tersign 0.0.1 → 0.1.0

package/dist/dispute/sign.js

@@ -0,0 +1,212 @@
+import { recoverTypedDataAddress } from 'viem';
+import { digestOf } from '../canonical.js';
+export const DISPUTE_DOMAIN = { name: 'tersign dispute', version: '1', chainId: 1n };
+export const EVIDENCE_DOMAIN = { name: 'tersign evidence', version: '1', chainId: 1n };
+export const CRITERIA_DOMAIN = { name: 'tersign acceptance-criteria', version: '1', chainId: 1n };
+export const DISPUTE_TYPES = {
+    DisputeAttestation: [
+        { name: 'version', type: 'uint256' },
+        { name: 'disputeDigest', type: 'bytes32' },
+        { name: 'receiptDigest', type: 'bytes32' },
+        { name: 'openedAt', type: 'uint256' },
+    ],
+};
+export const EVIDENCE_TYPES = {
+    EvidenceAttestation: [
+        { name: 'version', type: 'uint256' },
+        { name: 'evidenceDigest', type: 'bytes32' },
+        { name: 'disputeDigest', type: 'bytes32' },
+        { name: 'submittedAt', type: 'uint256' },
+    ],
+};
+export const CRITERIA_TYPES = {
+    CriteriaAttestation: [
+        { name: 'version', type: 'uint256' },
+        { name: 'criteriaDigest', type: 'bytes32' },
+        { name: 'issuedAt', type: 'uint256' },
+    ],
+};
+/** Pinned digest of the dispute-layer EIP-712 material. The ledger re-declares these
+ * constants (Workers bundle, no shared package yet) and pins the SAME vector — if either
+ * side edits a domain or type, the cross-impl test breaks before signatures do. */
+export const DISPUTE_WIRE_VECTOR = digestOf({
+    domains: {
+        dispute: { ...DISPUTE_DOMAIN, chainId: 1 },
+        evidence: { ...EVIDENCE_DOMAIN, chainId: 1 },
+        criteria: { ...CRITERIA_DOMAIN, chainId: 1 },
+    },
+    types: { ...DISPUTE_TYPES, ...EVIDENCE_TYPES, ...CRITERIA_TYPES },
+});
+export function disputeDigest(dispute) {
+    return digestOf(dispute);
+}
+export function evidenceDigest(evidence) {
+    return digestOf(evidence);
+}
+export function criteriaDigest(criteria) {
+    return digestOf(criteria);
+}
+/** Sign a dispute as the CLAIMANT. The ledger only accepts disputes whose recovered
+ * signer equals the disputed receipt's `payer` — possession of the paying key IS the
+ * standing to dispute. */
+export async function signDispute(dispute, account) {
+    if (!account.signTypedData)
+        throw new Error('account cannot sign typed data');
+    const payload = {
+        version: 1,
+        disputeDigest: disputeDigest(dispute),
+        receiptDigest: dispute.receiptDigest,
+        openedAt: dispute.openedAt,
+    };
+    const signature = await account.signTypedData({
+        domain: DISPUTE_DOMAIN,
+        types: DISPUTE_TYPES,
+        primaryType: 'DisputeAttestation',
+        message: {
+            version: BigInt(payload.version),
+            disputeDigest: payload.disputeDigest,
+            receiptDigest: payload.receiptDigest,
+            openedAt: BigInt(payload.openedAt),
+        },
+    });
+    return { dispute, attestation: { format: 'eip712', payload, signature } };
+}
+export async function verifyDispute(signed, expectedSigner) {
+    const { dispute, attestation } = signed;
+    if (attestation.format !== 'eip712')
+        return { valid: false, reason: 'jws not implemented in v0' };
+    if (attestation.payload.disputeDigest !== disputeDigest(dispute)) {
+        return { valid: false, reason: 'dispute digest mismatch — dispute was altered after signing' };
+    }
+    if (attestation.payload.receiptDigest !== dispute.receiptDigest) {
+        return { valid: false, reason: 'attestation/receipt digest mismatch' };
+    }
+    try {
+        const signer = await recoverTypedDataAddress({
+            domain: DISPUTE_DOMAIN,
+            types: DISPUTE_TYPES,
+            primaryType: 'DisputeAttestation',
+            message: {
+                version: BigInt(attestation.payload.version),
+                disputeDigest: attestation.payload.disputeDigest,
+                receiptDigest: attestation.payload.receiptDigest,
+                openedAt: BigInt(attestation.payload.openedAt),
+            },
+            signature: attestation.signature,
+        });
+        if (expectedSigner && signer.toLowerCase() !== expectedSigner.toLowerCase()) {
+            return { valid: false, signer, reason: 'signer is not the receipt payer' };
+        }
+        return { valid: true, signer };
+    }
+    catch (e) {
+        return { valid: false, reason: e instanceof Error ? e.message : 'signature recovery failed' };
+    }
+}
+/** Sign evidence as either party. Role/identity binding is enforced by the ledger:
+ * claimant evidence must recover to the receipt payer, respondent evidence to the
+ * seller's payTo key. */
+export async function signEvidence(evidence, account) {
+    if (!account.signTypedData)
+        throw new Error('account cannot sign typed data');
+    const payload = {
+        version: 1,
+        evidenceDigest: evidenceDigest(evidence),
+        disputeDigest: evidence.disputeDigest,
+        submittedAt: evidence.submittedAt,
+    };
+    const signature = await account.signTypedData({
+        domain: EVIDENCE_DOMAIN,
+        types: EVIDENCE_TYPES,
+        primaryType: 'EvidenceAttestation',
+        message: {
+            version: BigInt(payload.version),
+            evidenceDigest: payload.evidenceDigest,
+            disputeDigest: payload.disputeDigest,
+            submittedAt: BigInt(payload.submittedAt),
+        },
+    });
+    return { evidence, attestation: { format: 'eip712', payload, signature } };
+}
+export async function verifyEvidence(signed, expectedSigner) {
+    const { evidence, attestation } = signed;
+    if (attestation.format !== 'eip712')
+        return { valid: false, reason: 'jws not implemented in v0' };
+    if (attestation.payload.evidenceDigest !== evidenceDigest(evidence)) {
+        return { valid: false, reason: 'evidence digest mismatch — evidence was altered after signing' };
+    }
+    if (attestation.payload.disputeDigest !== evidence.disputeDigest) {
+        return { valid: false, reason: 'attestation/dispute digest mismatch' };
+    }
+    try {
+        const signer = await recoverTypedDataAddress({
+            domain: EVIDENCE_DOMAIN,
+            types: EVIDENCE_TYPES,
+            primaryType: 'EvidenceAttestation',
+            message: {
+                version: BigInt(attestation.payload.version),
+                evidenceDigest: attestation.payload.evidenceDigest,
+                disputeDigest: attestation.payload.disputeDigest,
+                submittedAt: BigInt(attestation.payload.submittedAt),
+            },
+            signature: attestation.signature,
+        });
+        if (expectedSigner && signer.toLowerCase() !== expectedSigner.toLowerCase()) {
+            return { valid: false, signer, reason: 'unexpected signer for this evidence role' };
+        }
+        return { valid: true, signer };
+    }
+    catch (e) {
+        return { valid: false, reason: e instanceof Error ? e.message : 'signature recovery failed' };
+    }
+}
+/** Sign acceptance criteria as the SELLER, pre-committing the machine-checkable bar the
+ * arbiter will hold the delivery to. Attach the returned digest to offers/records. */
+export async function signCriteria(criteria, account) {
+    if (!account.signTypedData)
+        throw new Error('account cannot sign typed data');
+    const payload = {
+        version: 1,
+        criteriaDigest: criteriaDigest(criteria),
+        issuedAt: criteria.issuedAt,
+    };
+    const signature = await account.signTypedData({
+        domain: CRITERIA_DOMAIN,
+        types: CRITERIA_TYPES,
+        primaryType: 'CriteriaAttestation',
+        message: {
+            version: BigInt(payload.version),
+            criteriaDigest: payload.criteriaDigest,
+            issuedAt: BigInt(payload.issuedAt),
+        },
+    });
+    return { criteria, attestation: { format: 'eip712', payload, signature } };
+}
+export async function verifyCriteria(signed, expectedSigner) {
+    const { criteria, attestation } = signed;
+    if (attestation.format !== 'eip712')
+        return { valid: false, reason: 'jws not implemented in v0' };
+    if (attestation.payload.criteriaDigest !== criteriaDigest(criteria)) {
+        return { valid: false, reason: 'criteria digest mismatch — criteria were altered after signing' };
+    }
+    try {
+        const signer = await recoverTypedDataAddress({
+            domain: CRITERIA_DOMAIN,
+            types: CRITERIA_TYPES,
+            primaryType: 'CriteriaAttestation',
+            message: {
+                version: BigInt(attestation.payload.version),
+                criteriaDigest: attestation.payload.criteriaDigest,
+                issuedAt: BigInt(attestation.payload.issuedAt),
+            },
+            signature: attestation.signature,
+        });
+        if (expectedSigner && signer.toLowerCase() !== expectedSigner.toLowerCase()) {
+            return { valid: false, signer, reason: 'unexpected signer' };
+        }
+        return { valid: true, signer };
+    }
+    catch (e) {
+        return { valid: false, reason: e instanceof Error ? e.message : 'signature recovery failed' };
+    }
+}

