inamprotocol 0.1.0 → 0.3.0

package/dist/client.d.ts

@@ -1,6 +1,7 @@
 import { type Keypair } from "./crypto/keys.js";
 import { type ReceiptContentInput } from "./core/receiptContent.js";
-import type { AgentRecord, ExecutionReceipt, JobOffer, JobRecord, ReputationResult } from "./types.js";
+import { type VerificationContentInput } from "./core/verificationContent.js";
+import type { AgentRecord, ExecutionReceipt, ExternalKeyType, JobOffer, JobRecord, LinkChallenge, ReputationResult, VerificationRecord } from "./types.js";
 /**
  * Minimal reference client — the seed of the future `@inamprotocol/agent-sdk`
  * package. Everything here is transport plumbing plus the two signature
@@ -16,7 +17,19 @@ export declare class InamClient {
     private request;
     registerAgent(capabilities: string[], metadata?: Record<string, unknown>): Promise<AgentRecord>;
     getAgent(id: string): Promise<AgentRecord>;
+    /** Links `a2a_endpoint` — the one protocol that isn't a key-derived
+     * identity, so there's nothing to prove control of beyond this request's
+     * own INAM signature. For `agentpass_id` / `aitp_id` / `passport_id`, use
+     * `requestLinkChallenge` + `completeLink` instead. */
     linkIdentity(protocol: string, value: string): Promise<AgentRecord>;
+    /** Step 1 of linking a key-derived external identity: request a single-use,
+     * ~60s challenge that must be signed with the *external* private key
+     * corresponding to `externalPublicKey` (not this INAM keypair). */
+    requestLinkChallenge(protocol: string, externalPublicKey: string, keyType: ExternalKeyType): Promise<LinkChallenge>;
+    /** Step 2: submit the signed challenge to complete the link. `proofSignature`
+     * must be a signature over the raw bytes of `challenge.challenge` (hex-decoded)
+     * produced by the external private key, base64-encoded. */
+    completeLink(protocol: string, value: string, challengeId: string, proofSignature: string): Promise<AgentRecord>;
     searchAgents(query: {
         capability?: string;
         minReputation?: number;
@@ -25,6 +38,7 @@ export declare class InamClient {
         agents: AgentRecord[];
     }>;
     getReputation(id: string): Promise<ReputationResult>;
+    getReceipt(receiptId: string): Promise<ExecutionReceipt>;
     listReceipts(agentId: string): Promise<{
         receipts: ExecutionReceipt[];
     }>;
@@ -57,4 +71,14 @@ export declare class InamClient {
     acceptOffer(jobId: string, agentId: string): Promise<JobRecord>;
     /** Called by the job's poster to cancel a not-yet-completed job. */
     cancelJob(jobId: string): Promise<JobRecord>;
+    /** Called by the verifier (who must not be the receipt's own provider/agentB).
+     * `jobId`/`provider` are derived from the referenced receipt (fetched here)
+     * rather than taken as caller input — the server independently derives the
+     * same values and would reject a signature built over the wrong ones, so
+     * there's no correct way for a caller to supply them manually anyway. */
+    submitVerification(input: Omit<VerificationContentInput, "verifier" | "jobId" | "provider">): Promise<VerificationRecord>;
+    getVerification(id: string): Promise<VerificationRecord>;
+    listReceiptVerifications(receiptId: string): Promise<{
+        verifications: VerificationRecord[];
+    }>;
 }

