvE,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;QAC/C,OAAO,CAAC,UAAU,CAAC,cAAc,KAAK,EAAE,CAAA;IAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;IAChE,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IACnD,CAAC;IACD,IACE,OAAO,CAAC,mBAAmB,KAAK,SAAS;QACzC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAC1D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAC3D,CAAC;IAED,qEAAqE;IACrE,qCAAqC;IACrC,MAAM,WAAW,GAAG,yBAAyB,CAAC;QAC5C,GAAG,OAAO;QACV,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;KACd,CAAC,CAAA;IACF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3C,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;SAC5C,MAAM,CAAC,KAAK,CAAC,CAAA;IAChB,IAAI,OAAO,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,gEAAgE;IAChE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACxF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;IAED,oDAAoD;IACpD,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAqC;YAClD,GAAG,OAAO,CAAC,mBAAmB;YAC9B,kBAAkB,EAAE,EAAE;SACvB,CAAA;QACD,MAAM,SAAS,GAA0B;YACvC,GAAG,OAAO;YACV,mBAAmB,EAAE,SAAS;SAC/B,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,CACnB,eAAe,CAAC,SAAS,CAAC,EAC1B,OAAO,CAAC,mBAAmB,CAAC,kBAAkB,EAC9C,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAC1C,CAAA;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;QACjE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"contestability.js","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/contestability.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,uCAAuC;AACvC,qEAAqE;AACrE,iBAAiB;AACjB,4EAA4E;AAC5E,gFAAgF;AAChF,8DAA8D;AAC9D,8DAA8D;AAC9D,8EAA8E;AAC9E,qFAAqF;AACrF,+EAA+E;AAC/E,sEAAsE;AACtE,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAwBhD,MAAM,cAAc,GAA6B;IAC/C,cAAc;IACd,aAAa;IACb,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,SAAS;IACT,WAAW;CACZ,CAAA;AAED,MAAM,YAAY,GAA+B;IAC/C,UAAU;IACV,QAAQ;IACR,aAAa;IACb,cAAc;IACd,SAAS;IACT,cAAc;CACf,CAAA;AAED,MAAM,YAAY,GAA6B;IAC7C,OAAO;IACP,cAAc;IACd,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,WAAW;CACZ,CAAA;AAED;4BAC4B;AAC5B,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAC1D,OAAO,IAA6B,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAA8B;IAE9B,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,uBAAuB,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,MAAM,MAAM,GACV,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,CAAA;IACvE,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;QAC/C,OAAO,CAAC,UAAU,CAAC,cAAc,KAAK,EAAE,CAAA;IAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;IAChE,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IACnD,CAAC;IACD,IACE,OAAO,CAAC,mBAAmB,KAAK,SAAS;QACzC,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAC1D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAC3D,CAAC;IAED,qEAAqE;IACrE,qCAAqC;IACrC,MAAM,WAAW,GAAG,yBAAyB,CAAC;QAC5C,GAAG,OAAO;QACV,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;KACd,CAAC,CAAA;IACF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3C,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;SAC5C,MAAM,CAAC,KAAK,CAAC,CAAA;IAChB,IAAI,OAAO,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,gEAAgE;IAChE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACxF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;IAED,oDAAoD;IACpD,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAqC;YAClD,GAAG,OAAO,CAAC,mBAAmB;YAC9B,kBAAkB,EAAE,EAAE;SACvB,CAAA;QACD,MAAM,SAAS,GAA0B;YACvC,GAAG,OAAO;YACV,mBAAmB,EAAE,SAAS;SAC/B,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,CACnB,eAAe,CAAC,SAAS,CAAC,EAC1B,OAAO,CAAC,mBAAmB,CAAC,kBAAkB,EAC9C,OAAO,CAAC,mBAAmB,CAAC,aAAa,CAC1C,CAAA;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;QACjE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/src/v2/accountability/verify/custody.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custody.d.ts","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/custody.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,qBAAqB,CAAA;AAE5B,MAAM,MAAM,0BAA0B,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,CAAA;AAEvB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,0BAA0B,CAAA;CACpC;AAuBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,0BAA0B,CA0BxF"}
+{"version":3,"file":"custody.d.ts","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/custody.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,qBAAqB,CAAA;AAE5B,MAAM,MAAM,0BAA0B,GAClC,oBAAoB,GACpB,oBAAoB,GACpB,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,CAAA;AAEvB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,0BAA0B,CAAA;CACpC;AAuBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,0BAA0B,CA+BxF"}

package/dist/src/v2/accountability/verify/custody.js

@@ -12,6 +12,7 @@
 // ══════════════════════════════════════════════════════════════════
 import { createHash } from 'node:crypto';
 import { canonicalizeJCS } from '../../../core/canonical-jcs.js';
+import { isRecord } from '../../../core/is-record.js';
 import { verify } from '../../../crypto/keys.js';
 const VALID_EVENT_TYPES = [
     'created',
@@ -33,6 +34,11 @@ const VALID_PURPOSES = [
     'incident_response',
 ];
 export function verifyCustodyReceipt(receipt) {
+    // Null / undefined / non-object rejects as a wrong claim type rather than
+    // throwing on the property access below.
+    if (!isRecord(receipt)) {
+        return { valid: false, reason: 'INVALID_CLAIM_TYPE' };
+    }
     if (receipt.claim_type !== 'aps:custody:v1') {
         return { valid: false, reason: 'INVALID_CLAIM_TYPE' };
     }

package/dist/src/v2/accountability/verify/custody.js.map

@@ -1 +1 @@
-{"version":3,"file":"custody.js","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/custody.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,gCAAgC;AAChC,qEAAqE;AACrE,sBAAsB;AACtB,8DAA8D;AAC9D,qEAAqE;AACrE,kEAAkE;AAClE,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAmBhD,MAAM,iBAAiB,GAAgC;IACrD,SAAS;IACT,QAAQ;IACR,aAAa;IACb,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,UAAU;CACX,CAAA;AAED,MAAM,cAAc,GAA8B;IAChD,gBAAgB;IAChB,sBAAsB;IACtB,gBAAgB;IAChB,sBAAsB;IACtB,gBAAgB;IAChB,UAAU;IACV,mBAAmB;CACpB,CAAA;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,IAAI,OAAO,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAmB,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAChF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3C,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAA;IAChB,IAAI,OAAO,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,WAAW,GAAmB,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IACjE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACtF,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"custody.js","sourceRoot":"","sources":["../../../../../src/v2/accountability/verify/custody.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,gCAAgC;AAChC,qEAAqE;AACrE,sBAAsB;AACtB,8DAA8D;AAC9D,qEAAqE;AACrE,kEAAkE;AAClE,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAmBhD,MAAM,iBAAiB,GAAgC;IACrD,SAAS;IACT,QAAQ;IACR,aAAa;IACb,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,UAAU;CACX,CAAA;AAED,MAAM,cAAc,GAA8B;IAChD,gBAAgB;IAChB,sBAAsB;IACtB,gBAAgB;IAChB,sBAAsB;IACtB,gBAAgB;IAChB,UAAU;IACV,mBAAmB;CACpB,CAAA;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAuB;IAC1D,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAmB,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAChF,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3C,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAA;IAChB,IAAI,OAAO,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,WAAW,GAAmB,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IACjE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACtF,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/src/v2/attribution-settlement/merkle.d.ts