package/dist/dispute/types.d.ts

@@ -0,0 +1,98 @@
+import type { SignedArtifact } from '../types.js';
+export type { VerifyLike } from '../compliance/types.js';
+/** Tersign dispute layer v0 — the genuinely unowned layer of agent commerce (x402 ships
+ * receipts + idempotency natively; disputes are explicitly out of scope upstream).
+ *
+ * Design constraints (do not relax):
+ * - OBJECTIVE disputes only in v1: reasons limited to machine-decidable or
+ *   default-judgment-decidable claims; anything contested and non-mechanical ESCALATES.
+ * - SIGNED-EVIDENCE-ONLY: the adjudicator reads signed artifacts + ledger records; free-text
+ *   from either party is never an input channel (prompt-injection neutralization).
+ * - Pre-committed outcomes: verdict ∈ {refund, uphold}; the arbiter can never invent
+ *   a third destination for value.
+ * Everything is content-addressed (keccak digests of canonical JSON) and signed via
+ * digest-bound EIP-712 attestations, so payload schemas can evolve without breaking
+ * signatures — same pattern as compliance records. */
+/** v1 objective reason codes. `quality`-style subjective claims are deliberately absent. */
+export type DisputeReason = 'not_delivered' | 'wrong_content' | 'duplicate_charge';
+export type DisputeVerdict = 'refund' | 'uphold';
+export type DisputeStatus = 'open' | 'adjudicated' | 'escalated' | 'closed';
+export interface DisputePayloadV1 {
+    version: 1;
+    /** digest of the receipt artifact being disputed */
+    receiptDigest: `0x${string}`;
+    reason: DisputeReason;
+    /** claimed refund, decimal string in the settlement asset/currency of the receipt */
+    claimAmount: string;
+    /** digest of the seller's pre-committed acceptance criteria, when the offer carried one */
+    criteriaDigest?: `0x${string}`;
+    /** free text for HUMANS reviewing the record — never an adjudication input */
+    statement?: string;
+    /** unix seconds */
+    openedAt: number;
+}
+/** Machine-checkable acceptance criteria a seller pre-commits at offer time. The
+ * pre-commitment is the contract surface: the arbiter selects between outcomes by
+ * evaluating THESE, not by judging quality after the fact. */
+export interface CriterionV1 {
+    id: string;
+    kind: 'content-digest' | 'delivered-by' | 'no-duplicate-charge';
+    /** kind-specific parameters, all string-valued (e.g. { expected: "0x…" } for
+     * content-digest, { withinSeconds: "300" } for delivered-by) */
+    params: Record<string, string>;
+    description: string;
+}
+export interface AcceptanceCriteriaV1 {
+    version: 1;
+    resourceUrl: string;
+    criteria: CriterionV1[];
+    /** unix seconds */
+    issuedAt: number;
+}
+export interface EvidenceArtifactRef {
+    kind: 'content-digest' | 'delivery-attestation' | 'payment-proof' | 'transcript';
+    /** digest of the underlying artifact (content, attestation JSON, tx proof, transcript) */
+    digest: `0x${string}`;
+    /** unix seconds the referenced event happened, when applicable */
+    at?: number;
+    note?: string;
+}
+export interface EvidencePayloadV1 {
+    version: 1;
+    /** content address of the dispute this evidence answers */
+    disputeDigest: `0x${string}`;
+    role: 'claimant' | 'respondent';
+    artifacts: EvidenceArtifactRef[];
+    /** unix seconds */
+    submittedAt: number;
+}
+/** Digest-bound attestation payloads (the only EIP-712-signed shapes — fixed forever). */
+export interface DisputeAttestationPayload {
+    version: 1;
+    disputeDigest: `0x${string}`;
+    receiptDigest: `0x${string}`;
+    openedAt: number;
+}
+export interface EvidenceAttestationPayload {
+    version: 1;
+    evidenceDigest: `0x${string}`;
+    disputeDigest: `0x${string}`;
+    submittedAt: number;
+}
+export interface CriteriaAttestationPayload {
+    version: 1;
+    criteriaDigest: `0x${string}`;
+    issuedAt: number;
+}
+export type SignedDispute = {
+    dispute: DisputePayloadV1;
+    attestation: SignedArtifact<DisputeAttestationPayload>;
+};
+export type SignedEvidence = {
+    evidence: EvidencePayloadV1;
+    attestation: SignedArtifact<EvidenceAttestationPayload>;
+};
+export type SignedCriteria = {
+    criteria: AcceptanceCriteriaV1;
+    attestation: SignedArtifact<CriteriaAttestationPayload>;
+};

