genesis-mesh-sdk 0.59.1 → 0.61.0

package/CHANGELOG.md

@@ -7,6 +7,48 @@ Versions align with the [Genesis Mesh release sequence](https://github.com/Genes
 
 ---
 
+## [0.61.0] - 2026-10-02
+
+Coordinated Genesis Mesh v0.61.0 release: the cross-language interoperability
+proof. The core's interop scenario uses this SDK to sign data access intents,
+submit them to the NA, and verify Python records.
+
+### Added
+
+- `verifyAgreement`, `verifyDataLicensePolicySignature` and
+  `verifyDataAccessIntent`: offline verification with the reason codes of the
+  Python reference.
+- `createDataAccessIntent`: build and sign a data access intent as the agent.
+- `agreementCanonical`, `dataLicensePolicyCanonical`,
+  `dataAccessIntentCanonical`.
+- The shared `interop` conformance vectors (25) in
+  `tests/fixtures/conformance/interop.json`, all passing.
+
+### Fixed
+
+- `AgreementRecord`, `AgreementTerms`, `CapabilityOffer`, `CapabilityCounter`,
+  `DataAccessIntent` and `DataSourceDescriptor` now match the wire format.
+- `parseJson` keeps integer literals beyond `Number.MAX_SAFE_INTEGER` exactly
+  (as `bigint`), and `canonicalJson` encodes them.
+
+## [0.60.0] - 2026-10-01
+
+Coordinated Genesis Mesh v0.60.0 release: client support for the Network
+Authority's optional high availability.
+
+- Add `baseUrls`: several NA instances without a load balancer. Idempotent
+  requests fail over on transport errors and 502/503/504. Non-idempotent
+  requests move only when the connection was never made, and are never
+  replayed after it may have been.
+- Add `NetworkError.connectFailed`.
+- Add `client.health`: `liveness()`, `readiness()` (typed `/readyz`, not-ready
+  returned as `ready: false` with the failing checks), `health()`, and
+  `endpoints()` to probe every configured instance.
+- Add `isRetryableConflict()` and the `HaConflictCode` type for the 409 codes
+  an NA instance returns when it loses a race the database decided.
+- Add a live HA test (`tests/e2e-ha.test.ts`): two instances on PostgreSQL
+  behind nginx, one killed mid-run. CI runs it against core `main`.
+
 ## [0.59.1] - 2026-10-01
 
 Coordinated Genesis Mesh v0.59.1 release: TypeScript support for governed

package/README.md

@@ -37,6 +37,7 @@ execution recording, evidence-store queries and offline verification.
 - [Governed actions and reconciliation](docs/governance.md)
 - [Evidence store, policies, signers and retries](docs/evidence-store.md)
 - [Offline verification and integration tests](docs/offline-verification.md)
+- [High availability: failover, readiness and conflicts](docs/high-availability.md)
 
 `governedAction` requires verification keys and explicit expected policies. It
 verifies the signed response and its request context before calling the supplied
@@ -219,6 +220,13 @@ const dv = await client.dataUsage.verify({ intent, policy: pol });
 console.log(dv.valid, dv.violations);
 ```
 
+## Offline verification
+
+The SDK verifies boundary decisions, evidence exports, and from 0.61.0
+agreements, data license policies and data access intents offline, and signs
+data access intents with `createDataAccessIntent`. See
+[docs/offline-verification.md](docs/offline-verification.md).
+
 ## Raw admin calls
 
 For NA routes not yet covered by a sub-client (e.g. `/admin/recognition-treaties`),

package/dist/cjs/auth.js

@@ -74,12 +74,17 @@ function pythonNumber(value, pythonFloat = false) {
  */
 const PYTHON_FLOATS = new WeakMap();
 /**
- * JSON.parse that remembers integral-valued floats so canonicalJson reproduces
- * them. Use it for any NA JSON that will be verified or digested. Requires
- * JSON.parse source text access (Node.js 22+).
+ * JSON.parse that keeps what Python would sign: integral-valued floats are
+ * remembered so canonicalJson reproduces them (`90.0`), and integer literals
+ * beyond Number.MAX_SAFE_INTEGER become `bigint` so no digit is lost. Use it
+ * for any NA JSON that will be verified or digested. Requires JSON.parse source
+ * text access (Node.js 22+).
