agentcert 0.2.5 → 0.2.7

package/README.md

@@ -49,6 +49,11 @@ files, 10 MiB per file, and 50 MiB total. Skipped references are reported in
 the CLI and hosted run timeline. Companion uploads are restricted to
 PNG/JPEG/WebP, JSON/JSONL, HTML, PDF, and ZIP; other extensions are skipped
 before they are read. Pass `--no-artifacts` to upload only the JSON bundle.
+Hosted pushes embed an `agentcert.artifact_manifest.v0.1` declaration with the
+normalized path, SHA-256 digest, byte size, and kind of every prepared
+companion artifact. The control plane reports `complete` only after every
+hosted object exactly matches that declaration; missing, skipped, undeclared,
+or mismatched artifacts remain observable as `partial` or `rejected`.
 Project API keys can create runs, record events, and upload evidence, but
 cannot approve their own runtime actions.
 

package/dist/artifact-manifest.js

@@ -0,0 +1,37 @@
+import { createHash } from "node:crypto";
+import { AGENTCERT_ARTIFACT_MANIFEST_VERSION, } from "./types.js";
+export function buildArtifactManifest(artifacts) {
+    const entries = artifacts.map((artifact) => ({
+        path: normalizeManifestPath(artifact.sourcePath),
+        sha256: createHash("sha256").update(artifact.bytes).digest("hex"),
+        sizeBytes: artifact.bytes.byteLength,
+        kind: artifact.kind,
+    })).sort((left, right) => left.path.localeCompare(right.path));
+    const paths = new Set();
+    for (const entry of entries) {
+        if (paths.has(entry.path))
+            throw new Error(`Artifact manifest contains duplicate path ${entry.path}.`);
+        paths.add(entry.path);
+    }
+    return { schemaVersion: AGENTCERT_ARTIFACT_MANIFEST_VERSION, entries };
+}
+export function withArtifactManifest(bundle, artifacts) {
+    return { ...bundle, artifactManifest: buildArtifactManifest(artifacts) };
+}
+export function serializeHostedEvidenceBundle(bundle, artifacts) {
+    const reconciledBundle = withArtifactManifest(bundle, artifacts);
+    return {
+        bundle: reconciledBundle,
+        bytes: new TextEncoder().encode(`${JSON.stringify(reconciledBundle, null, 2)}\n`),
+    };
+}
+export function normalizeManifestPath(value) {
+    const path = value.replace(/\\/g, "/").replace(/^\.\//, "").trim();
+    if (!path || path.length > 1024 || path.startsWith("/") || /^[A-Za-z]:\//.test(path)) {
+        throw new Error(`Artifact manifest path must be a relative path: ${value}`);
+    }
+    if (path.split("/").some((segment) => segment === ".." || segment === "")) {
+        throw new Error(`Artifact manifest path cannot contain empty or parent segments: ${value}`);
+    }
+    return path;
+}