package/dist/client.js

@@ -1,6 +1,7 @@
 import { canonicalize } from "./crypto/canonical.js";
 import { sha256Hex, sign, toBase64 } from "./crypto/keys.js";
 import { buildSignableContent } from "./core/receiptContent.js";
+import { buildSignableVerificationContent } from "./core/verificationContent.js";
 /**
  * Minimal reference client — the seed of the future `@inamprotocol/agent-sdk`
  * package. Everything here is transport plumbing plus the two signature
@@ -49,11 +50,31 @@ export class InamClient {
     getAgent(id) {
         return this.request("GET", `/v1/agents/${encodeURIComponent(id)}`);
     }
+    /** Links `a2a_endpoint` — the one protocol that isn't a key-derived
+     * identity, so there's nothing to prove control of beyond this request's
+     * own INAM signature. For `agentpass_id` / `aitp_id` / `passport_id`, use
+     * `requestLinkChallenge` + `completeLink` instead. */
     linkIdentity(protocol, value) {
         return this.request("POST", `/v1/agents/${encodeURIComponent(this.did)}/link`, { protocol, value }, {
             idempotencyKey: `link:${protocol}:${value}`,
         });
     }
+    /** Step 1 of linking a key-derived external identity: request a single-use,
+     * ~60s challenge that must be signed with the *external* private key
+     * corresponding to `externalPublicKey` (not this INAM keypair). */
+    requestLinkChallenge(protocol, externalPublicKey, keyType) {
+        return this.request("POST", `/v1/agents/${encodeURIComponent(this.did)}/link/challenge`, { protocol, externalPublicKey, keyType }, {
+            idempotencyKey: `link-challenge:${protocol}:${externalPublicKey}:${Date.now()}`,
+        });
+    }
+    /** Step 2: submit the signed challenge to complete the link. `proofSignature`
+     * must be a signature over the raw bytes of `challenge.challenge` (hex-decoded)
+     * produced by the external private key, base64-encoded. */
+    completeLink(protocol, value, challengeId, proofSignature) {
+        return this.request("POST", `/v1/agents/${encodeURIComponent(this.did)}/link`, { protocol, value, challengeId, proofSignature }, {
+            idempotencyKey: `link:${protocol}:${challengeId}`,
+        });
+    }
     searchAgents(query) {
         const params = new URLSearchParams();
         if (query.capability)
@@ -67,6 +88,9 @@ export class InamClient {
     getReputation(id) {
         return this.request("GET", `/v1/agents/${encodeURIComponent(id)}/reputation`);
     }
+    getReceipt(receiptId) {
+        return this.request("GET", `/v1/receipts/${encodeURIComponent(receiptId)}`);
+    }
     listReceipts(agentId) {
         return this.request("GET", `/v1/agents/${encodeURIComponent(agentId)}/receipts`);
     }
@@ -129,5 +153,23 @@ export class InamClient {
             idempotencyKey: `cancel:${jobId}`,
         });
     }
+    // ---- Verification (SPEC.md §12) — independent attestation of a finalized receipt ----
+    /** Called by the verifier (who must not be the receipt's own provider/agentB).
+     * `jobId`/`provider` are derived from the referenced receipt (fetched here)
+     * rather than taken as caller input — the server independently derives the
+     * same values and would reject a signature built over the wrong ones, so
+     * there's no correct way for a caller to supply them manually anyway. */
+    async submitVerification(input) {
+        const receipt = await this.getReceipt(input.receiptId);
+        const content = buildSignableVerificationContent({ ...input, jobId: receipt.jobId, provider: receipt.agentB.id, verifier: this.did });
+        const signature = toBase64(sign(new TextEncoder().encode(canonicalize(content)), this.keypair.privateKey));
+        return this.request("POST", "/v1/verifications", { receiptId: input.receiptId, verifier: this.did, method: input.method, outputHash: input.outputHash, result: input.result, score: input.score, evidenceUri: input.evidenceUri, signature }, { idempotencyKey: `verification:${content.verificationId}` });
+    }
+    getVerification(id) {
+        return this.request("GET", `/v1/verifications/${encodeURIComponent(id)}`);
+    }
+    listReceiptVerifications(receiptId) {
+        return this.request("GET", `/v1/receipts/${encodeURIComponent(receiptId)}/verifications`);
+    }
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAG1F;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,OAAe,EACf,OAAgB;QADhB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAkC;QACvG,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC9B,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;SAC5B,CAAC;QACF,IAAI,IAAI,EAAE,cAAc;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,YAAsB,EAAE,QAAkC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,KAAa;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAClG,cAAc,EAAE,QAAQ,QAAQ,IAAI,KAAK,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAyE;QACpF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,KAA0B;QAC3D,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,OAAyB;QACxC,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE;YAC9G,cAAc,EAAE,eAAe,OAAO,CAAC,SAAS,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE;YAC/F,cAAc,EAAE,WAAW,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEzE,OAAO,CAAC,KAAoH;QAC1H,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,KAA+C;QACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,KAAa,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,UAAU,KAAK,IAAI,OAAO,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;YACrF,cAAc,EAAE,UAAU,KAAK,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAYhH;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,OAAe,EACf,OAAgB;QADhB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAkC;QACvG,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC9B,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;SAC5B,CAAC;QACF,IAAI,IAAI,EAAE,cAAc;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,YAAsB,EAAE,QAAkC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;0DAGsD;IACtD,YAAY,CAAC,QAAgB,EAAE,KAAa;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAClG,cAAc,EAAE,QAAQ,QAAQ,IAAI,KAAK,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;uEAEmE;IACnE,oBAAoB,CAAC,QAAgB,EAAE,iBAAyB,EAAE,OAAwB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE;YACjI,cAAc,EAAE,kBAAkB,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED;;+DAE2D;IAC3D,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB,EAAE,cAAsB;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;YAC/H,cAAc,EAAE,QAAQ,QAAQ,IAAI,WAAW,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAyE;QACpF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,KAA0B;QAC3D,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,OAAyB;QACxC,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC7F,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE;YAC9G,cAAc,EAAE,eAAe,OAAO,CAAC,SAAS,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE;YAC/F,cAAc,EAAE,WAAW,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEzE,OAAO,CAAC,KAAoH;QAC1H,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,KAA+C;QACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,KAAa,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,UAAU,KAAK,IAAI,OAAO,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;YACrF,cAAc,EAAE,UAAU,KAAK,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IAExF;;;;6EAIyE;IACzE,KAAK,CAAC,kBAAkB,CAAC,KAAwE;QAC/F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,gCAAgC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtI,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,mBAAmB,EACnB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,EAC3L,EAAE,cAAc,EAAE,gBAAgB,OAAO,CAAC,cAAc,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;CACF"}