  */
 function parseJson(text) {
     return JSON.parse(text, function (key, value, context) {
+        if (typeof value === 'number' && !Number.isSafeInteger(value) && context?.source && /^-?\d+$/.test(context.source)) {
+            return BigInt(context.source);
+        }
         if (typeof value === 'number' && Number.isInteger(value) && context?.source && /[.eE]/.test(context.source)) {
             let keys = PYTHON_FLOATS.get(this);
             if (!keys)
@@ -112,6 +117,8 @@ function canonicalJson(value) {
         return asciiString(value);
     if (typeof value === 'number')
         return pythonNumber(value);
+    if (typeof value === 'bigint')
+        return value.toString();
     if (typeof value === 'boolean')
         return value ? 'true' : 'false';
     if (Array.isArray(value))

package/dist/cjs/canonical.js

@@ -20,6 +20,9 @@ exports.freshnessProofCanonical = freshnessProofCanonical;
 exports.checkpointCanonical = checkpointCanonical;
 exports.entryDigest = entryDigest;
 exports.payloadDigest = payloadDigest;
+exports.agreementCanonical = agreementCanonical;
+exports.dataLicensePolicyCanonical = dataLicensePolicyCanonical;
+exports.dataAccessIntentCanonical = dataAccessIntentCanonical;
 const auth_js_1 = require("./auth.js");
 /** v0.59 resource-chain fields, omitted from the execution canonical form when absent. */
 exports.RESOURCE_CHAIN_FIELDS = [
@@ -87,3 +90,22 @@ function entryDigest(entry) {
 function payloadDigest(payload) {
     return (0, auth_js_1.canonicalDigest)(payload);
 }
+/** Fields both parties sign; identical for CapabilityCounter and AgreementRecord (excludes ids and timestamps). */
+const AGREEMENT_CANONICAL_FIELDS = [
+    'agreed_terms', 'graph_digest', 'offer_id', 'offerer_evidence',
+    'offerer_sovereign_id', 'responder_evidence', 'responder_sovereign_id',
+];
+/** The body both parties of an agreement sign. */
+function agreementCanonical(record) {
+    const source = record;
+    const body = {};
+    for (const key of AGREEMENT_CANONICAL_FIELDS)
+        body[key] = source[key] ?? null;
+    return (0, auth_js_1.canonicalJson)(body);
+}
+function dataLicensePolicyCanonical(policy) {
+    return (0, auth_js_1.canonicalJson)(without(policy, ['signature']));
+}
+function dataAccessIntentCanonical(intent) {
+    return (0, auth_js_1.canonicalJson)(without(intent, ['signature']));
+}

package/dist/cjs/client.js

@@ -21,8 +21,24 @@ function buildPath(path, query) {
     const qs = params.toString();
     return qs ? `${path}?${qs}` : path;
 }
+const FAILOVER_STATUS = new Set([502, 503, 504]);
+/** Errors meaning no connection was made, so the request was never sent. */
+const CONNECT_FAILURE_CODES = new Set([
+    'ECONNREFUSED', 'ENOTFOUND', 'EHOSTUNREACH', 'ENETUNREACH', 'EAI_AGAIN', 'UND_ERR_CONNECT_TIMEOUT',
+]);
+function isConnectFailure(err) {
+    const cause = err?.cause;
+    if (!cause)
+        return false;
+    if (typeof cause.code === 'string' && CONNECT_FAILURE_CODES.has(cause.code))
+        return true;
+    return Array.isArray(cause.errors) && cause.errors.length > 0
+        && cause.errors.every(e => typeof e?.code === 'string' && CONNECT_FAILURE_CODES.has(e.code));
+}
 class HttpTransport {
-    baseUrl;
+    /** Every configured NA endpoint, in preference order. */
+    baseUrls;
+    active = 0;
     /** Key ID sent in X-Admin-Key-Id. */
     keyId;
     signer;
@@ -31,7 +47,14 @@ class HttpTransport {
     headers;
     _fetch;
     constructor(options) {
-        this.baseUrl = options.baseUrl.replace(/\/$/, '');
+        const urls = options.baseUrls ?? (options.baseUrl !== undefined ? [options.baseUrl] : []);
+        if (urls.length === 0 || urls.some(u => typeof u !== 'string' || !/^https?:\/\//.test(u))) {
+            throw new Error('baseUrl or baseUrls must give at least one http(s) URL');
+        }
+        if (options.baseUrl !== undefined && options.baseUrls !== undefined) {
+            throw new Error('pass either baseUrl or baseUrls, not both');
+        }
+        this.baseUrls = Object.freeze(urls.map(u => u.replace(/\/$/, '')));
         this.signer = options.signer
             ?? (options.signingKeyBase64
                 ? (0, auth_js_1.seedSigner)(options.signingKeyBase64, options.keyId ?? 'operator-local')
@@ -46,6 +69,15 @@ class HttpTransport {
         this.headers = options.headers ?? {};
         this._fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
     }
+    /** The endpoint requests currently go to. */
+    get baseUrl() {
+        return this.baseUrls[this.active];
+    }
+    /** Move to the next endpoint (no-op with one endpoint). */
+    failover() {
+        if (this.baseUrls.length > 1)
+            this.active = (this.active + 1) % this.baseUrls.length;
+    }
     /** Signed admin POST. Not retried unless `idempotent` is set. */
     async adminPost(path, body, idempotent = false) {
         const response = await this._send({ method: 'POST', path, body, admin: true, idempotent });
@@ -73,30 +105,76 @@ class HttpTransport {
         return this._parse(response);
     }
     async _send(spec) {
-        const attempts = spec.idempotent ? this.retry.attempts : 0;
-        for (let attempt = 0;; attempt++) {
+        // Idempotent requests may try every other endpoint once, plus the
+        // configured retries (with backoff). Non-idempotent requests move to
+        // another endpoint only when the connection was never established; after
+        // any other failure they are not replayed, and the next request starts at
+        // another endpoint.