@@ -1,9 +1,11 @@
 /** sha256(canonicalize(obj)) as raw 32 bytes. */
 export declare function leafHash(obj: unknown): Buffer;
 /** Build a balanced binary Merkle tree over arbitrary leaf hashes and
- *  return the root as raw bytes. Odd levels duplicate the trailing node
- *  (the standard fold convention). Throws on empty input — the caller is
- *  responsible for using the empty-axis convention in that case. */
+ *  return the root as raw bytes. Leaves and internal nodes are domain-
+ *  separated; an odd trailing node is promoted unchanged (never
+ *  duplicated) to avoid the CVE-2012-2459 duplicate-leaf collision.
+ *  Throws on empty input — the caller is responsible for using the
+ *  empty-axis convention in that case. */
 export declare function buildMerkleRoot(leaves: Buffer[]): Buffer;
 /** Returns the sibling hashes (bottom-up) required to reconstruct the
  *  root from `leaves[targetIndex]`. The returned hex strings are 32-byte

package/dist/src/v2/attribution-settlement/merkle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merkle.d.ts","sourceRoot":"","sources":["../../../../src/v2/attribution-settlement/merkle.ts"],"names":[],"mappings":"AAuBA,iDAAiD;AACjD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE7C;AAED;;;oEAGoE;AACpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAexD;AAED;;;;oDAIoD;AACpD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EAAE,EAChB,WAAW,EAAE,MAAM,GAClB,MAAM,EAAE,CA2BV;AAED;;+BAE+B;AAC/B,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EAAE,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAaT;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}
+{"version":3,"file":"merkle.d.ts","sourceRoot":"","sources":["../../../../src/v2/attribution-settlement/merkle.ts"],"names":[],"mappings":"AA6CA,iDAAiD;AACjD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE7C;AAED;;;;;0CAK0C;AAC1C,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAiBxD;AAED;;;;oDAIoD;AACpD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EAAE,EAChB,WAAW,EAAE,MAAM,GAClB,MAAM,EAAE,CAgCV;AAED;;+BAE+B;AAC/B,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EAAE,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAkBT;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/src/v2/attribution-settlement/merkle.js

@@ -8,36 +8,56 @@
 // The construction:
 //
 //   1. Compute leaf hashes over canonicalized contributor bodies.
-//   2. Adjacent-pair reduction: pair (2i, 2i+1) → hashNode(left, right).
-//   3. If a level has an odd number of nodes, the trailing node is
-//      duplicated (hashNode(node, node)) — common Bitcoin-style convention.
-//   4. Recurse until one root remains.
+//   2. Domain-separate: every leaf is re-hashed as sha256(0x00 || leaf)
+//      and every internal node as sha256(0x01 || left || right), so an
+//      internal node value can never be reinterpreted as a leaf.
+//   3. Adjacent-pair reduction: pair (2i, 2i+1) → internal(left, right).
+//   4. If a level has an odd number of nodes, the trailing node is
+//      promoted unchanged (NOT duplicated). Duplicating it would let a
+//      set like [a,b,c] collide with [a,b,c,c] and forge phantom-
+//      duplicate inclusion (CVE-2012-2459 class).
+//   5. Recurse until one root remains.
 //
 // The empty-axis convention (I-C5) uses sha256(canonicalize([])) as the
 // axis_merkle_root — handled by the caller.
 // ══════════════════════════════════════════════════════════════════
 import { createHash } from 'node:crypto';
 import { canonicalize } from '../../core/canonical.js';
-import { hashNode } from '../attribution-primitive/canonical.js';
+const LEAF_TAG = Buffer.from([0x00]);
+const NODE_TAG = Buffer.from([0x01]);
+/** Path token marking a level where the target was the lone odd node and
+ *  was promoted unchanged. It cannot collide with a 64-hex digest, so
+ *  {@link verifyMerklePath} disambiguates promotion from a real sibling. */
+const PROMOTED_LEVEL = 'promoted';
+/** Domain-separated leaf hash: sha256(0x00 || leaf). */
+function hashLeafNode(leaf) {
+    return createHash('sha256').update(Buffer.concat([LEAF_TAG, leaf])).digest();
+}
+/** Domain-separated internal node: sha256(0x01 || left || right). */
+function hashInternalNode(left, right) {
+    return createHash('sha256').update(Buffer.concat([NODE_TAG, left, right])).digest();
+}
 /** sha256(canonicalize(obj)) as raw 32 bytes. */
 export function leafHash(obj) {
     return createHash('sha256').update(canonicalize(obj)).digest();
 }
 /** Build a balanced binary Merkle tree over arbitrary leaf hashes and
- *  return the root as raw bytes. Odd levels duplicate the trailing node
- *  (the standard fold convention). Throws on empty input — the caller is
- *  responsible for using the empty-axis convention in that case. */
+ *  return the root as raw bytes. Leaves and internal nodes are domain-
+ *  separated; an odd trailing node is promoted unchanged (never
+ *  duplicated) to avoid the CVE-2012-2459 duplicate-leaf collision.
+ *  Throws on empty input — the caller is responsible for using the
+ *  empty-axis convention in that case. */
 export function buildMerkleRoot(leaves) {
     if (leaves.length === 0) {
         throw new Error('attribution-settlement: buildMerkleRoot requires at least one leaf');
     }
-    let level = leaves.slice();
+    let level = leaves.map(hashLeafNode);
     while (level.length > 1) {
         const next = [];
         for (let i = 0; i < level.length; i += 2) {
-            const left = level[i];
-            const right = i + 1 < level.length ? level[i + 1] : level[i];
-            next.push(hashNode(left, right));
+            next.push(i + 1 < level.length
+                ? hashInternalNode(level[i], level[i + 1])
+                : level[i]);
         }
         level = next;
     }
@@ -56,18 +76,21 @@ export function buildContributorMerklePath(leaves, targetIndex) {
         throw new Error(`attribution-settlement: targetIndex ${targetIndex} out of range for ${leaves.length} leaves`);
     }
     const path = [];
-    let level = leaves.slice();
+    let level = leaves.map(hashLeafNode);
     let idx = targetIndex;
     while (level.length > 1) {
         const isRight = idx % 2 === 1;
         const siblingIdx = isRight ? idx - 1 : idx + 1;
-        const sibling = siblingIdx < level.length ? level[siblingIdx] : level[idx];
-        path.push(sibling.toString('hex'));
+        // Exactly one entry per level keeps the verifier's index arithmetic in
+        // sync. When the target is the lone odd node it has no sibling and is
+        // promoted unchanged, recorded as PROMOTED_LEVEL rather than a self-
+        // duplicate (which would reintroduce the collision).
+        path.push(siblingIdx < level.length ? level[siblingIdx].toString('hex') : PROMOTED_LEVEL);
         const next = [];
         for (let i = 0; i < level.length; i += 2) {
-            const left = level[i];
-            const right = i + 1 < level.length ? level[i + 1] : level[i];
-            next.push(hashNode(left, right));
+            next.push(i + 1 < level.length
+                ? hashInternalNode(level[i], level[i + 1])
+                : level[i]);
         }
         level = next;
         idx = Math.floor(idx / 2);
@@ -80,16 +103,21 @@ export function buildContributorMerklePath(leaves, targetIndex) {
 export function verifyMerklePath(leaf, leafIndex, path, expectedRootHex) {
     if (leafIndex < 0)
         return false;
-    let acc = leaf;
+    let acc = hashLeafNode(leaf);
     let idx = leafIndex;
     for (const siblingHex of path) {
+        if (siblingHex === PROMOTED_LEVEL) {
+            // Lone odd node promoted unchanged: nothing to combine at this level.
+            idx = Math.floor(idx / 2);
+            continue;
+        }
         if (typeof siblingHex !== 'string' || !/^[0-9a-f]{64}$/i.test(siblingHex))
             return false;
         const sibling = Buffer.from(siblingHex, 'hex');
         if (sibling.length !== 32)
             return false;
         const isRight = idx % 2 === 1;
-        acc = isRight ? hashNode(sibling, acc) : hashNode(acc, sibling);
+        acc = isRight ? hashInternalNode(sibling, acc) : hashInternalNode(acc, sibling);
         idx = Math.floor(idx / 2);
     }
     return acc.toString('hex') === expectedRootHex.toLowerCase();

