{"_id":"@cognitiveproof/cawg-trqp","_rev":"2-50e2b432eb7a79c923b119548437b152","name":"@cognitiveproof/cawg-trqp","dist-tags":{"latest":"0.17.1"},"versions":{"0.17.0":{"name":"@cognitiveproof/cawg-trqp","version":"0.17.0","license":"MIT","_id":"@cognitiveproof/cawg-trqp@0.17.0","maintainers":[{"name":"mrappard","email":"mrappard@gmail.com"}],"homepage":"https://github.com/Cognitive-Proof/cawg-trqp-verifer#readme","bugs":{"url":"https://github.com/Cognitive-Proof/cawg-trqp-verifer/issues"},"bin":{"cawg-trqp-verifier":"dist/cli.js"},"dist":{"shasum":"bd13e2c941008e73de96b25154247bf28df34ce5","tarball":"https://registry.npmjs.org/@cognitiveproof/cawg-trqp/-/cawg-trqp-0.17.0.tgz","fileCount":65,"integrity":"sha512-3AcIUsmc4/okTue+6qw3SvGg7xMXh1qXLWzQISl5RKJP1bipcxUgkM43/MZAlMRxODWQSI8rXcg+LHmxGXs7tQ==","signatures":[{"sig":"MEUCIQCW3mlxdnIk8ft2LdT4hLrfn7BHcXro7iht49/i3ONE4QIgY06BstAKjYCaiWjEqYOsHB/RGRStaYEXEVmu0r3VTkw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":158488},"main":"dist/index.js","type":"module","types":"dist/index.d.ts","engines":{"node":">=20"},"gitHead":"8826f04d0b5ed79855bbc2b34f138cbaf3a6d2ae","scripts":{"demo":"tsx scripts/run_demo.ts","test":"vitest run && npm run test --workspaces --if-present","build":"npm run build -w @cognitiveproof/cawg-trqp-plugin-types && npm run build -w @cognitiveproof/cawg-trqp-plugin-mongodb -w @cognitiveproof/cawg-trqp-plugin-mysql -w @cognitiveproof/cawg-trqp-plugin-postgres -w @cognitiveproof/cawg-trqp-plugin-redis && tsc -p tsconfig.json","serve":"tsx scripts/start_http_service.ts","verify":"tsx src/cli.ts","release":"npm run build && changeset publish","validate":"npm run validate:examples && npm run validate:feed-descriptors && npm run validate:photography-contest && npm test","changeset":"changeset","typecheck":"npm run build -w @cognitiveproof/cawg-trqp-plugin-types && npm run typecheck --workspaces --if-present && tsc -p tsconfig.typecheck.json","sign:snapshot":"tsx scripts/sign_snapshot.ts","version-packages":"changeset version","sign:audit-bundle":"tsx scripts/sign_audit_bundle.ts","validate:examples":"tsx scripts/validate_examples.ts","replay:audit-bundle":"tsx scripts/replay_audit_bundle.ts","check:reproducibility":"tsx scripts/check_reproducibility.ts","validate:audit-bundle":"tsx scripts/validate_audit_bundle.ts","export:conformance-pack":"tsx scripts/export_conformance_pack.ts","validate:feed-descriptors":"tsx scripts/validate_feed_descriptors.ts","validate:photography-contest":"tsx scripts/validate_photography_contest_example.ts"},"_npmUser":{"name":"mrappard","email":"mrappard@gmail.com"},"repository":{"url":"git+https://github.com/Cognitive-Proof/cawg-trqp-verifer.git","type":"git"},"workspaces":["plugins/*"],"_npmVersion":"11.12.1","description":"Reference implementation for CAWG + TRQP integration (TypeScript port)","directories":{},"_nodeVersion":"25.9.0","dependencies":{"ajv":"^8.17.1","express":"^4.21.2","commander":"^12.1.0","ajv-formats":"^3.0.1","@cognitiveproof/cawg-trqp-plugin-types":"^0.1.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.19.2","vitest":"^4.1.10","typescript":"^5.7.2","@types/node":"^22.10.2","@types/express":"^4.17.21","@changesets/cli":"^2.31.0","@changesets/changelog-github":"^0.7.0"},"peerDependencies":{"@cognitiveproof/cawg-trqp-plugin-mysql":"^0.1.0","@cognitiveproof/cawg-trqp-plugin-redis":"^0.1.0","@cognitiveproof/cawg-trqp-plugin-mongodb":"^0.1.0","@cognitiveproof/cawg-trqp-plugin-postgres":"^0.1.0"},"peerDependenciesMeta":{"@cognitiveproof/cawg-trqp-plugin-mysql":{"optional":true},"@cognitiveproof/cawg-trqp-plugin-redis":{"optional":true},"@cognitiveproof/cawg-trqp-plugin-mongodb":{"optional":true},"@cognitiveproof/cawg-trqp-plugin-postgres":{"optional":true}},"_npmOperationalInternal":{"tmp":"tmp/cawg-trqp_0.17.0_1787689350073_0.17766413929171598","host":"s3://npm-registry-packages-npm-production"}},"0.17.1":{"name":"@cognitiveproof/cawg-trqp","version":"0.17.1","description":"Reference implementation for CAWG + TRQP integration (TypeScript port)","license":"MIT","repository":{"type":"git","url":"git+https://github.com/Cognitive-Proof/cawg-trqp-verifer.git"},"type":"module","main":"dist/index.js","types":"dist/index.d.ts","bin":{"cawg-trqp-verifier":"dist/cli.js"},"publishConfig":{"access":"public"},"workspaces":["plugins/*"],"scripts":{"build":"npm