agentskeptic 8.6.1 → 8.8.0

package/dist/decisionEvidenceBundle/failureCodes.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Normative `errors[].code` and `errors[].message` constants for decision-bundle validation.
+ * Messages are contract-fixed; contract tests string-compare both code and message.
+ */
+export declare const MANIFEST_SCHEMA = "MANIFEST_SCHEMA";
+export declare const DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH = "DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH";
+export declare const DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH = "DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH";
+export declare const DECISION_BUNDLE_MATERIAL_TRUTH_MISSING = "DECISION_BUNDLE_MATERIAL_TRUTH_MISSING";
+export declare const DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA = "DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA";
+export declare const DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED = "DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED";
+export declare const DECISION_BUNDLE_SIGNATURE_INVALID = "DECISION_BUNDLE_SIGNATURE_INVALID";
+export declare const DECISION_BUNDLE_FAILURE_MESSAGES: {
+    readonly MANIFEST_SCHEMA: "manifest.json failed schema validation or is not a supported manifest version.";
+    readonly DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH: "outcome-certificate.json sha256 does not match manifest.certificate.sha256";
+    readonly DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH: "material-truth.json sha256 does not match manifest.materialTruth.sha256";
+    readonly DECISION_BUNDLE_MATERIAL_TRUTH_MISSING: "material-truth.json is required for manifest schemaVersion 2 and was not found.";
+    readonly DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA: "material-truth.json failed material-truth-v2 schema validation.";
+    readonly DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED: "manifest.sig.json is present; pass --public-key <path> with the signer's SPKI PEM.";
+    readonly DECISION_BUNDLE_SIGNATURE_INVALID: "manifest.sig.json failed Ed25519 verification or does not match manifest.json bytes.";
+};
+export type DecisionBundleFailureCode = keyof typeof DECISION_BUNDLE_FAILURE_MESSAGES;
+export declare function decisionBundleFailure(code: DecisionBundleFailureCode): {
+    code: string;
+    message: string;
+};
+//# sourceMappingURL=failureCodes.d.ts.map

package/dist/decisionEvidenceBundle/failureCodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failureCodes.d.ts","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/failureCodes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,yCAAyC,8CAA8C,CAAC;AACrG,eAAO,MAAM,mDAAmD,wDACT,CAAC;AACxD,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAC/F,eAAO,MAAM,qCAAqC,0CAA0C,CAAC;AAC7F,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAC/F,eAAO,MAAM,iCAAiC,sCAAsC,CAAC;AAErF,eAAO,MAAM,gCAAgC;;;;;;;;CAcnC,CAAC;AAEX,MAAM,MAAM,yBAAyB,GAAG,MAAM,OAAO,gCAAgC,CAAC;AAEtF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAExG"}

package/dist/decisionEvidenceBundle/failureCodes.js

@@ -0,0 +1,24 @@
+/**
+ * Normative `errors[].code` and `errors[].message` constants for decision-bundle validation.
+ * Messages are contract-fixed; contract tests string-compare both code and message.
+ */
+export const MANIFEST_SCHEMA = "MANIFEST_SCHEMA";
+export const DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH = "DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH";
+export const DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH = "DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH";
+export const DECISION_BUNDLE_MATERIAL_TRUTH_MISSING = "DECISION_BUNDLE_MATERIAL_TRUTH_MISSING";
+export const DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA = "DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA";
+export const DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED = "DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED";
+export const DECISION_BUNDLE_SIGNATURE_INVALID = "DECISION_BUNDLE_SIGNATURE_INVALID";
+export const DECISION_BUNDLE_FAILURE_MESSAGES = {
+    [MANIFEST_SCHEMA]: "manifest.json failed schema validation or is not a supported manifest version.",
+    [DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH]: "outcome-certificate.json sha256 does not match manifest.certificate.sha256",
+    [DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH]: "material-truth.json sha256 does not match manifest.materialTruth.sha256",
+    [DECISION_BUNDLE_MATERIAL_TRUTH_MISSING]: "material-truth.json is required for manifest schemaVersion 2 and was not found.",
+    [DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA]: "material-truth.json failed material-truth-v2 schema validation.",
+    [DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED]: "manifest.sig.json is present; pass --public-key <path> with the signer's SPKI PEM.",
+    [DECISION_BUNDLE_SIGNATURE_INVALID]: "manifest.sig.json failed Ed25519 verification or does not match manifest.json bytes.",
+};
+export function decisionBundleFailure(code) {
+    return { code, message: DECISION_BUNDLE_FAILURE_MESSAGES[code] };
+}
+//# sourceMappingURL=failureCodes.js.map

