eve-ai-governance 0.2.0 → 0.3.0

package/README.md

@@ -1,58 +1,63 @@
-# eve-ai-governance
+# eve-governance (TypeScript)
 
-**EVE AI Core Governance SDK (Node/TypeScript)** — deterministic AI decision
-enforcement in one API call, plus offline proof verification.
+TypeScript SDK for offline cryptographic verification of EVE AI Core
+governance artifacts.
+
+> **Note:** This package provides the TypeScript API contract and type
+> definitions.  Implementation bodies are stubs; the Python SDK
+> (`sdks/governance/`) contains the reference implementation.
+
+## Installation
 
 ```bash
-npm install eve-ai-governance
+npm install eve-governance
 ```
 
-Zero-config, dependency-light, ships ESM + CJS + type declarations.
+## Usage
 
-## Enforce a decision
+```typescript
+import {
+  verifyDecisionCertificate,
+  verifyChain,
+  verifyItiSnapshot,
+  healthBand,
+} from "eve-governance";
 
-```ts
-import { GovernanceClient, RateLimitError, PaymentRequiredError } from 'eve-ai-governance';
+// Verify a decision certificate
+const result = await verifyDecisionCertificate(cert);
+console.log(result.valid ? "✓ VERIFIED" : "✗ FAILED");
 
-const client = new GovernanceClient({ apiKey: 'eve_sk_...' });
+// Health band
+console.log(healthBand(87.5));  // "GOOD"
+```
 
-const result = await client.evaluate({
-  request_id: 'req-001',
-  tenant_id: 'bank_001',
-  proposed_action: { type: 'loan_approval', amount: 250000 },
-  model_output: { decision: 'approve', confidence: 0.91 },
-  context: { credit_score: 580, debt_to_income: 0.52 },
-  policy_set: 'lending_v1',
-});
-// result.decision.status -> "ALLOWED" | "BLOCKED" | "MODIFIED"
+## API
 
-// Billing / rate-limit metadata from the most recent call:
-client.subscriptionState; // 'active' | 'past_due' | ...
-client.rateLimit;         // { limit, remaining } | { limit: null, ... }
-client.quotaWarning;      // null | 'payment_past_due'
-```
+### `verifyHmac(payload, signature, key)`
+Verify an HMAC-SHA256 signature.
 
-Auth is `Authorization: Bearer eve_...`; the org/tenant is derived from the key
-server-side. See the [Response-Header Contract](../../docs/sdk/RESPONSE_HEADER_CONTRACT.md)
-for the full status-code and accessor reference (`RateLimitError` on 429,
-`PaymentRequiredError` on 402).
+### `verifyDecisionCertificate(certDict, options?)`
+Verify a single EVE CoreGuard decision certificate.
 
-## Verify a proof offline
+### `verifyBundle(bundlePath, options?)`
+Verify a replay export bundle (ZIP or JSONL).
 
-`verifyProof` recomputes the canonical content hash and checks the HMAC-SHA256
-signature **locally** — no network call. The canonicalization is byte-for-byte
-compatible with the Python SDKs (`json.dumps(sort_keys=True)`), so a proof signed
-by EVE verifies here and vice-versa. Tampering any field (including nested ones)
-fails; a wrong/empty signature returns `false` (never throws).
+### `verifyChain(events)`
+Verify hash-chain integrity of a list of audit events.
 
-```ts
-import { GovernanceClient } from 'eve-ai-governance';
+### `verifyItiSnapshot(snapshot, options?)`
+Verify an ITI snapshot.
 
-const ok = GovernanceClient.verifyProof(proofBundle, sharedSigningKey); // boolean
-```
+### `healthBand(compositeScore)`
+Map a score (0–100) to a health band string.
+
+### `analyzeReplayChain(events)`
+Analyze a replay chain and return structured metrics.
+
+## Types
 
-The same canonicalizer is exported as `canonicalizeForHash` for custom tooling.
+See `src/types.ts` for all TypeScript interfaces.
 
