@aicent/iqa 1.2.8 → 1.3.1

package/bin/iqa.mjs

@@ -1,59 +1,59 @@
-#!/usr/bin/env node
-// iqa -- replay the published conformance vectors. [PASS] or it is not.
-//
-//   npx @aicent/iqa                       # replay the shipped vectors
-//   npx @aicent/iqa --vectors ./new.json  # replay a different vector set
-//   npx @aicent/iqa --json                # machine-readable output
-
-import { runConformance, loadVectors, DEFAULT_VECTORS_PATH } from '../src/conformance.mjs';
-
-const args = process.argv.slice(2);
-
-let vectorsPath = DEFAULT_VECTORS_PATH;
-let json = false;
-
-for (let i = 0; i < args.length; i++) {
-  if (args[i] === '--vectors') {
-    vectorsPath = args[++i];
-    if (!vectorsPath) {
-      console.error('error: --vectors requires a path');
-      process.exit(2);
-    }
-  } else if (args[i] === '--json') {
-    json = true;
-  } else if (args[i] === '--help' || args[i] === '-h') {
-    console.log('@aicent/iqa -- replay the published conformance vectors (RFC-009 sec. 10/sec. 11)');
-    console.log('  npx @aicent/iqa                       replay the shipped vectors');
-    console.log('  npx @aicent/iqa --vectors ./new.json  replay a different vector set');
-    console.log('  npx @aicent/iqa --json                machine-readable output');
-    process.exit(0);
-  } else {
-    console.error(`error: unknown argument ${args[i]}`);
-    process.exit(2);
-  }
-}
-
-let vectors;
-try {
-  vectors = loadVectors(vectorsPath);
-} catch (err) {
-  console.error(`error: cannot load vectors (${err.message})`);
-  process.exit(2);
-}
-
-const result = runConformance(vectors);
-
-if (json) {
-  console.log(JSON.stringify({
-    checked: result.checked,
-    passed: result.passed,
-    failures: result.failures,
-    vectors: vectorsPath,
-  }, null, 2));
-} else {
-  console.log(`iqa conformance replay -- spec ${vectors.spec ?? '(unlabeled)'}`);
-  for (const f of result.failures) console.log(`[FAIL] ${f}`);
-  console.log(`[PASS] all ${result.checked} checks passed`);
-}
-
-process.exit(result.failures.length === 0 ? 0 : 1);
+#!/usr/bin/env node
+// iqa -- replay the published conformance vectors. [PASS] or it is not.
+//
+//   npx @aicent/iqa                       # replay the shipped vectors
+//   npx @aicent/iqa --vectors ./new.json  # replay a different vector set
+//   npx @aicent/iqa --json                # machine-readable output
+
+import { runConformance, loadVectors, DEFAULT_VECTORS_PATH } from '../src/conformance.mjs';
+
+const args = process.argv.slice(2);
+
+let vectorsPath = DEFAULT_VECTORS_PATH;
+let json = false;
+
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === '--vectors') {
+    vectorsPath = args[++i];
+    if (!vectorsPath) {
+      console.error('error: --vectors requires a path');
+      process.exit(2);
+    }
+  } else if (args[i] === '--json') {
+    json = true;
+  } else if (args[i] === '--help' || args[i] === '-h') {
+    console.log('@aicent/iqa -- replay the published conformance vectors (AICENT-009 sec. 10/sec. 11)');
+    console.log('  npx @aicent/iqa                       replay the shipped vectors');
+    console.log('  npx @aicent/iqa --vectors ./new.json  replay a different vector set');
+    console.log('  npx @aicent/iqa --json                machine-readable output');
+    process.exit(0);
+  } else {
+    console.error(`error: unknown argument ${args[i]}`);
+    process.exit(2);
+  }
+}
+
+let vectors;
+try {
+  vectors = loadVectors(vectorsPath);
+} catch (err) {
+  console.error(`error: cannot load vectors (${err.message})`);
+  process.exit(2);
+}
+
+const result = runConformance(vectors);
+
+if (json) {
+  console.log(JSON.stringify({
+    checked: result.checked,
+    passed: result.passed,
+    failures: result.failures,
+    vectors: vectorsPath,
+  }, null, 2));
+} else {
+  console.log(`iqa conformance replay -- spec ${vectors.spec ?? '(unlabeled)'}`);
+  for (const f of result.failures) console.log(`[FAIL] ${f}`);
+  console.log(`[PASS] all ${result.checked} checks passed`);
+}
+
+process.exit(result.failures.length === 0 ? 0 : 1);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aicent/iqa",
-  "version": "1.2.8",
-  "description": "IQA for JavaScript: iqa:// subject-attestation addressing, IQA_ROUTE derivation, action safety classes -- and the published conformance vectors that prove an implementation is right.",
+  "version": "1.3.1",
+  "description": "IQA for JavaScript: iqa:// subject-attestation addressing, IQA_ROUTE derivation, action safety classes, the AE-128 fixed attestation envelope -- and the published conformance vectors that prove an implementation is right.",
   "author": "IQA.ORG Organization",
   "license": "Apache-2.0",
   "homepage": "https://iqa.org/",
@@ -13,6 +13,10 @@
       "types": "./src/iqa-uri.d.mts",
       "default": "./src/iqa-uri.mjs"
     },
+    "./envelope": {
+      "types": "./src/envelope.d.mts",
+      "default": "./src/envelope.mjs"
+    },
     "./conformance": {
       "types": "./src/conformance.d.mts",
       "default": "./src/conformance.mjs"
@@ -39,6 +43,9 @@
     "uri",
     "conformance",
     "ed25519",
+    "ae-128",
+    "envelope",
+    "hmac",
     "aicent"
   ],
   "repository": {

