{"_id":"@agenomics/capability-manifest-validator","name":"@agenomics/capability-manifest-validator","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@agenomics/capability-manifest-validator","version":"0.1.0","description":"ADR-060 reference validator for AEP capability manifests. Validates schema, RFC-8785 canonical-JSON hash, and Ed25519 signature.","type":"module","main":"dist/index.js","types":"dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"}},"keywords":["agenomics","aep","solana","capability","manifest","ed25519","rfc-8785"],"repository":{"type":"git","url":"git+https://github.com/agenomics-labs/protocol.git","directory":"packages/capability-manifest-validator"},"bugs":{"url":"https://github.com/agenomics-labs/protocol/issues"},"homepage":"https://github.com/agenomics-labs/protocol/tree/main/packages/capability-manifest-validator#readme","license":"Apache-2.0","private":false,"publishConfig":{"access":"public"},"scripts":{"build":"tsc","prepublishOnly":"tsc","test":"node --import tsx --test test/validate.test.ts test/golden-canonical.test.ts"},"dependencies":{"@agenomics/action-runtime":"*","@noble/curves":"^2.2.0","@noble/hashes":"^1.4.0","canonicalize":"^3.0.0","zod":"^4.4.3"},"devDependencies":{"@types/node":"^24.12.4","tsx":"^4.21.0","typescript":"^6.0.3"},"gitHead":"dd96a1e0a3eb8a1c9223aa972a66e44387d1cf9f","_id":"@agenomics/capability-manifest-validator@0.1.0","_nodeVersion":"24.18.0","_npmVersion":"11.18.0","dist":{"integrity":"sha512-Z/AJv/LC+sjhAnikqEdHKerLBf5IFw53dHjBNXjtP+JOl9T2JH3b6ZqIJ1qlQJeDAalxDkZVo8w51kYSf+6cpA==","shasum":"8315d4eabaa7f7a3e6ee6f56d2271b6c0b350595","tarball":"https://registry.npmjs.org/@agenomics/capability-manifest-validator/-/capability-manifest-validator-0.1.0.tgz","fileCount":22,"unpackedSize":60916,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCID+uEwWGsN9GuTd7v/g0Bo4VYCUnEbw0Sh+kilG3jtDhAiA+54intnwx4zkwxwQg6yCsQSCdkJl0SL0BNDsbGGPOcA=="}]},"_npmUser":{"name":"k2jac9","email":"alexcastellanos29@gmail.com"},"directories":{},"maintainers":[{"name":"k2jac9","email":"alexcastellanos29@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/capability-manifest-validator_0.1.0_1784099528721_0.11658937742965647"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-15T07:12:08.613Z","0.1.0":"2026-07-15T07:12:08.883Z","modified":"2026-07-15T07:12:09.138Z"},"maintainers":[{"name":"k2jac9","email":"alexcastellanos29@gmail.com"}],"description":"ADR-060 reference validator for AEP capability manifests. Validates schema, RFC-8785 canonical-JSON hash, and Ed25519 signature.","homepage":"https://github.com/agenomics-labs/protocol/tree/main/packages/capability-manifest-validator#readme","keywords":["agenomics","aep","solana","capability","manifest","ed25519","rfc-8785"],"repository":{"type":"git","url":"git+https://github.com/agenomics-labs/protocol.git","directory":"packages/capability-manifest-validator"},"bugs":{"url":"https://github.com/agenomics-labs/protocol/issues"},"license":"Apache-2.0","readme":"# @agenomics/capability-manifest-validator\n\nReference validator for the AEP capability manifest format defined in\n[ADR-060](../../docs/adr/ADR-060-capability-descriptor-format.md).\n\nAgents in the Agenomics Protocol publish a signed, off-chain\n**capability manifest** that describes what they can do, in what I/O\nshape, with what cost, and under what preflight gates. The Registry\nprogram stores only a content hash + signature; the manifest itself\nlives on IPFS or Arweave. This package validates a manifest body against\nthe on-chain commitment.\n\n## What it checks\n\n1. **Schema** — the JSON conforms to the ADR-060 §2 v1.0 `CapabilityManifest` interface (base58 pubkeys, kebab-case capability names, valid side-effects, recognized preflight gates, stability enum, required fields).\n2. **Canonical JSON hash** — the bytes fed in, serialized with [RFC-8785 canonicalization](https://datatracker.ietf.org/doc/html/rfc8785) and SHA-256'd, match the on-chain `manifest_hash`. Eliminates whitespace / key-order drift.\n3. **Ed25519 signature** — the on-chain `manifest_signature` is a valid Ed25519 signature over `manifest_hash` by the agent's authority pubkey.\n4. **Authority binding** — the manifest's self-declared `agent.pubkey` matches the on-chain authority passed in (defense-in-depth against manifest-author confusion).\n\n## Install\n\n```sh\nnpm install @agenomics/capability-manifest-validator\n```\n\nPeer dependencies: `@noble/curves@^1.4.0`, `@noble/hashes@^1.4.0`, `canonicalize@^2.0.0`, `zod@^3.23`.\n\n## Usage\n\n```ts\nimport { validateManifest } from \"@agenomics/capability-manifest-validator\";\n\n// Bytes fetched from IPFS/Arweave via the manifest_cid stored on-chain.\nconst manifestBytes: Uint8Array = await fetchManifestBody(cid);\n\n// On-chain commitments from AgentProfile.\nconst onChainHash: Uint8Array      = profile.manifest_hash;\nconst onChainSignature: Uint8Array = profile.manifest_signature;\nconst authorityPubkey: Uint8Array  = profile.authority;\n\nconst result = validateManifest(\n  manifestBytes,\n  onChainHash,\n  onChainSignature,\n  authorityPubkey,\n);\n\nif (!result.ok) {\n  // Typed error: { code: 'HASH_MISMATCH' | 'SIGNATURE_INVALID' | 'SCHEMA_INVALID' | ... , message, details? }\n  throw new Error(`manifest invalid: ${result.error.message}`);\n}\n\nconst manifest = result.value;\nconsole.log(manifest.agent.name, manifest.capabilities.length);\n```\n\n## Non-goals\n\nThis package does **not** fetch the manifest from IPFS/Arweave, the Registry account from Solana, or SAS attestations. Those concerns live upstream (in a downstream integration) or in `@agenomics/sas-resolver`. This package is pure, synchronous-ish (Ed25519 is fast), and has no network dependency.\n\n## Related\n\n- [ADR-060](../../docs/adr/ADR-060-capability-descriptor-format.md) — manifest format + on-chain commitments\n- [ADR-061](../../docs/adr/ADR-061-sas-integration.md) — the `owner_attestation` field reserved for SAS\n- [`@agenomics/sas-resolver`](../sas-resolver/README.md) — resolves SAS attestations referenced by a validated manifest\n\n## License\n\nPart of the Agenomics Protocol. See repository root.\n","readmeFilename":"README.md","_rev":"1-8a014f66d551da47f197d69619259ab0"}