 ## License
 
-Proprietary. See LICENSE.
+Proprietary — EVE NeuroSystems LLC

package/dist/cjs/attestation.d.ts

@@ -0,0 +1,29 @@
+/**
+ * EVE Governance SDK — Attestation verification stubs (TypeScript).
+ */
+import type { VerificationResult, VerifyOptions } from "./types.js";
+/**
+ * Verify a deployment attestation / build provenance artifact.
+ *
+ * @param attestation - The attestation dict.
+ * @param options     - Optional signing key override.
+ * @returns           - Resolves to a `VerificationResult`.
+ */
+export declare function verifyDeploymentAttestation(attestation: Record<string, unknown>, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Verify a tenant trust certificate.
+ *
+ * @param cert    - The trust certificate dict.
+ * @param options - Optional signing key override.
+ * @returns       - Resolves to a `VerificationResult`.
+ */
+export declare function verifyTrustCertificate(cert: Record<string, unknown>, options?: VerifyOptions): Promise<VerificationResult>;
+/**
+ * Verify an enterprise onboarding bundle.
+ *
+ * @param bundle  - The onboarding bundle dict.
+ * @param options - Optional signing key override.
+ * @returns       - Resolves to a `VerificationResult`.
+ */
+export declare function verifyOnboardingBundle(bundle: Record<string, unknown>, options?: VerifyOptions): Promise<VerificationResult>;
+//# sourceMappingURL=attestation.d.ts.map

package/dist/cjs/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../../src/attestation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEpE;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAG7B;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAG7B"}

package/dist/cjs/attestation.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * EVE Governance SDK — Attestation verification stubs (TypeScript).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyDeploymentAttestation = verifyDeploymentAttestation;
+exports.verifyTrustCertificate = verifyTrustCertificate;
+exports.verifyOnboardingBundle = verifyOnboardingBundle;
+/**
+ * Verify a deployment attestation / build provenance artifact.
+ *
+ * @param attestation - The attestation dict.
+ * @param options     - Optional signing key override.
+ * @returns           - Resolves to a `VerificationResult`.
+ */
+async function verifyDeploymentAttestation(attestation, options) {
+    // TODO: implement
+    throw new Error("Not implemented");
+}
+/**
+ * Verify a tenant trust certificate.
+ *
+ * @param cert    - The trust certificate dict.
+ * @param options - Optional signing key override.
+ * @returns       - Resolves to a `VerificationResult`.
+ */
+async function verifyTrustCertificate(cert, options) {
+    // TODO: implement
+    throw new Error("Not implemented");
+}
+/**
+ * Verify an enterprise onboarding bundle.
+ *
+ * @param bundle  - The onboarding bundle dict.
+ * @param options - Optional signing key override.
+ * @returns       - Resolves to a `VerificationResult`.
+ */
+async function verifyOnboardingBundle(bundle, options) {
+    // TODO: implement
+    throw new Error("Not implemented");
+}
+//# sourceMappingURL=attestation.js.map

package/dist/cjs/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../../src/attestation.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAWH,kEAMC;AASD,wDAMC;AASD,wDAMC;AA3CD;;;;;;GAMG;AACI,KAAK,UAAU,2BAA2B,CAC/C,WAAoC,EACpC,OAAuB;IAEvB,kBAAkB;IAClB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAA6B,EAC7B,OAAuB;IAEvB,kBAAkB;IAClB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB,CAC1C,MAA+B,EAC/B,OAAuB;IAEvB,kBAAkB;IAClB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACrC,CAAC"}

