burnledger 0.9.1 → 0.10.0

package/dist/cjs/verify.d.ts

@@ -16,6 +16,7 @@
  *     output at issuance time (transparency_status=PENDING, no transparency).
  */
 import type { CryptoOps } from "./crypto.js";
+import { VerificationError } from "./errors.js";
 import type { TransparencyResult, VerificationResult } from "./models.js";
 /**
  * Every format this build can read, oldest first. Mirrors core.FormatVersions()
@@ -28,6 +29,17 @@ import type { TransparencyResult, VerificationResult } from "./models.js";
  * script on the page could otherwise push a version onto it.
  */
 export declare const KNOWN_FORMAT_VERSIONS: readonly string[];
+/**
+ * Does this format sign the top-level run_id (ADR-031)?
+ *
+ * v10 onward, and optional even there: a record issued outside a run has none.
+ * A record OLDER than v10 that carries one is refused outright rather than
+ * signed without it — the field would ride in the JSON beside a signature that
+ * says nothing about it. Exported for the audit pack verifier, which asks the
+ * same question of a record that carries none: below v10 that says nothing
+ * about its run, from v10 it says the record was issued under no run.
+ */
+export declare function signatureCoversRunId(version: string): boolean;
 /** Decode hex: whole bytes, digits in either case, nothing else. Anything else
  * throws TypeError. It is exported, so its input is a boundary: reading a stray
  * character as 0, as it once did, turned a typo into different bytes. */
@@ -199,6 +211,18 @@ export declare function registrationQualifier(image: IssuingImage): string;
 export declare function verifyCertificate(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, options?: VerifyOptions): Promise<VerificationResult>;
 /** Verify the transparency proof embedded in a certificate. */
 export declare function verifyTransparency(crypto: CryptoOps, certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<TransparencyResult>;
+/** The first half of a transparency check, shared with the run record's
+ * (run-record.ts): the key's authority at the head's own timestamp, then the
+ * head's signature. The tree head carries its own timestamp, so this path
+ * always has an anchor; a timestamp that does not read leaves none, which is
+ * the same conservative answer as no proof at all. Throws the VerificationError
+ * the caller reports. Exported as an internal seam, not from index.ts. */
+export declare function verifyTransparencyHead(crypto: CryptoOps, transparency: Doc, pki: PublicKeyInfo, keyId: string): Promise<void>;
+/** The second half: an already-hashed leaf against the signed head, after the
+ * unsigned duplicates beside the proof are held to the signed copies. Throws
+ * the VerificationError the caller reports. Exported as an internal seam. */
+export declare function verifyTransparencyInclusion(crypto: CryptoOps, transparency: Doc, leaf: Uint8Array): Promise<void>;
+export declare function transparencyVerdictName(e: VerificationError): string;
 /** Reconstruct the certificate JSON as it existed at issuance time.
  *
  * At issuance: transparency_status = "PENDING", transparency = nil (omitted).
@@ -214,6 +238,30 @@ export declare function issuanceBytes(certificate: Cert): Uint8Array;
  * this and must be able to prove the two agree. Not re-exported from index.ts,
  * so it stays off the published API. */
 export declare function canonicalJson(obj: unknown): Uint8Array;
+type Doc = Record<string, unknown>;
+/** The 16 bytes of a UUID, in any form Go's uuid.Parse reads. Throws TypeError
+ * for anything else: a UUID reaches a signed payload only as its canonical
+ * string, and an unreadable one must not be signed as whatever text arrived. */
+export declare function parseUuid(text: string): Uint8Array;
+/** The canonical lowercase 8-4-4-4-12 form, as Go's uuid.UUID.String prints:
+ * the only form a UUID takes inside a signed payload. */
+export declare function formatUuid(bytes: Uint8Array): string;
+/**
+ * Decode a fixed-size byte field — a hash, a key, a signature.