package/dist/decisionEvidenceBundle/failureCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failureCodes.js","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/failureCodes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,yCAAyC,GAAG,2CAA2C,CAAC;AACrG,MAAM,CAAC,MAAM,mDAAmD,GAC9D,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,sCAAsC,GAAG,wCAAwC,CAAC;AAC/F,MAAM,CAAC,MAAM,qCAAqC,GAAG,uCAAuC,CAAC;AAC7F,MAAM,CAAC,MAAM,sCAAsC,GAAG,wCAAwC,CAAC;AAC/F,MAAM,CAAC,MAAM,iCAAiC,GAAG,mCAAmC,CAAC;AAErF,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,CAAC,eAAe,CAAC,EAAE,gFAAgF;IACnG,CAAC,yCAAyC,CAAC,EACzC,4EAA4E;IAC9E,CAAC,mDAAmD,CAAC,EACnD,yEAAyE;IAC3E,CAAC,sCAAsC,CAAC,EACtC,iFAAiF;IACnF,CAAC,qCAAqC,CAAC,EACrC,iEAAiE;IACnE,CAAC,sCAAsC,CAAC,EACtC,oFAAoF;IACtF,CAAC,iCAAiC,CAAC,EACjC,sFAAsF;CAChF,CAAC;AAIX,MAAM,UAAU,qBAAqB,CAAC,IAA+B;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,CAAC,IAAI,CAAC,EAAE,CAAC;AACnE,CAAC"}

package/dist/decisionEvidenceBundle/index.d.ts

@@ -1,5 +1,7 @@
 export { DECISION_EVIDENCE_FILES } from "./constants.js";
 export { exitCodeFromOutcomeCertificate } from "./exitCode.js";
+export { fingerprintUtf8JsonFileBytes, lineUtf8JsonFileBytes } from "./canonicalBytes.js";
+export { MANIFEST_SCHEMA, DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH, DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH, DECISION_BUNDLE_MATERIAL_TRUTH_MISSING, DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA, DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED, DECISION_BUNDLE_SIGNATURE_INVALID, DECISION_BUNDLE_FAILURE_MESSAGES, decisionBundleFailure, type DecisionBundleFailureCode, } from "./failureCodes.js";
 export { a5RequiredFromCertificate, computeCompletenessFromParts, type DecisionEvidenceCompleteness, type DecisionEvidenceCompletenessStatus, type DecisionEvidenceArtifactsFlags, } from "./completeness.js";
 export { writeDecisionEvidenceBundle, type WriteDecisionEvidenceBundleOptions } from "./writeDecisionEvidenceBundle.js";
 export { validateDecisionEvidenceBundle, formatValidationStdout, type DecisionBundleValidationLine, } from "./validateDecisionEvidenceBundle.js";

package/dist/decisionEvidenceBundle/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,4BAA4B,EACjC,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,KAAK,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACxH,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,KAAK,4BAA4B,GAClC,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,eAAe,EACf,yCAAyC,EACzC,mDAAmD,EACnD,sCAAsC,EACtC,qCAAqC,EACrC,sCAAsC,EACtC,iCAAiC,EACjC,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,4BAA4B,EACjC,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,GACpC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,KAAK,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AACxH,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,KAAK,4BAA4B,GAClC,MAAM,qCAAqC,CAAC"}

package/dist/decisionEvidenceBundle/index.js

@@ -1,5 +1,7 @@
 export { DECISION_EVIDENCE_FILES } from "./constants.js";
 export { exitCodeFromOutcomeCertificate } from "./exitCode.js";
+export { fingerprintUtf8JsonFileBytes, lineUtf8JsonFileBytes } from "./canonicalBytes.js";
+export { MANIFEST_SCHEMA, DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH, DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH, DECISION_BUNDLE_MATERIAL_TRUTH_MISSING, DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA, DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED, DECISION_BUNDLE_SIGNATURE_INVALID, DECISION_BUNDLE_FAILURE_MESSAGES, decisionBundleFailure, } from "./failureCodes.js";
 export { a5RequiredFromCertificate, computeCompletenessFromParts, } from "./completeness.js";
 export { writeDecisionEvidenceBundle } from "./writeDecisionEvidenceBundle.js";
 export { validateDecisionEvidenceBundle, formatValidationStdout, } from "./validateDecisionEvidenceBundle.js";

package/dist/decisionEvidenceBundle/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAI7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAA2C,MAAM,kCAAkC,CAAC;AACxH,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GAEvB,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,eAAe,EACf,yCAAyC,EACzC,mDAAmD,EACnD,sCAAsC,EACtC,qCAAqC,EACrC,sCAAsC,EACtC,iCAAiC,EACjC,gCAAgC,EAChC,qBAAqB,GAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAI7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAA2C,MAAM,kCAAkC,CAAC;AACxH,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GAEvB,MAAM,qCAAqC,CAAC"}

