@agirails/sdk 4.4.8 → 4.5.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/builders/DeliveryProofBuilder.d.ts +224 -13
- package/dist/builders/DeliveryProofBuilder.d.ts.map +1 -1
- package/dist/builders/DeliveryProofBuilder.js +247 -13
- package/dist/builders/DeliveryProofBuilder.js.map +1 -1
- package/dist/cli/agirails.d.ts +85 -1
- package/dist/cli/agirails.d.ts.map +1 -1
- package/dist/cli/agirails.js +429 -154
- package/dist/cli/agirails.js.map +1 -1
- package/dist/cli/commands/init.d.ts +54 -0
- package/dist/cli/commands/init.d.ts.map +1 -1
- package/dist/cli/commands/init.js +193 -1
- package/dist/cli/commands/init.js.map +1 -1
- package/dist/cli/commands/receipt.d.ts +70 -2
- package/dist/cli/commands/receipt.d.ts.map +1 -1
- package/dist/cli/commands/receipt.js +218 -3
- package/dist/cli/commands/receipt.js.map +1 -1
- package/dist/cli/commands/test.d.ts +77 -1
- package/dist/cli/commands/test.d.ts.map +1 -1
- package/dist/cli/commands/test.js +264 -2
- package/dist/cli/commands/test.js.map +1 -1
- package/dist/cli/lib/runRequest.d.ts +90 -0
- package/dist/cli/lib/runRequest.d.ts.map +1 -1
- package/dist/cli/lib/runRequest.js +300 -9
- package/dist/cli/lib/runRequest.js.map +1 -1
- package/dist/cli/lib/sentinelReflections.d.ts +111 -0
- package/dist/cli/lib/sentinelReflections.d.ts.map +1 -0
- package/dist/cli/lib/sentinelReflections.js +193 -0
- package/dist/cli/lib/sentinelReflections.js.map +1 -0
- package/dist/delivery/MockDeliveryChannel.d.ts +208 -0
- package/dist/delivery/MockDeliveryChannel.d.ts.map +1 -0
- package/dist/delivery/MockDeliveryChannel.js +445 -0
- package/dist/delivery/MockDeliveryChannel.js.map +1 -0
- package/dist/delivery/RelayDeliveryChannel.d.ts +176 -0
- package/dist/delivery/RelayDeliveryChannel.d.ts.map +1 -0
- package/dist/delivery/RelayDeliveryChannel.js +377 -0
- package/dist/delivery/RelayDeliveryChannel.js.map +1 -0
- package/dist/delivery/channel.d.ts +282 -0
- package/dist/delivery/channel.d.ts.map +1 -0
- package/dist/delivery/channel.js +76 -0
- package/dist/delivery/channel.js.map +1 -0
- package/dist/delivery/channelLog.d.ts +115 -0
- package/dist/delivery/channelLog.d.ts.map +1 -0
- package/dist/delivery/channelLog.js +94 -0
- package/dist/delivery/channelLog.js.map +1 -0
- package/dist/delivery/crypto.d.ts +312 -0
- package/dist/delivery/crypto.d.ts.map +1 -0
- package/dist/delivery/crypto.js +495 -0
- package/dist/delivery/crypto.js.map +1 -0
- package/dist/delivery/eip712.d.ts +248 -0
- package/dist/delivery/eip712.d.ts.map +1 -0
- package/dist/delivery/eip712.js +397 -0
- package/dist/delivery/eip712.js.map +1 -0
- package/dist/delivery/envelopeBuilder.d.ts +531 -0
- package/dist/delivery/envelopeBuilder.d.ts.map +1 -0
- package/dist/delivery/envelopeBuilder.js +832 -0
- package/dist/delivery/envelopeBuilder.js.map +1 -0
- package/dist/delivery/index.d.ts +53 -0
- package/dist/delivery/index.d.ts.map +1 -0
- package/dist/delivery/index.js +143 -0
- package/dist/delivery/index.js.map +1 -0
- package/dist/delivery/keys.d.ts +344 -0
- package/dist/delivery/keys.d.ts.map +1 -0
- package/dist/delivery/keys.js +513 -0
- package/dist/delivery/keys.js.map +1 -0
- package/dist/delivery/nonce-keys.d.ts +93 -0
- package/dist/delivery/nonce-keys.d.ts.map +1 -0
- package/dist/delivery/nonce-keys.js +88 -0
- package/dist/delivery/nonce-keys.js.map +1 -0
- package/dist/delivery/setupBuilder.d.ts +403 -0
- package/dist/delivery/setupBuilder.d.ts.map +1 -0
- package/dist/delivery/setupBuilder.js +554 -0
- package/dist/delivery/setupBuilder.js.map +1 -0
- package/dist/delivery/types.d.ts +722 -0
- package/dist/delivery/types.d.ts.map +1 -0
- package/dist/delivery/types.js +150 -0
- package/dist/delivery/types.js.map +1 -0
- package/dist/delivery/validate.d.ts +288 -0
- package/dist/delivery/validate.d.ts.map +1 -0
- package/dist/delivery/validate.js +648 -0
- package/dist/delivery/validate.js.map +1 -0
- package/dist/level1/Agent.d.ts +130 -0
- package/dist/level1/Agent.d.ts.map +1 -1
- package/dist/level1/Agent.js +248 -0
- package/dist/level1/Agent.js.map +1 -1
- package/dist/level1/types/Options.d.ts +62 -0
- package/dist/level1/types/Options.d.ts.map +1 -1
- package/dist/level1/types/Options.js +22 -0
- package/dist/level1/types/Options.js.map +1 -1
- package/dist/runtime/MockRuntime.d.ts +32 -0
- package/dist/runtime/MockRuntime.d.ts.map +1 -1
- package/dist/runtime/MockRuntime.js +44 -0
- package/dist/runtime/MockRuntime.js.map +1 -1
- package/dist/wallet/aa/BundlerClient.d.ts.map +1 -1
- package/dist/wallet/aa/BundlerClient.js +18 -3
- package/dist/wallet/aa/BundlerClient.js.map +1 -1
- package/dist/wallet/aa/PaymasterClient.d.ts.map +1 -1
- package/dist/wallet/aa/PaymasterClient.js +4 -1
- package/dist/wallet/aa/PaymasterClient.js.map +1 -1
- package/package.json +6 -1
|
@@ -1,18 +1,70 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* DeliveryProofBuilder - AIP-4 Delivery Proof Construction
|
|
3
|
-
* Reference: AIP-4 §9.1
|
|
4
|
-
*
|
|
5
|
-
* Builds complete delivery proofs
|
|
6
|
-
*
|
|
7
|
-
* -
|
|
8
|
-
*
|
|
9
|
-
*
|
|
2
|
+
* DeliveryProofBuilder - AIP-4 / AIP-16 Delivery Proof Construction
|
|
3
|
+
* Reference: AIP-4 §9.1, AIP-16 Rev 5 §6 (DEC-3 split)
|
|
4
|
+
*
|
|
5
|
+
* Builds complete delivery proofs in TWO variants:
|
|
6
|
+
*
|
|
7
|
+
* 1. `buildPublicProof(params)` — the original AIP-4 behavior. Uploads the
|
|
8
|
+
* plaintext result JSON to IPFS, computes `resultHash = keccak256(...)`
|
|
9
|
+
* over the canonical JSON, and creates an EAS attestation that
|
|
10
|
+
* references `resultCID` (IPFS pointer to the plaintext) and
|
|
11
|
+
* `resultHash` (canonical plaintext hash).