package/dist/dispute/types.js

@@ -0,0 +1 @@
+export {};

package/dist/envelope/serialize.d.ts

@@ -0,0 +1,30 @@
+/** Venue serializers for EvidenceEnvelopeV1. Pure functions — the same envelope serializes for
+ * every venue, which is what makes the adapter venue-neutral (supplier-to-N-courts, never
+ * bound to one). MUST stay byte-identical to @tersign/ledger's copy (envelope.ts); the
+ * cross-impl vector is pinned in both test suites.
+ *
+ * Anti-injection invariant (all venues): party-supplied text NEVER mixes with ledger-attested
+ * prose. It travels either under a self-describing key (`unverifiedPartyStatement`) or after
+ * the fixed UNVERIFIED_CLAIM_MARKER, always LAST, so no attested content follows untrusted
+ * bytes. A statement can therefore never impersonate the neutral ledger voice to a human or
+ * LLM juror. */
+import { type EvidenceEnvelopeV1 } from './types.js';
+export declare function assertEnvelopeCaps(env: EvidenceEnvelopeV1): void;
+/** Internet Court submission: a self-describing JSON string that fits the evidenceDefs slot
+ * (≤5,000 chars). Carries digests + verifyUrl, never raw evidence. */
+export declare function toInternetCourtSubmission(env: EvidenceEnvelopeV1): string;
+/** Kleros ERC-1497 evidence JSON. fileURI resolves to the public verify endpoint; fileHash is
+ * the artifact digest. The party statement travels in its own self-describing extension field,
+ * never inside the attested description (ERC-1497 JSON tolerates extra fields). */
+export interface Kleros1497Evidence {
+    name: string;
+    description: string;
+    fileURI: string;
+    fileHash: string;
+    fileTypeExtension: string;
+    unverifiedPartyStatement?: string;
+}
+export declare function toKlerosEvidence(env: EvidenceEnvelopeV1): Kleros1497Evidence;
+/** UMA-style claim: a compact assertion string a verifier can check mechanically. The party
+ * statement, when present, is appended LAST behind the fixed untrusted-text marker. */
+export declare function toUMAClaim(env: EvidenceEnvelopeV1): string;

