{"_id":"@accord-protocol/conformance","_rev":"3-d6afcec2f9666ff70bd3e2e97691c113","name":"@accord-protocol/conformance","dist-tags":{"latest":"0.4.2"},"versions":{"0.4.0":{"name":"@accord-protocol/conformance","version":"0.4.0","keywords":["accord-protocol","conformance","compatibility","test-suite","agent-payments","accord-compatible"],"author":{"name":"bez111"},"license":"MIT","_id":"@accord-protocol/conformance@0.4.0","maintainers":[{"name":"accord-protocol","email":"alexander.bezkrovny@gmail.com"}],"homepage":"https://github.com/accord-protocol/accord-protocol/tree/main/packages/accord-conformance","bugs":{"url":"https://github.com/accord-protocol/accord-protocol/issues"},"bin":{"accord-conformance":"dist/cli.js"},"dist":{"shasum":"896bb71f79a9cf6f2b9259cdadc811f2cbe333ae","tarball":"https://registry.npmjs.org/@accord-protocol/conformance/-/conformance-0.4.0.tgz","fileCount":11,"integrity":"sha512-dQZXg6YMID9ok2Q9CWR87iFPfv61S2ii1bPml4o04fGa0toDWZqjqsbdvRh6rEMvSPXkUzYacK9s5DAuGbAlCw==","signatures":[{"sig":"MEUCIQD9fMM2AD2qkrqEbuAlwg4UphRP0BHu4tmts7i8+7QxBAIgQNiIuHxJnzrP/ty4RIUTfrK1+4YUEfYByIreoeNgRDs=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":266112},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"}},"gitHead":"3de0b386d2e83302cac87206d198a8a799b6baa8","scripts":{"test":"npx tsx --test src/__tests__/*.test.ts","build":"tsup src/index.ts src/cli.ts --format esm,cjs --dts --clean","typecheck":"tsc --noEmit"},"_npmUser":{"name":"accord-protocol","email":"alexander.bezkrovny@gmail.com"},"repository":{"url":"git+https://github.com/accord-protocol/accord-protocol.git","type":"git","directory":"packages/accord-conformance"},"_npmVersion":"10.9.4","description":"Accord Protocol conformance suite and CLI. Exercises L0 schema, L1 transport, L2 rail, L3 security and L4 registry compatibility against an Accord implementation. Supports HTTP and MCP-stdio probing, plus ed25519 signing of conformance results. The output","directories":{},"_nodeVersion":"22.21.1","dependencies":{"ajv":"^8.12.0","ajv-formats":"^3.0.0","@noble/curves":"^1.8.0","@noble/hashes":"^1.8.0","agentpay-base":"^0.3.0","ergo-agent-pay":"^0.3.0","ergo-agent-scripts":"^0.3.0","@accord-protocol/mcp":"^0.4.0","@accord-protocol/core":"^0.4.0","@accord-protocol/rails":"^0.4.0","@accord-protocol/gateway":"^0.4.0","@accord-protocol/rails-base":"^0.4.0","@accord-protocol/rails-ergo":"^0.4.0","@accord-protocol/rails-x402":"^0.4.0","@accord-protocol/rails-rosen":"^0.4.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.0.0","tsup":"^8.0.0","typescript":"^5.0.0","@types/node":"^20.0.0"},"_npmOperationalInternal":{"tmp":"tmp/conformance_0.4.0_1778775654612_0.5213832761817854","host":"s3://npm-registry-packages-npm-production"}},"0.4.1":{"name":"@accord-protocol/conformance","version":"0.4.1","keywords":["accord-protocol","conformance","compatibility","test-suite","agent-payments","accord-compatible"],"author":{"name":"bez111"},"license":"MIT","_id":"@accord-protocol/conformance@0.4.1","maintainers":[{"name":"accord-protocol","email":"alexander.bezkrovny@gmail.com"}],"homepage":"https://github.com/accord-protocol/accord-protocol/tree/main/packages/accord-conformance","bugs":{"url":"https://github.com/accord-protocol/accord-protocol/issues"},"bin":{"accord-conformance":"dist/cli.js"},"dist":{"shasum":"5d1b6fc788475af1fcb378b5d7163d2529fc4f19","tarball":"https://registry.npmjs.org/@accord-protocol/conformance/-/conformance-0.4.1.tgz","fileCount":52,"integrity":"sha512-72bAA7HDck++1+ab4oSWp/P8L6idt1Mjl1E2230s8tqQY7WIhZMngXmEs/d7VMmHPsWWwlayNdbnOIytMPqonw==","signatures":[{"sig":"MEYCIQCOHysumMy68jTg+uofT+GW1XbXwxAMWbQQhGfvWjjJVAIhANYSkjvtGjlXXCzbIUFqmLn9ykKC8MFoSKZYq8rHY0q+","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@accord-protocol%2fconformance@0.4.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":316775},"main":"./dist/index.cjs","type":"module","types":"./dist/index.d.ts","module":"./dist/index.