package/dist/src/v2/attribution-settlement/merkle.js.map

@@ -1 +1 @@
-{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../../../src/v2/attribution-settlement/merkle.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,oBAAoB;AACpB,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,mEAAmE;AACnE,4EAA4E;AAC5E,uCAAuC;AACvC,EAAE;AACF,wEAAwE;AACxE,4CAA4C;AAC5C,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAA;AAEhE,iDAAiD;AACjD,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AAChE,CAAC;AAED;;;oEAGoE;AACpE,MAAM,UAAU,eAAe,CAAC,MAAgB;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;IAC1B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC5D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,GAAG,IAAI,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED;;;;oDAIoD;AACpD,MAAM,UAAU,0BAA0B,CACxC,MAAgB,EAChB,WAAmB;IAEnB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,uCAAuC,WAAW,qBAAqB,MAAM,CAAC,MAAM,SAAS,CAC9F,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;IAC1B,IAAI,GAAG,GAAG,WAAW,CAAA;IACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAClC,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC5D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,GAAG,IAAI,CAAA;QACZ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;+BAE+B;AAC/B,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,SAAiB,EACjB,IAAc,EACd,eAAuB;IAEvB,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/B,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,IAAI,GAAG,GAAG,SAAS,CAAA;IACnB,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAA;QACvF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;QACvC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/D,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,WAAW,EAAE,CAAA;AAC9D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC"}
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../../../src/v2/attribution-settlement/merkle.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,oBAAoB;AACpB,EAAE;AACF,kEAAkE;AAClE,wEAAwE;AACxE,uEAAuE;AACvE,iEAAiE;AACjE,yEAAyE;AACzE,mEAAmE;AACnE,uEAAuE;AACvE,kEAAkE;AAClE,kDAAkD;AAClD,uCAAuC;AACvC,EAAE;AACF,wEAAwE;AACxE,4CAA4C;AAC5C,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAEtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AAEpC;;4EAE4E;AAC5E,MAAM,cAAc,GAAG,UAAU,CAAA;AAEjC,wDAAwD;AACxD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AAC9E,CAAC;AAED,qEAAqE;AACrE,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACrF,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AAChE,CAAC;AAED;;;;;0CAK0C;AAC1C,MAAM,UAAU,eAAe,CAAC,MAAgB;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CACP,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;gBAClB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACb,CAAA;QACH,CAAC;QACD,KAAK,GAAG,IAAI,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED;;;;oDAIoD;AACpD,MAAM,UAAU,0BAA0B,CACxC,MAAgB,EAChB,WAAmB;IAEnB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,uCAAuC,WAAW,qBAAqB,MAAM,CAAC,MAAM,SAAS,CAC9F,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACpC,IAAI,GAAG,GAAG,WAAW,CAAA;IACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;QAC9C,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;QACzF,MAAM,IAAI,GAAa,EAAE,CAAA;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CACP,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;gBAClB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CACb,CAAA;QACH,CAAC;QACD,KAAK,GAAG,IAAI,CAAA;QACZ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;+BAE+B;AAC/B,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,SAAiB,EACjB,IAAc,EACd,eAAuB;IAEvB,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/B,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,GAAG,GAAG,SAAS,CAAA;IACnB,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;YAClC,sEAAsE;YACtE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;YACzB,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAA;QACvF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;QACvC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/E,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,WAAW,EAAE,CAAA;AAC9D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC"}

package/dist/src/v2/offline-verifier/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AAMtE,MAAM,MAAM,YAAY,GAEpB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GAEnB,oBAAoB,GACpB,oBAAoB,GACpB,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,UAAU,GACV,aAAa,GACb,qBAAqB,CAAA;AAEzB;;8DAE8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,SAAS,YAAY,EAIvD,CAAA;AAID,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,sBAAsB,EAAE,MAAM,CAAA;IAC9B,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAA;IAC7B,sDAAsD;IACtD,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,0CAA0C;IAC1C,iBAAiB,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wDAAwD;IACxD,sBAAsB,EAAE,MAAM,CAAA;IAC9B,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,wBAAwB,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAA;IAC/B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,GAClB,mBAAmB,CAoDrB"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AAMtE,MAAM,MAAM,YAAY,GAEpB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GAEnB,oBAAoB,GACpB,oBAAoB,GACpB,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,UAAU,GACV,aAAa,GACb,qBAAqB,CAAA;AAEzB;;8DAE8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,SAAS,YAAY,EAIvD,CAAA;AAID,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,sBAAsB,EAAE,MAAM,CAAA;IAC9B,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAA;IAC7B,sDAAsD;IACtD,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,0CAA0C;IAC1C,iBAAiB,EAAE,MAAM,CAAA;IACzB,sEAAsE;IACtE,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wDAAwD;IACxD,sBAAsB,EAAE,MAAM,CAAA;IAC9B,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,wBAAwB,EAAE,MAAM,CAAA;IAChC,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,2DAA2D;IAC3D,uBAAuB,EAAE,MAAM,CAAA;IAC/B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,cAAc,GAClB,mBAAmB,CAyDrB"}