+ *
+ * Go marshals `[N]byte` as an array of numbers; hand-written documents carry
+ * hex or standard base64. A well-formed value of the right size is never
+ * ambiguous between the two text forms, because base64 of 32 or 64 bytes ends
+ * in padding hex cannot contain.
+ *
+ * Everything else is refused here, by name: a number, an array element that is
+ * not a byte, text that is neither encoding, the wrong length. Decoding it
+ * leniently instead wrapped 300 to 44 inside a Uint8Array, produced bytes no
+ * signature covers and blamed the signature — or threw from inside atob.
+ */
+/** Exported for run-record.ts, whose digests and roots arrive in the same
+ * shapes; not published from index.ts. */
+export declare function decodeFixed(value: unknown, path: string, length: number): Uint8Array;
 /** Normalize a certificate timestamp to the UTC form Go signs.
  *
  * Go builds every payload timestamp as `t.UTC().Format("2006-01-02T15:04:05Z")`
@@ -239,6 +287,10 @@ export declare function canonicalJson(obj: unknown): Uint8Array;
  * always used, for callers normalizing a time that is not a field of a document.
  */
 export declare function formatTimestamp(ts: unknown, field?: string): string;
+/** Port of Go's BuildLogLeafPayload (ADR-016 §4). A RUN_RECORD leaf names its
+ * run id where the other two name a certificate id, under the same key
+ * (ADR-031). Exported for run-record.ts; not published from index.ts. */
+export declare function buildLogLeafPayload(entryType: unknown, certificateId: string, certificateHash: Uint8Array, appendedAt: unknown): Uint8Array;
 /**
  * Port of Go's BuildTreeHeadPayload.
  *
@@ -253,6 +305,12 @@ export declare function formatTimestamp(ts: unknown, field?: string): string;
  * between two modules of this package, not published surface.
  */
 export declare function buildTreeHeadPayload(head: Record<string, unknown>): Uint8Array;
+/** Exported for run-record.ts, whose roots are trees over these leaves. */
+export declare function hashLeaf(crypto: CryptoOps, data: Uint8Array): Promise<Uint8Array>;
+/** The RFC 6962 root over already-hashed leaves, in the order given. Port of
+ * Go's treeHash, which like it takes at least one leaf: the empty tree has no
+ * root here, and a caller with nothing to commit to says so itself. */
+export declare function merkleRoot(crypto: CryptoOps, leaves: Uint8Array[]): Promise<Uint8Array>;
 /** Verify a Merkle consistency proof (RFC 6962 Section 2.1.4).
  *
  * Port of Go's VerifyConsistency / Python's _verify_consistency.

package/dist/cjs/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQjD,CAAC;AAqIH;;yEAEyE;AACzE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQlD;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAqC7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AA0FD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,CAAC;CACrD;AAoCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAQ7D,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,wBAAgB,YAAY,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAmBjE;AA0ED,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA+H7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AA6FD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAMD;;wCAEwC;AACxC,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEtD;AA4HD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,SAAc,GAAG,MAAM,CAMxE;AAybD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AA0FD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAuBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,aAAa,EAAE,OAAO,EACtB,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAoFjB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAKL,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAoF1E;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EASjD,CAAC;AA8EH;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE7D;AAyDD;;yEAEyE;AACzE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQlD;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQpD;AAoCD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;8CAE0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AACzE,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAoBnE;;;sEAGsE;AACtE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAqC7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAUrF;AA0FD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,CAAC;CACrD;AAoCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAQ7D,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrF;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