+        const failovers = this.baseUrls.length - 1;
+        const retries = spec.idempotent ? this.retry.attempts : 0;
+        let failoversLeft = failovers;
+        let retriesUsed = 0;
+        for (;;) {
+            let response;
+            let error;
             try {
-                const response = await this._once(spec);
-                if (attempt < attempts && RETRYABLE_STATUS.has(response.status)) {
-                    await this._backoff(attempt);
-                    continue;
-                }
-                let body;
-                try {
-                    body = await response.text();
-                }
-                catch {
-                    throw new errors_js_1.NetworkError(`Failed to read response body (${spec.method} ${spec.path})`);
-                }
-                return { ok: response.ok, status: response.status, text: async () => body };
+                response = await this._attempt(spec);
             }
             catch (err) {
-                if (attempt < attempts && err instanceof errors_js_1.NetworkError) {
-                    await this._backoff(attempt);
-                    continue;
-                }
-                throw err;
+                if (!(err instanceof errors_js_1.NetworkError))
+                    throw err;
+                error = err;
+            }
+            const failoverWorthy = error !== undefined || (response !== undefined && FAILOVER_STATUS.has(response.status));
+            if (failoverWorthy)
+                this.failover();
+            // A request that may have reached an instance is replayed elsewhere only
+            // if it is idempotent; one that never connected can always move on.
+            const mayMove = spec.idempotent || (error instanceof errors_js_1.NetworkError && error.connectFailed);
+            if (failoverWorthy && mayMove && failoversLeft > 0) {
+                failoversLeft -= 1;
+                continue;
             }
+            const retryable = error !== undefined || (response !== undefined && RETRYABLE_STATUS.has(response.status));
+            if (retryable && retriesUsed < retries) {
+                await this._backoff(retriesUsed);
+                retriesUsed += 1;
+                failoversLeft = failovers;
+                continue;
+            }
+            if (error !== undefined)
+                throw error;
+            return response;
+        }
+    }
+    /** One request to the active endpoint, with the body fully read (a dropped body is a NetworkError). */
+    async _attempt(spec) {
+        const res = await this._once(spec);
+        let body;
+        try {
+            body = await res.text();
+        }
+        catch {
+            throw new errors_js_1.NetworkError(`Failed to read response body (${spec.method} ${spec.path})`);
+        }
+        return { ok: res.ok, status: res.status, text: async () => body };
+    }
+    /** Unauthenticated GET against one specific endpoint (no failover), e.g. per-instance readiness. */
+    async publicGetAt(baseUrl, path) {
+        const url = baseUrl.replace(/\/$/, '') + path;
+        let response;
+        try {
+            response = await this._fetch(url, { method: 'GET', headers: { ...this.headers }, signal: AbortSignal.timeout(this.timeout) });
+        }
+        catch (err) {
+            throw new errors_js_1.NetworkError(`GET ${url} failed: ${err.message}`);
+        }
+        const text = await response.text();
+        try {
+            return { status: response.status, body: (0, auth_js_1.parseJson)(text) };
+        }
+        catch {
+            throw new errors_js_1.NetworkError(`Failed to parse response body from ${url} (HTTP ${response.status})`);
         }
     }
     async _once(spec) {
@@ -117,7 +195,9 @@ class HttpTransport {
             return await this._fetch(this.baseUrl + path, init);
         }
         catch (err) {
-            throw new errors_js_1.NetworkError(`${spec.method} ${spec.path} failed: ${err.message}`);
+            const error = new errors_js_1.NetworkError(`${spec.method} ${spec.path} failed: ${err.message}`);
+            error.connectFailed = isConnectFailure(err);
+            throw error;
         }
     }
     _backoff(attempt) {

package/dist/cjs/data_intent.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Agent-side data access intents (v0.61): build and sign a DataAccessIntent
+ * exactly as the Python reference `create_data_access_intent` does, so the NA
+ * and every SDK verify it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDataAccessIntent = createDataAccessIntent;
+const node_crypto_1 = require("node:crypto");
+const auth_js_1 = require("./auth.js");
+const canonical_js_1 = require("./canonical.js");
+/**
+ * Build and sign a DataAccessIntent with the agent's signer. The reference
+ * implementation uses the agent sovereign id as the signature key id, so pass
+ * a signer whose `keyId` is the agent sovereign id for byte-identical output.