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"}},"gitHead":"e42de427235ef205df05351fb51e607b159d23b6","scripts":{"test":"npx tsx --test src/__tests__/*.test.ts","build":"tsup src/index.ts src/cli.ts --format esm,cjs --dts --clean","prepack":"node scripts/sync-fixtures.mjs","prebuild":"node scripts/sync-fixtures.mjs","typecheck":"tsc --noEmit"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:455082fd-672e-4630-8f60-795335018672"}},"repository":{"url":"git+https://github.com/accord-protocol/accord-protocol.git","type":"git","directory":"packages/accord-conformance"},"_npmVersion":"11.14.1","description":"Accord Protocol conformance suite and CLI. Exercises L0 schema, L1 transport, L2 rail, L3 security and L4 registry compatibility against an Accord implementation. Supports HTTP and MCP-stdio probing, plus ed25519 signing of conformance results. The output","directories":{},"_nodeVersion":"24.15.0","dependencies":{"ajv":"^8.12.0","ajv-formats":"^3.0.0","@noble/curves":"^1.8.0","@noble/hashes":"^1.8.0","agentpay-base":"^0.3.1","ergo-agent-pay":"^0.3.1","ergo-agent-scripts":"^0.3.1","@accord-protocol/mcp":"^0.4.1","@accord-protocol/core":"^0.4.1","@accord-protocol/rails":"^0.4.1","@accord-protocol/gateway":"^0.4.1","@accord-protocol/rails-base":"^0.4.1","@accord-protocol/rails-ergo":"^0.4.1","@accord-protocol/rails-x402":"^0.4.1","@accord-protocol/rails-rosen":"^0.4.1"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.0.0","tsup":"^8.0.0","typescript":"^5.0.0","@types/node":"^20.0.0"},"_npmOperationalInternal":{"tmp":"tmp/conformance_0.4.1_1778872953749_0.22424996817362852","host":"s3://npm-registry-packages-npm-production"}},"0.4.2":{"name":"@accord-protocol/conformance","version":"0.4.2","description":"Accord Protocol conformance suite and CLI. Exercises L0 schema, L1 transport, L2 rail, L3 security and L4 registry compatibility against an Accord implementation. Supports HTTP and MCP-stdio probing, plus ed25519 signing of conformance results. The output","type":"module","main":"./dist/index.cjs","module":"./dist/index.js","types":"./dist/index.d.ts","bin":{"accord-conformance":"dist/cli.js"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"prebuild":"node scripts/sync-fixtures.mjs","build":"tsup src/index.ts src/cli.ts --format esm,cjs --dts --clean","prepack":"node scripts/sync-fixtures.mjs","typecheck":"tsc --noEmit","test":"npx tsx --test src/__tests__/*.test.ts"},"keywords":["accord-protocol","conformance","compatibility","test-suite","agent-payments","accord-compatible"],"author":{"name":"bez111"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/accord-protocol/accord-protocol.git","directory":"packages/accord-conformance"},"homepage":"https://accordprotocol.ai/learn/conformance-levels/","bugs":{"url":"https://github.com/accord-protocol/accord-protocol/issues"},"dependencies":{"@accord-protocol/core":"^0.4.2","@accord-protocol/gateway":"^0.4.2","@accord-protocol/mcp":"^0.4.2","@accord-protocol/rails":"^0.4.2","@accord-protocol/rails-base":"^0.4.2","@accord-protocol/rails-ergo":"^0.4.2","@accord-protocol/rails-rosen":"^0.4.2","@accord-protocol/rails-x402":"^0.4.2","@noble/curves":"^1.8.0","@noble/hashes":"^1.8.0","agentpay-base":"^0.3.2","ajv":"^8.12.0","ajv-formats":"^3.0.0","ergo-agent-pay":"^0.3.2","ergo-agent-scripts":"^0.3.2"},"devDependencies":{"@types/node":"^20.0.0","tsup":"^8.0.0","tsx":"^4.0.0","typescript":"^5.0.0"},"engines":{"node":">=18"},"publishConfig":{"access":"public"},"gitHead":"437febb0a70b3162d4b10b19874f1a0026a59bdf","_id":"@accord-protocol/conformance@0.4.2","_nodeVersion":"24.15.0","_npmVersion":"11.15.0","dist":{"integrity":"sha512-73Wo3Lqfa/WR/pyDdxQWY/AUNH5qFdEBG+0ja71LEMhP/DtPAoU8qDS+NEhdzkSoIm8pEIr6e3BiIbURk/5J/w==","shasum":"de45a8ac8387f2179b1ba197f9b6bc72532e828a","tarball":"https://registry.npmjs.org/@accord-protocol/conformance/-/conformance-0.4.2.tgz","fileCount":52,"unpackedSize":319070,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@accord-protocol%2fconformance@0.4.