package/dist/cjs/canonical.d.ts

@@ -0,0 +1,51 @@
+/**
+ * EVE Governance SDK — pure canonicalization primitives.
+ *
+ * ZERO runtime dependencies and ZERO platform APIs (no `node:crypto`, no
+ * `Buffer`) — safe to run in Node **and** in the browser. This is the single
+ * source of truth for the serialization used by every verifier
+ * (`verify.ts` = Node, `decision.ts` = Node asymmetric, `decision-web.ts` =
+ * browser/WebCrypto), so their canonical bytes cannot drift apart.
+ *
+ * Two serializations, matching the Python backend byte-for-byte:
+ *   - COMPACT      json.dumps(obj, sort_keys=True, separators=(",",":"))
+ *                  -> eve-request-v1 / eve-response-v1 preimage digests + HMAC certs
+ *   - DEFAULT-SEP  json.dumps(payload, sort_keys=True)   (", " / ": ")
+ *                  -> eve-jsonc-v1 decision-record content hash
+ *
+ * Both use ensure_ascii=True (non-ASCII -> \uXXXX) and recursive key sorting by
+ * Unicode code point.
+ */
+/**
+ * Compare two strings by Unicode code point (matching Python `sort_keys=True`),
+ * NOT by UTF-16 code unit (JS default `Array.sort`), which diverges for
+ * astral-plane keys.
+ */
+export declare function compareCodePoints(a: string, b: string): number;
+/** Deep-copy with all object keys recursively sorted; arrays keep order. */
+export declare function sortKeys(obj: unknown): unknown;
+/**
+ * Escape to match Python `json.dumps` default (`ensure_ascii=True`): standard
+ * short escapes, `\uXXXX` (lowercase hex) for every other control char and every
+ * non-ASCII UTF-16 code unit. `/` is not escaped. Iterating code units yields
+ * the surrogate halves Python emits for astral characters.
+ */
+export declare function escapeString(s: string): string;
+/**
+ * Format a number to match Python `json.dumps`. Integers emit without a decimal
+ * point; non-integers use JS shortest repr (agrees with Python for the decimal
+ * values in EVE evidence). See the canonicalization registry for the
+ * integer-valued-float cross-language constraint.
+ */
+export declare function formatNumber(n: number): string;
+/** Compact serialization of an ALREADY key-sorted value (separators ",",":"). */
+export declare function serializeCompact(value: unknown): string;
+/** Default-separator serialization of an ALREADY key-sorted value (", " / ": "). */
+export declare function serializeDefaultSep(value: unknown): string;
+/** Canonical compact JSON bytes of a payload (sorts keys, then compact). */
+export declare function canonicalizeCompact(payload: Record<string, unknown>): string;
+/** Canonical default-separator JSON bytes of a payload (sorts keys, then ", "/": "). */
+export declare function canonicalizeDefaultSep(payload: Record<string, unknown>): string;
+/** Constant-time-ish equality for two strings (no platform crypto needed). */
+export declare function constantTimeEqual(a: string, b: string): boolean;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/cjs/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAW9C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAqB9C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO9C;AAmBD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEvD;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE1D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAE5E;AAED,wFAAwF;AACxF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAE/E;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK/D"}