package/dist/envelope/serialize.js

@@ -0,0 +1,73 @@
+/** Venue serializers for EvidenceEnvelopeV1. Pure functions — the same envelope serializes for
+ * every venue, which is what makes the adapter venue-neutral (supplier-to-N-courts, never
+ * bound to one). MUST stay byte-identical to @tersign/ledger's copy (envelope.ts); the
+ * cross-impl vector is pinned in both test suites.
+ *
+ * Anti-injection invariant (all venues): party-supplied text NEVER mixes with ledger-attested
+ * prose. It travels either under a self-describing key (`unverifiedPartyStatement`) or after
+ * the fixed UNVERIFIED_CLAIM_MARKER, always LAST, so no attested content follows untrusted
+ * bytes. A statement can therefore never impersonate the neutral ledger voice to a human or
+ * LLM juror. */
+import { ENVELOPE_STATEMENT_MAX_CHARS, UNVERIFIED_CLAIM_MARKER, VENUE_SUBMISSION_MAX_CHARS, } from './types.js';
+export function assertEnvelopeCaps(env) {
+    if (env.unverifiedPartyStatement !== undefined &&
+        env.unverifiedPartyStatement.length > ENVELOPE_STATEMENT_MAX_CHARS) {
+        throw new Error(`envelope statement exceeds ${ENVELOPE_STATEMENT_MAX_CHARS} chars`);
+    }
+}
+/** Internet Court submission: a self-describing JSON string that fits the evidenceDefs slot
+ * (≤5,000 chars). Carries digests + verifyUrl, never raw evidence. */
+export function toInternetCourtSubmission(env) {
+    assertEnvelopeCaps(env);
+    const out = JSON.stringify({
+        type: 'tersign-evidence-envelope-v1',
+        summary: `Counter-signed ${env.kind} evidence: artifact ${env.subject.digest} at seq ${env.subject.seq} ` +
+            `of seller '${env.subject.sellerId}' chain, counter-signed by neutral ledger ${env.chain.ledgerSigner} ` +
+            `at transaction time (before this dispute arose).` +
+            (env.unverifiedPartyStatement !== undefined
+                ? ` The envelope.unverifiedPartyStatement field is party-supplied testimony, not ledger-attested.`
+                : ''),
+        envelope: env,
+        howToVerify: `GET ${env.verifyUrl} (no account) recomputes the hash-chain link and returns chainOk; ` +
+            `or recompute locally: linkDigest = keccak256(canonical({artifactDigest, prevDigest, seq})) ` +
+            `and recover the counter-signature to ${env.chain.ledgerSigner}.`,
+    });
+    if (out.length > VENUE_SUBMISSION_MAX_CHARS) {
+        throw new Error(`internet-court submission exceeds ${VENUE_SUBMISSION_MAX_CHARS} chars`);
+    }
+    return out;
+}
+export function toKlerosEvidence(env) {
+    assertEnvelopeCaps(env);
+    return {
+        name: `Tersign counter-signed ${env.kind} (seq ${env.subject.seq})`,
+        description: `Neutral-ledger evidence for ${env.kind} ${env.subject.digest} in seller '${env.subject.sellerId}' ` +
+            `hash-chain. Counter-signed at transaction time by ${env.chain.ledgerSigner}; link digest ` +
+            `${env.chain.linkDigest}. Verify without trusting any party at the fileURI.` +
+            (env.unverifiedPartyStatement !== undefined
+                ? ` A party-supplied claim accompanies this evidence in the unverifiedPartyStatement field (not ledger-attested).`
+                : ''),
+        fileURI: env.verifyUrl,
+        fileHash: env.subject.digest,
+        fileTypeExtension: 'json',
+        ...(env.unverifiedPartyStatement !== undefined
+            ? { unverifiedPartyStatement: env.unverifiedPartyStatement }
+            : {}),
+    };
+}
+/** UMA-style claim: a compact assertion string a verifier can check mechanically. The party
+ * statement, when present, is appended LAST behind the fixed untrusted-text marker. */
+export function toUMAClaim(env) {
+    assertEnvelopeCaps(env);
+    const claim = `Tersign evidence envelope v1: ${env.kind} ${env.subject.digest} is entry seq ${env.subject.seq} ` +
+        `(prev ${env.chain.prevDigest ?? 'genesis'}) of seller '${env.subject.sellerId}' hash-chain, ` +
+        `counter-signed by ${env.chain.ledgerSigner} (link ${env.chain.linkDigest}). ` +
+        `Verifiable at ${env.verifyUrl}.` +
+        (env.unverifiedPartyStatement !== undefined
+            ? ` ${UNVERIFIED_CLAIM_MARKER} ${env.unverifiedPartyStatement}`
+            : '');
+    if (claim.length > VENUE_SUBMISSION_MAX_CHARS) {
+        throw new Error(`uma claim exceeds ${VENUE_SUBMISSION_MAX_CHARS} chars`);
+    }
+    return claim;
+}