+ */
+async function createDataAccessIntent(params, signer) {
+    const validFor = params.valid_for_seconds ?? 300;
+    if (!Number.isSafeInteger(validFor) || validFor <= 0)
+        throw new Error('valid_for_seconds must be a positive integer');
+    const now = params.now ?? new Date();
+    const intent = {
+        intent_id: params.intent_id ?? (0, node_crypto_1.randomUUID)(),
+        agent_sovereign_id: params.agent_sovereign_id,
+        decision_id: params.decision_id,
+        declared_sources: params.sources.map(s => ({ ...s, classification_tags: [...(s.classification_tags ?? [])] })),
+        declared_access_types: [...params.access_types],
+        estimated_volume_bytes: params.estimated_volume_bytes ?? null,
+        declared_at: (0, auth_js_1.pythonTimestamp)(now),
+        expires_at: (0, auth_js_1.pythonTimestamp)(new Date(now.getTime() + validFor * 1000)),
+        signature: null,
+    };
+    intent.signature = await (0, auth_js_1.signCanonical)((0, canonical_js_1.dataAccessIntentCanonical)(intent), signer);
+    return intent;
+}

package/dist/cjs/errors.js

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BadRequestError = exports.NetworkError = exports.RateLimitError = exports.NotFoundError = exports.ServiceUnavailableError = exports.ConflictError = exports.ForbiddenError = exports.ValidationError = exports.UnauthorizedError = exports.GenesisMeshError = void 0;
 exports.fromHttpError = fromHttpError;
+exports.isRetryableConflict = isRetryableConflict;
 class GenesisMeshError extends Error {
     code;
     status;
@@ -70,6 +71,12 @@ class RateLimitError extends GenesisMeshError {
 }
 exports.RateLimitError = RateLimitError;
 class NetworkError extends GenesisMeshError {
+    /**
+     * True when the connection could not be established (refused, unresolvable,
+     * unreachable): the request never reached the NA, so another instance may
+     * take it even when it is not idempotent (v0.60).
+     */
+    connectFailed = false;
     constructor(message, code = 'network_error') {
         super(message, code, 0);
         this.name = 'NetworkError';
@@ -127,3 +134,16 @@ function errorForStatus(status, message, code) {
         default: return new GenesisMeshError(message, code, status);
     }
 }
+const HA_CONFLICT_CODES = new Set([
+    'boundary_policy_activation_conflict',
+    'boundary_policy_version_conflict',
+    'crl_publish_contention',
+    'retention_in_progress',
+]);
+/**
+ * True for a 409 that only means another NA instance won a race the database
+ * decided (v0.60). The request changed nothing and can be retried.
+ */
+function isRetryableConflict(err) {
+    return err instanceof ConflictError && HA_CONFLICT_CODES.has(err.code);
+}

package/dist/cjs/health.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HealthClient = void 0;
+const errors_js_1 = require("./errors.js");
+function normalise(body, ready) {
+    return { ...body, status: ready ? 'ready' : 'not_ready', ready };
+}
+/** Liveness, readiness and health of the Network Authority (v0.60). */
+class HealthClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /** Process liveness only (`GET /healthz`). */
+    liveness() {
+        return this.http.publicGet('/healthz');
+    }
+    /**
+     * Readiness (`GET /readyz`): database writable at the expected schema, key
+     * loaded, shared state in HA mode. A not-ready NA (503 `service_not_ready`)
+     * is returned as `ready: false` with the failing checks, not thrown. With
+     * several `baseUrls`, a not-ready instance is skipped for the next one.