|
|
12
|
+
*
|
|
13
|
+
* `build()` remains as a deprecated alias to `buildPublicProof()` so
|
|
14
|
+
* every existing AIP-4 caller continues to work unmodified.
|
|
15
|
+
*
|
|
16
|
+
* 2. `buildEncryptedProof(params)` — AIP-16 Rev 5 §6 DEC-3 variant. Takes
|
|
17
|
+
* a *signed AIP-16 envelope wire object* as input (i.e. the ciphertext
|
|
18
|
+
* has already been produced by the delivery channel + envelope
|
|
19
|
+
* builder). Uploads the **ENCRYPTED ENVELOPE WIRE JSON** to IPFS (NOT
|
|
20
|
+
* the plaintext) and uses `envelopeHash =
|
|
21
|
+
* DeliveryEnvelopeBuilder.computeHash(envelopeWire)` (i.e.
|
|
22
|
+
* `keccak256(utf8(canonicalJson(envelopeWire.signed)))`) as the EAS
|
|
23
|
+
* `resultHash`. The EAS `resultCID` points at the encrypted-wire CID.
|
|
24
|
+
*
|
|
25
|
+
* **The plaintext NEVER leaves the buyer/provider channel.** It is
|
|
26
|
+
* never written to IPFS, never written to EAS, never hashed into the
|
|
27
|
+
* EAS attestation.
|
|
28
|
+
*
|
|
29
|
+
* ## DEC-3 design choice (IPFS payload for encrypted variant)
|
|
30
|
+
*
|
|
31
|
+
* Three options were considered for what the encrypted variant uploads
|
|
32
|
+
* to IPFS:
|
|
33
|
+
*
|
|
34
|
+
* (a) plaintext bytes — **rejected** (defeats the purpose of encryption;
|
|
35
|
+
* the whole point of the encrypted scheme is to keep plaintext off
|
|
36
|
+
* any public surface).
|
|
37
|
+
* (b) only the envelope hash, no IPFS upload — rejected because dispute
|
|
38
|
+
* resolution then requires the original delivery channel to still
|
|
39
|
+
* be live. Channels are ephemeral; this would break archival
|
|
40
|
+
* guarantees.
|
|
41
|
+
* (c) the encrypted envelope wire JSON (full `DeliveryEnvelopeWireV1`,
|
|
42
|
+
* signed projection + ciphertext body + provider signature) —
|
|
43
|
+
* **CHOSEN.** Gives arbitrators a durable, content-addressable
|
|
44
|
+
* artifact: they can fetch the envelope from IPFS, verify the
|
|
45
|
+
* provider EIP-712 signature, and confirm `envelopeHash` matches the
|
|
46
|
+
* value in the EAS attestation, all without ever decrypting the
|
|
47
|
+
* body. The buyer (who holds the X25519 secret) can additionally
|
|
48
|
+
* reproduce plaintext on demand.
|
|
49
|
+
*
|
|
50
|
+
* Hence: encrypted variant uploads the encrypted wire to IPFS, EAS
|
|
51
|
+
* references envelope-hash, plaintext stays in the channel.
|
|
52
|
+
*
|
|
53
|
+
* ## Common to both variants
|
|
54
|
+
*
|
|
55
|
+
* - EIP-712 signature over the `DeliveryProofMessage` using the AIP-4
|
|
56
|
+
* `AGIRAILS` domain (NOT the AIP-16 `AGIRAILS Delivery` domain — they
|
|
57
|
+
* are deliberately separate to prevent cross-feature signature reuse).
|
|
58
|
+
* - Anti-replay nonce tracked through {@link NonceManager} under
|
|
59
|
+
* namespace `agirails.delivery.v1`.
|
|
60
|
+
* - The delivery proof itself is uploaded to IPFS and pinned.
|
|
10
61
|
*/
|
|
11
62
|
import { Signer } from 'ethers';
|
|
12
63
|
import { EAS } from '@ethereum-attestation-service/eas-sdk';
|
|
13
64
|
import { IPFSClient } from '../utils/IPFSClient';
|
|
14
65
|
import { NonceManager } from '../utils/NonceManager';
|
|
15
66
|
import { DeliveryProofMessage } from '../types/message';
|
|
67
|
+
import { DeliveryEnvelopeWireV1 } from '../delivery/types';
|
|
16
68
|
/**
|
|
17
69
|
* AGIRAILS Delivery Schema UID (Base Sepolia)
|
|
18
70
|
* Deployed 2025-11-23 - AIP-4 delivery proof schema
|
|
@@ -20,7 +72,15 @@ import { DeliveryProofMessage } from '../types/message';
|
|
|
20
72
|
*/
|
|
21
73
|
export declare const AGIRAILS_DELIVERY_SCHEMA_UID = "0x1b0ebdf0bd20c28ec9d5362571ce8715a55f46e81c3de2f9b0d8e1b95fb5ffce";
|
|
22
74
|
/**
|
|
23
|
-
*
|
|
75
|
+
* Public delivery proof build parameters.
|
|
76
|
+
*
|
|
77
|
+
* Used by {@link DeliveryProofBuilder.buildPublicProof} (and by the
|
|
78
|
+
* deprecated {@link DeliveryProofBuilder.build} alias). The plaintext
|
|
79
|
+
* `resultData` is uploaded to IPFS and hashed into the EAS attestation;
|
|
80
|
+
* anyone with the CID can read it.
|
|
81
|
+
*
|
|
82
|
+
* For private/encrypted deliveries, see {@link DeliveryProofEncryptedParams}
|
|
83
|
+
* and {@link DeliveryProofBuilder.buildEncryptedProof}.
|
|
24
84
|
*/
|
|
25
85
|
export interface DeliveryProofParams {
|
|
26
86
|
txId: string;
|
|
@@ -36,6 +96,51 @@ export interface DeliveryProofParams {
|
|
|
36
96
|
chainId: number;
|
|
37
97
|
kernelAddress: string;
|
|
38
98
|
}
|
|
99
|
+
/**
|
|
100
|
+
* Encrypted delivery proof build parameters (AIP-16 §6 DEC-3 variant).