package/dist/src/v2/offline-verifier/context.js

@@ -34,6 +34,7 @@
 //     receipt is a signed declaration, not a causal proof.
 // ══════════════════════════════════════════════════════════════════
 import { verifyActionReceipt } from '../accountability/verify/action.js';
+import { isRecord } from '../../core/is-record.js';
 /** The closed set of crypto-layer reasons, for callers that want to
  *  branch on which layer surfaced a rejection without re-running the
  *  verifier. Mirrors {@link RejectReason}'s crypto subset. */
@@ -53,6 +54,11 @@ export const CRYPTO_LAYER_REASONS = [
  * {@link ReceiptContext}.
  */
 export function verifyReceiptContext(receipt, ctx) {
+    // Null / undefined / non-object rejects at the crypto layer rather than
+    // throwing on a downstream property access.
+    if (!isRecord(receipt)) {
+        return { valid: false, reason: 'INVALID_CLAIM_TYPE' };
+    }
     const crypto = verifyActionReceipt(receipt);
     if (!crypto.valid) {
         return { valid: false, reason: crypto.reason };

package/dist/src/v2/offline-verifier/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,iDAAiD;AACjD,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,qDAAqD;AACrD,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,8BAA8B;AAC9B,gEAAgE;AAChE,iEAAiE;AACjE,kDAAkD;AAClD,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,2DAA2D;AAC3D,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAsBxE;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAA4B;IAC3D,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;CACpB,CAAA;AAmCD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,GAAmB;IAEnB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAsB,EAAE,CAAA;IAChE,CAAC;IAED,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,GAAG,CAAC,uBAAuB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,8DAA8D;IAC9D,IAAI,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,GAAG,CAAC,wBAAwB,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACjD,CAAC;IAED,mEAAmE;IACnE,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC7C,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/context.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,iDAAiD;AACjD,qEAAqE;AACrE,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,qDAAqD;AACrD,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,EAAE;AACF,8BAA8B;AAC9B,gEAAgE;AAChE,iEAAiE;AACjE,kDAAkD;AAClD,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,2DAA2D;AAC3D,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAsBlD;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAA4B;IAC3D,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;CACpB,CAAA;AAmCD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,GAAmB;IAEnB,wEAAwE;IACxE,4CAA4C;IAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAsB,EAAE,CAAA;IAChE,CAAC;IAED,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,GAAG,CAAC,uBAAuB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,GAAG,CAAC,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IAED,8DAA8D;IAC9D,IAAI,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IAED,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,GAAG,CAAC,wBAAwB,GAAG,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IACjD,CAAC;IAED,mEAAmE;IACnE,IAAI,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC7C,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACxD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/src/v2/offline-verifier/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC;mEACmE;AACnE,MAAM,WAAW,uBAAuB;IACtC;;;8DAG0D;IAC1D,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC/B,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,sBAAsB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAA;IACpC,sDAAsD;IACtD,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtC;AAED;2CAC2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC;;sEAEkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,uBAAuB,CAAA;CACrC;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEtD,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,OAAO,CAAA;IACpB,0EAA0E;IAC1E,cAAc,EAAE,OAAO,CAAA;IACvB;mBACe;IACf,YAAY,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,kDAAkD;IAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IACtC;;uEAEmE;IACnE,UAAU,EAAE,kBAAkB,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,oBAAyB,GAC9B,mBAAmB,CA2ErB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAA;AAErB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC;mEACmE;AACnE,MAAM,WAAW,uBAAuB;IACtC;;;8DAG0D;IAC1D,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC/B,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,sBAAsB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAA;IACpC,sDAAsD;IACtD,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtC;AAED;2CAC2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC;;sEAEkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,uBAAuB,CAAA;CACrC;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEtD,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,OAAO,CAAA;IACpB,0EAA0E;IAC1E,cAAc,EAAE,OAAO,CAAA;IACvB;mBACe;IACf,YAAY,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,kDAAkD;IAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IACtC;;uEAEmE;IACnE,UAAU,EAAE,kBAAkB,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,oBAAyB,GAC9B,mBAAmB,CAkGrB"}

package/dist/src/v2/offline-verifier/verify.js

@@ -41,6 +41,7 @@
 //     the underlying outcome. A receipt is a signed declaration.
 // ══════════════════════════════════════════════════════════════════
 import { verifyActionReceipt } from '../accountability/verify/action.js';
+import { isRecord } from '../../core/is-record.js';
 import { verifyReceiptContext, } from './context.js';
 import { buildDescriptor } from './descriptor.js';
 /**
@@ -57,6 +58,28 @@ import { buildDescriptor } from './descriptor.js';
  * read beyond what the caller supplies in {@link ReceiptContext}.
  */
 export function verifyOffline(receipt, opts = {}) {
+    // ── 0. input guard ──
+    // Null / undefined / non-object (attacker-deliverable JSON `null`) rejects
+    // at the crypto layer rather than throwing on the receipt.signer_did access
+    // used to seed the descriptor below. The descriptor is still emitted so a
+    // relying party always gets a mechanical-facts view, even on this rejection.
+    if (!isRecord(receipt)) {
+        const descriptor = buildDescriptor({
+            receiptId: '',
+            signatures: [
+                { signerId: '', role: 'action_signer', claim: 'outcome', valid: false },
+            ],
+        });
+        return {
+            verdict: 'reject',
+            cryptoValid: false,
+            contextChecked: false,
+            contextValid: false,
+            reason: 'INVALID_CLAIM_TYPE',
+            rejectedAtLayer: 'crypto',
+            descriptor,
+        };
+    }
     // ── 1. crypto layer ──
     const crypto = verifyActionReceipt(receipt);
     const cryptoValid = crypto.valid;