package/dist/cjs/canonical.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * EVE Governance SDK — pure canonicalization primitives.
+ *
+ * ZERO runtime dependencies and ZERO platform APIs (no `node:crypto`, no
+ * `Buffer`) — safe to run in Node **and** in the browser. This is the single
+ * source of truth for the serialization used by every verifier
+ * (`verify.ts` = Node, `decision.ts` = Node asymmetric, `decision-web.ts` =
+ * browser/WebCrypto), so their canonical bytes cannot drift apart.
+ *
+ * Two serializations, matching the Python backend byte-for-byte:
+ *   - COMPACT      json.dumps(obj, sort_keys=True, separators=(",",":"))
+ *                  -> eve-request-v1 / eve-response-v1 preimage digests + HMAC certs
+ *   - DEFAULT-SEP  json.dumps(payload, sort_keys=True)   (", " / ": ")
+ *                  -> eve-jsonc-v1 decision-record content hash
+ *
+ * Both use ensure_ascii=True (non-ASCII -> \uXXXX) and recursive key sorting by
+ * Unicode code point.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareCodePoints = compareCodePoints;
+exports.sortKeys = sortKeys;
+exports.escapeString = escapeString;
+exports.formatNumber = formatNumber;
+exports.serializeCompact = serializeCompact;
+exports.serializeDefaultSep = serializeDefaultSep;
+exports.canonicalizeCompact = canonicalizeCompact;
+exports.canonicalizeDefaultSep = canonicalizeDefaultSep;
+exports.constantTimeEqual = constantTimeEqual;
+/**
+ * Compare two strings by Unicode code point (matching Python `sort_keys=True`),
+ * NOT by UTF-16 code unit (JS default `Array.sort`), which diverges for
+ * astral-plane keys.
+ */
+function compareCodePoints(a, b) {
+    const ia = Array.from(a);
+    const ib = Array.from(b);
+    const n = Math.min(ia.length, ib.length);
+    for (let i = 0; i < n; i += 1) {
+        const ca = ia[i].codePointAt(0);
+        const cb = ib[i].codePointAt(0);
+        if (ca !== cb)
+            return ca - cb;
+    }
+    return ia.length - ib.length;
+}
+/** Deep-copy with all object keys recursively sorted; arrays keep order. */
+function sortKeys(obj) {
+    if (Array.isArray(obj))
+        return obj.map(sortKeys);
+    if (obj !== null && typeof obj === "object") {
+        const src = obj;
+        const sorted = {};
+        for (const key of Object.keys(src).sort(compareCodePoints)) {
+            sorted[key] = sortKeys(src[key]);
+        }
+        return sorted;
+    }
+    return obj;
+}
+/**
+ * Escape to match Python `json.dumps` default (`ensure_ascii=True`): standard
+ * short escapes, `\uXXXX` (lowercase hex) for every other control char and every
+ * non-ASCII UTF-16 code unit. `/` is not escaped. Iterating code units yields
+ * the surrogate halves Python emits for astral characters.
+ */
+function escapeString(s) {
+    let out = '"';
+    for (let i = 0; i < s.length; i += 1) {
+        const code = s.charCodeAt(i);
+        switch (code) {
+            case 0x22:
+                out += '\\"';
+                break;
+            case 0x5c:
+                out += "\\\\";
+                break;
+            case 0x08:
+                out += "\\b";
+                break;
+            case 0x09:
+                out += "\\t";
+                break;
+            case 0x0a:
+                out += "\\n";
+                break;
+            case 0x0c:
+                out += "\\f";
+                break;
+            case 0x0d:
+                out += "\\r";
+                break;
+            default:
+                if (code < 0x20 || code > 0x7e) {
+                    out += "\\u" + code.toString(16).padStart(4, "0");
+                }
+                else {
+                    out += s[i];
+                }
+        }
+    }
+    return out + '"';
+}
+/**
+ * Format a number to match Python `json.dumps`. Integers emit without a decimal
+ * point; non-integers use JS shortest repr (agrees with Python for the decimal
+ * values in EVE evidence). See the canonicalization registry for the
+ * integer-valued-float cross-language constraint.
+ */
+function formatNumber(n) {
+    if (!Number.isFinite(n)) {
+        if (Number.isNaN(n))
+            return "NaN";
+        return n > 0 ? "Infinity" : "-Infinity";
+    }
+    if (Number.isInteger(n))
+        return Object.is(n, -0) ? "0" : String(n);
+    return String(n);
+}
+function serializeWith(value, itemSep, kvSep) {
+    if (value === null || value === undefined)
+        return "null";
+    const t = typeof value;
+    if (t === "string")
+        return escapeString(value);
+    if (t === "number")
+        return formatNumber(value);
+    if (t === "boolean")
+        return value ? "true" : "false";
+    if (t === "bigint")
+        return value.toString();
+    if (Array.isArray(value))
+        return "[" + value.map((v) => serializeWith(v, itemSep, kvSep)).join(itemSep) + "]";
+    if (t === "object") {
+        const obj = value;
+        const parts = [];
+        for (const key of Object.keys(obj))
+            parts.push(escapeString(key) + kvSep + serializeWith(obj[key], itemSep, kvSep));
+        return "{" + parts.join(itemSep) + "}";
+    }
+    return "null";
+}
+/** Compact serialization of an ALREADY key-sorted value (separators ",",":"). */
+function serializeCompact(value) {
+    return serializeWith(value, ",", ":");
+}
+/** Default-separator serialization of an ALREADY key-sorted value (", " / ": "). */
+function serializeDefaultSep(value) {
+    return serializeWith(value, ", ", ": ");
+}
+/** Canonical compact JSON bytes of a payload (sorts keys, then compact). */
+function canonicalizeCompact(payload) {
+    return serializeCompact(sortKeys(payload));
+}
+/** Canonical default-separator JSON bytes of a payload (sorts keys, then ", "/": "). */
+function canonicalizeDefaultSep(payload) {
+    return serializeDefaultSep(sortKeys(payload));
+}
+/** Constant-time-ish equality for two strings (no platform crypto needed). */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i += 1)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/cjs/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/canonical.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAOH,8CAUC;AAGD,4BAWC;AAQD,oCAqBC;AAQD,oCAOC;AAoBD,4CAEC;AAGD,kDAEC;AAGD,kDAEC;AAGD,wDAEC;AAGD,8CAKC;AAtHD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;QAC1C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;QAC1C,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,4EAA4E;AAC5E,SAAgB,QAAQ,CAAC,GAAY;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;gBAAC,MAAM;YAC/B,KAAK,IAAI;gBAAE,GAAG,IAAI,MAAM,CAAC;gBAAC,MAAM;YAChC,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;gBAAC,MAAM;YAC/B,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;gBAAC,MAAM;YAC/B,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;gBAAC,MAAM;YAC/B,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;gBAAC,MAAM;YAC/B,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;gBAAC,MAAM;YAC/B;gBACE,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;oBAC/B,GAAG,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,CAAS;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,OAAe,EAAE,KAAa;IACnE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,CAAC,GAAG,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAe,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAe,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAQ,KAAgB,CAAC,QAAQ,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;IAC9G,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACpH,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,OAAO,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,oFAAoF;AACpF,SAAgB,mBAAmB,CAAC,KAAc;IAChD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,SAAgB,mBAAmB,CAAC,OAAgC;IAClE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,wFAAwF;AACxF,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,SAAgB,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/cjs/decision-web.d.ts