package/dist/decisionEvidenceBundle/validateDecisionEvidenceBundle.d.ts

@@ -1,24 +1,45 @@
+type ArtifactsFlags = {
+    a4Present: boolean;
+    a5Present: boolean;
+    a5Required: boolean;
+};
+type Completeness = {
+    status: "complete" | "partial" | "invalid";
+    artifacts: ArtifactsFlags;
+};
+type IntegritySignature = "absent" | "valid" | "invalid";
+type Integrity = {
+    manifestVersion: 1 | 2;
+    certificateFingerprintOk: boolean | null;
+    materialTruthFingerprintOk: boolean | null;
+    materialTruthPresent: boolean;
+    selfVerifying: boolean;
+    signature: IntegritySignature;
+    signaturePublicKeySpkiPem: string | null;
+};
 export type DecisionBundleValidationLine = {
     schemaVersion: 1;
     kind: "decision_bundle_validation";
-    status: "complete" | "partial" | "invalid";
+    status: "valid" | "invalid";
     bundleDir: string;
-    completeness: {
-        status: "complete" | "partial" | "invalid";
-        artifacts: {
-            a4Present: boolean;
-            a5Present: boolean;
-            a5Required: boolean;
-        };
-    };
+    completeness: Completeness;
     errors: Array<{
         code: string;
         message: string;
     }>;
+    integrity: Integrity;
+};
+export type ValidateDecisionEvidenceBundleOptions = {
+    /** When set, used to verify `manifest.sig.json` if present. */
+    publicKeyPemUtf8?: string;
 };
 /**
- * Validates a directory produced by writeDecisionEvidenceBundle. Returns stdout payload object (serialize with {@link formatValidationStdout}).
+ * Validates a directory produced by writeDecisionEvidenceBundle.
+ *
+ * Tier 1 (throws): `realpathSync` / `readdirSync` on `bundleDir` fail. Caller maps to exit 3.
+ * Tier 2 (returns): Always returns a `DecisionBundleValidationLine` with `integrity` populated.
  */
-export declare function validateDecisionEvidenceBundle(bundleDir: string): DecisionBundleValidationLine;
+export declare function validateDecisionEvidenceBundle(bundleDir: string, options?: ValidateDecisionEvidenceBundleOptions): DecisionBundleValidationLine;
 export declare function formatValidationStdout(line: DecisionBundleValidationLine): string;
+export {};
 //# sourceMappingURL=validateDecisionEvidenceBundle.d.ts.map

package/dist/decisionEvidenceBundle/validateDecisionEvidenceBundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateDecisionEvidenceBundle.d.ts","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/validateDecisionEvidenceBundle.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,4BAA4B,GAAG;IACzC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,4BAA4B,CAAC;IACnC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE;QACZ,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,SAAS,EAAE;YACT,SAAS,EAAE,OAAO,CAAC;YACnB,SAAS,EAAE,OAAO,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC;SACrB,CAAC;KACH,CAAC;IACF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD,CAAC;AAYF;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,4BAA4B,CAiJ9F;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,GAAG,MAAM,CAEjF"}
+{"version":3,"file":"validateDecisionEvidenceBundle.d.ts","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/validateDecisionEvidenceBundle.ts"],"names":[],"mappings":"AAoBA,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,KAAK,YAAY,GAAG;IAClB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,SAAS,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF,KAAK,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzD,KAAK,SAAS,GAAG;IACf,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,wBAAwB,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,0BAA0B,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,oBAAoB,EAAE,OAAO,CAAC;IAC9B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,4BAA4B,CAAC;IACnC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG;IAClD,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AA0FF;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,qCAA0C,GAClD,4BAA4B,CAoL9B;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,GAAG,MAAM,CAEjF"}