|
|
101
|
+
*
|
|
102
|
+
* Carries the *already-signed* AIP-16 envelope wire object. The plaintext
|
|
103
|
+
* has already been encrypted by the delivery channel layer; this builder
|
|
104
|
+
* never sees and never touches it.
|
|
105
|
+
*
|
|
106
|
+
* On-chain anchoring is via `envelopeHash =
|
|
107
|
+
* DeliveryEnvelopeBuilder.computeHash(envelopeWire)`. IPFS upload is the
|
|
108
|
+
* encrypted envelope wire JSON (see top-of-file DEC-3 note for the
|
|
109
|
+
* rationale).
|
|
110
|
+
*
|
|
111
|
+
* `provider` / `consumer` are DIDs (matching the AIP-4 shape). The
|
|
112
|
+
* `txId` MUST equal `envelopeWire.signed.txId`; the `chainId` MUST equal
|
|
113
|
+
* `envelopeWire.signed.chainId`; these consistency checks are enforced
|
|
114
|
+
* by `buildEncryptedProof` before any IPFS or EAS calls so that the
|
|
115
|
+
* signing layer fails fast on mismatched inputs.
|
|
116
|
+
*/
|
|
117
|
+
export interface DeliveryProofEncryptedParams {
|
|
118
|
+
/** bytes32 transaction id (0x-prefixed). MUST equal `envelopeWire.signed.txId`. */
|
|
119
|
+
txId: string;
|
|
120
|
+
/** Provider DID (e.g. `did:ethr:84532:0x...`). */
|
|
121
|
+
provider: string;
|
|
122
|
+
/** Consumer DID. */
|
|
123
|
+
consumer: string;
|
|
124
|
+
/**
|
|
125
|
+
* The signed AIP-16 envelope wire. Either `scheme: "x25519-aes256gcm-v1"`
|
|
126
|
+
* (true encrypted delivery) or — in principle — `scheme: "public-v1"`
|
|
127
|
+
* (transports plaintext but still routes through the envelope channel).
|
|
128
|
+
* Either way, the wire object as supplied is what gets pinned to IPFS,
|
|
129
|
+
* verbatim, and `envelopeHash` is the EAS anchor.
|
|
130
|
+
*/
|
|
131
|
+
envelopeWire: DeliveryEnvelopeWireV1;
|
|
132
|
+
/** Optional metadata (same shape as the public variant). */
|
|
133
|
+
metadata?: {
|
|
134
|
+
executionTime?: number;
|
|
135
|
+
outputFormat?: string;
|
|
136
|
+
outputSize?: number;
|
|
137
|
+
notes?: string;
|
|
138
|
+
};
|
|
139
|
+
/** EVM chain id. MUST equal `envelopeWire.signed.chainId`. */
|
|
140
|
+
chainId: number;
|
|
141
|
+
/** ACTPKernel contract address (EIP-712 `verifyingContract`). */
|
|
142
|
+
kernelAddress: string;
|
|
143
|
+
}
|
|
39
144
|
/**
|
|
40
145
|
* DeliveryProofBuilder - Main Builder Class
|
|
41
146
|
*/
|
|
@@ -46,17 +151,123 @@ export declare class DeliveryProofBuilder {
|
|
|
46
151
|
private eas;
|
|
47
152
|
constructor(ipfs: IPFSClient, signer: Signer, nonceManager: NonceManager, eas: EAS);
|
|
48
153
|
/**
|
|
49
|
-
* Build
|
|
50
|
-
*
|
|
154
|
+
* Build a *public* delivery proof — the original AIP-4 §5.1 flow.
|
|
155
|
+
*
|
|
156
|
+
* Steps:
|
|
157
|
+
* 1. Upload `params.resultData` (plaintext JSON) to IPFS, pin it.
|
|
158
|
+
* 2. Compute `resultHash = computeResultHash(params.resultData)`
|
|
159
|
+
* (keccak256 over canonical JSON).
|
|
160
|
+
* 3. Create EAS attestation with `(txId, resultCID, resultHash,
|
|
161
|
+
* deliveredAt)`. `deliveredAt` is `secondsNow()`.
|
|
162
|
+
* 4. Construct unsigned `DeliveryProofMessage`, allocate and record
|
|
163
|
+
* an anti-replay nonce.
|
|
164
|
+
* 5. Sign the proof with EIP-712 over the AIP-4 `AGIRAILS` domain.
|
|
165
|
+
* 6. Upload signed delivery proof JSON to IPFS, pin it.
|
|
166
|
+
*
|
|
167
|
+
* This variant is appropriate when the deliverable is intentionally
|
|
168
|
+
* public (open data, demo outputs, etc.) and the buyer is fine with
|
|
169
|
+
* the result being readable by anyone with the CID.
|
|
51
170
|
*
|
|
52
|
-
*
|
|
53
|
-
*
|
|
171
|
+
* For confidential deliveries, use {@link buildEncryptedProof}.
|
|
172
|
+
*
|
|
173
|
+
* @param params - Public delivery proof parameters.
|
|
174
|
+
* @returns Signed delivery proof message, CID of the proof on IPFS,
|
|
175
|
+
* and EAS attestation UID.
|
|
176
|
+
*/
|
|
177
|
+
buildPublicProof(params: DeliveryProofParams): Promise<{
|
|
178
|
+
deliveryProof: DeliveryProofMessage;
|
|
179
|
+
deliveryProofCID: string;
|
|
180
|
+
attestationUID: string;
|
|
181
|
+
}>;
|
|
182
|
+
/**
|
|
183
|
+
* Build complete delivery proof.
|
|
184
|
+
*
|
|
185
|
+
* @deprecated Use {@link buildPublicProof} for explicit intent, or
|
|
186
|
+
* {@link buildEncryptedProof} for the AIP-16 §6 encrypted variant.
|
|
187
|
+
* Retained as an alias to `buildPublicProof` so all existing AIP-4
|
|
188
|
+
* call sites continue to work without modification (DEC-3 backward
|
|
189
|
+
* compatibility requirement).
|
|
190
|
+
*
|
|
191
|
+
* @param params - Delivery proof parameters (public variant shape).
|
|
192
|
+
* @returns Same shape as {@link buildPublicProof}.
|
|
54
193
|
*/
|
|
55
194
|
build(params: DeliveryProofParams): Promise<{
|
|
56
195
|
deliveryProof: DeliveryProofMessage;
|
|
57
196
|
deliveryProofCID: string;
|
|
58
197
|
attestationUID: string;
|
|
59
198
|
}>;
|
|
199
|
+
/**
|
|
200
|
+
* Build an *encrypted* delivery proof (AIP-16 Rev 5 §6 DEC-3 variant).
|
|
201
|
+
*
|
|
202
|
+
* Takes a *signed AIP-16 envelope wire* as input. The plaintext is
|
|
203
|
+
* NEVER touched by this builder — the encryption was performed
|
|
204
|
+
* upstream by the channel/envelope layer.