package/dist/envelope/types.d.ts

@@ -0,0 +1,49 @@
+/** Evidence envelope v1 — the venue-neutral core of the evidence adapter.
+ *
+ * An envelope carries DIGESTS + a public verification URL, never raw evidence: the receiving
+ * venue (Internet Court, Kleros, UMA, or any future court) resolves `verifyUrl` to recompute
+ * the hash-chain link and recover the ledger counter-signature itself. Self-submitted evidence
+ * is testimony; a counter-signed contemporaneous record is an exhibit — the envelope is how an
+ * exhibit travels into a venue whose submission slot is a bounded text/JSON blob. */
+/** 'refund' is deliberately absent: refunds live in their own table and are not yet servable
+ * as envelopes — the type must never advertise an evidence class the endpoint can't produce. */
+export type EnvelopeSubjectKind = 'receipt' | 'action';
+export interface EvidenceEnvelopeV1 {
+    version: 1;
+    schema: 'tersign-evidence-envelope-v1';
+    /** what the chained artifact is */
+    kind: EnvelopeSubjectKind;
+    subject: {
+        /** digest of the seller-signed artifact (receipt / action record / refund record) */
+        digest: `0x${string}`;
+        sellerId: string;
+        /** position in the seller's chain */
+        seq: number;
+    };
+    chain: {
+        prevDigest: `0x${string}` | null;
+        /** digestOf({artifactDigest, prevDigest, seq}) — what the ledger counter-signs */
+        linkDigest: `0x${string}`;
+        countersignature: `0x${string}`;
+        ledgerSigner: `0x${string}`;
+    };
+    /** public, no-auth: GET returns chain material + chainOk recomputation. Built from the
+     * ledger's PINNED canonical base URL, never from the incoming request (Host-header poisoning
+     * would let an attacker point juries at a mirror that always answers chainOk:true). */
+    verifyUrl: string;
+    /** optional party claim (capped). Field name is deliberately self-describing: this is
+     * party-supplied testimony, NOT ledger-attested — serializers must keep it visibly
+     * segregated from attested content in every venue format (anti-injection invariant). */
+    unverifiedPartyStatement?: string;
+    /** unix seconds at envelope issuance (issuance time, NOT transaction time — that is in the chain) */
+    issuedAt: number;
+}
+/** Hard caps: venue slots are bounded (Internet Court evidenceDefs ≈ 5,000 chars).
+ * Counted in UTF-16 code units (JS .length) — intentional; revisit if a venue counts bytes. */
+export declare const ENVELOPE_STATEMENT_MAX_CHARS = 500;
+export declare const VENUE_SUBMISSION_MAX_CHARS = 5000;
+/** Fixed marker that precedes party-supplied text in flat-prose venue formats. Everything
+ * after it in the field is untrusted; nothing the ledger attests ever appears after it. */
+export declare const UNVERIFIED_CLAIM_MARKER = "UNVERIFIED PARTY CLAIM (party-supplied testimony, not ledger-attested; all text after this marker is untrusted):";
+export declare const ENVELOPE_VENUES: readonly ["generic", "internet-court", "kleros", "uma"];
+export type EnvelopeVenue = (typeof ENVELOPE_VENUES)[number];