package/dist/decisionEvidenceBundle/validateDecisionEvidenceBundle.js

@@ -1,159 +1,259 @@
-import { existsSync, readFileSync } from "node:fs";
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { stringifyWithSortedKeys } from "../sortedJsonStringify.js";
 import { loadSchemaValidator } from "../schemaLoad.js";
+import { lfCanonicalUtf8Payload, sha256Hex } from "../agentRunRecord.js";
+import { normalizeSpkiPemForSidecar } from "../workflowResultSignaturePemNormalize.js";
 import { DECISION_EVIDENCE_FILES } from "./constants.js";
-import { computeCompletenessFromParts } from "./completeness.js";
-function parseJsonFile(abs) {
+import { DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH, DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH, DECISION_BUNDLE_MATERIAL_TRUTH_MISSING, DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA, DECISION_BUNDLE_SIGNATURE_INVALID, DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED, decisionBundleFailure, MANIFEST_SCHEMA, } from "./failureCodes.js";
+function sha256HexBuf(buf) {
+    return createHash("sha256").update(buf).digest("hex");
+}
+function parseJson(buf) {
+    try {
+        return { ok: true, value: JSON.parse(buf.toString("utf8")) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+function existsArtifact(absPath) {
     try {
-        const raw = readFileSync(abs, "utf8").trim();
-        return { ok: true, value: JSON.parse(raw) };
+        return existsSync(absPath);
     }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        return { ok: false, message: msg };
+    catch {
+        return false;
+    }
+}
+function readFileOptional(absPath) {
+    try {
+        return readFileSync(absPath);
+    }
+    catch {
+        return null;
+    }
+}
+function detectManifestVersion(parsed) {
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const obj = parsed;
+        const sv = obj.schemaVersion;
+        if (sv === 1)
+            return 1;
+    }
+    return 2;
+}
+function manifestSchemaFailureEnvelope(args) {
+    return {
+        schemaVersion: 1,
+        kind: "decision_bundle_validation",
+        status: "invalid",
+        bundleDir: args.resolved,
+        completeness: {
+            status: "invalid",
+            artifacts: args.artifacts,
+        },
+        errors: [decisionBundleFailure(MANIFEST_SCHEMA)],
+        integrity: {
+            manifestVersion: args.manifestVersion,
+            certificateFingerprintOk: null,
+            materialTruthFingerprintOk: null,
+            materialTruthPresent: args.materialTruthPresent,
+            selfVerifying: false,
+            signature: "absent",
+            signaturePublicKeySpkiPem: null,
+        },
+    };
+}
+function tryVerifySignature(args) {
+    try {
+        const sidecar = JSON.parse(args.sidecarBytes.toString("utf8"));
+        const validateSidecar = loadSchemaValidator("workflow-result-signature");
+        if (!validateSidecar(sidecar))
+            return false;
+        const sigB64 = String(sidecar.signatureBase64);
+        const lfManifest = lfCanonicalUtf8Payload(args.manifestBytes);
+        const expectedHash = sha256Hex(lfManifest);
+        if (sidecar.signedContentSha256Hex !== expectedHash)
+            return false;
+        const pubKey = createPublicKey({
+            key: normalizeSpkiPemForSidecar(args.publicKeyPemUtf8),
+            format: "pem",
+        });
+        return verify(null, lfManifest, pubKey, Buffer.from(sigB64, "base64"));
+    }
+    catch {
+        return false;
     }
 }
 /**
- * Validates a directory produced by writeDecisionEvidenceBundle. Returns stdout payload object (serialize with {@link formatValidationStdout}).
+ * Validates a directory produced by writeDecisionEvidenceBundle.
+ *
+ * Tier 1 (throws): `realpathSync` / `readdirSync` on `bundleDir` fail. Caller maps to exit 3.
+ * Tier 2 (returns): Always returns a `DecisionBundleValidationLine` with `integrity` populated.
  */
-export function validateDecisionEvidenceBundle(bundleDir) {
-    const resolved = path.resolve(bundleDir);
-    const structuralErrors = [];
-    const ocPath = path.join(resolved, DECISION_EVIDENCE_FILES.outcomeCertificate);
-    const exitPath = path.join(resolved, DECISION_EVIDENCE_FILES.exit);
-    const hlPath = path.join(resolved, DECISION_EVIDENCE_FILES.humanLayer);
+export function validateDecisionEvidenceBundle(bundleDir, options = {}) {
+    const resolved = realpathSync(path.resolve(bundleDir));
+    // Tier-1 probe: directory must be open for read.
+    readdirSync(resolved);
     const manifestPath = path.join(resolved, DECISION_EVIDENCE_FILES.manifest);
+    const sigPath = path.join(resolved, DECISION_EVIDENCE_FILES.manifestSignature);
+    const ocPath = path.join(resolved, DECISION_EVIDENCE_FILES.outcomeCertificate);
+    const mtPath = path.join(resolved, DECISION_EVIDENCE_FILES.materialTruth);
     const a4Path = path.join(resolved, DECISION_EVIDENCE_FILES.attestation);
     const a5Path = path.join(resolved, DECISION_EVIDENCE_FILES.nextAction);
-    for (const [label, p] of [
-        ["outcome-certificate.json", ocPath],
-        ["exit.json", exitPath],
-        ["human-layer.json", hlPath],
-        ["manifest.json", manifestPath],
-    ]) {
-        if (!existsSync(p)) {
-            structuralErrors.push({ code: "MISSING_FILE", message: `Missing ${label}.` });
