inamprotocol 0.4.2 → 0.6.0

package/dist/client.d.ts

@@ -59,8 +59,29 @@ export declare class InamClient {
     submitWork(agentAId: string, input: ReceiptContentInput, opts?: {
         visibility?: "public" | "participants_only";
     }): Promise<ExecutionReceipt>;
-    /** Called by the requester (agent_a) to accept the worker's submitted result. */
-    acceptWork(receipt: ExecutionReceipt): Promise<ExecutionReceipt>;
+    /**
+     * Called by the requester (agent_a) to accept the worker's submitted
+     * result. `receipt` is normally whatever a caller just fetched with
+     * getReceipt() — an external review found that blindly trusting it and
+     * signing without checking anything let a caller be tricked (e.g. via
+     * prompt injection reaching an LLM-driven agent through job/dispute free
+     * text) into countersigning content it never actually reviewed. Two
+     * guards, both cheap and backward compatible:
+     *  - Always: refuse to sign a receipt this client isn't even the named
+     *    requester on (`receipt.agentA.id !== this.did`) — the server would
+     *    reject the submission anyway, but a real Ed25519 signature over
+     *    arbitrary content would already have been produced by then.
+     *  - When `expected` is passed: the caller states what it believes it's
+     *    approving (sourced from its own job knowledge, not from `receipt`
+     *    itself — checking a fetched object against itself proves nothing),
+     *    and a mismatch on any field throws before signing.
+     */
+    acceptWork(receipt: ExecutionReceipt, expected?: {
+        jobId?: string;
+        outputHash?: string;
+        amount?: string;
+        currency?: string;
+    }): Promise<ExecutionReceipt>;
     disputeReceipt(receiptId: string, reason: string): Promise<ExecutionReceipt>;
     /** Withdraw a dispute this client opened (SPEC.md §4.3) — moves the receipt
      * `disputed` -> `finalized` so it counts toward reputation again. Only the
@@ -90,6 +111,11 @@ export declare class InamClient {
     acceptOffer(jobId: string, agentId: string): Promise<JobRecord>;
     /** Called by the job's poster to cancel a not-yet-completed job. */
     cancelJob(jobId: string): Promise<JobRecord>;
+    /** SPEC.md §3.3 (v0.25). Called by the job's poster once its accepted
+     *  worker never delivers — the one negative-outcome path that doesn't
+     *  require a receipt at all. Only callable once the same grace window
+     *  used for dispute resolution has passed since acceptance. */
+    reportNonPerformance(jobId: string, reason?: string): Promise<JobRecord>;
     /** Called by the verifier (who must not be the receipt's own provider/agentB).
      * `jobId`/`provider` are derived from the referenced receipt (fetched here)
      * rather than taken as caller input — the server independently derives the

