@ainize/core 0.2.3 → 0.3.0

package/dist/config-schema.js

@@ -125,7 +125,7 @@ export const nodeConfigSchema = z.object({
      */
     operatorPasswordHash: z.string().optional(),
     /**
-     * Addresses that may sign in as this node's operator instead of typing the password.
+     * Addresses that may sign in as this node's operator, besides the node's own key.
      *
      * The node's OWN address is always allowed and is not listed here — whoever holds the node's key already owns
      * everything the node published, so requiring them to also type a password protects nothing. This list is for

package/dist/identity.d.ts

@@ -7,9 +7,52 @@ export declare function createIdentity(): Identity;
 export declare function identityFromPrivateKey(privHex: string): Identity;
 export declare function signMessage(message: string, privHex: string): string;
 export declare function verifyMessage(message: string, signature: string, address: string): boolean;
+/**
+ * ─── HUMANS SIGN EIP-191, KEYS SIGN AIN ───────────────────────────────────────────────────────────────────
+ *
+ * `verifyMessage` above is the product's universal scheme and it is deliberately NOT widened. It verifies
+ * teach headers, delegations, publish claims, x402 payment proofs, p2p headers and every local-ledger record —
+ * all of them produced by a key this product generated, several of them firing per minute. Making that one
+ * function accept a second signature shape would widen every one of those surfaces at once.
+ *
+ * What a browser wallet gives us is different in kind: a PERSON, present, approving one thing, with a prompt
+ * in front of them. That happens a handful of times — sign-in, claiming a node, approving a device — so it
+ * gets its own verifier and its own call sites.
+ *
+ * The two schemes differ twice over, and both differences are fatal to interop:
+ *
+ *   AIN      keccak256(keccak256( varint(26) ‖ 'AINetwork Signed Message:\n' ‖ varint(str.length) ‖ bytes ))
+ *            wire: 0x ‖ hash(32) ‖ r(32) ‖ s(32) ‖ v(1)   — the digest travels WITH the signature
+ *   EIP-191  keccak256( '\x19Ethereum Signed Message:\n' ‖ byteLength ‖ bytes )
+ *            wire: 0x ‖ r(32) ‖ s(32) ‖ v(1)              — 65 bytes, no embedded digest
+ *
+ * Note the length: AIN counts UTF-16 code units (JS `.length`), EIP-191 counts UTF-8 bytes. For "한글" that is
+ * 2 against 6, so a Korean message hashes differently even before the prefix is considered.
+ *
+ * The ADDRESS is the same in both worlds — same curve, same keccak-of-pubkey derivation — which is the whole
+ * reason this works: a MetaMask account names exactly one AIN address. Measured, not assumed: the same private
+ * key yields 0x00ADEc28… under both `privateToAddress` and Ethereum's rules.
+ */
+/** The EIP-191 personal-message digest MetaMask signs. Byte length, not string length. */
+export declare function hashEip191(message: string): Buffer;
+/**
+ * Did `address` sign `message` with a browser wallet (MetaMask and every EIP-1193 wallet)?
+ *
+ * Rejects anything that is not a bare 65-byte signature, so an AIN signature — which carries its own 32-byte
+ * digest in front and is therefore 97 bytes — cannot be smuggled in here and silently verified under the wrong
+ * rules. `v` is accepted as 27/28 (what wallets send) or 0/1 (what some libraries send).
+ */
+export declare function verifyEip191(message: string, signature: string, address: string): boolean;
+/** Which scheme produced a signature. `ain` is a key this product generated; `eip191` is a person's wallet. */
+export type AuthScheme = 'ain' | 'eip191';
+/**
+ * Verify a signature under a NAMED scheme.
+ *
+ * The scheme is always stated by the caller and never guessed from the signature's shape. A verifier that
+ * tried both would accept whichever passed, which means an attacker picks the scheme — and the two have
+ * different security properties at the call site (a wallet prompt a human saw, versus a key acting on its own).
+ */
+export declare function verifyAuth(scheme: AuthScheme, message: string, signature: string, address: string): boolean;
 export declare function isAddress(value: string): boolean;
 export declare function checksum(address: string): string;
-/** Operator password hashing (scrypt) for the web console login. */
-export declare function hashPassword(password: string): string;
-export declare function verifyPassword(password: string, stored: string): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,cAAc,IAAI,QAAQ,CAKzC;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAKhE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMhD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIrD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAMxE"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,cAAc,IAAI,QAAQ,CAKzC;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAKhE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAezF;AAED,+GAA+G;AAC/G,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3G;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMhD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/identity.js