package/dist/src/v2/offline-verifier/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,+DAA+D;AAC/D,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,yEAAyE;AACzE,qEAAqE;AACrE,wDAAwD;AACxD,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,wBAAwB;AACxB,EAAE;AACF,8BAA8B;AAC9B,sEAAsE;AACtE,kEAAkE;AAClE,0EAA0E;AAC1E,qEAAqE;AACrE,8BAA8B;AAC9B,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,iEAAiE;AACjE,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAGxE,OAAO,EACL,oBAAoB,GAGrB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAwDjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsB,EACtB,IAAI,GAAyB,EAAE;IAE/B,wBAAwB;IACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAA;IAEhC,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,aAAa,GAAqB;QACtC,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,WAAW;KACnB,CAAA;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,IAAI,EAAE,CAAA;IACzD,MAAM,UAAU,GAAuB,CAAC,aAAa,EAAE,GAAG,eAAe,CAAC,CAAA;IAE1E,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,UAAU;QACV,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB;QACzD,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB;QACnD,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW;KAC1C,CAAC,CAAA;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAsB;YACrC,eAAe,EAAE,QAAQ;YACzB,UAAU;SACX,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,oEAAoE;QACpE,qEAAqE;QACrE,gCAAgC;QAChC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,UAAU;SACX,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,eAAe,EAAE,SAAS;YAC1B,UAAU;SACX,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,IAAI;QAClB,UAAU;KACX,CAAA;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/offline-verifier/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,8DAA8D;AAC9D,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,+DAA+D;AAC/D,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,yEAAyE;AACzE,qEAAqE;AACrE,wDAAwD;AACxD,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,wBAAwB;AACxB,EAAE;AACF,8BAA8B;AAC9B,sEAAsE;AACtE,kEAAkE;AAClE,0EAA0E;AAC1E,qEAAqE;AACrE,8BAA8B;AAC9B,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,iEAAiE;AACjE,qEAAqE;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAGlD,OAAO,EACL,oBAAoB,GAGrB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAwDjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsB,EACtB,IAAI,GAAyB,EAAE;IAE/B,uBAAuB;IACvB,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,SAAS,EAAE,EAAE;YACb,UAAU,EAAE;gBACV,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE;aACxE;SACF,CAAC,CAAA;QACF,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,oBAAoB;YAC5B,eAAe,EAAE,QAAQ;YACzB,UAAU;SACX,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAA;IAEhC,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,aAAa,GAAqB;QACtC,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,WAAW;KACnB,CAAA;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,IAAI,EAAE,CAAA;IACzD,MAAM,UAAU,GAAuB,CAAC,aAAa,EAAE,GAAG,eAAe,CAAC,CAAA;IAE1E,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,UAAU;QACV,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB;QACzD,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB;QACnD,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW;KAC1C,CAAC,CAAA;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAsB;YACrC,eAAe,EAAE,QAAQ;YACzB,UAAU;SACX,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,oEAAoE;QACpE,qEAAqE;QACrE,gCAAgC;QAChC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,UAAU;SACX,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,eAAe,EAAE,SAAS;YAC1B,UAAU;SACX,CAAA;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,IAAI;QAClB,UAAU;KACX,CAAA;AACH,CAAC"}

package/dist/src/verification/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAIhE;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE;IACL,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;0EAIsE;IACtE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B,GACA,kBAAkB,CAiGpB;AAED,wBAAgB,eAAe,CAAC,gBAAgB,SAAM,GAAG,SAAS,CAOjE;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAKT"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAIhE;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE;IACL,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;;;0EAIsE;IACtE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B,GACA,kBAAkB,CAwGpB;AAED,wBAAgB,eAAe,CAAC,gBAAgB,SAAM,GAAG,SAAS,CAOjE;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAKT"}

package/dist/src/verification/verify.js

@@ -3,6 +3,7 @@
 // Passport Verification — validate signatures and integrity
 import { verify } from '../crypto/keys.js';
 import { canonicalize } from '../core/canonical.js';
+import { isRecord } from '../core/is-record.js';
 import { isExpired } from '../core/passport.js';
 import { randomBytes } from 'node:crypto';
 import { v4 as uuidv4 } from 'uuid';
@@ -15,6 +16,12 @@ import { v4 as uuidv4 } from 'uuid';
 export function verifyPassport(signed, opts) {
     const errors = [];
     const warnings = [];
+    // Null / undefined / non-object (attacker-deliverable JSON `null`) rejects
+    // with the missing-fields verdict rather than throwing on the property
+    // access below.
+    if (!isRecord(signed)) {
+        return { valid: false, errors: ['Missing passport or signature'], warnings };
+    }
     // Check required fields
     if (!signed.passport || !signed.signature) {
         return { valid: false, errors: ['Missing passport or signature'], warnings };