,wBAAgB,YAAY,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,CAQ5D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAmBjE;AA0ED,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA+H7B;AAKD,+DAA+D;AAC/D,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAgC7B;AAyFD;;;;;0EAK0E;AAC1E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,GAAG,EACjB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;6EAE6E;AAC7E,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,YAAY,EAAE,GAAG,EACjB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,IAAI,CAAC,CA+Cf;AAkBD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAKpE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAK3D;AAMD;;wCAEwC;AACxC,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAEtD;AAkCD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAgDnC;;gFAEgF;AAChF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAMlD;AAED;yDACyD;AACzD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAkBD;;;;;;;;;;;;GAYG;AACH;0CAC0C;AAC1C,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAmBpF;AAYD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,SAAc,GAAG,MAAM,CAMxE;AAyZD;;yEAEyE;AACzE,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,UAAU,EAC3B,UAAU,EAAE,OAAO,GAClB,UAAU,CAYZ;AA8BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAW9E;AAMD,2EAA2E;AAC3E,wBAAsB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEvF;AAED;;uEAEuE;AACvE,wBAAsB,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAK7F;AAkFD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAGD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,UAAU,CAuBZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAqB5E;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,aAAa,EAAE,OAAO,EACtB,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAoFjB"}

package/dist/cjs/verify.js

@@ -18,6 +18,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VALID_REVOCATION_UNKNOWN = exports.PRE_PROTOCOL_12_IMAGES = exports.VALID_KEY_WINDOW_UNKNOWN = exports.VALID_KEY_COMPROMISED_LATER = exports.KEY_COMPROMISED = exports.KEY_OUTSIDE_VALIDITY = exports.KNOWN_FORMAT_VERSIONS = void 0;
+exports.signatureCoversRunId = signatureCoversRunId;
 exports.hexToBytes = hexToBytes;
 exports.bytesToHex = bytesToHex;
 exports.publicKeyFromHex = publicKeyFromHex;
@@ -28,10 +29,19 @@ exports.issuingImage = issuingImage;
 exports.registrationQualifier = registrationQualifier;
 exports.verifyCertificate = verifyCertificate;
 exports.verifyTransparency = verifyTransparency;
+exports.verifyTransparencyHead = verifyTransparencyHead;
+exports.verifyTransparencyInclusion = verifyTransparencyInclusion;
+exports.transparencyVerdictName = transparencyVerdictName;
 exports.issuanceBytes = issuanceBytes;
 exports.canonicalJson = canonicalJson;
+exports.parseUuid = parseUuid;
+exports.formatUuid = formatUuid;
+exports.decodeFixed = decodeFixed;
 exports.formatTimestamp = formatTimestamp;
+exports.buildLogLeafPayload = buildLogLeafPayload;
 exports.buildTreeHeadPayload = buildTreeHeadPayload;
+exports.hashLeaf = hashLeaf;
+exports.merkleRoot = merkleRoot;
 exports.verifyConsistency = verifyConsistency;
 exports.buildCertificateStatusPayload = buildCertificateStatusPayload;
 exports.buildKeyListPayload = buildKeyListPayload;
@@ -98,6 +108,17 @@ const FORMAT_VERSION_V8 = "8.0";
 const PAYLOAD_TYPE_ATTESTATION_V9 = "burnledger.attestation.v9";
 const PAYLOAD_TYPE_VERIFICATION_RECORD_V9 = "burnledger.verification_record.v9";
 const FORMAT_VERSION_V9 = "9.0";
+// v10 signs one top-level field, run_id: the run-level record (ADR-031) the
+// record was issued under, when it was issued under one. The attestation bytes
+// are v9's; its tag still moves, for the reason every version's does.
+//
+// READ-ONLY IN THIS BUILD, mirroring core, for the runbook-invariant-5 reason
+// spelled out for v8 above. Until issuance moves, a run binds its records by
+// the run record's records_root alone (run-record.ts), which is the binding
+// the verifier checks in every case.
+const PAYLOAD_TYPE_ATTESTATION_V10 = "burnledger.attestation.v10";
+const PAYLOAD_TYPE_VERIFICATION_RECORD_V10 = "burnledger.verification_record.v10";
+const FORMAT_VERSION_V10 = "10.0";
 const FORMAT_VERSION_V3 = "3.0";
 /**
  * The only signature scheme this SDK can check. A v7 record names its own
@@ -123,6 +144,7 @@ exports.KNOWN_FORMAT_VERSIONS = Object.freeze([
     FORMAT_VERSION_V7,
     FORMAT_VERSION_V8,
     FORMAT_VERSION_V9,
+    FORMAT_VERSION_V10,
 ]);
 /**
  * Returns the version, or throws if this SDK cannot read it.