-        }
+    const a4Present = existsArtifact(a4Path);
+    const a5Present = existsArtifact(a5Path);
+    const materialTruthPresent = existsArtifact(mtPath);
+    const baseArtifacts = { a4Present, a5Present, a5Required: false };
+    // --- Tier 2: load manifest bytes (any IO failure collapses to MANIFEST_SCHEMA + exit 2)
+    const manifestBytes = readFileOptional(manifestPath);
+    if (manifestBytes === null) {
+        return manifestSchemaFailureEnvelope({
+            resolved,
+            manifestVersion: 2,
+            materialTruthPresent,
+            artifacts: baseArtifacts,
+        });
     }
-    let certificate = null;
-    let certificateValid = false;
-    if (existsSync(ocPath)) {
-        const parsed = parseJsonFile(ocPath);
-        if (!parsed.ok) {
-            structuralErrors.push({ code: "CERTIFICATE_PARSE", message: parsed.message });
-        }
-        else {
-            const v = loadSchemaValidator("outcome-certificate-v3");
-            if (!v(parsed.value)) {
-                structuralErrors.push({
-                    code: "CERTIFICATE_SCHEMA",
-                    message: JSON.stringify(v.errors ?? []),
-                });
-            }
-            else {
-                certificateValid = true;
-                certificate = parsed.value;
-            }
-        }
+    const parsedManifest = parseJson(manifestBytes);
+    if (!parsedManifest.ok) {
+        return manifestSchemaFailureEnvelope({
+            resolved,
+            manifestVersion: 2,
+            materialTruthPresent,
+            artifacts: baseArtifacts,
+        });
     }
-    if (existsSync(exitPath)) {
-        const parsed = parseJsonFile(exitPath);
-        if (!parsed.ok) {
-            structuralErrors.push({ code: "EXIT_PARSE", message: parsed.message });
-        }
-        else {
-            const v = loadSchemaValidator("decision-evidence-exit-v1");
-            if (!v(parsed.value)) {
-                structuralErrors.push({ code: "EXIT_SCHEMA", message: JSON.stringify(v.errors ?? []) });
-            }
-        }
+    const manifestVersion = detectManifestVersion(parsedManifest.value);
+    const v1Validator = loadSchemaValidator("decision-evidence-bundle-manifest-v1");
+    const v2Validator = loadSchemaValidator("decision-evidence-bundle-manifest-v2");
+    const v1Ok = v1Validator(parsedManifest.value);
+    const v2Ok = v2Validator(parsedManifest.value);
+    if (!v1Ok && !v2Ok) {
+        return manifestSchemaFailureEnvelope({
+            resolved,
+            manifestVersion,
+            materialTruthPresent,
+            artifacts: baseArtifacts,
+        });
     }
-    if (existsSync(hlPath)) {
-        const parsed = parseJsonFile(hlPath);
-        if (!parsed.ok) {
-            structuralErrors.push({ code: "HUMAN_LAYER_PARSE", message: parsed.message });
-        }
-        else {
-            const v = loadSchemaValidator("decision-evidence-human-layer-v1");
-            if (!v(parsed.value)) {
-                structuralErrors.push({ code: "HUMAN_LAYER_SCHEMA", message: JSON.stringify(v.errors ?? []) });
-            }
-        }
+    const manifest = parsedManifest.value;
+    const manifestCompleteness = manifest.completeness;
+    const manifestStatus = typeof manifestCompleteness?.status === "string" &&
+        (manifestCompleteness.status === "complete" ||
+            manifestCompleteness.status === "partial" ||
+            manifestCompleteness.status === "invalid")
+        ? manifestCompleteness.status
+        : "invalid";
+    const manifestArtifacts = (manifestCompleteness?.artifacts ?? {});
+    const completenessArtifacts = {
+        a4Present: typeof manifestArtifacts.a4Present === "boolean" ? manifestArtifacts.a4Present : a4Present,
+        a5Present: typeof manifestArtifacts.a5Present === "boolean" ? manifestArtifacts.a5Present : a5Present,
+        a5Required: typeof manifestArtifacts.a5Required === "boolean" ? manifestArtifacts.a5Required : false,
+    };
+    const certBytes = readFileOptional(ocPath);
+    const errors = [];
+    let certificateFingerprintOk;
+    let materialTruthFingerprintOk;
+    let signature = "absent";
+    let signaturePublicKeySpkiPem = null;
+    if (manifestVersion === 1) {
+        certificateFingerprintOk = null;
+        materialTruthFingerprintOk = null;
+        signature = "absent";
     }
-    const a4Present = existsSync(a4Path);
-    const a5Present = existsSync(a5Path);
-    if (a4Present) {
-        const parsed = parseJsonFile(a4Path);
-        if (!parsed.ok) {
-            structuralErrors.push({ code: "ATTESTATION_PARSE", message: parsed.message });
+    else {
+        // v2 path
+        const certEntry = manifest.certificate;
+        const declaredCertSha = typeof certEntry?.sha256 === "string" ? certEntry.sha256 : "";
+        if (certBytes !== null && declaredCertSha) {
+            certificateFingerprintOk = sha256HexBuf(certBytes) === declaredCertSha;
+            if (!certificateFingerprintOk) {
+                errors.push(decisionBundleFailure(DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH));
+            }
         }
         else {
-            const v = loadSchemaValidator("decision-evidence-attestation-v1");
-            if (!v(parsed.value)) {