package/dist/core/verificationContent.d.ts

@@ -0,0 +1,25 @@
+import type { IndependentVerificationMethod, VerificationResult } from "../types.js";
+/**
+ * Pure, dependency-free verification content logic (SPEC.md §12) — same
+ * "shared by server and any SDK/client" contract as receiptContent.ts.
+ */
+export interface VerificationContentInput {
+    receiptId: string;
+    jobId: string;
+    provider: string;
+    verifier: string;
+    method: IndependentVerificationMethod;
+    outputHash: string;
+    result: VerificationResult;
+    score?: number;
+    evidenceUri?: string;
+}
+/** Content-addressed, same principle as computeReceiptId (SPEC.md §12.2). */
+export declare function computeVerificationId(input: VerificationContentInput): string;
+/** The exact object shape that must be signed — mirrors buildSignableContent:
+ * embeds the already-computed verificationId alongside the fields that were
+ * hashed to produce it. */
+export declare function buildSignableVerificationContent(input: VerificationContentInput): {
+    verificationVersion: "1.0";
+    verificationId: string;
+} & VerificationContentInput;

package/dist/core/verificationContent.js

@@ -0,0 +1,14 @@
+import { canonicalize } from "../crypto/canonical.js";
+import { sha256Hex } from "../crypto/keys.js";
+/** Content-addressed, same principle as computeReceiptId (SPEC.md §12.2). */
+export function computeVerificationId(input) {
+    return `sha256:${sha256Hex(canonicalize({ ...input }))}`;
+}
+/** The exact object shape that must be signed — mirrors buildSignableContent:
+ * embeds the already-computed verificationId alongside the fields that were
+ * hashed to produce it. */
+export function buildSignableVerificationContent(input) {
+    const verificationId = computeVerificationId(input);
+    return { verificationVersion: "1.0", verificationId, ...input };
+}
+//# sourceMappingURL=verificationContent.js.map

package/dist/core/verificationContent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationContent.js","sourceRoot":"","sources":["../../src/core/verificationContent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAoB9C,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,KAA+B;IACnE,OAAO,UAAU,SAAS,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;2BAE2B;AAC3B,MAAM,UAAU,gCAAgC,CAAC,KAA+B;IAC9E,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC;AAClE,CAAC"}

package/dist/crypto/keys.d.ts

@@ -9,6 +9,12 @@ export declare function generateKeypair(): Keypair;
 export declare function keypairFromPrivateKey(privateKey: Uint8Array): Keypair;
 export declare function sign(message: Uint8Array, privateKey: Uint8Array): Uint8Array;
 export declare function verify(signature: Uint8Array, message: Uint8Array, did: string): boolean;
+/** Verifies against a raw Ed25519 public key rather than a did:key — for
+ * externally-issued identities (e.g. an AgentPass/AITP key) that aren't
+ * necessarily encoded as an INAM did:key. */
+export declare function verifyRawEd25519(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;
 export declare function sha256Hex(data: Uint8Array | string): string;
 export declare function toBase64(bytes: Uint8Array): string;
 export declare function fromBase64(b64: string): Uint8Array;
+export declare function toHex(bytes: Uint8Array): string;
+export declare function fromHex(hex: string): Uint8Array;