@@ -0,0 +1,29 @@
+/**
+ * EVE Governance SDK — BROWSER decision-record verifier (WebCrypto).
+ *
+ * The browser/isomorphic counterpart of `decision.ts`. It verifies the
+ * asymmetric, independently-verifiable `eve.decision.v3` decision certificate
+ * (`ed25519-` / `ecdsa-p256-`) using **WebCrypto (`crypto.subtle`)** and the
+ * shared pure canonicalization in `canonical.ts` — so its bytes match the Node
+ * and Python verifiers exactly. No `node:*` imports; runs in the browser and in
+ * Node (>=20). Public key only — no shared secret.
+ *
+ * `verifyDecisionRecordWeb` is **async** (WebCrypto is promise-based). HMAC
+ * records are reported not-independently-verifiable and are NOT verified here
+ * (symmetric verification belongs on a trusted server, not the browser).
+ *
+ * Browser support note: WebCrypto Ed25519 requires a recent browser
+ * (Chrome/Edge 137+, Firefox 129+, Safari 17+) or Node >=20. ECDSA-P256 is
+ * universally supported. If the runtime lacks Ed25519, verification returns a
+ * clear `valid:false` reason rather than throwing.
+ */
+import type { DecisionRecordVerificationResult } from "./types.js";
+import type { VerifyDecisionRecordOptions } from "./decision.js";
+/**
+ * Verify an EVE decision record (or `{decision_record, verification}` wrapper)
+ * in the browser with WebCrypto. Async; mirrors `verifyDecisionRecord` (Node).
+ * HMAC records are reported not-independently-verifiable (not verified here).
+ * Never throws — failures resolve to `{ valid: false, ... }`.
+ */
+export declare function verifyDecisionRecordWeb(recordOrEvidence: Record<string, unknown>, options?: VerifyDecisionRecordOptions): Promise<DecisionRecordVerificationResult>;
+//# sourceMappingURL=decision-web.d.ts.map

package/dist/cjs/decision-web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-web.d.ts","sourceRoot":"","sources":["../../src/decision-web.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AA8MjE;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gCAAgC,CAAC,CAkF3C"}