package/src/ae128-vectors-v1.json

@@ -0,0 +1,112 @@
+{
+  "schema": "iqa-ae128-vectors/1",
+  "spec": "ae128-draft-v0.3 sec. 2-6",
+  "generated_by": "SPEC/tools/ae128_vectors.py",
+  "generated_with": "python 3.14.2 on windows",
+  "how_to_reproduce": "change the cases in the generator, never the JSON",
+  "params": {
+    "authority": "f3b2a1c4.pillar.example",
+    "route_shard_hex": "557c8154d3780cb78cc5fa1bd72b331c",
+    "key_ascii": "PLSF-TEST-ORG-KEY-00012345678901",
+    "lease_expiry": 1798761600,
+    "standing": 2,
+    "organ_ascii": "ORG-TEST",
+    "nonce": 1
+  },
+  "positive_frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+  "negative_frames": [
+    {
+      "name": "length 127 (truncated)",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d5445535400000000000000010200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "length"
+    },
+    {
+      "name": "length 129 (padded)",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d54455354000000000000000102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "length"
+    },
+    {
+      "name": "pulse-frame magic 'RTTP'",
+      "frame_hex": "5254545001010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "magic"
+    },
+    {
+      "name": "version 2",
+      "frame_hex": "4951414502010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "version"
+    },
+    {
+      "name": "algorithm 0x00",
+      "frame_hex": "4951414501000000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "algorithm"
+    },
+    {
+      "name": "algorithm 0x02 (undefined)",
+      "frame_hex": "4951414501020000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "algorithm"
+    },
+    {
+      "name": "flags 0x0001 (unassigned bit)",
+      "frame_hex": "4951414501010100000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "flags"
+    },
+    {
+      "name": "standing 0x04 (outside the closed set)",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "standing"
+    },
+    {
+      "name": "reserved nonzero (byte 85)",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "reserved"
+    },
+    {
+      "name": "extension nonzero (byte 100)",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "extension"
+    },
+    {
+      "name": "organ tag non-ASCII (0xFF)",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596aff52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "reject_reason": "organ"
+    }
+  ],
+  "tampered_frames": [
+    {
+      "name": "one attestation bit flipped",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4ad14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "verify_reason": "hmac"
+    },
+    {
+      "name": "organ tag altered (ORG-TESU)",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553550000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "verify_reason": "hmac"
+    },
+    {
+      "name": "nonce altered",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000002020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "verify_reason": "hmac"
+    },
+    {
+      "name": "standing flipped radiant -> genesis",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "verify_reason": "hmac"
+    },
+    {
+      "name": "lease_expiry altered",
+      "frame_hex": "4951414501010000000000006b36ec81557c8154d3780cb78cc5fa1bd72b331c4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "verify_reason": "hmac"
+    },
+    {
+      "name": "intent_shard swapped for another subject",
+      "frame_hex": "4951414501010000000000006b36ec80000102030405060708090a0b0c0d0e0f4bd14b6ae7b00904986294a326a0f0255847184ff2c9185539d4863efb84596a4f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "verify_reason": "hmac"
+    },
+    {
+      "name": "attestation from a different key",
+      "frame_hex": "4951414501010000000000006b36ec80557c8154d3780cb78cc5fa1bd72b331c7dff5e97f9ff451e7989f47b670fe003964a26aced4df399a9f242541dcd93f84f52472d544553540000000000000001020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "verify_reason": "hmac"
+    }
+  ],
+  "note": "Generated, not written: every frame is computed from the documented parameters and the documented mutations. A conforming implementation reproduces the positive frame byte for byte, rejects every negative frame at parse time, and fails verification on every tampered frame."
+}

package/src/conformance.d.mts

@@ -1,29 +1,29 @@
-/** Independent conformance replay for the published IQA vector set. */
-
-export interface ConformanceResult {
-  checked: number;
-  failures: string[];
-  passed: number;
-}
-
-export interface ParsedForConformance {
-  authority: string;
-  action: string | null;
-  shardHex: string;
-}
-
-/**
- * The independent RFC-009 sec. 10 implementation used by the checker.
- * `buildFrame`-style helpers do not exist here: IQA v1.2.6 has no frame --
- * the derivation chain is URI -> IQA_ROUTE (4 bytes).
- */
-export declare function parseUri(uri: string): ParsedForConformance;
-
-/** Replay a vector set. Accepts any object with the documented groups. */
-export declare function runConformance(vectors: object): ConformanceResult;
-
-/** Parse a vector set; defaults to the shipped one. */
-export declare function loadVectors(path?: string): Record<string, unknown>;
-
-/** Absolute path of the shipped vectors.json. */
-export declare const DEFAULT_VECTORS_PATH: string;
+/** Independent conformance replay for the published IQA vector set. */
+
+export interface ConformanceResult {
+  checked: number;
+  failures: string[];
+  passed: number;
+}
+
+export interface ParsedForConformance {
+  authority: string;
+  action: string | null;
+  shardHex: string;
+}
+
+/**
+ * The independent AICENT-009 sec. 10 implementation used by the checker.
+ * `buildFrame`-style helpers do not exist here: IQA v1.2.6 has no frame --
+ * the derivation chain is URI -> IQA_ROUTE (4 bytes).
+ */
+export declare function parseUri(uri: string): ParsedForConformance;
+
+/** Replay a vector set. Accepts any object with the documented groups. */
+export declare function runConformance(vectors: object): ConformanceResult;
+
+/** Parse a vector set; defaults to the shipped one. */
+export declare function loadVectors(path?: string): Record<string, unknown>;
+
+/** Absolute path of the shipped vectors.json. */
+export declare const DEFAULT_VECTORS_PATH: string;