package/dist/client.js

@@ -125,8 +125,39 @@ export class InamClient {
         const signature = toBase64(sign(signingBytes, this.keypair.privateKey));
         return this.request("POST", "/v1/receipts", { ...input, agentAId, signature, visibility: opts?.visibility }, { idempotencyKey: `receipt:${input.jobId}` });
     }
-    /** Called by the requester (agent_a) to accept the worker's submitted result. */
-    async acceptWork(receipt) {
+    /**
+     * Called by the requester (agent_a) to accept the worker's submitted
+     * result. `receipt` is normally whatever a caller just fetched with
+     * getReceipt() — an external review found that blindly trusting it and
+     * signing without checking anything let a caller be tricked (e.g. via
+     * prompt injection reaching an LLM-driven agent through job/dispute free
+     * text) into countersigning content it never actually reviewed. Two
+     * guards, both cheap and backward compatible:
+     *  - Always: refuse to sign a receipt this client isn't even the named
+     *    requester on (`receipt.agentA.id !== this.did`) — the server would
+     *    reject the submission anyway, but a real Ed25519 signature over
+     *    arbitrary content would already have been produced by then.
+     *  - When `expected` is passed: the caller states what it believes it's
+     *    approving (sourced from its own job knowledge, not from `receipt`
+     *    itself — checking a fetched object against itself proves nothing),
+     *    and a mismatch on any field throws before signing.
+     */
+    async acceptWork(receipt, expected) {
+        if (receipt.agentA.id !== this.did) {
+            throw new Error(`acceptWork: this client (${this.did}) is not the receipt's agentA (${receipt.agentA.id})`);
+        }
+        if (expected?.jobId !== undefined && expected.jobId !== receipt.jobId) {
+            throw new Error(`acceptWork: expected jobId ${expected.jobId}, receipt has ${receipt.jobId}`);
+        }
+        if (expected?.outputHash !== undefined && expected.outputHash !== receipt.result.outputHash) {
+            throw new Error(`acceptWork: expected result.outputHash ${expected.outputHash}, receipt has ${receipt.result.outputHash}`);
+        }
+        if (expected?.amount !== undefined && expected.amount !== receipt.settlement?.amount) {
+            throw new Error(`acceptWork: expected settlement.amount ${expected.amount}, receipt has ${receipt.settlement?.amount}`);
+        }
+        if (expected?.currency !== undefined && expected.currency !== receipt.settlement?.currency) {
+            throw new Error(`acceptWork: expected settlement.currency ${expected.currency}, receipt has ${receipt.settlement?.currency}`);
+        }
         // `visibility` (v0.19) is operational metadata, excluded from the
         // signed content the same way `dispute`/`status` already are — the
         // server's countersign verification excludes it identically
@@ -186,6 +217,15 @@ export class InamClient {
             idempotencyKey: `cancel:${jobId}`,
         });
     }
+    /** SPEC.md §3.3 (v0.25). Called by the job's poster once its accepted
+     *  worker never delivers — the one negative-outcome path that doesn't
+     *  require a receipt at all. Only callable once the same grace window
+     *  used for dispute resolution has passed since acceptance. */
+    reportNonPerformance(jobId, reason) {
+        return this.request("POST", `/v1/jobs/${encodeURIComponent(jobId)}/report-nonperformance`, reason ? { reason } : {}, {
+            idempotencyKey: `report-nonperformance:${jobId}`,
+        });
+    }
     // ---- Verification (SPEC.md §12) — independent attestation of a finalized receipt ----
     /** Called by the verifier (who must not be the receipt's own provider/agentB).
      * `jobId`/`provider` are derived from the referenced receipt (fetched here)