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDwZivxRW8kYjudya7OIBsT6hrucv76NXFjGDqiWkQBrQIgZcVv5jzAn+yRShslYJS7FGGWgQUPMJR4Wjrdh+hfSfA="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:455082fd-672e-4630-8f60-795335018672"}},"directories":{},"maintainers":[{"name":"accord-protocol","email":"alexander.bezkrovny@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/conformance_0.4.2_1779582114163_0.6671265940382054"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-14T16:20:54.460Z","modified":"2026-05-24T00:21:54.611Z","0.4.0":"2026-05-14T16:20:54.770Z","0.4.1":"2026-05-15T19:22:33.903Z","0.4.2":"2026-05-24T00:21:54.313Z"},"bugs":{"url":"https://github.com/accord-protocol/accord-protocol/issues"},"author":{"name":"bez111"},"license":"MIT","homepage":"https://accordprotocol.ai/learn/conformance-levels/","keywords":["accord-protocol","conformance","compatibility","test-suite","agent-payments","accord-compatible"],"repository":{"type":"git","url":"git+https://github.com/accord-protocol/accord-protocol.git","directory":"packages/accord-conformance"},"description":"Accord Protocol conformance suite and CLI. Exercises L0 schema, L1 transport, L2 rail, L3 security and L4 registry compatibility against an Accord implementation. Supports HTTP and MCP-stdio probing, plus ed25519 signing of conformance results. The output","maintainers":[{"name":"accord-protocol","email":"alexander.bezkrovny@gmail.com"}],"readme":"# `@accord-protocol/conformance`\n\nAccord Protocol conformance suite. Library + CLI that exercises **all five levels** (L0 schema, L1 transport, L2 rail, L3 security, L4 registry) against an Accord implementation. **The output is the source of truth for \"Accord-compatible (L*)\" badge claims** per [TRADEMARK.md](../../TRADEMARK.md).\n\nPublic docs: [Website](https://accordprotocol.ai/) · [Conformance guide](https://accordprotocol.ai/learn/conformance-levels/) · [What conformance does not prove](https://accordprotocol.ai/learn/what-conformance-does-not-prove/)\n\n## Install\n\n```bash\nnpm install --save-dev @accord-protocol/conformance @accord-protocol/core\n# or run on the fly:\nnpx accord-conformance run\n```\n\n## CLI subcommands\n\n```bash\naccord-conformance run     [flags]              # default if no subcommand (back-compat)\naccord-conformance keygen                       # generate ed25519 keypair\naccord-conformance sign    --key 0x... <input.json>     # sign any Accord JSON object\naccord-conformance verify  [--expected-key 0x...] <signed.json>\n```\n\n`run` is invoked by default if no subcommand is given, so prior usage like `npx accord-conformance --levels L0,L1` still works.\n\nFor an end-to-end keygen / run / sign / verify walkthrough with a working signed artifact, see [`docs/conformance-signed-example.md`](../../docs/conformance-signed-example.md).\n\n## Levels\n\n```text\nL0  Schema-compatible       — objects validate against schemas/v0\nL1  Transport-compatible    — Accord/402 or Accord/MCP roundtrip works\nL2  Rail-compatible         — at least one rail adapter passes verifyPayment + settle\nL3  Security-compatible     — production-safety gates fire on mainnet writes\nL4  Registry-certified      — listed in the public registry with passing conformance\n```\n\nThis package ships **all five levels** (L0 + L1 + L2 + L3 + L4). The CLI runs them in-process by default, or against a live HTTP endpoint via `--target <url>`.