+     */
+    async readiness() {
+        try {
+            return normalise(await this.http.publicGet('/readyz'), true);
+        }
+        catch (err) {
+            if (err instanceof errors_js_1.ServiceUnavailableError && err.code === 'service_not_ready') {
+                return normalise(err.details, false);
+            }
+            throw err;
+        }
+    }
+    /** Network, version, boundary policy health and evidence store mode (`GET /health`). */
+    health() {
+        return this.http.publicGet('/health');
+    }
+    /** Probe every configured endpoint's `/readyz` directly, for monitoring an HA deployment. */
+    async endpoints() {
+        return Promise.all(this.http.baseUrls.map(async (baseUrl) => {
+            try {
+                const { status, body } = await this.http.publicGetAt(baseUrl, '/readyz');
+                if (status === 200)
+                    return { base_url: baseUrl, reachable: true, ready: true, readiness: normalise(body, true) };
+                const details = body?.['error']?.details;
+                return {
+                    base_url: baseUrl, reachable: true, ready: false,
+                    ...(details ? { readiness: normalise(details, false) } : {}),
+                    error: `HTTP ${status}`,
+                };
+            }
+            catch (err) {
+                return { base_url: baseUrl, reachable: false, ready: false, error: err.message };
+            }
+        }));
+    }
+}
+exports.HealthClient = HealthClient;

package/dist/cjs/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyRetentionCheckpoint = exports.verifyRevocationFeedSignature = exports.verifyJustificationSignature = exports.verifyPolicySignature = exports.verifyAttestationSignature = exports.verifyDecisionSignature = exports.verifyBoundaryDecision = exports.MAX_METADATA_BYTES = exports.SecretMaterialError = exports.checkMetadataOnly = exports.ExecutionRecorder = exports.payloadDigest = exports.entryDigest = exports.checkpointCanonical = exports.justificationCanonical = exports.policySetDigest = exports.policyDigest = exports.policyCanonical = exports.revocationFeedCanonical = exports.attestationDigest = exports.attestationCanonical = exports.executionDigest = exports.executionCanonical = exports.decisionCanonical = exports.RESOURCE_CHAIN_FIELDS = exports.buildAdminHeadersWithSigner = exports.buildAdminHeaders = exports.pythonTimestamp = exports.verifyCanonical = exports.signCanonical = exports.seedSigner = exports.publicKeyFromSeed = exports.verifyBytes = exports.signBytes = exports.sha256Hex = exports.parseJson = exports.canonicalDigest = exports.canonicalJson = exports.buildPath = exports.HttpTransport = exports.DataUsageClient = exports.ConsensusClient = exports.DisclosureClient = exports.AttestationClient = exports.EvidenceStoreClient = exports.EvidenceClient = exports.PolicyClient = exports.BoundaryClient = exports.AgreementClient = exports.GenesisMeshClient = void 0;
-exports.BadRequestError = exports.NetworkError = exports.ServiceUnavailableError = exports.RateLimitError = exports.ConflictError = exports.NotFoundError = exports.ValidationError = exports.ForbiddenError = exports.UnauthorizedError = exports.GenesisMeshError = exports.DecisionVerificationError = exports.GovernedActionError = exports.reconcileResources = exports.summarizeDecision = exports.governedAction = exports.parseTimestampMicros = exports.parseExportLines = exports.verifyEvidenceEvents = exports.verifyExecutionSignature = void 0;
+exports.verifyAttestationSignature = exports.verifyDecisionSignature = exports.verifyBoundaryDecision = exports.MAX_METADATA_BYTES = exports.SecretMaterialError = exports.checkMetadataOnly = exports.ExecutionRecorder = exports.payloadDigest = exports.entryDigest = exports.checkpointCanonical = exports.justificationCanonical = exports.dataAccessIntentCanonical = exports.dataLicensePolicyCanonical = exports.agreementCanonical = exports.policySetDigest = exports.policyDigest = exports.policyCanonical = exports.revocationFeedCanonical = exports.attestationDigest = exports.attestationCanonical = exports.executionDigest = exports.executionCanonical = exports.decisionCanonical = exports.RESOURCE_CHAIN_FIELDS = exports.buildAdminHeadersWithSigner = exports.buildAdminHeaders = exports.pythonTimestamp = exports.verifyCanonical = exports.signCanonical = exports.seedSigner = exports.publicKeyFromSeed = exports.verifyBytes = exports.signBytes = exports.sha256Hex = exports.parseJson = exports.canonicalDigest = exports.canonicalJson = exports.buildPath = exports.HttpTransport = exports.DataUsageClient = exports.ConsensusClient = exports.DisclosureClient = exports.AttestationClient = exports.HealthClient = exports.EvidenceStoreClient = exports.EvidenceClient = exports.PolicyClient = exports.BoundaryClient = exports.AgreementClient = exports.GenesisMeshClient = void 0;