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAYhH;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,OAAe,EACf,OAAgB;QADhB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAkC;QACvG,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC9B,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;SAC5B,CAAC;QACF,IAAI,IAAI,EAAE,cAAc;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,YAAsB,EAAE,QAAkC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;+CAI2C;IAC3C,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE;YACnG,cAAc,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;;sDAGkD;IAClD,iBAAiB,CAAC,aAAqB,EAAE,UAAmB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,EAAE;YAC7G,cAAc,EAAE,mBAAmB,aAAa,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED;;;0DAGsD;IACtD,YAAY,CAAC,QAAgB,EAAE,KAAa;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAClG,cAAc,EAAE,QAAQ,QAAQ,IAAI,KAAK,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;uEAEmE;IACnE,oBAAoB,CAAC,QAAgB,EAAE,iBAAyB,EAAE,OAAwB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE;YACjI,cAAc,EAAE,kBAAkB,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED;;+DAE2D;IAC3D,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB,EAAE,cAAsB;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;YAC/H,cAAc,EAAE,QAAQ,QAAQ,IAAI,WAAW,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAyE;QACpF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;8EAE0E;IAC1E,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,KAA0B,EAC1B,IAAsD;QAEtD,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7J,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,OAAyB;QACxC,kEAAkE;QAClE,mEAAmE;QACnE,4DAA4D;QAC5D,mEAAmE;QACnE,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACpH,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE;YAC9G,cAAc,EAAE,eAAe,OAAO,CAAC,SAAS,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE;YAC/F,cAAc,EAAE,WAAW,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED;;qEAEiE;IACjE,cAAc,CAAC,SAAiB,EAAE,IAAa;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACjH,cAAc,EAAE,mBAAmB,SAAS,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEzE,OAAO,CAAC,KAAoH;QAC1H,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,KAA+C;QACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,KAAa,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,UAAU,KAAK,IAAI,OAAO,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;YACrF,cAAc,EAAE,UAAU,KAAK,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IAExF;;;;6EAIyE;IACzE,KAAK,CAAC,kBAAkB,CAAC,KAAwE;QAC/F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,gCAAgC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtI,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,mBAAmB,EACnB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,EAC3L,EAAE,cAAc,EAAE,gBAAgB,OAAO,CAAC,cAAc,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAgB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA4B,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAiC,MAAM,+BAA+B,CAAC;AAYhH;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IAEF;IACA;IAFnB,YACmB,OAAe,EACf,OAAgB;QADhB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,IAAkC;QACvG,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAEnG,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC9B,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;SAC5B,CAAC;QACF,IAAI,IAAI,EAAE,cAAc;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAE3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,aAAa,CAAC,YAAsB,EAAE,QAAkC;QACtE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;+CAI2C;IAC3C,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE;YACnG,cAAc,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;;sDAGkD;IAClD,iBAAiB,CAAC,aAAqB,EAAE,UAAmB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,EAAE;YAC7G,cAAc,EAAE,mBAAmB,aAAa,IAAI,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC;IAED;;;0DAGsD;IACtD,YAAY,CAAC,QAAgB,EAAE,KAAa;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAClG,cAAc,EAAE,QAAQ,QAAQ,IAAI,KAAK,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;uEAEmE;IACnE,oBAAoB,CAAC,QAAgB,EAAE,iBAAyB,EAAE,OAAwB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE;YACjI,cAAc,EAAE,kBAAkB,QAAQ,IAAI,iBAAiB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED;;+DAE2D;IAC3D,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB,EAAE,cAAsB;QACvF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;YAC/H,cAAc,EAAE,QAAQ,QAAQ,IAAI,WAAW,EAAE;SAClD,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAyE;QACpF,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACjG,IAAI,KAAK,CAAC,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;8EAE0E;IAC1E,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,KAA0B,EAC1B,IAAsD;QAEtD,oEAAoE;QACpE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7J,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,UAAU,CACd,OAAyB,EACzB,QAAsF;QAEtF,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,GAAG,kCAAkC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,KAAK,iBAAiB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,UAAU,iBAAiB,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,iBAAiB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,QAAQ,EAAE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,CAAC,QAAQ,iBAAiB,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChI,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,4DAA4D;QAC5D,mEAAmE;QACnE,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACpH,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE;YAC9G,cAAc,EAAE,eAAe,OAAO,CAAC,SAAS,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE;YAC/F,cAAc,EAAE,WAAW,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED;;qEAEiE;IACjE,cAAc,CAAC,SAAiB,EAAE,IAAa;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACjH,cAAc,EAAE,mBAAmB,SAAS,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAEzE,OAAO,CAAC,KAAoH;QAC1H,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,KAA+C;QACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,OAAgB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,KAAa,EAAE,OAAe;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE;YACvF,cAAc,EAAE,UAAU,KAAK,IAAI,OAAO,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;YACrF,cAAc,EAAE,UAAU,KAAK,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;mEAG+D;IAC/D,oBAAoB,CAAC,KAAa,EAAE,MAAe;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,kBAAkB,CAAC,KAAK,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnH,cAAc,EAAE,yBAAyB,KAAK,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IAED,wFAAwF;IAExF;;;;6EAIyE;IACzE,KAAK,CAAC,kBAAkB,CAAC,KAAwE;QAC/F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,gCAAgC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtI,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,mBAAmB,EACnB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,EAC3L,EAAE,cAAc,EAAE,gBAAgB,OAAO,CAAC,cAAc,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;CACF"}

package/dist/core/receiptVisibility.d.ts

@@ -14,6 +14,7 @@
  */
 export interface VisibilityCheckable {
     visibility?: "public" | "participants_only";
+    status?: string;
     agentA: {
         id: string;
     };
@@ -21,5 +22,18 @@ export interface VisibilityCheckable {
         id: string;
     };
 }
+/**
+ * A `draft` receipt is restricted regardless of its own `visibility` field —
+ * only agentB (the drafter) has consented to anything at draft time, so a
+ * `visibility: "public"` a drafter unilaterally chose isn't the requester's
+ * (agentA's) consent to expose it. An external review found this let anyone
+ * name any registered agent as agentA on an unbounded number of drafts, all
+ * publicly visible immediately with no involvement from the named agent
+ * (300 garbage "failed" drafts in one repro) — outcome/content freely chosen
+ * by whoever calls createDraft, landing in the named victim's public record
+ * before they've had any chance to react. Once countersigned (finalized) or
+ * disputed, both parties have acted on it and the chosen visibility applies
+ * as normal.
+ */
 export declare function isReceiptRestricted(receipt: VisibilityCheckable): boolean;
 export declare function isReceiptParticipant(receipt: VisibilityCheckable, callerDid: string | null | undefined): boolean;