run build -w @cognitiveproof/cawg-trqp-plugin-types && npm run build -w @cognitiveproof/cawg-trqp-plugin-mongodb -w @cognitiveproof/cawg-trqp-plugin-mysql -w @cognitiveproof/cawg-trqp-plugin-postgres -w @cognitiveproof/cawg-trqp-plugin-redis && tsc -p tsconfig.json","changeset":"changeset","version-packages":"changeset version","release":"npm run build && changeset publish && npm run publish-root","publish-root":"node scripts/publish_root_if_unpublished.mjs","verify":"tsx src/cli.ts","serve":"tsx scripts/start_http_service.ts","test":"vitest run && npm run test --workspaces --if-present","typecheck":"npm run build -w @cognitiveproof/cawg-trqp-plugin-types && npm run typecheck --workspaces --if-present && tsc -p tsconfig.typecheck.json","demo":"tsx scripts/run_demo.ts","validate:examples":"tsx scripts/validate_examples.ts","validate:feed-descriptors":"tsx scripts/validate_feed_descriptors.ts","validate:audit-bundle":"tsx scripts/validate_audit_bundle.ts","validate:photography-contest":"tsx scripts/validate_photography_contest_example.ts","replay:audit-bundle":"tsx scripts/replay_audit_bundle.ts","sign:audit-bundle":"tsx scripts/sign_audit_bundle.ts","sign:snapshot":"tsx scripts/sign_snapshot.ts","check:reproducibility":"tsx scripts/check_reproducibility.ts","export:conformance-pack":"tsx scripts/export_conformance_pack.ts","validate":"npm run validate:examples && npm run validate:feed-descriptors && npm run validate:photography-contest && npm test"},"dependencies":{"ajv":"^8.17.1","ajv-formats":"^3.0.1","@cognitiveproof/cawg-trqp-plugin-types":"^0.1.0","commander":"^12.1.0","express":"^4.21.2"},"peerDependencies":{"@cognitiveproof/cawg-trqp-plugin-mongodb":"^0.1.0","@cognitiveproof/cawg-trqp-plugin-mysql":"^0.1.0","@cognitiveproof/cawg-trqp-plugin-postgres":"^0.1.0","@cognitiveproof/cawg-trqp-plugin-redis":"^0.1.0"},"peerDependenciesMeta":{"@cognitiveproof/cawg-trqp-plugin-mongodb":{"optional":true},"@cognitiveproof/cawg-trqp-plugin-mysql":{"optional":true},"@cognitiveproof/cawg-trqp-plugin-postgres":{"optional":true},"@cognitiveproof/cawg-trqp-plugin-redis":{"optional":true}},"devDependencies":{"@changesets/changelog-github":"^0.7.0","@changesets/cli":"^2.31.0","@types/express":"^4.17.21","@types/node":"^22.10.2","tsx":"^4.19.2","typescript":"^5.7.2","vitest":"^4.1.10"},"engines":{"node":">=20"},"gitHead":"cbb4f094e7b24bf8c23b65d9332d0a912a8c49f5","_id":"@cognitiveproof/cawg-trqp@0.17.1","bugs":{"url":"https://github.com/Cognitive-Proof/cawg-trqp-verifer/issues"},"homepage":"https://github.com/Cognitive-Proof/cawg-trqp-verifer#readme","_nodeVersion":"20.20.2","_npmVersion":"11.19.1","dist":{"integrity":"sha512-SAkhoBTYLMmfb/zdPlnV7geSA7NjOgHvWaOOq3Cxm2Vot/iHZwtr2iPMKhvOXDbmopTleuTkfmfu87Sc6SwrIA==","shasum":"3ef92a82da121c849b028346859bfd5615522ccc","tarball":"https://registry.npmjs.org/@cognitiveproof/cawg-trqp/-/cawg-trqp-0.17.1.tgz","fileCount":65,"unpackedSize":162110,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@cognitiveproof%2fcawg-trqp@0.17.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCo/8bDN4JnvWTYkVUQLpiMPVr/zU7azYgMmOQ4IvCBcgIgF1HYLTXojMvNDv9yDp2hHQlXm/WmU43bnGL1otjS7Go="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:05f2a441-684c-4951-9eea-5ea21427979b"}},"directories":{},"maintainers":[{"name":"mrappard","email":"mrappard@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/cawg-trqp_0.17.1_1787876345650_0.41684172214772364"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-25T20:22:29.885Z","modified":"2026-08-28T00:19:06.122Z","0.17.0":"2026-08-25T20:22:30.215Z","0.17.1":"2026-08-28T00:19:05.796Z"},"bugs":{"url":"https://github.com/Cognitive-Proof/cawg-trqp-verifer/issues"},"license":"MIT","homepage":"https://github.com/Cognitive-Proof/cawg-trqp-verifer#readme","repository":{"type":"git","url":"git+https://github.com/Cognitive-Proof/cawg-trqp-verifer.git"},"description":"Reference implementation for CAWG + TRQP integration (TypeScript port)","maintainers":[{"name":"mrappard","email":"mrappard@gmail.com"}],"readme":"# cawg-trqp-refimpl (TypeScript)\n\nA TypeScript port of [`cawg-trqp-verifier-refimpl`](https://github.com/sankarshanmukhopadhyay/cawg-trqp-verifier-refimpl), the reference implementation for CAWG + TRQP integration. This port preserves the original's behavior byte-for-byte where it matters: canonical JSON hashing, Ed25519 signing/verification, and verifier decision logic have all been cross-checked against the Python implementation (see [Fidelity notes](#fidelity-notes)).