-                structuralErrors.push({ code: "ATTESTATION_SCHEMA", message: JSON.stringify(v.errors ?? []) });
-            }
+            certificateFingerprintOk = false;
+            errors.push(decisionBundleFailure(DECISION_BUNDLE_CERT_FINGERPRINT_MISMATCH));
         }
-    }
-    if (a5Present) {
-        const parsed = parseJsonFile(a5Path);
-        if (!parsed.ok) {
-            structuralErrors.push({ code: "NEXT_ACTION_PARSE", message: parsed.message });
+        const mtEntry = manifest.materialTruth;
+        const declaredMtSha = typeof mtEntry?.sha256 === "string" ? mtEntry.sha256 : "";
+        if (!materialTruthPresent) {
+            materialTruthFingerprintOk = null;
+            errors.push(decisionBundleFailure(DECISION_BUNDLE_MATERIAL_TRUTH_MISSING));
         }
         else {
-            const v = loadSchemaValidator("decision-evidence-next-action-v1");
-            if (!v(parsed.value)) {
-                structuralErrors.push({ code: "NEXT_ACTION_SCHEMA", message: JSON.stringify(v.errors ?? []) });
+            const mtBytes = readFileOptional(mtPath);
+            if (mtBytes === null) {
+                materialTruthFingerprintOk = null;
+                errors.push(decisionBundleFailure(DECISION_BUNDLE_MATERIAL_TRUTH_MISSING));
+            }
+            else {
+                // Fingerprint check first; mt-v2 schema check only when the bytes hash to the declared digest.
+                materialTruthFingerprintOk = sha256HexBuf(mtBytes) === declaredMtSha;
+                if (!materialTruthFingerprintOk) {
+                    errors.push(decisionBundleFailure(DECISION_BUNDLE_MATERIAL_TRUTH_FINGERPRINT_MISMATCH));
+                }
+                else {
+                    const parsedMt = parseJson(mtBytes);
+                    const mtSchemaOk = parsedMt.ok && loadSchemaValidator("material-truth-v2")(parsedMt.value);
+                    if (!mtSchemaOk) {
+                        errors.push(decisionBundleFailure(DECISION_BUNDLE_MATERIAL_TRUTH_SCHEMA));
+                    }
+                }
             }
         }
-    }
-    if (existsSync(manifestPath)) {
-        const parsed = parseJsonFile(manifestPath);
-        if (!parsed.ok) {
-            structuralErrors.push({ code: "MANIFEST_PARSE", message: parsed.message });
-        }
-        else {
-            const v = loadSchemaValidator("decision-evidence-bundle-manifest-v1");
-            if (!v(parsed.value)) {
-                structuralErrors.push({ code: "MANIFEST_SCHEMA", message: JSON.stringify(v.errors ?? []) });
+        // Signature handling (v2 only)
+        const sidecarBytes = readFileOptional(sigPath);
+        if (sidecarBytes !== null) {
+            if (options.publicKeyPemUtf8 === undefined) {
+                signature = "invalid";
+                errors.push(decisionBundleFailure(DECISION_BUNDLE_SIGNATURE_KEY_REQUIRED));
+            }
+            else {
+                const ok = tryVerifySignature({
+                    manifestBytes,
+                    sidecarBytes,
+                    publicKeyPemUtf8: options.publicKeyPemUtf8,
+                });
+                if (ok) {
+                    signature = "valid";
+                    signaturePublicKeySpkiPem = normalizeSpkiPemForSidecar(options.publicKeyPemUtf8);
+                }
+                else {
+                    signature = "invalid";
+                    errors.push(decisionBundleFailure(DECISION_BUNDLE_SIGNATURE_INVALID));
+                }
             }
         }
     }
-    const coreFilesPresent = existsSync(ocPath) &&
-        existsSync(exitPath) &&
-        existsSync(hlPath) &&
-        existsSync(manifestPath);
-    const computed = computeCompletenessFromParts({
-        certificateValid,
-        coreFilesPresent,
-        certificate,
-        a4Present,
-        a5Present,
-    });
-    if (structuralErrors.length > 0) {
-        return {
-            schemaVersion: 1,
-            kind: "decision_bundle_validation",
-            status: "invalid",
-            bundleDir: resolved,
-            completeness: {
-                status: "invalid",
-                artifacts: computed.artifacts,
-            },
-            errors: structuralErrors,
-        };
-    }
-    const status = computed.status;
+    const hasIntegrityError = errors.length > 0;
+    const completenessStatus = manifestStatus;
+    const status = hasIntegrityError || completenessStatus === "invalid" ? "invalid" : "valid";
+    const selfVerifying = manifestVersion === 2 &&
+        status === "valid" &&
+        !hasIntegrityError &&
+        (signature === "absent" || signature === "valid");
     return {
         schemaVersion: 1,
         kind: "decision_bundle_validation",
         status,
         bundleDir: resolved,
         completeness: {
-            status,
-            artifacts: computed.artifacts,
+            status: completenessStatus,
+            artifacts: completenessArtifacts,
+        },
+        errors,
+        integrity: {
+            manifestVersion,
+            certificateFingerprintOk,
+            materialTruthFingerprintOk,
+            materialTruthPresent,
+            selfVerifying,
+            signature,
+            signaturePublicKeySpkiPem,
         },
-        errors: computed.errors,
     };
 }
 export function formatValidationStdout(line) {