package/dist/core/receiptVisibility.js

@@ -12,8 +12,21 @@
  * so that check stays at the route layer, which already imports both
  * services. This module only encodes the two checks that need no lookup.
  */
+/**
+ * A `draft` receipt is restricted regardless of its own `visibility` field —
+ * only agentB (the drafter) has consented to anything at draft time, so a
+ * `visibility: "public"` a drafter unilaterally chose isn't the requester's
+ * (agentA's) consent to expose it. An external review found this let anyone
+ * name any registered agent as agentA on an unbounded number of drafts, all
+ * publicly visible immediately with no involvement from the named agent
+ * (300 garbage "failed" drafts in one repro) — outcome/content freely chosen
+ * by whoever calls createDraft, landing in the named victim's public record
+ * before they've had any chance to react. Once countersigned (finalized) or
+ * disputed, both parties have acted on it and the chosen visibility applies
+ * as normal.
+ */
 export function isReceiptRestricted(receipt) {
-    return receipt.visibility === "participants_only";
+    return receipt.visibility === "participants_only" || receipt.status === "draft";
 }
 export function isReceiptParticipant(receipt, callerDid) {
     if (!callerDid)

package/dist/core/receiptVisibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"receiptVisibility.js","sourceRoot":"","sources":["../../src/core/receiptVisibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,MAAM,UAAU,mBAAmB,CAAC,OAA4B;IAC9D,OAAO,OAAO,CAAC,UAAU,KAAK,mBAAmB,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA4B,EAAE,SAAoC;IACrG,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"receiptVisibility.js","sourceRoot":"","sources":["../../src/core/receiptVisibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA4B;IAC9D,OAAO,OAAO,CAAC,UAAU,KAAK,mBAAmB,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA4B,EAAE,SAAoC;IACrG,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AAC5E,CAAC"}

package/dist/core/schemas.d.ts

@@ -241,6 +241,13 @@ export declare const resolveDisputeSchema: z.ZodObject<{
 }, {
     note?: string | undefined;
 }>;
+export declare const reportNonPerformanceSchema: z.ZodObject<{
+    reason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string | undefined;
+}, {
+    reason?: string | undefined;
+}>;
 export declare const submitVerificationSchema: z.ZodObject<{
     receiptId: z.ZodString;
     verifier: z.ZodString;
@@ -254,8 +261,8 @@ export declare const submitVerificationSchema: z.ZodObject<{
     receiptId: string;
     result: "verified" | "rejected";
     method: "deterministic" | "agent_attestation";
-    verifier: string;
     outputHash: string;
+    verifier: string;
     signature: string;
     score?: number | undefined;
     evidenceUri?: string | undefined;
@@ -263,8 +270,8 @@ export declare const submitVerificationSchema: z.ZodObject<{
     receiptId: string;
     result: "verified" | "rejected";
     method: "deterministic" | "agent_attestation";
-    verifier: string;
     outputHash: string;
+    verifier: string;
     signature: string;
     score?: number | undefined;
     evidenceUri?: string | undefined;

package/dist/core/schemas.js

@@ -92,6 +92,9 @@ export const draftReceiptSchema = z.object({
 export const countersignSchema = z.object({ signature: z.string().min(1) });
 export const disputeSchema = z.object({ reason: z.string().min(1) });
 export const resolveDisputeSchema = z.object({ note: z.string().max(500).optional() });
+// SPEC.md §3.3 (v0.25) — reported by a job's poster once its accepted
+// worker never delivers.
+export const reportNonPerformanceSchema = z.object({ reason: z.string().max(500).optional() });
 export const submitVerificationSchema = z.object({
     receiptId: z.string().min(1),
     verifier: z.string().min(1),

package/dist/core/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/core/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,oEAAoE;AACpE,uDAAuD;AACvD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;AAC/F,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;AAC9F,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;AAE1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,WAAW;KACvB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,WAAW;KACzB,CAAC;IACF,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,WAAW;KACf,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;QAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;KAClD,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/core/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,oEAAoE;AACpE,uDAAuD;AACvD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;AAC/F,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;AAC9F,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;AAE1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,SAAS,EAAE,WAAW;KACvB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,WAAW,EAAE,WAAW;KACzB,CAAC;IACF,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,WAAW;KACf,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;QAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;KAClD,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEvF,sEAAsE;AACtE,yBAAyB;AACzB,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE/F,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC"}