\n\n## What this is\n\nA reference verifier for evaluating CAWG/C2PA manifest trust signals against TRQP-governed policy, with:\n\n- A **verifier core** (`src/verifier.ts`) supporting online, cached, gateway-mediated, and offline/snapshot verification modes\n- **Ed25519-signed feed descriptors, snapshots, and audit bundles**, using Node's native `node:crypto`\n- An **Express HTTP service** exposing authorization, recognition, verification, and audit-bundle endpoints\n- A **CLI** (`src/cli.ts`) for one-off verification runs and audit-bundle export\n- **Deterministic replay**: audit bundles carry enough evidence (pinned policy/revocation feed digests, transport metadata, profile) to be replayed and independently re-verified later\n\n## Requirements\n\n- Node.js >= 20\n\n## Install\n\nAs a dependency in your own project:\n\n```bash\nnpm install @cognitiveproof/cawg-trqp\n```\n\nTo work on this repo itself (an npm workspaces monorepo — `npm install` at the root also installs every package under `plugins/*`):\n\n```bash\nnpm install\n```\n\n## Build\n\n```bash\nnpm run build      # compiles src/ -> dist/\nnpm run typecheck   # type-checks src/, scripts/, and tests/ without emitting\n```\n\n## Test\n\n```bash\nnpm test\n```\n\n77 tests across 20 files, ported from the Python `pytest` suite, run against the same JSON fixtures/conformance vectors as the original.\n\n## Run\n\n```bash\n# CLI: verify a manifest fixture\nnpm run verify -- --fixture examples/fixtures/cawg_manifest_minimal.json\n\n# HTTP service\nnpm run serve -- --policy-path data/policies.json --revocation-path data/revocations.json --port 5000\n\n# Demo script (a few canned verification scenarios)\nnpm run demo\n```\n\n## Scripts\n\n| Command | Purpose |\n|---|---|\n| `npm run validate:examples` | Validate all `examples/` and `fixtures/` JSON against their schemas |\n| `npm run validate:feed-descriptors` | Validate signed feed descriptors (signature, digest, authority) |\n| `npm run validate:audit-bundle -- <bundle.json>` | Validate an audit bundle's schema, digest, and attestation |\n| `npm run validate:photography-contest` | Validate the photography-contest example end to end |\n| `npm run replay:audit-bundle -- <bundle.json>` | Replay an audit bundle and compare against its recorded result |\n| `npm run sign:audit-bundle -- <bundle.json> <key.pem> --key-id <id>` | Sign an audit bundle with an Ed25519 key |\n| `npm run sign:snapshot -- <snapshot.json> <key.pem> --key-id <id>` | Sign an offline snapshot with an Ed25519 key |\n| `npm run check:reproducibility -- <expected.json>` | Rebuild a bundle and diff against a pinned fixture |\n| `npm run export:conformance-pack -- --check` | Verify `conformance/assurance-suite-manifest.json` is current |\n| `npm run validate` | Run the example/feed-descriptor/photography-contest checks plus the test suite |\n\n## Project structure\n\n```\nsrc/            library source (verifier, mock service, gateway, profile, audit,\n                replay, feed descriptors, attestation, HTTP service, CLI, ...)\nscripts/        standalone CLI utilities (validation, signing, replay, demo)\ntests/          Vitest suite\ndata/           policy/revocation/snapshot/trust-anchor fixtures\nexamples/       request/response/manifest/feed-descriptor examples\nfixtures/       profile-bound conformance fixtures (request -> expected result)\nprofiles/       built-in verification profiles (standard, edge, high_assurance) + overlays\nschemas/        JSON Schemas (Draft 2020-12) for all wire formats\nconformance/    assurance-suite manifest and compatibility matrix\n```\n\n## Library usage\n\n```ts\nimport { Verifier, MockTRQPService, loadManifestFixture } from \"@cognitiveproof/cawg-trqp\";\n\nconst request = loadManifestFixture(\"examples/fixtures/cawg_manifest_minimal.json\", \"did:web:media-registry.example\");\nconst verifier = new Verifier({ service: new MockTRQPService(\"data/policies.json\", \"data/revocations.json\") });\nconst result = verifier.verify(request, \"standard\");\n```\n\n## Plugins\n\n`MockTRQPService`, `TTLCache`, and `InMemoryRevocationDeltaStore` are in-memory reference adapters, each behind a small async interface (`PolicyService`, `DecisionCache<T>`, `RevocationDeltaStore`) so a real deployment can swap in a network/database-backed implementation without changing `Verifier` or `HTTPTRQPService`. This repo publishes those as separate optional packages under `plugins/*`:\n\n| Package | Provides | Backend |\n|---|---|---|\n| [`@cognitiveproof/cawg-trqp-plugin-mongodb`](plugins/mongodb) | `PolicyService` | [`mongodb`](https://www.npmjs.com/package/mongodb) |\n| [`@cognitiveproof/cawg-trqp-plugin-mysql`](plugins/mysql) | `PolicyService` | [`mysql2`](https://www.npmjs.com/package/mysql2) |\n| [`@cognitiveproof/cawg-trqp-plugin-postgres`](plugins/postgres) | `PolicyService` | [`pg`](https://www.npmjs.com/package/pg) |\n| [`@cognitiveproof/cawg-trqp-plugin-redis`](plugins/redis) | `DecisionCache`, `RevocationDeltaStore` | [`ioredis`](https://github.com/redis/ioredis) — needed once you run more than one verifier instance, since the in-memory defaults don't share state across processes |\n\nEach is an optional peer dependency of the core package — install only the ones your deployment needs. See each plugin's own README for schema and usage.\n\n## Releasing\n\nVersioning and npm publishing for this package and every `plugins/*` package are automated with [Changesets](https://github.com/changesets/changesets):\n\n1. On a feature branch, describe your change: `npm run changeset` — pick which package(s) changed and whether it's a patch/minor/major bump, then write a summary. Commit the generated `.changeset/*.md` file with your PR.\n2. Once merged to `main`, CI opens (or updates) a \"Version Packages\" PR that applies the version bumps and changelog entries for every pending changeset.\n3. Merging that PR triggers the same workflow to build, test, and `npm publish` every package that changed, using npm's OIDC Trusted Publishing (no long-lived npm token stored in this repo).\n\nSee `.github/workflows/npm-publish.yaml` and `.github/workflows/ci.yaml`.\n\n## Fidelity notes\n\nThis port was validated against the Python reference implementation, not just translated:\n\n- **Canonical JSON**: Python's `json.dumps(sort_keys=True, separators=(\",\", \":\"))` is replicated exactly, in both its `ensure_ascii=False` form (used for `bundle_digest_sha256`) and its `ensure_ascii=True` form (used for signing payloads) — confirmed byte-for-byte against Python output.\n- **Ed25519**: signing/verification via `node:crypto` uses the same PEM key format as Python's `cryptography` library. A bundle signed by this TypeScript CLI was verified successfully by the Python verifier, and vice versa; `bundle_digest_sha256`, `bundle_id`, and signature bytes matched exactly for identical input.\n- **Verifier logic**: online/edge/gateway verification modes, transport and revocation freshness enforcement, and process-proof appraisal all match the Python test suite's assertions.\n- **Known cosmetic difference**: JSON key ordering in pretty-printed output can differ from the Python implementation's field order (JSON objects are unordered, so this doesn't affect hashing, signing, or schema validation).\n\n### Not ported\n\nA handful of Python scripts and tests validate the *documentation and governance content* of the original repository (its full `docs/` tree, `governance/*.yaml` registers, `api/openapi.json`, release-checksum manifests) rather than verifier logic. Those weren't duplicated here since this port focuses on the library, not the documentation tree. See the original repository if you need those.\n\n## License\n\nMIT — see [LICENSE](./LICENSE). Ported from [`cawg-trqp-verifier-refimpl`](https://github.com/sankarshanmukhopadhyay/cawg-trqp-verifier-refimpl).\n","readmeFilename":"README.md"}