package/dist/src/verification/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,4DAA4D;AAE5D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,IAQC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IAEtC,iCAAiC;IACjC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACzE,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAI,MAAc,CAAC,eAAe,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAA;QACrE,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,CAAA;QAChG,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,MAAM,aAAa,GAAG,YAAY,CAAC;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAG,MAAc,CAAC,QAAQ;aACnC,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,eAAe,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,IAAI,EAAE,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,6BAA6B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACrD,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3C,CAAC;IAED,oBAAoB;IACpB,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,cAAc,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW;YAC/C,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,4BAA4B,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,gBAAgB,GAAG,GAAG;IACpD,OAAO;QACL,WAAW,EAAE,MAAM,EAAE;QACrB,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,YAAoB,EACpB,YAAoB;IAEpB,eAAe;IACf,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5D,kCAAkC;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;AAC5D,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/verification/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,4DAA4D;AAE5D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAA;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,IAQC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,2EAA2E;IAC3E,uEAAuE;IACvE,gBAAgB;IAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC9E,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IAEtC,iCAAiC;IACjC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACzE,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAI,MAAc,CAAC,eAAe,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAA;QACrE,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,UAAU,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,CAAA;QAChG,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,MAAM,aAAa,GAAG,YAAY,CAAC;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAG,MAAc,CAAC,QAAQ;aACnC,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,eAAe,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAA;IAClF,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,IAAI,EAAE,KAAK,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,6BAA6B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACrD,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3C,CAAC;IAED,oBAAoB;IACpB,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,cAAc,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW;YAC/C,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,WAAW,4BAA4B,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;QACR,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,gBAAgB,GAAG,GAAG;IACpD,OAAO;QACL,WAAW,EAAE,MAAM,EAAE;QACrB,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACxE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,YAAoB,EACpB,YAAoB;IAEpB,eAAe;IACf,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5D,kCAAkC;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;AAC5D,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-passport-system",
-  "version": "3.3.1",
-  "description": "Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Verifier hot path p50 = 420ns bare-metal Linux EPYC 7313P (§13.1 canonical environment per spec), 347ns AWS c7i.2xlarge, 292ns Mac M3. Gateway enforcement, monotonic narrowing, cascade revocation, Bayesian reputation, wallet binding, unified four-axis attribution primitive, per-period attribution settlement, data lifecycle, mutual authentication, Wave 1 accountability primitives (action, authority-boundary, custody, contestability, bundle), evidentiary type safety (claim/evidence registry, claim verifier with forbidden-substitution detection, contestation cascade). 4,097 tests.",
+  "version": "4.0.0",
+  "description": "Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Verifier hot path p50 = 420ns bare-metal Linux EPYC 7313P (§13.1 canonical environment per spec), 347ns AWS c7i.2xlarge, 292ns Mac M3. Gateway enforcement, monotonic narrowing, cascade revocation, Bayesian reputation, wallet binding, unified four-axis attribution primitive, per-period attribution settlement, data lifecycle, mutual authentication, Wave 1 accountability primitives (action, authority-boundary, custody, contestability, bundle), evidentiary type safety (claim/evidence registry, claim verifier with forbidden-substitution detection, contestation cascade). 4,098 tests.",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -20,7 +20,7 @@
   },
   "scripts": {
     "build": "tsc && chmod +x dist/src/cli/index.js",
-    "test": "npx tsx --test tests/passport.test.ts tests/adversarial.ts tests/v2.0-integration.ts tests/contract.test.ts tests/agora.test.ts tests/values.test.ts tests/delegation.test.ts tests/attribution.test.ts tests/policy.test.ts tests/canonical.test.ts tests/coordination.test.ts tests/commerce.test.ts tests/enforcement.test.ts tests/routing.test.ts tests/did-vc.test.ts tests/a2a.test.ts tests/principal.test.ts tests/adversarial-paper.test.ts tests/property-delegation.test.ts tests/property-canonical.test.ts tests/intent.test.ts tests/reputation-authority.test.ts tests/cross-chain.test.ts tests/encrypted-messaging.test.ts tests/obligations.test.ts tests/execution-envelope.test.ts tests/adversarial-causal-chain.test.ts tests/governance.test.ts tests/feasibility.test.ts tests/identity.test.ts tests/precedent.test.ts tests/reanchor.test.ts tests/escalation.test.ts tests/oracle-witness.test.ts tests/messaging-audit.test.ts tests/policy-conflict.test.ts tests/data-source.test.ts tests/decision-semantics.test.ts tests/interop-vectors.test.ts tests/v2-bridge.test.ts tests/v2-full.test.ts tests/key-storage.test.ts tests/qntm-bridge.test.ts tests/agent-json-bridge.test.ts tests/did-resolution-conformance.test.ts tests/decision-equivalence.test.ts tests/data-lifecycle.test.ts tests/campaign7-composition.test.ts tests/entity-verification.test.ts tests/conformance.test.ts tests/governance-block.test.ts tests/aps-txt.test.ts tests/governance-360.test.ts tests/storage-backend.test.ts tests/receipt-bundle.test.ts tests/reputation-confidence.test.ts tests/governance-consumer.test.ts tests/charter.test.ts tests/institutional-governance-phase2.test.ts tests/data-source-attribution.test.ts tests/canonical-jcs.test.ts tests/temporal-spread.test.ts tests/fidelity-pressure.test.ts tests/denial-domains.test.ts tests/data-narrowing.test.ts tests/governance-posture.test.ts tests/anchor-state.test.ts tests/issuer-signature.test.ts tests/openshell-adapter.test.ts tests/attestation.test.ts tests/execution-attestation.test.ts tests/bilateral-receipt.test.ts tests/proof-namespace.test.ts tests/ecosystem-features.test.ts