\n\n```text\n$ npx accord-conformance --levels L0,L1,L2,L3,L4\n\n  L0 PASS  (20/20 pass, 0 fail, 0 inconclusive)\n  L1 PASS  (13/13 pass, 0 fail, 0 inconclusive)\n  L2 PASS  (24/24 pass, 0 fail, 0 inconclusive)\n  L3 PASS  (12/12 pass, 0 fail, 0 inconclusive)\n  L4 PASS  (13/13 pass, 0 fail, 0 inconclusive)\n\nAchieved: L4\n```\n\n## L3 — what it checks (security gates)\n\nProbes `assertProductionSafety()` and the audit-manifest verifiers in both rail SDKs:\n\n- Mainnet writes without `scriptErgoTree` → `INSECURE_MAINNET_MODE`\n- Mainnet writes with arbitrary tree but no `auditPolicy` → `UNAUDITED_ERGOTREE`\n- The documented `dangerouslyAllowInsecureMainnetP2PK` / `dangerouslyAllowUnauditedContract` escape hatches still work\n- Testnet always allowed\n- `verifyAuditedErgoTree({ requireMainnet: true })` rejects on a draft-pre-audit manifest\n- Both audit manifests are in `draft-pre-audit` status with all entries `mainnetAllowed: false`\n- Same probes run for the Base/EVM rail's `assertProductionSafety` + `verifyAuditedContract`\n\n## L4 — what it checks (registry validation)\n\nStatic-validates the `registry/` folder:\n\n- `registry/{providers,verifiers,rails,manifests}/*.json` parse + carry the right `type` literal + `version: \"v0\"`\n- `registry/revocations.json` is a well-formed array\n- Each rail record's `manifest` field points at a manifest file that exists\n- Provider records' `accepted_rails[]` only name rails registered in `registry/rails/`\n- `conformance.level` (when claimed) is one of L0–L4\n\n## Network mode (HTTP probing)\n\n`--target <url>` makes the L1 transport probe a real HTTP endpoint instead of running in-process. Three probes:\n\n```text\n$ npx accord-conformance --levels L1 --target https://provider.example/api/run\n\n  1. POST without Accord-* headers → expects 402 + Accord-Version, Accord-Agreement-Required, WWW-Authenticate: Accord402\n  2. POST with X-Accord-Agreement-Id but no payment → expects 402 + body.error in {MISSING_PAYMENT, UNKNOWN_AGREEMENT}\n  3. POST with both headers (only when --agreement-id + --payment supplied) → expects 200 + x-accord-agreement-hash + body { output, _meta }\n```\n\nOptional flags for the happy-path probe:\n\n```bash\nnpx accord-conformance --levels L1 \\\n  --target https://provider.example/api/run \\\n  --agreement-id acc_01HX… \\\n  --payment '{\"value\":\"0.001\"}'\n```\n\n### MCP-stdio mode\n\n`--target stdio:./build/mcp-server.js` spawns a child process and probes its JSON-RPC over stdin/stdout per the MCP spec:\n\n```bash\nnpx accord-conformance run --levels L1 \\\n  --target stdio:./build/mcp-server.js\n```\n\nFour checks:\n1. `initialize` → server returns `protocolVersion`\n2. `tools/list` → returns at least one tool whose `inputSchema` declares `accord_agreement_id` + `accord_payment`\n3. `tools/call` without `accord_agreement_id` → `_meta.accord_error_code == MISSING_AGREEMENT_ID`\n4. `tools/call` with agreement-id but no payment → `_meta.accord_error_code ∈ {MISSING_PAYMENT, UNKNOWN_AGREEMENT}`\n\n## Conformance-result signing\n\nSign a conformance result so the registry / verifiers can confirm provenance:\n\n```bash\n# 1. Generate keypair (one-time setup)\n$ npx accord-conformance keygen\n\n# 2. Run + sign + submit\n$ npx accord-conformance run --levels L0,L1,L2,L3,L4 --json > result.json\n$ npx accord-conformance sign \\\n    --key 0x<your private key> \\\n    --signer 'verifier://your-id' \\\n    -o signed.json \\\n    result.json\n\n# 3. Anyone can verify\n$ npx accord-conformance verify signed.json\n$ npx accord-conformance verify --expected-key 0x<your public key> signed.json\n```\n\nThe signing input is `BLAKE2b-256(canonical_json_bytes(object_without_signature))` — same algorithm as ACCORD-002 §5 receipts. Tampering with any field after signing breaks the signature; `verify` exits non-zero with code `BAD_SIGNATURE`.\n\nThe same `sign`/`verify` subcommands work on **any** Accord JSON object — Agreement, Verification Receipt, audit manifest, registry record. The signature shape (`scheme: \"ed25519\"`, hex-encoded `public_key` + `signature` + ISO-8601 `signed_at`) is uniform across artifacts.