@@ -190,6 +212,19 @@ function signatureCoversRecoverableState(version) {
 function signatureCoversAuthorization(version) {
     return formatAtLeast(version, FORMAT_VERSION_V9);
 }
+/**
+ * Does this format sign the top-level run_id (ADR-031)?
+ *
+ * v10 onward, and optional even there: a record issued outside a run has none.
+ * A record OLDER than v10 that carries one is refused outright rather than
+ * signed without it — the field would ride in the JSON beside a signature that
+ * says nothing about it. Exported for the audit pack verifier, which asks the
+ * same question of a record that carries none: below v10 that says nothing
+ * about its run, from v10 it says the record was issued under no run.
+ */
+function signatureCoversRunId(version) {
+    return formatAtLeast(version, FORMAT_VERSION_V10);
+}
 /** The two values a v9 record's per-system authorization may take. */
 const AUTHORIZATION_CERTIFIED = "certified";
 const AUTHORIZATION_NONE = "none";
@@ -752,14 +787,25 @@ async function verifyTransparency(crypto, certificate, publicKeys) {
     if (certificate.transparency == null) {
         return "NOT_AVAILABLE";
     }
+    const transparency = objectAt(certificate, "transparency", "transparency");
+    // Read before the key lookup, as it always was: a proof with no head is
+    // reported as that, not as a key the reader does not hold.
+    objectAt(transparency, "signed_tree_head", "transparency.signed_tree_head");
     const issuer = objectAt(certificate, "issuer", "issuer");
     const keyId = stringAt(issuer, "key_id", "issuer.key_id");
     const pki = publicKeys.get(keyId);
     if (pki === undefined)
         throw new errors_js_1.VerificationError(`unknown issuer key: ${keyId}`);
-    // The tree head carries its own timestamp, so this path always has an anchor.
-    requireUsableKey(pki, certificateAnchor(certificate), keyId);
-    await checkCertificateInclusion(crypto, certificate, pki);
+    await verifyTransparencyHead(crypto, transparency, pki, keyId);
+    // The leaf is NOT the certificate. It is the canonical log_leaf.v3 payload
+    // over entry_type, certificate_id, certificate_hash and appended_at, where
+    // certificate_hash is SHA-256 of the issuance-time certificate JSON
+    // (ADR-016 §4). v2 hashed the certificate directly, so an issuance and a
+    // revocation of the same certificate produced identical leaves and the tree
+    // committed to neither the entry type nor when it happened.
+    const issuanceData = issuanceBytes(certificate);
+    const leafPayload = buildLogLeafPayload(transparency.entry_type, stringAt(certificate, "certificate_id", "certificate_id"), await crypto.sha256(issuanceData), transparency.appended_at);
+    await verifyTransparencyInclusion(crypto, transparency, await hashLeaf(crypto, leafPayload));
     return "INCLUDED";
 }
 /**
@@ -824,6 +870,91 @@ async function checkCertificateInclusion(crypto, certificate, pki) {
         throw new errors_js_1.VerificationError("merkle inclusion proof is invalid");
     }
 }
+/** The first half of a transparency check, shared with the run record's
+ * (run-record.ts): the key's authority at the head's own timestamp, then the
+ * head's signature. The tree head carries its own timestamp, so this path
+ * always has an anchor; a timestamp that does not read leaves none, which is
+ * the same conservative answer as no proof at all. Throws the VerificationError
+ * the caller reports. Exported as an internal seam, not from index.ts. */
+async function verifyTransparencyHead(crypto, transparency, pki, keyId) {