package/dist/cli.js

@@ -9,6 +9,7 @@ import { collectCompanionArtifacts, MAX_REPORTED_COMPANION_ARTIFACT_SKIPS } from
 import { recordsFromAgentCertResult, evaluateFailureClassifier, renderCorpusSummary, summarizeCorpus, writeReviewedFailureDataset, } from "./corpus.js";
 import { openCorpusStore, parseCorpusStoreKind } from "./corpus-store.js";
 import { pushEvidenceToControlPlane, verifyControlPlaneConnection } from "./control-plane.js";
+import { runEvidenceConformance } from "./conformance.js";
 import { DEFAULT_AGENTCERT_SERVER, resolveConnection, saveConnection } from "./credentials.js";
 import { applyFailureReviews, appendFailureReview, createFailureReview, findFailurePattern, parseFailureReviewStatus, parseFailureType, parseReviewConfidence, readFailureReviews, } from "./failure-review.js";
 import { buildMonitorSnapshot, writeMonitorSnapshot } from "./monitor.js";
@@ -515,6 +516,32 @@ else if (command === "validate") {
         }
     }
 }
+else if (command === "conformance") {
+    const file = readFlag("--file") ?? readFirstPositionalAfterCommand();
+    if (!file)
+        throw new Error("Missing evidence file. Usage: agentcert conformance <file> --artifact-root <directory>.");
+    const artifactRoot = resolve(readFlag("--artifact-root") ?? dirname(resolve(file)));
+    const report = await runEvidenceConformance(await readJson(file), {
+        evidenceFile: file,
+        artifactRoot,
+        implementation: readFlag("--implementation"),
+    });
+    const output = `${JSON.stringify(report, null, 2)}\n`;
+    const outPath = readFlag("--out");
+    if (outPath) {
+        await mkdir(dirname(resolve(outPath)), { recursive: true });
+        await writeFile(outPath, output);
+        process.stdout.write(`Wrote conformance report: ${resolve(outPath)}\n`);
+    }
+    process.stdout.write(`${report.valid ? "Conformant" : "Non-conformant"} evidence implementation: ${report.implementation}\n`);
+    for (const item of report.checks) {
+        process.stdout.write(`- ${item.status === "passed" ? "PASS" : "FAIL"} ${item.id}: ${item.message}\n`);
+        for (const error of item.errors)
+            process.stdout.write(`  - ${error}\n`);
+    }
+    if (!report.valid)
+        process.exitCode = 1;
+}
 else {
     process.stdout.write(`Usage:
   agentcert init --subject my-browser-agent
@@ -543,6 +570,7 @@ else {
   agentcert serve --corpus .agentcert/corpus/corpus.jsonl --static public-demo/agentcert-monitor --artifact-root public-demo/browser-agent-robustness/evidence/tripwire-public-demo
   agentcert validate .agentcert/latest/agentcert-evidence.json
   agentcert validate .agentcert/latest/agentcert-evidence.json --check-artifacts
+  agentcert conformance .agentcert/latest/agentcert-evidence.json --artifact-root . --implementation my-agent
   agentcert schema validate --schema evidence-bundle --file .agentcert/latest/agentcert-evidence.json
 `);
 }
@@ -911,12 +939,13 @@ jobs:
     # permissions:
     #   contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
 
-      - uses: Kakarottoooo/agentcert/actions/tripwire@v0
+      - id: agentcert
+        uses: Kakarottoooo/agentcert/actions/tripwire@v0
         with:
           config: tripwire.yml
           out: .tripwire/latest

package/dist/command-help.js

@@ -1,4 +1,10 @@
 export function renderCommandHelp(command) {
+    if (command === "conformance")
+        return `Usage:
+  agentcert conformance <evidence.json> --artifact-root <directory> [--implementation <name>] [--out <report.json>]
+
+Checks schema identity, v0.1 compatibility, artifact manifest structure, and exact artifact hashes and sizes.
+`;
     if (command !== "push")
         return undefined;
     return `Usage:

package/dist/conformance.js

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { normalizeManifestPath } from "./artifact-manifest.js";
+import { validateAgentCertSchema } from "./schema-validator.js";
+const SUPPORTED_TOP_LEVEL_FIELDS = new Set([
+    "schemaName", "schemaVersion", "schemaSemver", "kind", "runId", "generatedAt", "subject", "verdict", "summary",
+    "results", "evidence", "artifacts", "artifactManifest", "standards",
+]);
+export async function runEvidenceConformance(input, options) {
+    const checks = [];
+    const schema = validateAgentCertSchema("evidence-bundle", input);
+    checks.push(check("schema", "Evidence bundle satisfies the AgentCert v0.1 semantic contract.", schema.errors));
+    const bundle = object(input);
+    const compatibilityErrors = bundle
+        ? Object.keys(bundle).filter((key) => !SUPPORTED_TOP_LEVEL_FIELDS.has(key)).map((key) => `Unsupported top-level field: ${key}.`)
+        : ["Evidence bundle must be an object."];
+    checks.push(check("compatibility", "Evidence bundle uses only v0.1-compatible top-level fields.", compatibilityErrors));
+    const manifestErrors = [];
+    const entries = parseManifest(bundle?.artifactManifest, manifestErrors);
+    checks.push(check("manifest", "Artifact manifest declares unique normalized paths, SHA-256, byte size, and kind.", manifestErrors));
+    const byteErrors = [];
+    if (manifestErrors.length === 0) {
+        const root = resolve(options.artifactRoot);
+        for (const entry of entries) {
+            const path = resolve(root, entry.path);
+            if (path !== root && !path.startsWith(`${root}\\`) && !path.startsWith(`${root}/`)) {
+                byteErrors.push(`${entry.path}: resolved path escapes artifact root.`);
+                continue;
+            }
+            try {
+                const bytes = await readFile(path);
+                const digest = createHash("sha256").update(bytes).digest("hex");
+                if (bytes.byteLength !== entry.sizeBytes)
+                    byteErrors.push(`${entry.path}: expected ${entry.sizeBytes} bytes, observed ${bytes.byteLength}.`);
+                if (digest !== entry.sha256)
+                    byteErrors.push(`${entry.path}: SHA-256 does not match the declared digest.`);
+            }
+            catch (error) {
+                const code = error && typeof error === "object" && "code" in error ? String(error.code) : "read_failed";
+                byteErrors.push(`${entry.path}: artifact could not be read (${code}).`);
+            }
+        }
+    }
+    else {
+        byteErrors.push("Artifact bytes were not checked because the manifest is invalid.");
+    }
+    checks.push(check("artifact-bytes", "Every declared artifact matches its exact runtime bytes.", byteErrors));
+    const passed = checks.filter((item) => item.status === "passed").length;
+    const failed = checks.length - passed;
+    return {
+        schemaVersion: "agentcert.conformance.v0.1",
+        kind: "agentcert.evidence_conformance_report",
+        implementation: options.implementation?.trim() || "third-party",
+        evidenceFile: resolve(options.evidenceFile),
+        artifactRoot: resolve(options.artifactRoot),
+        generatedAt: (options.now ?? new Date()).toISOString(),
+        valid: failed === 0,
+        summary: { passed, failed },
+        checks,
+    };
+}
+function parseManifest(input, errors) {
+    const manifest = object(input);
+    if (!manifest) {
+        errors.push("artifactManifest is required for conformance.");
+        return [];
+    }
+    if (manifest.schemaVersion !== "agentcert.artifact_manifest.v0.1")
+        errors.push("artifactManifest.schemaVersion must be agentcert.artifact_manifest.v0.1.");
+    if (!Array.isArray(manifest.entries)) {
+        errors.push("artifactManifest.entries must be an array.");
+        return [];
+    }
+    if (manifest.entries.length > 500)
+        errors.push("artifactManifest.entries cannot exceed 500 entries.");
+    const paths = new Set();
+    const entries = [];
+    manifest.entries.forEach((inputEntry, index) => {
+        const entry = object(inputEntry);
+        if (!entry) {
+            errors.push(`artifactManifest.entries[${index}] must be an object.`);
+            return;
+        }
+        let path;
+        try {
+            path = typeof entry.path === "string" ? normalizeManifestPath(entry.path) : undefined;
+        }
+        catch (error) {
+            errors.push(`artifactManifest.entries[${index}].path: ${error.message}`);
+        }
+        if (!path)
+            errors.push(`artifactManifest.entries[${index}].path must be a normalized relative path.`);
+        else if (paths.has(path))
+            errors.push(`artifactManifest contains duplicate path ${path}.`);
+        else
+            paths.add(path);
+        if (typeof entry.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(entry.sha256))
+            errors.push(`artifactManifest.entries[${index}].sha256 must be 64 lowercase hex characters.`);
+        if (!Number.isInteger(entry.sizeBytes) || entry.sizeBytes < 0)
+            errors.push(`artifactManifest.entries[${index}].sizeBytes must be a non-negative integer.`);
+        if (typeof entry.kind !== "string" || !/^[a-z][a-z0-9_-]{0,63}$/.test(entry.kind))
+            errors.push(`artifactManifest.entries[${index}].kind must be a stable lowercase identifier.`);
+        if (path && typeof entry.sha256 === "string" && Number.isInteger(entry.sizeBytes) && typeof entry.kind === "string") {
+            entries.push({ path, sha256: entry.sha256, sizeBytes: entry.sizeBytes, kind: entry.kind });
+        }
+    });
+    return entries;
+}
+function check(id, message, errors) {
+    return { id, status: errors.length === 0 ? "passed" : "failed", message, errors };
+}
+function object(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : undefined;
+}