package/dist/decisionEvidenceBundle/validateDecisionEvidenceBundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateDecisionEvidenceBundle.js","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/validateDecisionEvidenceBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAkBjE,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,gBAAgB,GAA6C,EAAE,CAAC;IAEtE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAEvE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI;QACvB,CAAC,0BAA0B,EAAE,MAAM,CAAC;QACpC,CAAC,WAAW,EAAE,QAAQ,CAAC;QACvB,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAC5B,CAAC,eAAe,EAAE,YAAY,CAAC;KACvB,EAAE,CAAC;QACX,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,KAAK,GAAG,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAgC,IAAI,CAAC;IACpD,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;YACxD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;iBACxC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,gBAAgB,GAAG,IAAI,CAAC;gBACxB,WAAW,GAAG,MAAM,CAAC,KAA6B,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC3D,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GACpB,UAAU,CAAC,MAAM,CAAC;QAClB,UAAU,CAAC,QAAQ,CAAC;QACpB,UAAU,CAAC,MAAM,CAAC;QAClB,UAAU,CAAC,YAAY,CAAC,CAAC;IAE3B,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,gBAAgB;QAChB,gBAAgB;QAChB,WAAW;QACX,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IAEH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE;gBACZ,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B;YACD,MAAM,EAAE,gBAAgB;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,4BAA4B;QAClC,MAAM;QACN,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE;YACZ,MAAM;YACN,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;QACD,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAkC;IACvE,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"validateDecisionEvidenceBundle.js","sourceRoot":"","sources":["../../src/decisionEvidenceBundle/validateDecisionEvidenceBundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,yCAAyC,EACzC,mDAAmD,EACnD,sCAAsC,EACtC,qCAAqC,EACrC,iCAAiC,EACjC,sCAAsC,EACtC,qBAAqB,EACrB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAwC3B,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,EAAE,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC5C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,6BAA6B,CAAC,IAKtC;IACC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,YAAY,EAAE;YACZ,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B;QACD,MAAM,EAAE,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;QAChD,SAAS,EAAE;YACT,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,IAAI;YAChC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,QAAQ;YACnB,yBAAyB,EAAE,IAAI;SAChC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAI3B;IACC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;QAC1F,MAAM,eAAe,GAAG,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,sBAAsB,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,MAAM,GAAG,eAAe,CAAC;YAC7B,GAAG,EAAE,0BAA0B,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACtD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAiB,EACjB,UAAiD,EAAE;IAEnD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,iDAAiD;IACjD,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEtB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEpD,MAAM,aAAa,GAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAElF,yFAAyF;IACzF,MAAM,aAAa,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,6BAA6B,CAAC;YACnC,QAAQ;YACR,eAAe,EAAE,CAAC;YAClB,oBAAoB;YACpB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO,6BAA6B,CAAC;YACnC,QAAQ;YACR,eAAe,EAAE,CAAC;YAClB,oBAAoB;YACpB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,WAAW,GAAG,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,mBAAmB,CAAC,sCAAsC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAE/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,6BAA6B,CAAC;YACnC,QAAQ;YACR,eAAe;YACf,oBAAoB;YACpB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAgC,CAAC;IACjE,MAAM,oBAAoB,GAAG,QAAQ,CAAC,YAEzB,CAAC;IACd,MAAM,cAAc,GAClB,OAAO,oBAAoB,EAAE,MAAM,KAAK,QAAQ;QAChD,CAAC,oBAAoB,CAAC,MAAM,KAAK,UAAU;YACzC,oBAAoB,CAAC,MAAM,KAAK,SAAS;YACzC,oBAAoB,CAAC,MAAM,KAAK,SAAS,CAAC;QAC1C,CAAC,CAAE,oBAAoB,CAAC,MAA6C;QACrE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,EAAE,SAAS,IAAI,EAAE,CAA4B,CAAC;IAC7F,MAAM,qBAAqB,GAAmB;QAC5C,SAAS,EACP,OAAO,iBAAiB,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5F,SAAS,EACP,OAAO,iBAAiB,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5F,UAAU,EACR,OAAO,iBAAiB,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;KAC3F,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAyE,EAAE,CAAC;IACxF,IAAI,wBAAwC,CAAC;IAC7C,IAAI,0BAA0C,CAAC;IAC/C,IAAI,SAAS,GAAuB,QAAQ,CAAC;IAC7C,IAAI,yBAAyB,GAAkB,IAAI,CAAC;IAEpD,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC1B,wBAAwB,GAAG,IAAI,CAAC;QAChC,0BAA0B,GAAG,IAAI,CAAC;QAClC,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,UAAU;QACV,MAAM,SAAS,GAAG,QAAQ,CAAC,WAA+C,CAAC;QAC3E,MAAM,eAAe,GAAG,OAAO,SAAS,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,IAAI,SAAS,KAAK,IAAI,IAAI,eAAe,EAAE,CAAC;YAC1C,wBAAwB,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,eAAe,CAAC;YACvE,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,yCAAyC,CAAC,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wBAAwB,GAAG,KAAK,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,yCAAyC,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAiD,CAAC;QAC3E,MAAM,aAAa,GAAG,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,0BAA0B,GAAG,IAAI,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,0BAA0B,GAAG,IAAI,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,+FAA+F;gBAC/F,0BAA0B,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC;gBACrE,IAAI,CAAC,0BAA0B,EAAE,CAAC;oBAChC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBAC1F,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;oBACpC,MAAM,UAAU,GACd,QAAQ,CAAC,EAAE,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,qCAAqC,CAAC,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAC3C,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,kBAAkB,CAAC;oBAC5B,aAAa;oBACb,YAAY;oBACZ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;iBAC3C,CAAC,CAAC;gBACH,IAAI,EAAE,EAAE,CAAC;oBACP,SAAS,GAAG,OAAO,CAAC;oBACpB,yBAAyB,GAAG,0BAA0B,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBACnF,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,SAAS,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,iCAAiC,CAAC,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,kBAAkB,GAAG,cAAc,CAAC;IAC1C,MAAM,MAAM,GACV,iBAAiB,IAAI,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,MAAM,aAAa,GACjB,eAAe,KAAK,CAAC;QACrB,MAAM,KAAK,OAAO;QAClB,CAAC,iBAAiB;QAClB,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,4BAA4B;QAClC,MAAM;QACN,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE;YACZ,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,qBAAqB;SACjC;QACD,MAAM;QACN,SAAS,EAAE;YACT,eAAe;YACf,wBAAwB;YACxB,0BAA0B;YAC1B,oBAAoB;YACpB,aAAa;YACb,SAAS;YACT,yBAAyB;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAkC;IACvE,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/decisionEvidenceBundle/writeDecisionEvidenceBundle.d.ts