\n\n## L1 — what it checks\n\nL1 exercises the **Accord/MCP** and **Accord/402** transports against the reference `@accord-protocol/{mcp,gateway}` implementations with a Mock rail + a synthetic verifier:\n\n- **MCP** — `wrapAccordMcp` rejects calls without `accord_agreement_id`; happy path runs the handler; `_meta.accord_agreement_hash` is the canonical-bytes blake2b256; embedded Verification + Settlement Receipts pass core's validators.\n- **Accord/402** — no Accord-* request headers → 402 with the right response headers (`Accord-Version`, `Accord-Agreement-Required`, `WWW-Authenticate: Accord402`); valid request → 200 with `{ output, _meta }` body and `x-accord-agreement-hash` response header; embedded receipts validate; second use of the same `payment_id` is rejected with `REPLAY_DETECTED`.\n\n## L2 — what it checks\n\nL2 exercises each of the four reference rails (`rails-ergo`, `rails-rosen`, `rails-base`, `rails-x402`) with a stub backend, six checks per rail:\n\n- `verifyPayment(happy)` returns `ok=true`\n- `payment_id` is a non-empty string (suitable for replay protection)\n- `rail.settle()` is implemented and returns a Settlement Receipt\n- The Settlement Receipt passes core's `validateSettlementReceipt` against the same Agreement id/hash, rail, currency, and decimals\n- `receipt.mode` is in `RAIL_MODE_ALLOWLIST[rail]`\n- `verifyPayment(garbage)` returns a structured `ok=false` result\n\nA third-party rail can be tested with the same harness by passing it via `runL2({ extraRails: [...] })`.\n\n```text\n$ npx accord-conformance --levels L0,L1,L2\n\n  L0 PASS  (20/20 pass, 0 fail, 0 inconclusive)\n  L1 PASS  (13/13 pass, 0 fail, 0 inconclusive)\n  L2 PASS  (24/24 pass, 0 fail, 0 inconclusive)\n\nAchieved: L2\n```\n\n```text\n$ npx accord-conformance --levels L0,L1\n\n  L0 PASS  (20/20 pass, 0 fail, 0 inconclusive)\n  L1 PASS  (13/13 pass, 0 fail, 0 inconclusive)\n\nAchieved: L1\n```\n\n## CLI\n\n```bash\n# Run L0 against the current repo\nnpx accord-conformance\n\n# Explicit\nnpx accord-conformance --levels L0\n\n# Request more levels (some may report inconclusive until they ship)\nnpx accord-conformance --levels L0,L1,L2\n\n# JSON output — what you submit to the registry\nnpx accord-conformance --json > conformance-result.json\n\n# Run against a specific repo dir\nnpx accord-conformance --repo-root /path/to/your/accord-protocol-fork\n```\n\nExit codes:\n\n- **0** — every requested level passed\n- **1** — at least one fail or inconclusive at the requested levels\n- **2** — CLI usage error\n\n## Library\n\n```ts\nimport { runConformance } from \"@accord-protocol/conformance\";\n\nconst result = await runConformance({\n  repoRoot: process.cwd(),\n  levels: [\"L0\"],\n});\nconsole.log(result.achieved_level); // \"L0\" | \"L1\" | … | null\n```\n\nThe `ConformanceResult` is JSON-shaped — same as the CLI's `--json` output. Submit it to `registry.accordprotocol.ai` to claim a badge.\n\n## L0 — what it checks\n\nFor every fixture in `test-vectors/{agreement,verification-receipt,settlement-receipt}/v0/`:\n\n1. **JSON Schema validation** against the matching `schemas/<kind>.v0.schema.json`.\n   - Filenames that start with `invalid-` are expected to fail validation. The check passes iff ajv rejects.\n2. **Canonical-bytes equality** against the pinned `<name>.canonical.txt` sidecar (for accept-case fixtures).\n3. **`accord_hash_v0` equality** against the pinned `<name>.hash.txt` sidecar (for accept-case fixtures).\n\nMissing pinned sidecars are reported as `inconclusive` (not `fail`) — the implementation isn't broken, the fixtures just need re-deriving via `node scripts/derive-fixture-hashes.mjs`.\n\n## Current limits\n\n- L1 / L2 transport / rail tests — planned transport/rail conformance scope.\n- A network-mode CLI (`--target https://provider.example`) — for L0 the implementation under test is a directory of schemas + fixtures, not a live endpoint. L1 / L2 will introduce HTTP / MCP probing.\n- Conformance-result signing. The result JSON is plain text today; v1 may add an issuer signature so the registry can verify provenance.\n\n## License\n\nMIT.\n","readmeFilename":"README.md"}