+    const sth = objectAt(transparency, "signed_tree_head", "transparency.signed_tree_head");
+    let anchor = null;
+    if (typeof sth.timestamp === "string") {
+        try {
+            anchor = parseRfc3339(sth.timestamp);
+        }
+        catch {
+            anchor = null;
+        }
+    }
+    requireUsableKey(pki, anchor, keyId);
+    const headPayload = buildTreeHeadPayload(sth);
+    const headSig = decodeFixed(sth.signature, "signed_tree_head.signature", 64);
+    if (!(await crypto.ed25519Verify(pki.keyBytes, headPayload, headSig))) {
+        throw new errors_js_1.VerificationError("tree head signature is invalid");
+    }
+}
+/** The second half: an already-hashed leaf against the signed head, after the
+ * unsigned duplicates beside the proof are held to the signed copies. Throws
+ * the VerificationError the caller reports. Exported as an internal seam. */
+async function verifyTransparencyInclusion(crypto, transparency, leaf) {
+    const sth = objectAt(transparency, "signed_tree_head", "transparency.signed_tree_head");
+    const proofHashes = arrayAt(transparency, "inclusion_proof", "transparency.inclusion_proof").map((h, i) => decodeFixed(h, `transparency.inclusion_proof[${i}]`, 32));
+    const root = decodeFixed(sth.root_hash, "signed_tree_head.root_hash", 32);
+    // `?? 0` is not a convenience: encoding/json leaves 0 in Go's uint64 fields
+    // for an explicit null and for an absent key rather than failing, so refusing
+    // either would reject documents the reference accepts — the same class of
+    // divergence as #452. An offline verifier is only useful while it agrees.
+    const index = requireUint(transparency.entry_index ?? 0, "entry_index");
+    const treeSize = requireUint(sth.tree_size ?? 0, "signed_tree_head.tree_size");
+    // transparency.tree_size duplicates the signed one but carries no signature:
+    // BuildTreeHeadPayload covers only the copy inside signed_tree_head. Go used
+    // to verify against the unsigned copy while this SDK used the signed one, so
+    // the same document got two verdicts (#456). Both now require the two to agree
+    // and then verify against the signed copy — the server always writes them
+    // equal, so this rejects only edited documents.
+    const unsignedSize = requireUint(transparency.tree_size ?? 0, "transparency.tree_size");
+    if (unsignedSize !== treeSize) {
+        throw new errors_js_1.VerificationError(`transparency.tree_size (${unsignedSize}) does not match the signed tree head ` +
+            `(${treeSize}); it is not covered by any signature`);
+    }
+    // Same rule for the log id (Q31). transparency.log_id sits beside log_url and
+    // is the field a reader looks at to answer "which log is this?", and nothing
+    // signs it — so a holder could relabel a genuine proof as belonging to a
+    // different log while every signature still checked out. A head predating log
+    // ids has neither side set and passes.
+    const signedLogId = sth.log_id ?? "";
+    const unsignedLogId = transparency.log_id ?? "";
+    if (unsignedLogId !== signedLogId) {
+        throw new errors_js_1.VerificationError(`transparency.log_id (${JSON.stringify(unsignedLogId)}) does not match the signed ` +
+            `tree head (${JSON.stringify(signedLogId)}); it is not covered by any signature`);
+    }
+    if (!(await verifyInclusion(crypto, leaf, index, treeSize, proofHashes, root))) {
+        throw new errors_js_1.VerificationError("merkle inclusion proof is invalid");
+    }
+}
+/** The refusals of verifyTransparencyHead and verifyTransparencyInclusion under
+ * core.TransparencyResult's names, for the verifiers that report a pack or a