package/dist/crypto/keys.js

@@ -41,6 +41,17 @@ export function verify(signature, message, did) {
         return false;
     }
 }
+/** Verifies against a raw Ed25519 public key rather than a did:key — for
+ * externally-issued identities (e.g. an AgentPass/AITP key) that aren't
+ * necessarily encoded as an INAM did:key. */
+export function verifyRawEd25519(signature, message, publicKey) {
+    try {
+        return ed25519.verify(signature, message, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
 export function sha256Hex(data) {
     const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
     return Buffer.from(sha256(bytes)).toString("hex");
@@ -51,4 +62,10 @@ export function toBase64(bytes) {
 export function fromBase64(b64) {
     return new Uint8Array(Buffer.from(b64, "base64"));
 }
+export function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+export function fromHex(hex) {
+    return new Uint8Array(Buffer.from(hex, "hex"));
+}
 //# sourceMappingURL=keys.js.map

package/dist/crypto/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,IAAkB,EAAE,EAAE,CACjD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAE3C,qEAAqE;AACrE,MAAM,yBAAyB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAQhE,MAAM,UAAU,cAAc,CAAC,SAAqB;IAClD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrF,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAsB;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAmB,EAAE,UAAsB;IAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAqB,EAAE,OAAmB,EAAE,GAAW;IAC5E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAyB;IACjD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,IAAkB,EAAE,EAAE,CACjD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAE3C,qEAAqE;AACrE,MAAM,yBAAyB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAQhE,MAAM,UAAU,cAAc,CAAC,SAAqB;IAClD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrF,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAsB;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAmB,EAAE,UAAsB;IAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAqB,EAAE,OAAmB,EAAE,GAAW;IAC5E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;6CAE6C;AAC7C,MAAM,UAAU,gBAAgB,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IAChG,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAyB;IACjD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/crypto/p256.d.ts

@@ -0,0 +1,21 @@
+/**
+ * ECDSA P-256, used alongside Ed25519 for external-identity challenge proofs
+ * (SPEC.md's external-identity linking section) because it's the primary
+ * curve mandated by ATTP (draft-sharif-attp-00, the trust-transport protocol
+ * AgentPass is built on): "Each agent MUST have a unique ECDSA key pair using
+ * the P-256 curve." Not used anywhere else in INAM — the protocol's own
+ * did:key identity stays Ed25519-only.
+ *
+ * `p256.sign`/`p256.verify` already do standard ECDSA-with-SHA256 internally
+ * (no manual pre-hashing needed) and return/accept the 64-byte compact r||s
+ * encoding — this matches ATTP's wire format exactly: "signature =
+ * ECDSA-Sign(SHA-256(challenge), agentPrivateKey)" with "IEEE P1363
+ * fixed-length r||s encoding (64 bytes for P-256)".
+ */
+export interface P256Keypair {
+    publicKey: Uint8Array;
+    privateKey: Uint8Array;
+}
+export declare function generateP256Keypair(): P256Keypair;
+export declare function p256Sign(message: Uint8Array, privateKey: Uint8Array): Uint8Array;
+export declare function p256Verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;

package/dist/crypto/p256.js

@@ -0,0 +1,18 @@
+import { p256 } from "@noble/curves/nist.js";
+export function generateP256Keypair() {
+    const privateKey = p256.utils.randomSecretKey();
+    const publicKey = p256.getPublicKey(privateKey, true);
+    return { privateKey, publicKey };
+}
+export function p256Sign(message, privateKey) {
+    return p256.sign(message, privateKey);
+}
+export function p256Verify(signature, message, publicKey) {
+    try {
+        return p256.verify(signature, message, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=p256.js.map