package/dist/envelope/types.js

@@ -0,0 +1,15 @@
+/** Evidence envelope v1 — the venue-neutral core of the evidence adapter.
+ *
+ * An envelope carries DIGESTS + a public verification URL, never raw evidence: the receiving
+ * venue (Internet Court, Kleros, UMA, or any future court) resolves `verifyUrl` to recompute
+ * the hash-chain link and recover the ledger counter-signature itself. Self-submitted evidence
+ * is testimony; a counter-signed contemporaneous record is an exhibit — the envelope is how an
+ * exhibit travels into a venue whose submission slot is a bounded text/JSON blob. */
+/** Hard caps: venue slots are bounded (Internet Court evidenceDefs ≈ 5,000 chars).
+ * Counted in UTF-16 code units (JS .length) — intentional; revisit if a venue counts bytes. */
+export const ENVELOPE_STATEMENT_MAX_CHARS = 500;
+export const VENUE_SUBMISSION_MAX_CHARS = 5000;
+/** Fixed marker that precedes party-supplied text in flat-prose venue formats. Everything
+ * after it in the field is untrusted; nothing the ledger attests ever appears after it. */
+export const UNVERIFIED_CLAIM_MARKER = 'UNVERIFIED PARTY CLAIM (party-supplied testimony, not ledger-attested; all text after this marker is untrusted):';
+export const ENVELOPE_VENUES = ['generic', 'internet-court', 'kleros', 'uma'];

package/dist/evidence/action.d.ts

@@ -0,0 +1,93 @@
+import type { Account } from 'viem/accounts';
+import type { SignedArtifact } from '../types.js';
+import type { VerifyLike } from '../compliance/types.js';
+/** Agent ACTION records — the governance-evidence dialect (governance-evidence design note).
+ *
+ * A payment receipt proves an agent PAID; an action record proves what an agent DID:
+ * a disclosure was presented (EU AI Act Art 50(1)/(2)), a governance checkpoint ran
+ * (MAS SAFR audit-log shape: proposed action → rules applied → outcome), a tool call
+ * happened. Records carry DIGESTS of content, never content — the ledger stays a
+ * data-minimized evidence chain (GDPR data-minimization posture), and the seller keeps
+ * the underlying artifacts under their own retention.
+ *
+ * Same digest-bound EIP-712 attestation pattern as compliance/dispute records: the
+ * signed shape is fixed forever; the record schema can evolve. */
+export type ActionKind = 'tool-call' | 'message' | 'decision' | 'disclosure' | 'payment';
+export type DisclosureKind = 'ai-interaction' | 'synthetic-content';
+export type GovernanceOutcome = 'allowed' | 'blocked' | 'escalated';
+export interface ActionRecordV1 {
+    version: 1;
+    agent: {
+        /** stable identifier for the agent (deployer-scoped; ERC-8004/DID id when available) */
+        id: string;
+        /** signed principal behind the agent — the liability anchor */
+        principal?: string;
+        model?: string;
+        framework?: string;
+    };
+    action: {
+        kind: ActionKind;
+        /** tool/function/route name when applicable */
+        name?: string;
+        inputDigest?: `0x${string}`;
+        outputDigest?: `0x${string}`;
+    };
+    /** Art 50 disclosure evidence: 'ai-interaction' → Art 50(1) (inform natural persons
+     * they interact with an AI system); 'synthetic-content' → Art 50(2)/(4) marking and
+     * deep-fake/text disclosure. textDigest = digest of the disclosure actually shown. */
+    disclosure?: {
+        kind: DisclosureKind;
+        /** unix seconds the disclosure was presented */
+        presentedAt: number;
+        /** channel: 'chat' | 'api' | 'voice' | 'ui' … free-form */
+        medium?: string;
+        textDigest?: `0x${string}`;
+    };
+    /** SAFR-shaped governance checkpoint evidence (audit-log component: proposed action,
+     * rules applied, outcome). SAFR is a MAS industry white paper (2026-07-03), not a
+     * mandate — position as alignment, never as statutory compliance. */
+    governance?: {
+        policyId?: string;
+        rulesApplied?: string[];
+        outcome: GovernanceOutcome;
+        /** digest of the controls-repository snapshot consulted */
+        controlsDigest?: `0x${string}`;
+    };
+    /** opaque per-deployer subject reference — never PII (data-minimization default) */
+    subjectRef?: string;
+    resourceUrl?: string;
+    /** unix seconds the action occurred */
+    occurredAt: number;
+}
+export interface ActionAttestationPayload {
+    version: 1;
+    actionDigest: `0x${string}`;
+    occurredAt: number;
+}
+export type SignedActionRecord = {
+    record: ActionRecordV1;
+    attestation: SignedArtifact<ActionAttestationPayload>;
+};
+export declare const ACTION_DOMAIN: {
+    readonly name: "tersign action-record";
+    readonly version: "1";
+    readonly chainId: 1n;
+};
+export declare const ACTION_TYPES: {
+    readonly ActionAttestation: readonly [{
+        readonly name: "version";
+        readonly type: "uint256";
+    }, {
+        readonly name: "actionDigest";
+        readonly type: "bytes32";
+    }, {
+        readonly name: "occurredAt";
+        readonly type: "uint256";
+    }];
+};
+/** Pinned digest of the action-record EIP-712 material — the ledger re-declares these
+ * constants and pins the SAME vector (cross-impl drift tripwire, like DISPUTE_WIRE_VECTOR). */
+export declare const ACTION_WIRE_VECTOR: `0x${string}`;
+export declare function actionDigest(record: ActionRecordV1): `0x${string}`;
+export declare function signActionRecord(record: ActionRecordV1, account: Account): Promise<SignedActionRecord>;
+export declare function verifyActionRecord(signed: SignedActionRecord, expectedSigner?: string): Promise<VerifyLike>;