@@ -4,7 +4,7 @@
  * so a node's signature over a ledger record is verifiable by any peer with only the address.
  */
 import { createRequire } from 'node:module';
-import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 const require = createRequire(import.meta.url);
 // ain-util is CommonJS
 const ainUtil = require('@ainblockchain/ain-util');
@@ -31,6 +31,73 @@ export function verifyMessage(message, signature, address) {
         return false;
     }
 }
+/**
+ * ─── HUMANS SIGN EIP-191, KEYS SIGN AIN ───────────────────────────────────────────────────────────────────
+ *
+ * `verifyMessage` above is the product's universal scheme and it is deliberately NOT widened. It verifies
+ * teach headers, delegations, publish claims, x402 payment proofs, p2p headers and every local-ledger record —
+ * all of them produced by a key this product generated, several of them firing per minute. Making that one
+ * function accept a second signature shape would widen every one of those surfaces at once.
+ *
+ * What a browser wallet gives us is different in kind: a PERSON, present, approving one thing, with a prompt
+ * in front of them. That happens a handful of times — sign-in, claiming a node, approving a device — so it
+ * gets its own verifier and its own call sites.
+ *
+ * The two schemes differ twice over, and both differences are fatal to interop:
+ *
+ *   AIN      keccak256(keccak256( varint(26) ‖ 'AINetwork Signed Message:\n' ‖ varint(str.length) ‖ bytes ))
+ *            wire: 0x ‖ hash(32) ‖ r(32) ‖ s(32) ‖ v(1)   — the digest travels WITH the signature
+ *   EIP-191  keccak256( '\x19Ethereum Signed Message:\n' ‖ byteLength ‖ bytes )
+ *            wire: 0x ‖ r(32) ‖ s(32) ‖ v(1)              — 65 bytes, no embedded digest
+ *
+ * Note the length: AIN counts UTF-16 code units (JS `.length`), EIP-191 counts UTF-8 bytes. For "한글" that is
+ * 2 against 6, so a Korean message hashes differently even before the prefix is considered.
+ *
+ * The ADDRESS is the same in both worlds — same curve, same keccak-of-pubkey derivation — which is the whole
+ * reason this works: a MetaMask account names exactly one AIN address. Measured, not assumed: the same private
+ * key yields 0x00ADEc28… under both `privateToAddress` and Ethereum's rules.
+ */
+/** The EIP-191 personal-message digest MetaMask signs. Byte length, not string length. */
+export function hashEip191(message) {
+    const bytes = Buffer.from(message, 'utf8');
+    return ainUtil.keccak(Buffer.concat([Buffer.from(`\x19Ethereum Signed Message:\n${bytes.length}`, 'utf8'), bytes]));
+}
+/**
+ * Did `address` sign `message` with a browser wallet (MetaMask and every EIP-1193 wallet)?
+ *
+ * Rejects anything that is not a bare 65-byte signature, so an AIN signature — which carries its own 32-byte
+ * digest in front and is therefore 97 bytes — cannot be smuggled in here and silently verified under the wrong
+ * rules. `v` is accepted as 27/28 (what wallets send) or 0/1 (what some libraries send).
+ */
+export function verifyEip191(message, signature, address) {
+    try {
+        const raw = Buffer.from(signature.replace(/^0x/, ''), 'hex');
+        if (raw.length !== 65)
+            return false;
+        const r = raw.subarray(0, 32);
+        const s = raw.subarray(32, 64);
+        const vRaw = raw[64];
+        const v = vRaw >= 27 ? vRaw : vRaw + 27;
+        if (v !== 27 && v !== 28)
+            return false;
+        const pub = ainUtil.ecRecoverPub(hashEip191(message), r, s, v);
+        const recovered = ainUtil.toChecksumAddress(ainUtil.bufferToHex(ainUtil.pubToAddress(pub.subarray(1))));
+        return recovered.toLowerCase() === address.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify a signature under a NAMED scheme.
+ *
+ * The scheme is always stated by the caller and never guessed from the signature's shape. A verifier that
+ * tried both would accept whichever passed, which means an attacker picks the scheme — and the two have
+ * different security properties at the call site (a wallet prompt a human saw, versus a key acting on its own).
+ */
+export function verifyAuth(scheme, message, signature, address) {
+    return scheme === 'eip191' ? verifyEip191(message, signature, address) : verifyMessage(message, signature, address);
+}
 export function isAddress(value) {
     try {
         return ainUtil.isValidAddress(value);
@@ -42,18 +109,4 @@ export function isAddress(value) {
 export function checksum(address) {
     return ainUtil.toChecksumAddress(address);
 }
-/** Operator password hashing (scrypt) for the web console login. */
-export function hashPassword(password) {
-    const salt = randomBytes(16);
-    const key = scryptSync(password, salt, 32);
-    return `scrypt$${salt.toString('hex')}$${key.toString('hex')}`;
-}
-export function verifyPassword(password, stored) {
-    const [alg, saltHex, keyHex] = stored.split('$');
-    if (alg !== 'scrypt' || !saltHex || !keyHex)
-        return false;
-    const key = scryptSync(password, Buffer.from(saltHex, 'hex'), 32);
-    const expected = Buffer.from(keyHex, 'hex');
-    return key.length === expected.length && timingSafeEqual(key, expected);
-}
 //# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,uBAAuB;AACvB,MAAM,OAAO,GAAG,OAAO,CAAC,yBAAyB,CAA6C,CAAC;AAQ/F,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAe;IAC1D,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe;IAC/E,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC7D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,uBAAuB;AACvB,MAAM,OAAO,GAAG,OAAO,CAAC,yBAAyB,CAA6C,CAAC;AAQ/F,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAe;IAC1D,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe;IAC/E,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAW,CAAC;AAChI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,SAAS,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAKD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,OAAe,EAAE,SAAiB,EAAE,OAAe;IAChG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ainize/core",
-  "version": "0.2.3",
-  "description": "Ainize core \u2014 knowledge-patch schemas, lineage, verification and ledger (AIN) bindings shared by @ainize/node and @ainize/cli",
+  "version": "0.3.0",
+  "description": "Ainize core — knowledge-patch schemas, lineage, verification and ledger (AIN) bindings shared by @ainize/node and @ainize/cli",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -42,8 +42,9 @@
     "zod": "^4.5.4"
   },
   "devDependencies": {
+    "@noble/secp256k1": "^2.3.0",
     "@types/node": "^24.10.0",
     "tsx": "^4.23.13",
     "typescript": "^5.9.3"
   }
-}
+}