|
|
205
|
+
*
|
|
206
|
+
* Steps:
|
|
207
|
+
* 1. Sanity-check `params.txId` and `params.chainId` against the
|
|
208
|
+
* signed envelope projection. Mismatch → fail fast.
|
|
209
|
+
* 2. Compute `envelopeHash =
|
|
210
|
+
* DeliveryEnvelopeBuilder.computeHash(envelopeWire)` (keccak256
|
|
211
|
+
* over canonical JSON of the SIGNED projection — stable across
|
|
212
|
+
* SDK languages and immune to `serverMeta` decoration).
|
|
213
|
+
* 3. Upload the ENCRYPTED ENVELOPE WIRE JSON (the full
|
|
214
|
+
* `DeliveryEnvelopeWireV1`, including signed projection,
|
|
215
|
+
* ciphertext body, and provider signature) to IPFS. Pin it.
|
|
216
|
+
* **NEVER upload plaintext.**
|
|
217
|
+
* 4. Create EAS attestation with `(txId, encryptedEnvelopeCID,
|
|
218
|
+
* envelopeHash, deliveredAt)`. EAS now anchors the envelope hash,
|
|
219
|
+
* NOT a plaintext content hash.
|
|
220
|
+
* 5. Construct the `DeliveryProofMessage` with `resultCID =
|
|
221
|
+
* encryptedEnvelopeCID` and `resultHash = envelopeHash`. Sign
|
|
222
|
+
* with EIP-712 over the AIP-4 `AGIRAILS` domain (same domain as
|
|
223
|
+
* the public variant — both are AIP-4 delivery proofs).
|
|
224
|
+
* 6. Upload signed delivery proof JSON to IPFS, pin it.
|
|
225
|
+
*
|
|
226
|
+
* ## IPFS upload set
|
|
227
|
+
*
|
|
228
|
+
* - The encrypted envelope wire JSON (NOT the plaintext).
|
|
229
|
+
* - The signed delivery proof JSON itself.
|
|
230
|
+
*
|
|
231
|
+
* ## EAS attestation contents
|
|
232
|
+
*
|
|
233
|
+
* - `txId` — same as the envelope.
|
|
234
|
+
* - `resultCID` — IPFS CID of the encrypted envelope wire.
|
|
235
|
+
* - `resultHash` — `envelopeHash` (keccak256 of canonical signed
|
|
236
|
+
* envelope projection), NOT a plaintext content hash.
|
|
237
|
+
* - `deliveredAt` — `secondsNow()`.
|
|
238
|
+
*
|
|
239
|
+
* ## Confidentiality invariant
|
|
240
|
+
*
|
|
241
|
+
* Anyone with the EAS attestation can:
|
|
242
|
+
* - Verify a specific envelope was signed by the provider for a
|
|
243
|
+
* specific txId (fetch from IPFS via `resultCID`, recompute
|
|
244
|
+
* `envelopeHash`, compare to EAS `resultHash`, recover signature).
|
|
245
|
+
* - Confirm the timing of delivery via `deliveredAt`.
|
|
246
|
+
* They CANNOT:
|
|
247
|
+
* - Read the plaintext. It is never on IPFS, never on EAS, never
|
|
248
|
+
* in any signed structure produced by this builder.
|
|
249
|
+
*
|
|
250
|
+
* Only the buyer (who holds the X25519 ephemeral secret) can decrypt
|
|
251
|
+
* the body; only the channel can serve the original wire object if
|
|
252
|
+
* the buyer didn't archive it. In a dispute, the encrypted wire from
|
|
253
|
+
* IPFS plus the buyer's secret reproduces the plaintext deterministically.
|
|
254
|
+
*
|
|
255
|
+
* @param params - Encrypted delivery proof parameters; carries the
|
|
256
|
+
* signed envelope wire.
|
|
257
|
+
* @returns Signed delivery proof message, CID of the proof on IPFS,
|
|
258
|
+
* EAS attestation UID, the IPFS CID of the encrypted envelope
|
|
259
|
+
* wire (for downstream wiring / logs), and the envelope hash
|
|
260
|
+
* used as the EAS anchor.
|
|
261
|
+
* @throws If `params.txId` / `params.chainId` disagree with the
|
|
262
|
+
* signed envelope projection.
|
|
263
|
+
*/
|
|
264
|
+
buildEncryptedProof(params: DeliveryProofEncryptedParams): Promise<{
|
|
265
|
+
deliveryProof: DeliveryProofMessage;
|
|
266
|
+
deliveryProofCID: string;
|
|
267
|
+
attestationUID: string;
|
|
268
|
+
encryptedEnvelopeCID: string;
|
|
269
|
+
envelopeHash: string;
|
|
270
|
+
}>;
|
|
60
271
|
/**
|
|
61
272
|
* Verify delivery proof signature and integrity
|
|
62
273
|
* Reference: AIP-4 §5.2 (Consumer verification)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"DeliveryProofBuilder.d.ts","sourceRoot":"","sources":["../../src/builders/DeliveryProofBuilder.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"DeliveryProofBuilder.d.ts","sourceRoot":"","sources":["../../src/builders/DeliveryProofBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAAE,MAAM,EAAmB,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,GAAG,EAAiB,MAAM,uCAAuC,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAgB3D;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,uEAAuE,CAAC;AAEjH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,GAAG,CAAC;IAChB,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,4BAA4B;IAC3C,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,YAAY,EAAE,sBAAsB,CAAC;IACrC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE;QACT,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;CACvB;AAID;;GAEG;AACH,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,GAAG;gBAHH,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,GAAG,EAAE,GAAG;IAGlB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAC3D,aAAa,EAAE,oBAAoB,CAAC;QACpC,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IA2EF;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAChD,aAAa,EAAE,oBAAoB,CAAC;QACpC,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IAIF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgEG;IACG,mBAAmB,CAAC,MAAM,EAAE,4BAA4B,GAAG,OAAO,CAAC;QACvE,aAAa,EAAE,oBAAoB,CAAC;QACpC,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IA6FF;;;;;;;;OAQG;IACG,MAAM,CACV,aAAa,EAAE,oBAAoB,EACnC,UAAU,EAAE,GAAG,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IA6DnB;;;;;;;OAOG;YACW,iBAAiB;IAsC/B;;;;;;OAMG;YACW,0BAA0B;IAwCxC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;CAU9B"}
|
|
@@ -1,13 +1,64 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
/**
|
|
3
|
-
* DeliveryProofBuilder - AIP-4 Delivery Proof Construction
|
|
4
|
-
* Reference: AIP-4 §9.1
|
|
3
|
+
* DeliveryProofBuilder - AIP-4 / AIP-16 Delivery Proof Construction
|
|
4
|
+
* Reference: AIP-4 §9.1, AIP-16 Rev 5 §6 (DEC-3 split)
|
|
5
5
|
*
|
|
6
|
-
* Builds complete delivery proofs
|
|
7
|
-
*
|
|
8
|
-
* -
|
|
9
|
-
*
|
|
10
|
-
*
|
|
6
|
+
* Builds complete delivery proofs in TWO variants:
|
|
7
|
+
*
|
|
8
|
+
* 1. `buildPublicProof(params)` — the original AIP-4 behavior. Uploads the
|
|
9
|
+
* plaintext result JSON to IPFS, computes `resultHash = keccak256(...)`
|
|
10
|
+
* over the canonical JSON, and creates an EAS attestation that
|
|
11
|
+
* references `resultCID` (IPFS pointer to the plaintext) and
|
|
12
|
+
* `resultHash` (canonical plaintext hash).