+exports.BadRequestError = exports.NetworkError = exports.isRetryableConflict = exports.ServiceUnavailableError = exports.RateLimitError = exports.ConflictError = exports.NotFoundError = exports.ValidationError = exports.ForbiddenError = exports.UnauthorizedError = exports.GenesisMeshError = exports.DecisionVerificationError = exports.GovernedActionError = exports.reconcileResources = exports.summarizeDecision = exports.governedAction = exports.createDataAccessIntent = exports.verifyDataAccessIntent = exports.verifyDataLicensePolicySignature = exports.verifyAgreement = exports.parseTimestampMicros = exports.parseExportLines = exports.verifyEvidenceEvents = exports.verifyExecutionSignature = exports.verifyRetentionCheckpoint = exports.verifyRevocationFeedSignature = exports.verifyJustificationSignature = exports.verifyPolicySignature = void 0;
 const client_js_1 = require("./client.js");
 const agreement_js_1 = require("./agreement.js");
 const boundary_js_1 = require("./boundary.js");
@@ -12,6 +12,7 @@ const consensus_js_1 = require("./consensus.js");
 const data_usage_js_1 = require("./data_usage.js");
 const policy_js_1 = require("./policy.js");
 const evidence_store_js_1 = require("./evidence_store.js");
+const health_js_1 = require("./health.js");
 class GenesisMeshClient {
     agreement;
     boundary;
@@ -23,6 +24,8 @@ class GenesisMeshClient {
     disclosure;
     consensus;
     dataUsage;
+    /** Liveness, readiness and health (v0.60). */
+    health;
     constructor(options) {
         const http = new client_js_1.HttpTransport(options);
         this.agreement = new agreement_js_1.AgreementClient(http);
@@ -30,6 +33,7 @@ class GenesisMeshClient {
         this.policy = new policy_js_1.PolicyClient(http);
         this.evidence = new evidence_js_1.EvidenceClient(http);
         this.evidenceStore = new evidence_store_js_1.EvidenceStoreClient(http);
+        this.health = new health_js_1.HealthClient(http);
         this.attestation = new attestation_js_1.AttestationClient(http);
         this.disclosure = new disclosure_js_1.DisclosureClient(http);
         this.consensus = new consensus_js_1.ConsensusClient(http);
@@ -48,6 +52,8 @@ var evidence_js_2 = require("./evidence.js");
 Object.defineProperty(exports, "EvidenceClient", { enumerable: true, get: function () { return evidence_js_2.EvidenceClient; } });
 var evidence_store_js_2 = require("./evidence_store.js");
 Object.defineProperty(exports, "EvidenceStoreClient", { enumerable: true, get: function () { return evidence_store_js_2.EvidenceStoreClient; } });
+var health_js_2 = require("./health.js");
+Object.defineProperty(exports, "HealthClient", { enumerable: true, get: function () { return health_js_2.HealthClient; } });
 var attestation_js_2 = require("./attestation.js");
 Object.defineProperty(exports, "AttestationClient", { enumerable: true, get: function () { return attestation_js_2.AttestationClient; } });
 var disclosure_js_2 = require("./disclosure.js");
@@ -87,6 +93,9 @@ Object.defineProperty(exports, "revocationFeedCanonical", { enumerable: true, ge
 Object.defineProperty(exports, "policyCanonical", { enumerable: true, get: function () { return canonical_js_1.policyCanonical; } });
 Object.defineProperty(exports, "policyDigest", { enumerable: true, get: function () { return canonical_js_1.policyDigest; } });
 Object.defineProperty(exports, "policySetDigest", { enumerable: true, get: function () { return canonical_js_1.policySetDigest; } });
+Object.defineProperty(exports, "agreementCanonical", { enumerable: true, get: function () { return canonical_js_1.agreementCanonical; } });
+Object.defineProperty(exports, "dataLicensePolicyCanonical", { enumerable: true, get: function () { return canonical_js_1.dataLicensePolicyCanonical; } });
+Object.defineProperty(exports, "dataAccessIntentCanonical", { enumerable: true, get: function () { return canonical_js_1.dataAccessIntentCanonical; } });
 Object.defineProperty(exports, "justificationCanonical", { enumerable: true, get: function () { return canonical_js_1.justificationCanonical; } });
 Object.defineProperty(exports, "checkpointCanonical", { enumerable: true, get: function () { return canonical_js_1.checkpointCanonical; } });
 Object.defineProperty(exports, "entryDigest", { enumerable: true, get: function () { return canonical_js_1.entryDigest; } });
@@ -110,6 +119,12 @@ Object.defineProperty(exports, "verifyExecutionSignature", { enumerable: true, g