tests/persistent-passport.test.ts tests/security-av.test.ts tests/audit-fixes.test.ts tests/did-interop.test.ts tests/identity-bridge.test.ts tests/vc-wrapper.test.ts tests/identity-pipeline.test.ts tests/cross-protocol/sint-crossverify.test.ts tests/action-ref.test.ts tests/external-action-ref.test.ts tests/freshness.test.ts tests/evidence-grade.test.ts tests/key-rotation.test.ts tests/governance-regression.test.ts tests/posture-overlay.test.ts tests/feasibility-gateway.test.ts tests/trust-adapters.test.ts tests/evaluation-context.test.ts tests/health.test.ts tests/composio-adapter.test.ts tests/interop/ietf-envelope.test.ts tests/interop/signet-combined.test.ts tests/interop/moltrust-attestation.test.ts tests/interop/cross-protocol-vectors.test.ts tests/interop/receipt-chaining.test.ts tests/ibac-adapter.test.ts tests/langchain-adapter.test.ts tests/crewai-adapter.test.ts tests/mcp-adapter.test.ts tests/a2a-adapter.test.ts tests/gonka-adapter.test.ts tests/cross-algo-mismatch.test.ts tests/credential-lifecycle.test.ts tests/behavioral-memory.test.ts tests/telemetry-scope.test.ts tests/idempotency.test.ts tests/v2/wallet-binding.test.ts tests/v2/wallet-binding-fixture.test.ts tests/v2/credential-check-policy.test.ts tests/v2/delegation-escalation.test.ts tests/v2/attribution-consent.test.ts tests/v2/attribution-integration.test.ts tests/v2/attribution-primitive.test.ts tests/v2/attribution-primitive-integration.test.ts tests/v2/build-b-fractional-weights.test.ts tests/v2/build-b-cross-language.test.ts tests/v2/build-c-settlement.test.ts tests/v2/build-c-cross-language.test.ts tests/v2/build-c-end-to-end.test.ts tests/v2/provisional-statement.test.ts tests/temporal-decay.test.ts tests/confidence-breakdown.test.ts tests/behavioral-fingerprint.test.ts tests/session-boundary.test.ts tests/probe-identity.test.ts tests/v2/cognitive-attestation/envelope.test.ts tests/v2/cognitive-attestation/verify.test.ts tests/v2/cognitive-attestation/adversarial.test.ts tests/v2/mutual-auth/handshake.test.ts tests/v2/mutual-auth/adversarial.test.ts tests/v2/mutual-auth/conformance.test.ts tests/property-bilateral-receipt.test.ts tests/v2/instruction-provenance/conformance.test.ts tests/v2/instruction-provenance/adversarial.test.ts tests/v2/identity-composition-error.test.ts tests/v2/claim-evidence-types.test.ts tests/v2/claim-verifier.test.ts tests/v2/downstream-taint.test.ts tests/v2/payment-rails/nano.test.ts tests/v2/payment-rails/governance.test.ts tests/v2/payment-rails/ap2.test.ts tests/v2/payment-rails/x402.test.ts tests/v2/payment-rails/conformance/harness.test.ts tests/v2/payment-rails/binding-harness.test.ts tests/v2/payment-rails/stripe-issuing-primitives.test.ts tests/v2/payment-rails/acp.test.ts tests/v2/payment-rails/cycles.test.ts tests/v2/payment-rails/mpp.test.ts tests/v2/payment-rails/scope-resolution.test.ts tests/v2/payment-rails/accountability-bundle.test.ts tests/v2/payment-rails/did-uri-signing.test.ts tests/v2/payment-rails/cross-receipt-chain.test.ts src/v2/accountability/__tests__/action.test.ts src/v2/accountability/__tests__/authority-boundary.test.ts src/v2/accountability/__tests__/bundle.test.ts src/v2/accountability/__tests__/contestability.test.ts src/v2/accountability/__tests__/custody.test.ts src/v2/accountability/__tests__/fixtures.test.ts src/v2/cognitive_attestation/__tests__/cognitive_attestation.test.ts src/v2/delegation/__tests__/responsibility_anchor.test.ts src/v2/memory_provenance/__tests__/memory_provenance.test.ts src/v2/cross_issuer_attestation/__tests__/cross_issuer_attestation.test.ts src/v2/behavioral_drift_window/__tests__/behavioral_drift_window.test.ts tests/tool-registry-integrity.test.ts tests/v2/transport/rfc9421/request-binding.test.ts tests/v2/verifier-hardening.test.ts tests/v2/key-resolution/resolver.test.ts src/v2/feasibility/__tests__/feasibility.test.ts tests/oauth-rfc8693-bridge.test.ts tests/conformance/conformance-negatives.test.ts tests/v2/policy-bundle/policy-bundle.test.ts src/v2/scope-registry/__tests__/scope-registry.test.ts tests/check-many-parity.test.ts tests/cross-impl/jcs-equivalence.test.ts tests/remote-signer.test.ts tests/v2/assurance/descriptor.test.ts tests/v2/audience-binding/audience-binding.test.ts tests/v2/hash-pointer/bbs-composition.test.ts tests/v2/hash-pointer/profile.test.ts tests/v2/human-oversight/human-oversight.test.ts tests/v2/offline-verifier/conformance-runner.test.ts tests/v2/offline-verifier/middleware.test.ts tests/v2/offline-verifier/verify.test.ts tests/v2/payment-rails/cycles-evidence-resolution.test.ts tests/v2/payment-rails/cycles-evidence-authority.test.ts tests/v2/revocation-enforcement.test.ts tests/v2/trust-policy/trust-policy.test.ts src/v2/context-provenance/__tests__/roundtrip.test.ts src/v2/context-provenance/__tests__/disclosure.test.ts src/v2/context-provenance/__tests__/known-answer.test.ts src/v2/context-provenance/__tests__/conformance.test.ts src/v2/context-provenance/__tests__/adversarial.test.ts src/v2/context-provenance/__tests__/parity.test.ts src/v2/context-provenance/__tests__/cross-lang-parity.test.ts tests/v2/verification-source.test.ts tests/v2/producer-attestation.test.ts tests/delegation-currency-narrowing.test.ts tests/delegation-temporal-narrowing.test.ts tests/oauth-id-jag-bridge.test.ts tests/v2/regulated-action/conformance.test.ts tests/commerce-spend-accumulation.test.ts tests/delegation-spend-unit-narrowing.test.ts tests/delegation-parent-verify.test.ts tests/commerce-currency-gate.test.ts tests/v2/composition-check/conformance.test.ts src/v2/word_handles/__tests__/word_handles.test.ts src/v2/read_fidelity_receipt/__tests__/read_fidelity_receipt.test.ts tests/jurisdiction-selection.test.ts tests/v2/bilateral-pair/bilateral-pair.test.ts tests/evidence-bundle.test.ts",
+    "test": "npx tsx --test tests/passport.test.ts tests/adversarial.ts tests/v2.0-integration.ts tests/contract.test.ts tests/agora.test.ts tests/values.test.ts tests/delegation.test.ts tests/attribution.test.ts tests/policy.test.ts tests/canonical.test.ts tests/coordination.test.ts tests/commerce.test.ts tests/enforcement.test.ts tests/routing.test.ts tests/did-vc.test.ts tests/a2a.test.ts tests/principal.test.ts tests/adversarial-paper.test.ts tests/property-delegation.test.ts tests/property-canonical.test.ts tests/intent.test.ts tests/reputation-authority.test.ts tests/cross-chain.test.ts tests/encrypted-messaging.test.ts tests/obligations.test.ts tests/execution-envelope.test.ts tests/adversarial-causal-chain.test.ts tests/governance.test.ts tests/feasibility.test.ts tests/identity.test.ts tests/precedent.test.ts tests/reanchor.test.ts tests/escalation.test.ts tests/oracle-witness.test.ts tests/messaging-audit.test.ts tests/policy-conflict.test.ts tests/data-source.test.ts tests/decision-semantics.test.ts tests/interop-vectors.test.ts tests/v2-bridge.test.ts tests/v2-full.test.ts tests/key-storage.test.ts tests/qntm-bridge.test.ts tests/agent-json-bridge.test.ts tests/did-resolution-conformance.test.ts tests/decision-equivalence.test.ts tests/data-lifecycle.test.ts