@@ -13,9 +13,23 @@ export type WriteDecisionEvidenceBundleOptions = {
     attestation?: unknown;
     /** Validated against decision-evidence-next-action-v1 when present. */
     nextAction?: unknown;
+    /** Override createdAt timestamp (fixtures / tests); otherwise `new Date().toISOString()`. */
+    createdAt?: string;
+    /**
+     * When set, emit `manifest.sig.json` next to `manifest.json` produced by
+     * {@link signCanonicalBytesEd25519} over the canonicalised manifest bytes.
+     */
+    signingPrivateKeyPemUtf8?: string;
 };
 /**
- * Writes Decision Evidence Bundle: outcome-certificate, exit, human-layer, optional attestation/next-action, manifest last.
+ * Writes a v2 Decision Evidence Bundle:
+ *   outcome-certificate.json (canonical sorted JSON, no trailing newline)
+ *   material-truth.json      (canonical sorted JSON, no trailing newline)
+ *   exit.json                (existing format: JSON.stringify + newline)
+ *   human-layer.json         (existing format: JSON.stringify + newline)
+ *   optional attestation.json, next-action.json
+ *   manifest.json            (sorted JSON + newline, v2 with fingerprints)
+ *   optional manifest.sig.json (Ed25519 sidecar over the manifest bytes)
  */
 export declare function writeDecisionEvidenceBundle(options: WriteDecisionEvidenceBundleOptions): DecisionEvidenceCompleteness;
 //# sourceMappingURL=writeDecisionEvidenceBundle.d.ts.map