package/dist/crypto/keys.js

@@ -32,9 +32,30 @@ export function keypairFromPrivateKey(privateKey) {
 export function sign(message, privateKey) {
     return ed25519.sign(message, privateKey);
 }
+/**
+ * An external review found a small-order (low-order torsion) Ed25519 point
+ * registers as a valid did:key with no rejection anywhere -- and for such a
+ * point, the standard Ed25519 verification equation is satisfiable by
+ * arbitrary signature bytes, independent of the message, with no private key
+ * at all. Anyone could "sign" as that identity. Every raw-key verification
+ * in this codebase routes through verify()/verifyRawEd25519() below, so
+ * rejecting it here closes registration, receipt/verification signatures,
+ * and link-challenge proofs all at once, not just the registration path the
+ * review specifically reproduced.
+ */
+function isSmallOrderPublicKey(publicKey) {
+    try {
+        return ed25519.Point.fromHex(publicKey).isSmallOrder();
+    }
+    catch {
+        return true; // not even a valid curve point -- reject alongside small-order
+    }
+}
 export function verify(signature, message, did) {
     try {
         const publicKey = didToPublicKey(did);
+        if (isSmallOrderPublicKey(publicKey))
+            return false;
         return ed25519.verify(signature, message, publicKey);
     }
     catch {
@@ -46,6 +67,8 @@ export function verify(signature, message, did) {
  * necessarily encoded as an INAM did:key. */
 export function verifyRawEd25519(signature, message, publicKey) {
     try {
+        if (isSmallOrderPublicKey(publicKey))
+            return false;
         return ed25519.verify(signature, message, publicKey);
     }
     catch {

package/dist/crypto/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,IAAkB,EAAE,EAAE,CACjD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAE3C,qEAAqE;AACrE,MAAM,yBAAyB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAQhE,MAAM,UAAU,cAAc,CAAC,SAAqB;IAClD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrF,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAsB;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAmB,EAAE,UAAsB;IAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAqB,EAAE,OAAmB,EAAE,GAAW;IAC5E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;6CAE6C;AAC7C,MAAM,UAAU,gBAAgB,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IAChG,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAyB;IACjD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,6EAA6E;AAC7E,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,IAAkB,EAAE,EAAE,CACjD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAE3C,qEAAqE;AACrE,MAAM,yBAAyB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAQhE,MAAM,UAAU,cAAc,CAAC,SAAqB;IAClD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACrF,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAsB;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAmB,EAAE,UAAsB;IAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAAC,SAAqB;IAClD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,YAAY,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,+DAA+D;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAqB,EAAE,OAAmB,EAAE,GAAW;IAC5E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,qBAAqB,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;6CAE6C;AAC7C,MAAM,UAAU,gBAAgB,CAAC,SAAqB,EAAE,OAAmB,EAAE,SAAqB;IAChG,IAAI,CAAC;QACH,IAAI,qBAAqB,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAyB;IACjD,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/types.d.ts

@@ -179,6 +179,10 @@ export interface ReputationComponents {
      * (SPEC.md §12.5) — distinct from `verifiedReceipts` above, which really
      * means "two-party finalized," not independently attested. */
     attestedReceipts: number;
+    /** Count of jobs where this agent was the accepted worker and the
+     * poster later reported non-performance (SPEC.md §3.3) — the only
+     * negative-outcome signal that doesn't require a receipt at all. */
+    nonPerformanceReports: number;
     /** This agent's history specifically as agentB (the one who did the work)
      * on its finalized receipts (SPEC.md §5.3). */
     asProvider: ReputationRoleBreakdown;
@@ -191,7 +195,7 @@ export interface ReputationResult {
     components: ReputationComponents;
     flags: string[];
 }
-export type JobStatus = "open" | "accepted" | "completed" | "cancelled";
+export type JobStatus = "open" | "accepted" | "completed" | "cancelled" | "nonperformed";
 export interface JobOffer {
     agentId: string;
     message?: string;
@@ -209,9 +213,17 @@ export interface JobRecord {
     status: JobStatus;
     offers: JobOffer[];
     acceptedAgentId?: string;
+    acceptedAt?: string;
     receiptId?: string;
     createdAt: string;
     expiresAt?: string;
+    /** SPEC.md §3.3 (v0.25) — set only when status transitions to
+     * "nonperformed"; a one-sided report by the poster, no worker
+     * counterpart is possible by design. */
+    nonPerformance?: {
+        reportedAt: string;
+        reason?: string;
+    };
 }
 /** SPEC.md §12 — how an independent Verification's signer actually checked
  *  the work. **Not** the same as `VerificationMethod` (§4.1) above: that's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inamprotocol",
-  "version": "0.4.2",
+  "version": "0.6.0",
   "description": "Reference TypeScript/JavaScript SDK for the INAM Protocol — agent identity, execution receipts, jobs, and reputation",
   "type": "module",
   "main": "./dist/index.js",