tests/campaign7-composition.test.ts tests/entity-verification.test.ts tests/conformance.test.ts tests/governance-block.test.ts tests/aps-txt.test.ts tests/governance-360.test.ts tests/storage-backend.test.ts tests/receipt-bundle.test.ts tests/reputation-confidence.test.ts tests/governance-consumer.test.ts tests/charter.test.ts tests/institutional-governance-phase2.test.ts tests/data-source-attribution.test.ts tests/canonical-jcs.test.ts tests/temporal-spread.test.ts tests/fidelity-pressure.test.ts tests/denial-domains.test.ts tests/data-narrowing.test.ts tests/governance-posture.test.ts tests/anchor-state.test.ts tests/issuer-signature.test.ts tests/openshell-adapter.test.ts tests/attestation.test.ts tests/execution-attestation.test.ts tests/bilateral-receipt.test.ts tests/proof-namespace.test.ts tests/ecosystem-features.test.ts tests/persistent-passport.test.ts tests/security-av.test.ts tests/audit-fixes.test.ts tests/did-interop.test.ts tests/identity-bridge.test.ts tests/vc-wrapper.test.ts tests/identity-pipeline.test.ts tests/cross-protocol/sint-crossverify.test.ts tests/action-ref.test.ts tests/external-action-ref.test.ts tests/freshness.test.ts tests/evidence-grade.test.ts tests/key-rotation.test.ts tests/governance-regression.test.ts tests/posture-overlay.test.ts tests/feasibility-gateway.test.ts tests/trust-adapters.test.ts tests/evaluation-context.test.ts tests/health.test.ts tests/composio-adapter.test.ts tests/interop/ietf-envelope.test.ts tests/interop/signet-combined.test.ts tests/interop/moltrust-attestation.test.ts tests/interop/cross-protocol-vectors.test.ts tests/interop/receipt-chaining.test.ts tests/ibac-adapter.test.ts tests/langchain-adapter.test.ts tests/crewai-adapter.test.ts tests/mcp-adapter.test.ts tests/a2a-adapter.test.ts tests/gonka-adapter.test.ts tests/cross-algo-mismatch.test.ts tests/credential-lifecycle.test.ts tests/behavioral-memory.test.ts tests/telemetry-scope.test.ts tests/idempotency.test.ts tests/v2/wallet-binding.test.ts tests/v2/wallet-binding-fixture.test.ts tests/v2/credential-check-policy.test.ts tests/v2/delegation-escalation.test.ts tests/v2/attribution-consent.test.ts tests/v2/attribution-integration.test.ts tests/v2/attribution-primitive.test.ts tests/v2/attribution-primitive-integration.test.ts tests/v2/build-b-fractional-weights.test.ts tests/v2/build-b-cross-language.test.ts tests/v2/build-c-settlement.test.ts tests/v2/build-c-cross-language.test.ts tests/v2/build-c-end-to-end.test.ts tests/v2/provisional-statement.test.ts tests/temporal-decay.test.ts tests/confidence-breakdown.test.ts tests/behavioral-fingerprint.test.ts tests/session-boundary.test.ts tests/probe-identity.test.ts tests/v2/cognitive-attestation/envelope.test.ts tests/v2/cognitive-attestation/verify.test.ts tests/v2/cognitive-attestation/adversarial.test.ts tests/v2/mutual-auth/handshake.test.ts tests/v2/mutual-auth/adversarial.test.ts tests/v2/mutual-auth/conformance.test.ts tests/property-bilateral-receipt.test.ts tests/v2/instruction-provenance/conformance.test.ts tests/v2/instruction-provenance/adversarial.test.ts tests/v2/identity-composition-error.test.ts tests/v2/claim-evidence-types.test.ts tests/v2/claim-verifier.test.ts tests/v2/downstream-taint.test.ts tests/v2/payment-rails/nano.test.ts tests/v2/payment-rails/governance.test.ts tests/v2/payment-rails/ap2.test.ts tests/v2/payment-rails/x402.test.ts tests/v2/payment-rails/conformance/harness.test.ts tests/v2/payment-rails/binding-harness.test.ts tests/v2/payment-rails/stripe-issuing-primitives.test.ts tests/v2/payment-rails/acp.test.ts tests/v2/payment-rails/cycles.test.ts tests/v2/payment-rails/mpp.test.ts tests/v2/payment-rails/scope-resolution.test.ts tests/v2/payment-rails/accountability-bundle.test.ts tests/v2/payment-rails/did-uri-signing.test.ts tests/v2/payment-rails/cross-receipt-chain.test.ts src/v2/accountability/__tests__/action.test.ts src/v2/accountability/__tests__/authority-boundary.test.ts src/v2/accountability/__tests__/bundle.test.ts src/v2/accountability/__tests__/contestability.test.ts src/v2/accountability/__tests__/custody.test.ts src/v2/accountability/__tests__/fixtures.test.ts src/v2/cognitive_attestation/__tests__/cognitive_attestation.test.ts src/v2/delegation/__tests__/responsibility_anchor.test.ts src/v2/memory_provenance/__tests__/memory_provenance.test.ts src/v2/cross_issuer_attestation/__tests__/cross_issuer_attestation.test.ts src/v2/behavioral_drift_window/__tests__/behavioral_drift_window.test.ts tests/tool-registry-integrity.test.ts tests/v2/transport/rfc9421/request-binding.test.ts tests/v2/verifier-hardening.test.ts tests/v2/key-resolution/resolver.test.ts src/v2/feasibility/__tests__/feasibility.test.ts tests/oauth-rfc8693-bridge.test.ts tests/conformance/conformance-negatives.test.ts tests/v2/policy-bundle/policy-bundle.test.ts src/v2/scope-registry/__tests__/scope-registry.test.ts tests/check-many-parity.test.ts tests/cross-impl/jcs-equivalence.test.ts tests/remote-signer.test.ts tests/v2/assurance/descriptor.test.ts tests/v2/audience-binding/audience-binding.test.ts tests/v2/hash-pointer/bbs-composition.test.ts tests/v2/hash-pointer/profile.test.ts tests/v2/human-oversight/human-oversight.test.ts tests/v2/offline-verifier/conformance-runner.test.ts tests/v2/offline-verifier/middleware.test.ts tests/v2/offline-verifier/verify.test.ts tests/v2/payment-rails/cycles-evidence-resolution.test.ts tests/v2/payment-rails/cycles-evidence-authority.test.ts tests/v2/revocation-enforcement.test.ts tests/v2/trust-policy/trust-policy.test.ts src/v2/context-provenance/__tests__/roundtrip.test.ts src/v2/context-provenance/__tests__/disclosure.test.ts src/v2/context-provenance/__tests__/known-answer.test.ts src/v2/context-provenance/__tests__/conformance.test.ts src/v2/context-provenance/__tests__/adversarial.test.ts src/v2/context-provenance/__tests__/parity.test.ts src/v2/context-provenance/__tests__/cross-lang-parity.test.ts tests/v2/verification-source.test.ts tests/v2/producer-attestation.test.ts tests/delegation-currency-narrowing.test.ts tests/delegation-temporal-narrowing.test.ts tests/oauth-id-jag-bridge.test.ts tests/v2/regulated-action/conformance.test.ts tests/commerce-spend-accumulation.test.ts tests/delegation-spend-unit-narrowing.test.ts tests/delegation-parent-verify.test.ts tests/commerce-currency-gate.test.ts tests/v2/composition-check/conformance.test.ts src/v2/word_handles/__tests__/word_handles.test.ts src/v2/read_fidelity_receipt/__tests__/read_fidelity_receipt.test.ts tests/jurisdiction-selection.test.ts tests/v2/bilateral-pair/bilateral-pair.test.ts tests/evidence-bundle.test.ts tests/v2/verifier-null-guards.test.ts tests/merkle-domain-separation.test.ts tests/threshold-verify-before-count.test.ts",
     "test:interop": "npx tsx --test tests/interop/ietf-envelope.test.ts tests/interop/signet-combined.test.ts tests/interop/moltrust-attestation.test.ts tests/interop/cross-protocol-vectors.test.ts tests/interop/receipt-chaining.test.ts",
     "test:quick": "tsx --test tests/passport.test.ts",
     "test:fixtures": "tsx fixtures/bilateral-delegation/test-canonicalize.ts",