+ * run record beside Go's verdicts rather than by throwing. The key verdicts
+ * collapse to KEY_UNUSABLE as they do in Go, whose transparency result does not
+ * say which key problem. Anything unmatched is a field this SDK could not read:
+ * UNREADABLE_DOCUMENT, never a tampering claim. */
+const TRANSPARENCY_VERDICTS = [
+    ["issuer key is compromised:", "KEY_UNUSABLE"],
+    ["issuer key was not valid when it signed:", "KEY_UNUSABLE"],
+    ["issuer key has an unusable status", "KEY_UNUSABLE"],
+    ["tree head signature is invalid", "INVALID_TREE_HEAD_SIGNATURE"],
+    ["transparency.tree_size (", "INVALID_INCLUSION_PROOF"],
+    ["transparency.log_id (", "INVALID_INCLUSION_PROOF"],
+    ["merkle inclusion proof is invalid", "INVALID_INCLUSION_PROOF"],
+];
+function transparencyVerdictName(e) {
+    for (const [prefix, verdict] of TRANSPARENCY_VERDICTS) {
+        if (e.message.startsWith(prefix))
+            return verdict;
+    }
+    return "UNREADABLE_DOCUMENT";
+}
 // ---------------------------------------------------------------------------
 // Issuance bytes — matches Go's core.IssuanceBytes(cert)
 // ---------------------------------------------------------------------------
@@ -915,6 +1046,45 @@ function arrayAt(parent, key, path) {
         throw new errors_js_1.VerificationError(`${path} is not an array`);
     return Array.from(value);
 }
+/** A UUID in the forms Go's uuid.Parse accepts: 8-4-4-4-12 hex, the same in
+ * braces or behind "urn:uuid:", or 32 bare hex digits. */
+const UUID_RE = /^(?:urn:uuid:)?\{?([0-9a-fA-F]{8})-([0-9a-fA-F]{4})-([0-9a-fA-F]{4})-([0-9a-fA-F]{4})-([0-9a-fA-F]{12})\}?$/;
+const UUID_BARE_RE = /^[0-9a-fA-F]{32}$/;
+/** The 16 bytes of a UUID, in any form Go's uuid.Parse reads. Throws TypeError
+ * for anything else: a UUID reaches a signed payload only as its canonical
+ * string, and an unreadable one must not be signed as whatever text arrived. */
+function parseUuid(text) {
+    if (typeof text !== "string")
+        throw new TypeError(`uuid is not a string: ${typeof text}`);
+    const m = UUID_RE.exec(text);
+    const hex = m !== null ? m.slice(1).join("") : UUID_BARE_RE.test(text) ? text : null;
+    if (hex === null)
+        throw new TypeError(`not a UUID: ${JSON.stringify(text)}`);
+    return hexToBytes(hex);
+}
+/** The canonical lowercase 8-4-4-4-12 form, as Go's uuid.UUID.String prints:
+ * the only form a UUID takes inside a signed payload. */
+function formatUuid(bytes) {
+    if (bytes.length !== 16)
+        throw new TypeError(`uuid is ${bytes.length} bytes, expected 16`);
+    const h = bytesToHex(bytes);
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+/** Read a UUID field as Go's uuid.UUID unmarshals it, refusing with a
+ * VerificationError what encoding/json would refuse to parse. */
+function uuidAt(parent, key, path) {
+    const v = parent[key];
+    if (typeof v !== "string")
+        throw new errors_js_1.VerificationError(`${path} is not a string`);
+    try {
+        return formatUuid(parseUuid(v));
+    }
+    catch (e) {
+        if (e instanceof TypeError)
+            throw new errors_js_1.VerificationError(`${path} is not a UUID: ${JSON.stringify(v)}`);
+        throw e;
+    }
+}
 const HEX_TEXT_RE = /^(?:[0-9a-fA-F]{2})*$/;
 const BASE64_TEXT_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 /**
@@ -930,6 +1100,8 @@ const BASE64_TEXT_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/
  * leniently instead wrapped 300 to 44 inside a Uint8Array, produced bytes no
  * signature covers and blamed the signature — or threw from inside atob.