package/dist/control-plane.js

@@ -1,3 +1,4 @@
+import { serializeHostedEvidenceBundle } from "./artifact-manifest.js";
 import { MAX_REPORTED_COMPANION_ARTIFACT_SKIPS, } from "./companion-artifacts.js";
 export class ControlPlaneRequestError extends Error {
     status;
@@ -40,8 +41,16 @@ export async function pushEvidenceToControlPlane(options) {
     }
     const request = options.fetch ?? fetch;
     const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(options.projectId)}`;
-    const externalId = options.externalId ?? options.bundle.runId;
-    const kind = hostedRunKind(options.bundle);
+    const companionArtifacts = options.companionArtifacts ?? [];
+    const hostedEvidence = options.companionArtifacts === undefined && options.bundle.artifactManifest
+        ? {
+            bundle: options.bundle,
+            bytes: new TextEncoder().encode(`${JSON.stringify(options.bundle, null, 2)}\n`),
+        }
+        : serializeHostedEvidenceBundle(options.bundle, companionArtifacts);
+    const bundle = hostedEvidence.bundle;
+    const externalId = options.externalId ?? bundle.runId;
+    const kind = hostedRunKind(bundle);
     const headers = { authorization: `Bearer ${options.apiKey}` };
     const run = await requestJson(request, `${projectUrl}/runs`, {
         method: "POST",
@@ -49,11 +58,11 @@ export async function pushEvidenceToControlPlane(options) {
         body: JSON.stringify({
             externalId,
             kind,
-            schemaVersion: options.bundle.schemaVersion,
-            startedAt: options.bundle.generatedAt,
+            schemaVersion: bundle.schemaVersion,
+            startedAt: bundle.generatedAt,
             metadata: {
-                subject: options.bundle.subject,
-                products: options.bundle.summary.products,
+                subject: bundle.subject,
+                products: bundle.summary.products,
             },
         }),
     });
@@ -65,12 +74,12 @@ export async function pushEvidenceToControlPlane(options) {
                     sequence: 0,
                     type: "agentcert.evidence.created",
                     actor: "agentcert-cli",
-                    occurredAt: options.bundle.generatedAt,
+                    occurredAt: bundle.generatedAt,
                     payload: {
-                        verdict: options.bundle.verdict,
-                        totalEvidence: options.bundle.summary.totalEvidence,
-                        criticalEvidence: options.bundle.summary.criticalEvidence,
-                        highEvidence: options.bundle.summary.highEvidence,
+                        verdict: bundle.verdict,
+                        totalEvidence: bundle.summary.totalEvidence,
+                        criticalEvidence: bundle.summary.criticalEvidence,
+                        highEvidence: bundle.summary.highEvidence,
                     },
                 }],
         }),
@@ -78,22 +87,21 @@ export async function pushEvidenceToControlPlane(options) {
     const query = new URLSearchParams({
         fileName: options.fileName ?? "agentcert-evidence.json",
         kind: "evidence_bundle",
-        schemaVersion: options.bundle.schemaVersion,
+        schemaVersion: bundle.schemaVersion,
         runId: run.id,
     });
     const evidence = await requestJson(request, `${projectUrl}/evidence?${query}`, {
         method: "POST",
         headers: { ...headers, "content-type": "application/json" },
-        body: new Uint8Array(options.evidenceBytes).buffer,
+        body: new Uint8Array(hostedEvidence.bytes).buffer,
     });
-    const companionArtifacts = options.companionArtifacts ?? [];
     const skippedArtifacts = options.skippedCompanionArtifacts ?? [];
     let artifactBytesUploaded = 0;
     for (const artifact of companionArtifacts) {
         const artifactQuery = new URLSearchParams({
             fileName: artifact.fileName,
             kind: artifact.kind,
-            schemaVersion: options.bundle.schemaVersion,
+            schemaVersion: bundle.schemaVersion,
             runId: run.id,
             sourcePath: artifact.sourcePath,
         });
@@ -113,7 +121,7 @@ export async function pushEvidenceToControlPlane(options) {
                         sequence: 1,
                         type: "agentcert.companion_artifacts.processed",
                         actor: "agentcert-cli",
-                        occurredAt: options.bundle.generatedAt,
+                        occurredAt: bundle.generatedAt,
                         payload: {
                             uploadedCount: companionArtifacts.length,
                             skippedCount: skippedArtifacts.length,
@@ -127,19 +135,20 @@ export async function pushEvidenceToControlPlane(options) {
             }),
         });
     }
-    const firstDivergence = options.bundle.evidence.find((item) => item.severity === "critical" || item.severity === "high")?.message;
+    const firstDivergence = bundle.evidence.find((item) => item.severity === "critical" || item.severity === "high")?.message;
     await requestJson(request, `${projectUrl}/runs/${encodeURIComponent(run.id)}/complete`, {
         method: "POST",
         headers: { ...headers, "content-type": "application/json" },
         body: JSON.stringify({
-            status: options.bundle.verdict.passed ? "passed" : "failed",
-            score: options.bundle.verdict.score,
-            summary: `${options.bundle.subject.name}: ${options.bundle.verdict.level}`,
+            status: bundle.verdict.passed ? "passed" : "failed",
+            score: bundle.verdict.score,
+            summary: `${bundle.subject.name}: ${bundle.verdict.level}`,
             firstDivergence,
-            completedAt: options.bundle.generatedAt,
+            completedAt: bundle.generatedAt,
             metadata: {
                 evidenceId: evidence.id,
-                evidenceSchemaVersion: options.bundle.schemaVersion,
+                evidenceSchemaVersion: bundle.schemaVersion,
+                artifactManifestVersion: bundle.artifactManifest?.schemaVersion,
                 companionArtifactsUploaded: companionArtifacts.length,
                 companionArtifactsSkipped: skippedArtifacts.length,
                 companionArtifactBytesUploaded: artifactBytesUploaded,