package/dist/crypto/p256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"p256.js","sourceRoot":"","sources":["../../src/crypto/p256.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAsB7C,MAAM,UAAU,mBAAmB;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAmB,EAAE,UAAsB;IAClE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IAC1F,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { InamClient } from "./client.js";
-export { generateKeypair, keypairFromPrivateKey, publicKeyToDid, didToPublicKey, sign, verify, sha256Hex, toBase64, fromBase64, type Keypair, } from "./crypto/keys.js";
+export { generateKeypair, keypairFromPrivateKey, publicKeyToDid, didToPublicKey, sign, verify, verifyRawEd25519, sha256Hex, toBase64, fromBase64, toHex, fromHex, type Keypair, } from "./crypto/keys.js";
+export { generateP256Keypair, p256Sign, p256Verify, type P256Keypair } from "./crypto/p256.js";
 export { canonicalize } from "./crypto/canonical.js";
 export { computeReceiptId, buildSignableContent, type ReceiptContentInput } from "./core/receiptContent.js";
-export type { LinkedIdentities, AgentRecord, VerificationMethod, ReceiptOutcome, ReceiptStatus, DisputeStatus, ExecutionReceipt, SignableReceiptContent, ReputationComponents, ReputationResult, JobStatus, JobOffer, JobRecord, } from "./types.js";
+export { computeVerificationId, buildSignableVerificationContent, type VerificationContentInput } from "./core/verificationContent.js";
+export type { LinkedIdentities, ExternalKeyType, LinkChallenge, AgentRecord, VerificationMethod, ReceiptOutcome, ReceiptStatus, DisputeStatus, ExecutionReceipt, SignableReceiptContent, ReputationComponents, ReputationResult, JobStatus, JobOffer, JobRecord, IndependentVerificationMethod, VerificationResult, VerificationRecord, } from "./types.js";

package/dist/index.js

@@ -1,5 +1,7 @@
 export { InamClient } from "./client.js";
-export { generateKeypair, keypairFromPrivateKey, publicKeyToDid, didToPublicKey, sign, verify, sha256Hex, toBase64, fromBase64, } from "./crypto/keys.js";
+export { generateKeypair, keypairFromPrivateKey, publicKeyToDid, didToPublicKey, sign, verify, verifyRawEd25519, sha256Hex, toBase64, fromBase64, toHex, fromHex, } from "./crypto/keys.js";
+export { generateP256Keypair, p256Sign, p256Verify } from "./crypto/p256.js";
 export { canonicalize } from "./crypto/canonical.js";
 export { computeReceiptId, buildSignableContent } from "./core/receiptContent.js";
+export { computeVerificationId, buildSignableVerificationContent } from "./core/verificationContent.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,SAAS,EACT,QAAQ,EACR,UAAU,GAEX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,IAAI,EACJ,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,UAAU,EACV,KAAK,EACL,OAAO,GAER,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAE5G,OAAO,EAAE,qBAAqB,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC"}

package/dist/types.d.ts

@@ -10,6 +10,17 @@ export interface LinkedIdentities {
     passport_id?: string;
     a2a_endpoint?: string;
 }
+/** Key type used to prove control of an external identity's public key
+ * before linking it (SPEC.md's external-identity linking section). P-256
+ * matches ATTP (the protocol AgentPass is built on); Ed25519 is offered as
+ * the same primitive INAM's own did:key already uses. */
+export type ExternalKeyType = "ed25519" | "p256";
+/** Response shape from POST /agents/:id/link/challenge. */
+export interface LinkChallenge {
+    challengeId: string;
+    challenge: string;
+    expiresAt: string;
+}
 export interface AgentRecord {
     id: string;
     capabilities: string[];
@@ -80,6 +91,10 @@ export interface ReputationComponents {
     volumeUsd: number;
     stakeUsd: number;
     decayHalfLifeDays: number;
+    /** Count of finalized receipts backed by at least one `verified` Verification
+     * (SPEC.md §12.5) — distinct from `verifiedReceipts` above, which really
+     * means "two-party finalized," not independently attested. */
+    attestedReceipts: number;
 }
 export interface ReputationResult {
     trustScore: number;
@@ -108,3 +123,23 @@ export interface JobRecord {
     createdAt: string;
     expiresAt?: string;
 }
+/** SPEC.md §12: independent attestation that a finalized receipt's output
+ * actually satisfies its job's requirements. Single verifier, no
+ * draft/countersign step — complete and signed on submission. */
+export type IndependentVerificationMethod = "deterministic" | "agent_attestation";
+export type VerificationResult = "verified" | "rejected";
+export interface VerificationRecord {
+    verificationVersion: "1.0";
+    verificationId: string;
+    receiptId: string;
+    jobId: string;
+    provider: string;
+    verifier: string;
+    method: IndependentVerificationMethod;
+    outputHash: string;
+    result: VerificationResult;
+    score?: number;
+    evidenceUri?: string;
+    createdAt: string;
+    signature: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inamprotocol",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Reference TypeScript/JavaScript SDK for the INAM Protocol — agent identity, execution receipts, jobs, and reputation",
   "type": "module",
   "main": "./dist/index.js",
@@ -40,6 +40,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
+    "@noble/curves": "^2.3.0",
     "@noble/ed25519": "^2.1.0",
     "@noble/hashes": "^1.5.0",
     "bs58": "^6.0.0"