  */
+/** Exported for run-record.ts, whose digests and roots arrive in the same
+ * shapes; not published from index.ts. */
 function decodeFixed(value, path, length) {
     if (value === undefined || value === null)
         throw new errors_js_1.VerificationError(`${path} is missing`);
@@ -1167,6 +1339,8 @@ function requireMeasured(value, field, systemName, version) {
 /** Domain separator for the record itself, by certificate format version. */
 function certificatePayloadType(version) {
     checkFormatVersion(version);
+    if (version === FORMAT_VERSION_V10)
+        return PAYLOAD_TYPE_VERIFICATION_RECORD_V10;
     if (version === FORMAT_VERSION_V9)
         return PAYLOAD_TYPE_VERIFICATION_RECORD_V9;
     if (version === FORMAT_VERSION_V8)
@@ -1192,6 +1366,8 @@ function attestationPayloadType(version) {
     // Equality here, deliberately: each format has its OWN separator, so this is
     // a lookup rather than a "this version onward" question. v3 and v4 share one
     // because their attestation bytes are identical.
+    if (version === FORMAT_VERSION_V10)
+        return PAYLOAD_TYPE_ATTESTATION_V10;
     if (version === FORMAT_VERSION_V9)
         return PAYLOAD_TYPE_ATTESTATION_V9;
     if (version === FORMAT_VERSION_V8)
@@ -1321,11 +1497,25 @@ function buildCertificatePayload(cert) {
             version: stringAt(scope, "version", "scope.version"),
         };
     }
+    // Signed from v10 when present. On an older format the field is refused
+    // rather than dropped from the bytes: core.BuildCertificatePayload returns an
+    // error there and the verdict is INVALID_CERTIFICATE_SIGNATURE, so the same
+    // words open this message for the audit pack verifier to read it back as
+    // that verdict. A JSON null is an absent run, as Go's *uuid.UUID reads it.
+    if (cert.run_id != null) {
+        if (!signatureCoversRunId(version)) {
+            throw new errors_js_1.VerificationError(`certificate signature is invalid: the record carries run_id, which format ${version} does not ` +
+                `sign (run_id is signed from ${FORMAT_VERSION_V10}), so no signature covers the document as presented`);
+        }
+        payload.run_id = uuidAt(cert, "run_id", "run_id");
+    }
     return canonicalJson(payload);
 }
-/** Port of Go's BuildLogLeafPayload (ADR-016 §4). */
+/** Port of Go's BuildLogLeafPayload (ADR-016 §4). A RUN_RECORD leaf names its
+ * run id where the other two name a certificate id, under the same key
+ * (ADR-031). Exported for run-record.ts; not published from index.ts. */
 function buildLogLeafPayload(entryType, certificateId, certificateHash, appendedAt) {
-    if (entryType !== "CERTIFICATE" && entryType !== "REVOCATION") {
+    if (entryType !== "CERTIFICATE" && entryType !== "REVOCATION" && entryType !== "RUN_RECORD") {
         throw new errors_js_1.VerificationError(`invalid log entry_type: ${String(entryType)}`);
     }
     const payload = {
@@ -1393,9 +1583,21 @@ function buildTreeHeadPayload(head) {
 // ---------------------------------------------------------------------------
 // Merkle tree (RFC 6962) — ports of core/merkle.go
 // ---------------------------------------------------------------------------
+/** Exported for run-record.ts, whose roots are trees over these leaves. */
 async function hashLeaf(crypto, data) {
     return crypto.sha256(concatBytes(new Uint8Array([0x00]), data));
 }
+/** The RFC 6962 root over already-hashed leaves, in the order given. Port of
+ * Go's treeHash, which like it takes at least one leaf: the empty tree has no
+ * root here, and a caller with nothing to commit to says so itself. */
+async function merkleRoot(crypto, leaves) {
+    if (leaves.length === 0)
+        throw new RangeError("merkleRoot: no leaves");
+    if (leaves.length === 1)
+        return leaves[0];
+    const k = splitPoint(leaves.length);
+    return hashNode(crypto, await merkleRoot(crypto, leaves.slice(0, k)), await merkleRoot(crypto, leaves.slice(k)));
+}
 async function hashNode(crypto, left, right) {
     const prefix = new Uint8Array([0x01]);
     return crypto.sha256(concatBytes(prefix, concatBytes(left, right)));