package/dist/index.js

@@ -2,6 +2,7 @@ export * from "./bundle.js";
 export * from "./corpus.js";
 export * from "./corpus-store.js";
 export * from "./control-plane.js";
+export * from "./conformance.js";
 export * from "./credentials.js";
 export * from "./failure-review.js";
 export * from "./evidence-signing.js";

package/dist/schema-validator.js

@@ -59,10 +59,33 @@ function validateEvidenceBundle(value, errors) {
     requiredArray(value, "evidence", errors);
     requiredObject(value, "artifacts", errors);
     requiredArray(value, "standards", errors);
+    const subject = recordValue(value.subject);
+    if (subject) {
+        requiredStringAt(subject, "name", "subject.name", errors);
+        requiredEnumAt(subject, "type", ["agent", "mcp-server", "tool", "application", "unknown"], "subject.type", errors);
+    }
+    const verdict = recordValue(value.verdict);
+    if (verdict) {
+        requiredBooleanAt(verdict, "passed", "verdict.passed", errors);
+        requiredNumberRange(verdict, "score", "verdict.score", 0, 100, errors);
+        requiredStringAt(verdict, "level", "verdict.level", errors);
+    }
+    const summary = recordValue(value.summary);
+    if (summary) {
+        stringArray(summary.products, "summary.products", errors);
+        requiredNonNegativeInteger(summary, "criticalEvidence", "summary.criticalEvidence", errors);
+        requiredNonNegativeInteger(summary, "highEvidence", "summary.highEvidence", errors);
+        requiredNonNegativeInteger(summary, "totalEvidence", "summary.totalEvidence", errors);
+    }
+    validateTimestamp(value.generatedAt, "generatedAt", errors);
+    validateArtifactMap(value.artifacts, "artifacts", errors);
+    validateResultArray(value.results, "results", errors);
+    validateEvidenceArray(value.evidence, "evidence", errors);
+    validateStandards(value.standards, errors);
 }
 function validateResult(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);
-    requiredEnum(value, "product", ["mcpbench", "tripwire-ci", "onegent-runtime", "agentcert-cli"], errors);
+    requiredString(value, "product", errors);
     requiredString(value, "runId", errors);
     requiredString(value, "timestamp", errors);
     requiredEnum(value, "phase", ["pre-release", "runtime"], errors);
@@ -70,6 +93,62 @@ function validateResult(value, errors) {
     requiredBoolean(value, "passed", errors);
     requiredObject(value, "artifacts", errors);
     requiredArray(value, "evidence", errors);
+    requiredNumberRange(value, "score", "score", 0, 100, errors);
+    validateTimestamp(value.timestamp, "timestamp", errors);
+    validateArtifactMap(value.artifacts, "artifacts", errors);
+    validateEvidenceArray(value.evidence, "evidence", errors);
+}
+function validateResultArray(input, path, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `${path}[${index}]`, errors);
+        if (!value)
+            return;
+        const nested = [];
+        validateResult(value, nested);
+        errors.push(...nested.map((error) => `${path}[${index}].${error}`));
+    });
+}
+function validateEvidenceArray(input, path, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `${path}[${index}]`, errors);
+        if (!value)
+            return;
+        requiredStringAt(value, "id", `${path}[${index}].id`, errors);
+        requiredStringAt(value, "kind", `${path}[${index}].kind`, errors);
+        requiredEnumAt(value, "severity", ["critical", "high", "medium", "low", "info"], `${path}[${index}].severity`, errors);