|
|
13
|
+
*
|
|
14
|
+
* `build()` remains as a deprecated alias to `buildPublicProof()` so
|
|
15
|
+
* every existing AIP-4 caller continues to work unmodified.
|
|
16
|
+
*
|
|
17
|
+
* 2. `buildEncryptedProof(params)` — AIP-16 Rev 5 §6 DEC-3 variant. Takes
|
|
18
|
+
* a *signed AIP-16 envelope wire object* as input (i.e. the ciphertext
|
|
19
|
+
* has already been produced by the delivery channel + envelope
|
|
20
|
+
* builder). Uploads the **ENCRYPTED ENVELOPE WIRE JSON** to IPFS (NOT
|
|
21
|
+
* the plaintext) and uses `envelopeHash =
|
|
22
|
+
* DeliveryEnvelopeBuilder.computeHash(envelopeWire)` (i.e.
|
|
23
|
+
* `keccak256(utf8(canonicalJson(envelopeWire.signed)))`) as the EAS
|
|
24
|
+
* `resultHash`. The EAS `resultCID` points at the encrypted-wire CID.
|
|
25
|
+
*
|
|
26
|
+
* **The plaintext NEVER leaves the buyer/provider channel.** It is
|
|
27
|
+
* never written to IPFS, never written to EAS, never hashed into the
|
|
28
|
+
* EAS attestation.
|
|
29
|
+
*
|
|
30
|
+
* ## DEC-3 design choice (IPFS payload for encrypted variant)
|
|
31
|
+
*
|
|
32
|
+
* Three options were considered for what the encrypted variant uploads
|
|
33
|
+
* to IPFS:
|
|
34
|
+
*
|
|
35
|
+
* (a) plaintext bytes — **rejected** (defeats the purpose of encryption;
|
|
36
|
+
* the whole point of the encrypted scheme is to keep plaintext off
|
|
37
|
+
* any public surface).
|
|
38
|
+
* (b) only the envelope hash, no IPFS upload — rejected because dispute
|
|
39
|
+
* resolution then requires the original delivery channel to still
|
|
40
|
+
* be live. Channels are ephemeral; this would break archival
|
|
41
|
+
* guarantees.
|
|
42
|
+
* (c) the encrypted envelope wire JSON (full `DeliveryEnvelopeWireV1`,
|
|
43
|
+
* signed projection + ciphertext body + provider signature) —
|
|
44
|
+
* **CHOSEN.** Gives arbitrators a durable, content-addressable
|
|
45
|
+
* artifact: they can fetch the envelope from IPFS, verify the
|
|
46
|
+
* provider EIP-712 signature, and confirm `envelopeHash` matches the
|
|
47
|
+
* value in the EAS attestation, all without ever decrypting the
|
|
48
|
+
* body. The buyer (who holds the X25519 secret) can additionally
|
|
49
|
+
* reproduce plaintext on demand.
|
|
50
|
+
*
|
|
51
|
+
* Hence: encrypted variant uploads the encrypted wire to IPFS, EAS
|
|
52
|
+
* references envelope-hash, plaintext stays in the channel.
|
|
53
|
+
*
|
|
54
|
+
* ## Common to both variants
|
|
55
|
+
*
|
|
56
|
+
* - EIP-712 signature over the `DeliveryProofMessage` using the AIP-4
|
|
57
|
+
* `AGIRAILS` domain (NOT the AIP-16 `AGIRAILS Delivery` domain — they
|
|
58
|
+
* are deliberately separate to prevent cross-feature signature reuse).
|
|
59
|
+
* - Anti-replay nonce tracked through {@link NonceManager} under
|
|
60
|
+
* namespace `agirails.delivery.v1`.
|
|
61
|
+
* - The delivery proof itself is uploaded to IPFS and pinned.
|
|
11
62
|
*/
|
|
12
63
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
13
64
|
exports.DeliveryProofBuilder = exports.AGIRAILS_DELIVERY_SCHEMA_UID = void 0;
|
|
@@ -15,6 +66,19 @@ const ethers_1 = require("ethers");
|
|
|
15
66
|
const eas_sdk_1 = require("@ethereum-attestation-service/eas-sdk");
|
|
16
67
|
const canonicalJson_1 = require("../utils/canonicalJson");
|
|
17
68
|
const eip712_1 = require("../types/eip712");
|
|
69
|
+
const envelopeBuilder_1 = require("../delivery/envelopeBuilder");
|
|
70
|
+
/**
|
|
71
|
+
* Module-local unix-seconds helper (AIP-16 timing rule #12).
|
|
72
|
+
*
|
|
73
|
+
* All wall-clock reads inside this module go through this single helper
|
|
74
|
+
* so tests can inject a fake clock by spying on / mocking it, and so the
|
|
75
|
+
* code never directly inlines `Math.floor(Date.now() / 1000)`.
|
|
76
|
+
*
|
|
77
|
+
* @returns Current unix time in seconds (integer).
|
|
78
|
+
*/
|
|
79
|
+
function secondsNow() {
|
|
80
|
+
return Math.floor(Date.now() / 1000);
|
|
81
|
+
}
|
|
18
82
|
/**
|
|
19
83
|
* AGIRAILS Delivery Schema UID (Base Sepolia)
|
|
20
84
|
* Deployed 2025-11-23 - AIP-4 delivery proof schema
|
|
@@ -33,20 +97,37 @@ class DeliveryProofBuilder {
|
|
|
33
97
|
this.eas = eas;
|
|
34
98
|
}
|
|
35
99
|
/**
|
|
36
|
-
* Build
|
|
37
|
-
* Reference: AIP-4 §5.1 (Provider workflow steps 1-9)
|
|
100
|
+
* Build a *public* delivery proof — the original AIP-4 §5.1 flow.
|
|
38
101
|
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
102
|
+
* Steps:
|
|
103
|
+
* 1. Upload `params.resultData` (plaintext JSON) to IPFS, pin it.
|
|
104
|
+
* 2. Compute `resultHash = computeResultHash(params.resultData)`
|
|
105
|
+
* (keccak256 over canonical JSON).