 Object.defineProperty(exports, "verifyEvidenceEvents", { enumerable: true, get: function () { return verify_js_1.verifyEvidenceEvents; } });
 Object.defineProperty(exports, "parseExportLines", { enumerable: true, get: function () { return verify_js_1.parseExportLines; } });
 Object.defineProperty(exports, "parseTimestampMicros", { enumerable: true, get: function () { return verify_js_1.parseTimestampMicros; } });
+Object.defineProperty(exports, "verifyAgreement", { enumerable: true, get: function () { return verify_js_1.verifyAgreement; } });
+Object.defineProperty(exports, "verifyDataLicensePolicySignature", { enumerable: true, get: function () { return verify_js_1.verifyDataLicensePolicySignature; } });
+Object.defineProperty(exports, "verifyDataAccessIntent", { enumerable: true, get: function () { return verify_js_1.verifyDataAccessIntent; } });
+// Data access intents (v0.61)
+var data_intent_js_1 = require("./data_intent.js");
+Object.defineProperty(exports, "createDataAccessIntent", { enumerable: true, get: function () { return data_intent_js_1.createDataAccessIntent; } });
 // Governed lifecycles
 var governance_js_1 = require("./governance.js");
 Object.defineProperty(exports, "governedAction", { enumerable: true, get: function () { return governance_js_1.governedAction; } });
@@ -127,5 +142,6 @@ Object.defineProperty(exports, "NotFoundError", { enumerable: true, get: functio
 Object.defineProperty(exports, "ConflictError", { enumerable: true, get: function () { return errors_js_1.ConflictError; } });
 Object.defineProperty(exports, "RateLimitError", { enumerable: true, get: function () { return errors_js_1.RateLimitError; } });
 Object.defineProperty(exports, "ServiceUnavailableError", { enumerable: true, get: function () { return errors_js_1.ServiceUnavailableError; } });
+Object.defineProperty(exports, "isRetryableConflict", { enumerable: true, get: function () { return errors_js_1.isRetryableConflict; } });
 Object.defineProperty(exports, "NetworkError", { enumerable: true, get: function () { return errors_js_1.NetworkError; } });
 Object.defineProperty(exports, "BadRequestError", { enumerable: true, get: function () { return errors_js_1.BadRequestError; } });

package/dist/cjs/verify.js

@@ -11,6 +11,9 @@ exports.verifyExecutionSignature = verifyExecutionSignature;
 exports.verifyBoundaryDecision = verifyBoundaryDecision;
 exports.parseExportLines = parseExportLines;
 exports.verifyEvidenceEvents = verifyEvidenceEvents;
+exports.verifyAgreement = verifyAgreement;
+exports.verifyDataLicensePolicySignature = verifyDataLicensePolicySignature;
+exports.verifyDataAccessIntent = verifyDataAccessIntent;
 const validation_js_1 = require("./validation.js");
 /**
  * Offline verification of NA-signed artifacts and evidence exports.
@@ -297,3 +300,71 @@ function verifyEvidenceEvents(events, options) {
     }
     return result;
 }
+/**
+ * Verify an AgreementRecord offline: at least one signature by an offerer key
+ * and one by a responder key over the shared canonical body, and the graph
+ * digest when `expectedGraphDigest` is given. Port of `verify_agreement`.
+ */
+function verifyAgreement(record, offererPublicKeys, responderPublicKeys, expectedGraphDigest) {
+    const result = (accepted, reason) => ({ accepted, reason, agreement_id: record.agreement_id });
+    const signatures = record.signatures ?? [];
+    if (signatures.length === 0)
+        return result(false, 'missing_offerer_signature');
+    const canonical = (0, canonical_js_1.agreementCanonical)(record);
+    if (!anySigned(canonical, signatures, offererPublicKeys))
+        return result(false, 'invalid_offerer_signature');
+    if (!anySigned(canonical, signatures, responderPublicKeys)) {
+        return result(false, signatures.length < 2 ? 'missing_responder_signature' : 'invalid_responder_signature');
+    }
+    if (expectedGraphDigest !== undefined && record.graph_digest !== expectedGraphDigest) {
+        return result(false, 'graph_digest_mismatch');
+    }
+    return result(true, 'accepted');
+}
+// ── Data usage (v0.61) ────────────────────────────────────────────────────────
+/** True when the licensor signed the DataLicensePolicy. */
+function verifyDataLicensePolicySignature(policy, licensorPublicKeys) {
+    return signedBy((0, canonical_js_1.dataLicensePolicyCanonical)(policy), policy.signature, licensorPublicKeys);
+}
+/**
+ * Check an agent-signed DataAccessIntent against a DataLicensePolicy offline:
+ * the agent signature, then expiry, licensed sources, prohibited
+ * classifications, permitted access types and the volume cap, in the order of
+ * the reference `verify_data_access_intent`.