+        requiredStringAt(value, "message", `${path}[${index}].message`, errors);
+        for (const field of ["source", "artifactPath", "suggestedFix"]) {
+            if (value[field] !== undefined && typeof value[field] !== "string")
+                errors.push(`${path}[${index}].${field} must be a string.`);
+        }
+        if (value.metadata !== undefined && !recordValue(value.metadata))
+            errors.push(`${path}[${index}].metadata must be an object.`);
+    });
+}
+function validateArtifactMap(input, path, errors) {
+    const value = recordValue(input);
+    if (!value)
+        return;
+    for (const [key, item] of Object.entries(value))
+        if (typeof item !== "string")
+            errors.push(`${path}.${key} must be a string.`);
+}
+function validateStandards(input, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `standards[${index}]`, errors);
+        if (!value)
+            return;
+        requiredStringAt(value, "id", `standards[${index}].id`, errors);
+        requiredStringAt(value, "name", `standards[${index}].name`, errors);
+        requiredEnumAt(value, "status", ["mapped", "planned"], `standards[${index}].status`, errors);
+        requiredStringAt(value, "note", `standards[${index}].note`, errors);
+    });
 }
 function validateCorpusRecord(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);
@@ -161,3 +240,37 @@ function requiredEnum(input, key, values, errors) {
         errors.push(`${key} must be one of: ${values.join(", ")}.`);
     }
 }
+function recordValue(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : undefined;
+}
+function requiredStringAt(input, key, path, errors) {
+    if (typeof input[key] !== "string" || input[key] === "")
+        errors.push(`${path} must be a non-empty string.`);
+}
+function requiredBooleanAt(input, key, path, errors) {
+    if (typeof input[key] !== "boolean")
+        errors.push(`${path} must be a boolean.`);
+}
+function requiredEnumAt(input, key, values, path, errors) {
+    if (typeof input[key] !== "string" || !values.includes(input[key]))
+        errors.push(`${path} must be one of: ${values.join(", ")}.`);
+}
+function requiredNumberRange(input, key, path, minimum, maximum, errors) {
+    const value = input[key];
+    if (typeof value !== "number" || !Number.isFinite(value) || value < minimum || value > maximum) {
+        errors.push(`${path} must be a finite number from ${minimum} to ${maximum}.`);
+    }
+}
+function requiredNonNegativeInteger(input, key, path, errors) {
+    const value = input[key];
+    if (!Number.isInteger(value) || value < 0)
+        errors.push(`${path} must be a non-negative integer.`);
+}
+function stringArray(input, path, errors) {
+    if (!Array.isArray(input) || input.some((item) => typeof item !== "string"))
+        errors.push(`${path} must be an array of strings.`);
+}
+function validateTimestamp(input, path, errors) {
+    if (typeof input === "string" && !Number.isFinite(Date.parse(input)))
+        errors.push(`${path} must be a valid date-time string.`);
+}

package/dist/types.js

@@ -1,2 +1,3 @@
 export const AGENTCERT_EVIDENCE_SCHEMA_VERSION = "agentcert.evidence.v0.1";
 export const AGENTCERT_EVIDENCE_SCHEMA_SEMVER = "0.1.0";
+export const AGENTCERT_ARTIFACT_MANIFEST_VERSION = "agentcert.artifact_manifest.v0.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentcert",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Assurance release gates, runtime evidence, and regression CI for AI agents.",
   "type": "module",
   "license": "Apache-2.0",