|
|
106
|
+
* 3. Create EAS attestation with `(txId, resultCID, resultHash,
|
|
107
|
+
* deliveredAt)`. `deliveredAt` is `secondsNow()`.
|
|
108
|
+
* 4. Construct unsigned `DeliveryProofMessage`, allocate and record
|
|
109
|
+
* an anti-replay nonce.
|
|
110
|
+
* 5. Sign the proof with EIP-712 over the AIP-4 `AGIRAILS` domain.
|
|
111
|
+
* 6. Upload signed delivery proof JSON to IPFS, pin it.
|
|
112
|
+
*
|
|
113
|
+
* This variant is appropriate when the deliverable is intentionally
|
|
114
|
+
* public (open data, demo outputs, etc.) and the buyer is fine with
|
|
115
|
+
* the result being readable by anyone with the CID.
|
|
116
|
+
*
|
|
117
|
+
* For confidential deliveries, use {@link buildEncryptedProof}.
|
|
118
|
+
*
|
|
119
|
+
* @param params - Public delivery proof parameters.
|
|
120
|
+
* @returns Signed delivery proof message, CID of the proof on IPFS,
|
|
121
|
+
* and EAS attestation UID.
|
|
41
122
|
*/
|
|
42
|
-
async
|
|
123
|
+
async buildPublicProof(params) {
|
|
43
124
|
// Step 1: Upload result to IPFS
|
|
44
125
|
const resultCID = await this.ipfs.add(JSON.stringify(params.resultData));
|
|
45
126
|
await this.ipfs.pin(resultCID); // Permanent pinning
|
|
46
127
|
// Step 2: Compute result hash (canonical JSON)
|
|
47
128
|
const resultHash = (0, canonicalJson_1.computeResultHash)(params.resultData);
|
|
48
129
|
// Step 3: Create EAS attestation on-chain
|
|
49
|
-
const deliveredAt =
|
|
130
|
+
const deliveredAt = secondsNow();
|
|
50
131
|
const schemaEncoder = new eas_sdk_1.SchemaEncoder('bytes32 txId,string resultCID,bytes32 resultHash,uint256 deliveredAt');
|
|
51
132
|
// Extract Ethereum address from consumer DID
|
|
52
133
|
const consumerAddress = this.extractAddressFromDID(params.consumer);
|
|
@@ -99,6 +180,159 @@ class DeliveryProofBuilder {
|
|
|
99
180
|
attestationUID
|
|
100
181
|
};
|
|
101
182
|
}
|
|
183
|
+
/**
|
|
184
|
+
* Build complete delivery proof.
|
|
185
|
+
*
|
|
186
|
+
* @deprecated Use {@link buildPublicProof} for explicit intent, or
|
|
187
|
+
* {@link buildEncryptedProof} for the AIP-16 §6 encrypted variant.
|
|
188
|
+
* Retained as an alias to `buildPublicProof` so all existing AIP-4
|
|
189
|
+
* call sites continue to work without modification (DEC-3 backward
|
|
190
|
+
* compatibility requirement).
|
|
191
|
+
*
|
|
192
|
+
* @param params - Delivery proof parameters (public variant shape).
|
|
193
|
+
* @returns Same shape as {@link buildPublicProof}.
|
|
194
|
+
*/
|
|
195
|
+
async build(params) {
|
|
196
|
+
return this.buildPublicProof(params);
|
|
197
|
+
}
|
|
198
|
+
/**
|
|
199
|
+
* Build an *encrypted* delivery proof (AIP-16 Rev 5 §6 DEC-3 variant).
|
|
200
|
+
*
|
|
201
|
+
* Takes a *signed AIP-16 envelope wire* as input. The plaintext is
|
|
202
|
+
* NEVER touched by this builder — the encryption was performed
|
|
203
|
+
* upstream by the channel/envelope layer.
|
|
204
|
+
*
|
|
205
|
+
* Steps:
|
|
206
|
+
* 1. Sanity-check `params.txId` and `params.chainId` against the
|
|
207
|
+
* signed envelope projection. Mismatch → fail fast.
|
|
208
|
+
* 2. Compute `envelopeHash =
|
|
209
|
+
* DeliveryEnvelopeBuilder.computeHash(envelopeWire)` (keccak256
|
|
210
|
+
* over canonical JSON of the SIGNED projection — stable across
|
|
211
|
+
* SDK languages and immune to `serverMeta` decoration).
|
|
212
|
+
* 3. Upload the ENCRYPTED ENVELOPE WIRE JSON (the full
|
|
213
|
+
* `DeliveryEnvelopeWireV1`, including signed projection,
|
|
214
|
+
* ciphertext body, and provider signature) to IPFS. Pin it.
|
|
215
|
+
* **NEVER upload plaintext.**
|
|
216
|
+
* 4. Create EAS attestation with `(txId, encryptedEnvelopeCID,
|
|
217
|
+
* envelopeHash, deliveredAt)`. EAS now anchors the envelope hash,
|
|
218
|
+
* NOT a plaintext content hash.
|
|
219
|
+
* 5. Construct the `DeliveryProofMessage` with `resultCID =
|
|
220
|
+
* encryptedEnvelopeCID` and `resultHash = envelopeHash`. Sign
|
|
221
|
+
* with EIP-712 over the AIP-4 `AGIRAILS` domain (same domain as
|
|
222
|
+
* the public variant — both are AIP-4 delivery proofs).
|
|
223
|
+
* 6. Upload signed delivery proof JSON to IPFS, pin it.
|
|
224
|
+
*
|
|
225
|
+
* ## IPFS upload set
|
|
226
|
+
*
|
|
227
|
+
* - The encrypted envelope wire JSON (NOT the plaintext).
|
|
228
|
+
* - The signed delivery proof JSON itself.
|
|
229
|
+
*
|
|
230
|
+
* ## EAS attestation contents
|
|
231
|
+
*
|
|
232
|
+
* - `txId` — same as the envelope.
|
|
233
|
+
* - `resultCID` — IPFS CID of the encrypted envelope wire.
|
|
234
|
+
* - `resultHash` — `envelopeHash` (keccak256 of canonical signed
|
|
235
|
+
* envelope projection), NOT a plaintext content hash.
|
|
236
|
+
* - `deliveredAt` — `secondsNow()`.
|
|
237
|
+
*
|
|
238
|
+
* ## Confidentiality invariant
|
|
239
|
+
*
|
|
240
|
+
* Anyone with the EAS attestation can:
|
|
241
|
+
* - Verify a specific envelope was signed by the provider for a
|
|
242
|
+
* specific txId (fetch from IPFS via `resultCID`, recompute
|
|
243
|
+
* `envelopeHash`, compare to EAS `resultHash`, recover signature).
|
|
244
|
+
* - Confirm the timing of delivery via `deliveredAt`.