+ */
+function verifyDataAccessIntent(intent, policy, agentPublicKeys, at = new Date()) {
+    const fail = (violations) => ({ valid: false, violation_reason: violations[0].violation_type, violations });
+    if (!intent.signature)
+        return fail([{ violation_type: 'intent_exceeds_license', detail: 'Missing intent signature' }]);
+    if (!signedBy((0, canonical_js_1.dataAccessIntentCanonical)(intent), intent.signature, agentPublicKeys)) {
+        return fail([{ violation_type: 'intent_exceeds_license', detail: 'Invalid intent signature' }]);
+    }
+    const now = micros(at);
+    const violations = [];
+    const add = (violation_type, detail) => violations.push({ violation_type, detail });
+    if (now > micros(intent.expires_at))
+        add('intent_expired', `Intent expired at ${intent.expires_at}`);
+    if (now > micros(policy.valid_until) || now < micros(policy.valid_from))
+        add('policy_expired', 'Policy not valid at verification time');
+    const allowed = new Set(policy.allowed_source_ids);
+    const prohibited = new Set(policy.prohibited_classification_tags);
+    for (const source of intent.declared_sources) {
+        if (!allowed.has(source.source_id))
+            add('source_not_licensed', `Source '${source.source_id}' not in allowed_source_ids`);
+        const overlap = source.classification_tags.filter(t => prohibited.has(t)).sort(auth_js_1.compareCodePoints);
+        if (overlap.length > 0) {
+            add('prohibited_classification', `Source '${source.source_id}' has prohibited tags: ${overlap.join(', ')}`);
+        }
+    }
+    const allowedTypes = new Set(policy.allowed_access_types.length > 0 ? policy.allowed_access_types : ['read']);
+    for (const accessType of intent.declared_access_types) {
+        if (!allowedTypes.has(accessType))
+            add('access_type_not_permitted', `Access type '${accessType}' not in allowed_access_types`);
+    }
+    const cap = policy.max_volume_bytes_per_session;
+    const volume = intent.estimated_volume_bytes;
+    if (cap !== null && cap !== undefined && volume !== null && volume !== undefined && volume > cap) {
+        add('volume_cap_exceeded', `Volume ${volume} > max ${cap}`);
+    }
+    return violations.length > 0 ? fail(violations) : { valid: true, violation_reason: null, violations: [] };
+}

package/dist/esm/auth.js

@@ -58,12 +58,17 @@ function pythonNumber(value, pythonFloat = false) {
  */
 const PYTHON_FLOATS = new WeakMap();
 /**
- * JSON.parse that remembers integral-valued floats so canonicalJson reproduces
- * them. Use it for any NA JSON that will be verified or digested. Requires
- * JSON.parse source text access (Node.js 22+).
+ * JSON.parse that keeps what Python would sign: integral-valued floats are
+ * remembered so canonicalJson reproduces them (`90.0`), and integer literals
+ * beyond Number.MAX_SAFE_INTEGER become `bigint` so no digit is lost. Use it
+ * for any NA JSON that will be verified or digested. Requires JSON.parse source
+ * text access (Node.js 22+).
  */
 export function parseJson(text) {
     return JSON.parse(text, function (key, value, context) {
+        if (typeof value === 'number' && !Number.isSafeInteger(value) && context?.source && /^-?\d+$/.test(context.source)) {
+            return BigInt(context.source);
+        }
         if (typeof value === 'number' && Number.isInteger(value) && context?.source && /[.eE]/.test(context.source)) {
             let keys = PYTHON_FLOATS.get(this);
             if (!keys)
@@ -96,6 +101,8 @@ export function canonicalJson(value) {
         return asciiString(value);
     if (typeof value === 'number')
         return pythonNumber(value);
+    if (typeof value === 'bigint')
+        return value.toString();
     if (typeof value === 'boolean')
         return value ? 'true' : 'false';
     if (Array.isArray(value))