package/dist/evidence/action.js

@@ -0,0 +1,70 @@
+import { recoverTypedDataAddress } from 'viem';
+import { digestOf } from '../canonical.js';
+export const ACTION_DOMAIN = { name: 'tersign action-record', version: '1', chainId: 1n };
+export const ACTION_TYPES = {
+    ActionAttestation: [
+        { name: 'version', type: 'uint256' },
+        { name: 'actionDigest', type: 'bytes32' },
+        { name: 'occurredAt', type: 'uint256' },
+    ],
+};
+/** Pinned digest of the action-record EIP-712 material — the ledger re-declares these
+ * constants and pins the SAME vector (cross-impl drift tripwire, like DISPUTE_WIRE_VECTOR). */
+export const ACTION_WIRE_VECTOR = digestOf({
+    domain: { ...ACTION_DOMAIN, chainId: 1 },
+    types: ACTION_TYPES,
+});
+export function actionDigest(record) {
+    return digestOf(record);
+}
+export async function signActionRecord(record, account) {
+    if (!account.signTypedData)
+        throw new Error('account cannot sign typed data');
+    const payload = {
+        version: 1,
+        actionDigest: actionDigest(record),
+        occurredAt: record.occurredAt,
+    };
+    const signature = await account.signTypedData({
+        domain: ACTION_DOMAIN,
+        types: ACTION_TYPES,
+        primaryType: 'ActionAttestation',
+        message: {
+            version: BigInt(payload.version),
+            actionDigest: payload.actionDigest,
+            occurredAt: BigInt(payload.occurredAt),
+        },
+    });
+    return { record, attestation: { format: 'eip712', payload, signature } };
+}
+export async function verifyActionRecord(signed, expectedSigner) {
+    const { record, attestation } = signed;
+    if (attestation.format !== 'eip712')
+        return { valid: false, reason: 'jws not implemented in v0' };
+    if (attestation.payload.actionDigest !== actionDigest(record)) {
+        return { valid: false, reason: 'action digest mismatch — record was altered after signing' };
+    }
+    if (attestation.payload.occurredAt !== record.occurredAt) {
+        return { valid: false, reason: 'attestation/occurredAt mismatch' };
+    }
+    try {
+        const signer = await recoverTypedDataAddress({
+            domain: ACTION_DOMAIN,
+            types: ACTION_TYPES,
+            primaryType: 'ActionAttestation',
+            message: {
+                version: BigInt(attestation.payload.version),
+                actionDigest: attestation.payload.actionDigest,
+                occurredAt: BigInt(attestation.payload.occurredAt),
+            },
+            signature: attestation.signature,
+        });
+        if (expectedSigner && signer.toLowerCase() !== expectedSigner.toLowerCase()) {
+            return { valid: false, signer, reason: 'unexpected signer' };
+        }
+        return { valid: true, signer };
+    }
+    catch (e) {
+        return { valid: false, reason: e instanceof Error ? e.message : 'signature recovery failed' };
+    }
+}