|
|
245
|
+
* They CANNOT:
|
|
246
|
+
* - Read the plaintext. It is never on IPFS, never on EAS, never
|
|
247
|
+
* in any signed structure produced by this builder.
|
|
248
|
+
*
|
|
249
|
+
* Only the buyer (who holds the X25519 ephemeral secret) can decrypt
|
|
250
|
+
* the body; only the channel can serve the original wire object if
|
|
251
|
+
* the buyer didn't archive it. In a dispute, the encrypted wire from
|
|
252
|
+
* IPFS plus the buyer's secret reproduces the plaintext deterministically.
|
|
253
|
+
*
|
|
254
|
+
* @param params - Encrypted delivery proof parameters; carries the
|
|
255
|
+
* signed envelope wire.
|
|
256
|
+
* @returns Signed delivery proof message, CID of the proof on IPFS,
|
|
257
|
+
* EAS attestation UID, the IPFS CID of the encrypted envelope
|
|
258
|
+
* wire (for downstream wiring / logs), and the envelope hash
|
|
259
|
+
* used as the EAS anchor.
|
|
260
|
+
* @throws If `params.txId` / `params.chainId` disagree with the
|
|
261
|
+
* signed envelope projection.
|
|
262
|
+
*/
|
|
263
|
+
async buildEncryptedProof(params) {
|
|
264
|
+
// Step 1: Consistency checks. Bail before any IPFS / EAS side effects
|
|
265
|
+
// if the caller's claimed (txId, chainId) disagree with the envelope.
|
|
266
|
+
const signed = params.envelopeWire.signed;
|
|
267
|
+
if (params.txId.toLowerCase() !== signed.txId.toLowerCase()) {
|
|
268
|
+
throw new Error(`DeliveryProofBuilder.buildEncryptedProof: txId mismatch — params.txId=${params.txId} but envelopeWire.signed.txId=${signed.txId}`);
|
|
269
|
+
}
|
|
270
|
+
if (params.chainId !== signed.chainId) {
|
|
271
|
+
throw new Error(`DeliveryProofBuilder.buildEncryptedProof: chainId mismatch — params.chainId=${params.chainId} but envelopeWire.signed.chainId=${signed.chainId}`);
|
|
272
|
+
}
|
|
273
|
+
// Step 2: Compute envelope hash (cross-SDK stable, signature- and
|
|
274
|
+
// serverMeta-independent). This is the EAS anchor.
|
|
275
|
+
const envelopeHash = envelopeBuilder_1.DeliveryEnvelopeBuilder.computeHash(params.envelopeWire);
|
|
276
|
+
// Step 3: Upload ENCRYPTED envelope wire JSON to IPFS. NEVER upload
|
|
277
|
+
// plaintext. The wire object as supplied — signed projection +
|
|
278
|
+
// ciphertext body + provider signature — is what gets pinned.
|
|
279
|
+
const encryptedEnvelopeCID = await this.ipfs.add(JSON.stringify(params.envelopeWire));
|
|
280
|
+
await this.ipfs.pin(encryptedEnvelopeCID); // Permanent pinning
|
|
281
|
+
// Step 4: EAS attestation. Schema is identical to the public variant
|
|
282
|
+
// (the AIP-4 delivery schema is intentionally generic over resultCID
|
|
283
|
+
// / resultHash semantics) — the differentiation is that `resultHash`
|
|
284
|
+
// is the *envelope hash*, not a plaintext content hash.
|
|
285
|
+
const deliveredAt = secondsNow();
|
|
286
|
+
const schemaEncoder = new eas_sdk_1.SchemaEncoder('bytes32 txId,string resultCID,bytes32 resultHash,uint256 deliveredAt');
|
|
287
|
+
const consumerAddress = this.extractAddressFromDID(params.consumer);
|
|
288
|
+
const encodedData = schemaEncoder.encodeData([
|
|
289
|
+
{ name: 'txId', value: params.txId, type: 'bytes32' },
|
|
290
|
+
{ name: 'resultCID', value: encryptedEnvelopeCID, type: 'string' },
|
|
291
|
+
{ name: 'resultHash', value: envelopeHash, type: 'bytes32' },
|
|
292
|
+
{ name: 'deliveredAt', value: deliveredAt, type: 'uint256' }
|
|
293
|
+
]);
|
|
294
|
+
const tx = await this.eas.attest({
|
|
295
|
+
schema: exports.AGIRAILS_DELIVERY_SCHEMA_UID,
|
|
296
|
+
data: {
|
|
297
|
+
recipient: consumerAddress,
|
|
298
|
+
expirationTime: 0n,
|
|
299
|
+
revocable: false,
|
|
300
|
+
data: encodedData
|
|
301
|
+
}
|
|
302
|
+
});
|
|
303
|
+
const receipt = await tx.wait();
|
|
304
|
+
const attestationUID = receipt.newAttestationUID || receipt;
|
|
305
|
+
// Step 5: Build delivery proof message (unsigned), then sign.
|
|
306
|
+
const deliveryProof = {
|
|
307
|
+
type: 'agirails.delivery.v1',
|
|
308
|
+
version: '1.0.0',
|
|
309
|
+
txId: params.txId,
|
|
310
|
+
provider: params.provider,
|
|
311
|
+
consumer: params.consumer,
|
|
312
|
+
resultCID: encryptedEnvelopeCID,
|
|
313
|
+
resultHash: envelopeHash,
|
|
314
|
+
metadata: params.metadata || {},
|
|
315
|
+
easAttestationUID: attestationUID,
|
|
316
|
+
deliveredAt,
|
|
317
|
+
chainId: params.chainId,
|
|
318
|
+
nonce: this.nonceManager.getNextNonce('agirails.delivery.v1'),
|
|
319
|
+
signature: ''
|
|
320
|
+
};
|
|
321
|
+
// Record nonce BEFORE sign/upload to bound replay on retry.
|
|
322
|
+
this.nonceManager.recordNonce('agirails.delivery.v1', deliveryProof.nonce);
|
|
323
|
+
const signature = await this.signDeliveryProof(deliveryProof, params.kernelAddress);
|
|
324
|
+
deliveryProof.signature = signature;
|
|
325
|
+
// Step 6: Upload signed delivery proof JSON to IPFS.
|
|
326
|
+
const deliveryProofCID = await this.ipfs.add(JSON.stringify(deliveryProof));
|
|
327
|
+
await this.ipfs.pin(deliveryProofCID);
|
|
328
|
+
return {
|
|
329
|
+
deliveryProof,
|
|
330
|
+
deliveryProofCID,
|
|
331
|
+
attestationUID,
|
|
332
|
+
encryptedEnvelopeCID,
|
|
333
|
+
envelopeHash
|
|
334
|
+
};
|
|
335
|
+
}
|
|
102
336
|
/**
|
|
103
337
|
* Verify delivery proof signature and integrity
|
|
104
338
|
* Reference: AIP-4 §5.2 (Consumer verification)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"DeliveryProofBuilder.js","sourceRoot":"","sources":["../../src/builders/DeliveryProofBuilder.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"DeliveryProofBuilder.js","sourceRoot":"","sources":["../../src/builders/DeliveryProofBuilder.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;;;AAEH,mCAAiD;AACjD,mEAA2E;AAC3E,0DAA2D;AAI3D,4CAA8F;AAE9F,iEAAsE;AAEtE;;;;;;;;GAQG;AACH,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACU,QAAA,4BAA4B,GAAG,oEAAoE,CAAC;AA0EjH,6DAA6D;AAE7D;;GAEG;AACH,MAAa,oBAAoB;IAC/B,YACU,IAAgB,EAChB,MAAc,EACd,YAA0B,EAC1B,GAAQ;QAHR,SAAI,GAAJ,IAAI,CAAY;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,iBAAY,GAAZ,YAAY,CAAc;QAC1B,QAAG,GAAH,GAAG,CAAK;IACf,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAA2B;QAKhD,gCAAgC;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;QAEpD,+CAA+C;QAC/C,MAAM,UAAU,GAAG,IAAA,iCAAiB,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAExD,0CAA0C;QAC1C,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;QAEjC,MAAM,aAAa,GAAG,IAAI,uBAAa,CACrC,sEAAsE,CACvE,CAAC;QAEF,6CAA6C;QAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpE,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC;YAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;YACrD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;SAC7D,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,oCAA4B;YACpC,IAAI,EAAE;gBACJ,SAAS,EAAE,eAAe;gBAC1B,cAAc,EAAE,EAAE,EAAE,6BAA6B;gBACjD,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,WAAW;aAClB;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChC,gEAAgE;QAChE,MAAM,cAAc,GAAI,OAAe,CAAC,iBAAiB,IAAK,OAAe,CAAC;QAE9E,kDAAkD;QAClD,MAAM,aAAa,GAAyB;YAC1C,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;YACT,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,iBAAiB,EAAE,cAAc;YACjC,WAAW;YACX,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,sBAAsB,CAAC;YAC7D,SAAS,EAAE,EAAE,CAAC,sBAAsB;SACrC,CAAC;QAEF,kEAAkE;QAClE,8DAA8D;QAC9D,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,sBAAsB,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE3E,4BAA4B;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACpF,aAAa,CAAC,SAAS,GAAG,SAAS,CAAC;QAEpC,wCAAwC;QACxC,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY;QAEnD,OAAO;YACL,aAAa;YACb,gBAAgB;YAChB,cAAc;SACf,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAC,MAA2B;QAKrC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgEG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAoC;QAO5D,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;QAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,yEAAyE,MAAM,CAAC,IAAI,iCAAiC,MAAM,CAAC,IAAI,EAAE,CACnI,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,+EAA+E,MAAM,CAAC,OAAO,oCAAoC,MAAM,CAAC,OAAO,EAAE,CAClJ,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,mDAAmD;QACnD,MAAM,YAAY,GAAG,yCAAuB,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE9E,oEAAoE;QACpE,+DAA+D;QAC/D,8DAA8D;QAC9D,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB;QAE/D,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;QAEjC,MAAM,aAAa,GAAG,IAAI,uBAAa,CACrC,sEAAsE,CACvE,CAAC;QAEF,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpE,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC;YAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;YACrD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;YAC5D,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE;SAC7D,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,EAAE,oCAA4B;YACpC,IAAI,EAAE;gBACJ,SAAS,EAAE,eAAe;gBAC1B,cAAc,EAAE,EAAE;gBAClB,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,WAAW;aAClB;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,cAAc,GAAI,OAAe,CAAC,iBAAiB,IAAK,OAAe,CAAC;QAE9E,8DAA8D;QAC9D,MAAM,aAAa,GAAyB;YAC1C,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,oBAAoB;YAC/B,UAAU,EAAE,YAAY;YACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,iBAAiB,EAAE,cAAc;YACjC,WAAW;YACX,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,sBAAsB,CAAC;YAC7D,SAAS,EAAE,EAAE;SACd,CAAC;QAEF,4DAA4D;QAC5D,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,sBAAsB,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAE3E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACpF,aAAa,CAAC,SAAS,GAAG,SAAS,CAAC;QAEpC,qDAAqD;QACrD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAEtC,OAAO;YACL,aAAa;YACb,gBAAgB;YAChB,cAAc;YACd,oBAAoB;YACpB,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,aAAmC,EACnC,UAAe,EACf,aAAqB;QAErB,sBAAsB;QACtB,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAC7F,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE3E,IAAI,gBAAgB,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,wBAAwB;QACxB,MAAM,YAAY,GAAG,IAAA,iCAAiB,EAAC,UAAU,CAAC,CAAC;QAEnD,IAAI,YAAY,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,gDAAgD;QAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAEnF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,oCAA4B,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,wCAAwC,oCAA4B,SAAS,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACrH,CAAC;QAED,mFAAmF;QACnF,IAAI,SAAS,IAAI,WAAW,IAAK,WAAmB,CAAC,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,gBAAgB,IAAI,WAAW,IAAK,WAAmB,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,oDAAoD;QACpD,MAAM,aAAa,GAAG,IAAI,uBAAa,CACrC,sEAAsE,CACvE,CAAC;QACF,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE/D,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;QAChF,MAAM,oBAAoB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;QAC1F,MAAM,qBAAqB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;QAE5F,IAAI,eAAe,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,oBAAoB,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,qBAAqB,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAC7B,aAAmC,EACnC,aAAqB;QAErB,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,iBAAiB,EAAE,aAAa;SACjC,CAAC;QAEF,MAAM,OAAO,GAA0B;YACrC,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;YAClD,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B,CAAC;QAEF,yCAAyC;QACzC,sDAAsD;QACtD,IAAI,eAAe,IAAI,IAAI,CAAC,MAAM,IAAI,OAAQ,IAAI,CAAC,MAAc,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;YAC/F,MAAM,SAAS,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,aAAa,CACxD,MAAM,EACN,+BAAsB,EACtB,OAAO,CACR,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAErF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,0BAA0B,CACtC,aAAmC,EACnC,aAAqB;QAErB,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,iBAAiB,EAAE,aAAa;SACjC,CAAC;QAEF,MAAM,OAAO,GAA0B;YACrC,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;YAClD,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B,CAAC;QAEF,kDAAkD;QAClD,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAA,wBAAe,EACtC,MAAM,EACN,+BAAsB,EACtB,OAAO,EACP,aAAa,CAAC,SAAS,CACxB,CAAC;YAEF,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,kEAAkE;YAClE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,OAAO,IAAI,+BAA+B,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAAC,GAAW;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEzD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA/dD,oDA+dC"}
|