@atlasauth/pca-abe 0.0.0-stage → 0.1.0

package/dist/abe.d.ts

@@ -0,0 +1,117 @@
+import { type Capability } from '@atlasauth/pca';
+import { type Policy } from './policy';
+/**
+ * Proof-carrying encryption: Ciphertext-Policy attribute/policy-based encryption built from a
+ * Boneh-Franklin IBE KEM on BLS12-381, composed over a monotone access structure by Shamir
+ * secret-sharing (an LSSS), sealing the payload with AES-256-GCM.
+ *
+ * CONSTRUCTION
+ *   setup()             -> master key pair (s, P_pub = s*g2).
+ *   keygen(attrs)       -> one BF decryption key d_A = s*H1(A) per attribute A the holder owns.
+ *   encrypt(policy, m)  -> pick a random root secret S; share it down the policy's threshold tree with
+ *                          Shamir (AND = n-of-n, OR = 1-of-n, threshold = k-of-n); at each leaf attribute
+ *                          A, BF-encapsulate a fresh KEM key and XOR-mask that leaf's assigned share.
+ *                          The content-encryption key is HKDF(S); the payload is AES-256-GCM sealed with
+ *                          the whole KEM header as AAD.
+ *   decrypt(key, ct)    -> at every leaf the key owns, decapsulate -> unmask that share; interpolate each
+ *                          gate once >= t shares are recovered; recover S iff the key's attribute set
+ *                          satisfies the policy; derive the CEK and open the AEAD. Else fail (null).
+ *
+ * SECURITY PROPERTY (honest)
+ *   Confidentiality holds under the Bilinear Diffie-Hellman assumption on BLS12-381 in the random-oracle
+ *   model (standard BF-IBE), and the Shamir sharing is information-theoretic (fewer than `t` shares of a
+ *   gate reveal nothing about its secret). A holder whose attribute set does NOT satisfy the policy
+ *   cannot recover enough shares to reconstruct S and therefore cannot derive the CEK. Payload and header
+ *   integrity are guaranteed by AES-256-GCM.
+ *
+ *   This is NOT a proof-of-knowledge / NIZK: it binds confidentiality to POSSESSION of capability-derived
+ *   attribute keys, not to a verified proof. Like any IBE-KEM-composed access structure (as opposed to a
+ *   single monolithic CP-ABE with per-key randomisation), it is collusion-resistant only within a single
+ *   issued key: two SEPARATELY issued keys under the same master, each holding part of the required
+ *   attributes, could in principle pool their attribute keys. Atlas issues exactly one key per capability
+ *   (`keygenForCapability`), and decryption is evaluated against that one key's attribute set — so the
+ *   enforced statement is precisely "this capability's authority satisfies the policy".
+ */
+export declare const ABE_ALG = "bf-ibe-bls12381/lsss/aes-256-gcm";
+export interface MasterPublicKey {
+    v: 1;
+    curve: 'bls12-381';
+    /** b64u compressed G2 point `P_pub = s * g2`. */
+    pPub: string;
+}
+export interface MasterSecretKey {
+    v: 1;
+    curve: 'bls12-381';
+    /** b64u 32-byte master secret scalar `s`. */
+    s: string;
+}
+export interface DecryptionKey {
+    v: 1;
+    curve: 'bls12-381';
+    /** The capability's bound holder key, when issued from a capability (informational). */
+    holder?: string;
+    /** attribute token -> b64u compressed G1 decryption key `d_A = s * H1(A)`. */
+    attrs: Record<string, string>;
+}
+/** The KEM header: the access structure realised as a tree of per-leaf encapsulations. */
+export type KemTree = {
+    kind: 'leaf';
+    attr: string;
+    U: string;
+    wrap: string;
+} | {
+    kind: 'gate';
+    t: number;
+    of: {
+        i: number;
+        sub: KemTree;
+    }[];
+};
+export interface AbeCiphertext {
+    v: 1;
+    alg: typeof ABE_ALG;
+    /** b64u HKDF salt (16 bytes) bound into every derived key and the CEK. */
+    salt: string;
+    /** The share-distribution tree (also the authenticated access structure). */
+    kem: KemTree;
+    /** b64u AES-256-GCM IV (12 bytes). */
+    iv: string;
+    /** b64u AES-256-GCM ciphertext. */
+    ct: string;
+    /** b64u AES-256-GCM tag (16 bytes). */
+    tag: string;
+}
+export declare class PcaEncryptionError extends Error {
+    constructor(message: string);
+}
+/** Generate a fresh master key pair. */
+export declare function setup(): {
+    mpk: MasterPublicKey;
+    msk: MasterSecretKey;
+};
+/** Issue a decryption key for an explicit set of attribute tokens. */
+export declare function keygenForAttributes(msk: MasterSecretKey, attrs: Iterable<string>): DecryptionKey;
+/**
+ * Issue a decryption key BOUND to a PCA capability: its attributes are exactly those the (signed)
+ * capability carries — holder, and the verbs/resources/scopes of its policy envelope — optionally
+ * extended with explicit extra tokens. The key can decrypt only ciphertexts whose policy is satisfied
+ * by this capability's authority.
+ */
+export declare function keygenForCapability(msk: MasterSecretKey, capability: Capability, extraAttributes?: Iterable<string>): DecryptionKey;
+/**
+ * Encrypt `plaintext` so that it decrypts only for a holder whose attribute set satisfies `policy`.
+ * Throws {@link PcaEncryptionError} on an invalid policy or master public key.
+ */
+export declare function encryptForPolicy(mpk: MasterPublicKey, policy: Policy, plaintext: Uint8Array | string): {
+    ciphertext: AbeCiphertext;
+};
+/** Validate an untrusted value as an {@link AbeCiphertext}; null (fail-closed) on any deviation. */
+export declare function parseCiphertext(x: unknown): AbeCiphertext | null;
+/**
+ * Decrypt. Returns the plaintext iff the key's attribute set satisfies the ciphertext's policy AND the
+ * AEAD authenticates; otherwise returns null (never throws). A key missing a required attribute cannot
+ * recover the root secret and therefore cannot derive the content-encryption key.
+ */
+export declare function decrypt(key: DecryptionKey, ciphertext: unknown): Uint8Array | null;
+/** Like {@link decrypt} but returns the plaintext decoded as UTF-8 text, or null. */
+export declare function decryptText(key: DecryptionKey, ciphertext: unknown): string | null;

package/dist/abe.js

@@ -0,0 +1,262 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PcaEncryptionError = exports.ABE_ALG = void 0;
+exports.setup = setup;
+exports.keygenForAttributes = keygenForAttributes;
+exports.keygenForCapability = keygenForCapability;
+exports.encryptForPolicy = encryptForPolicy;
+exports.parseCiphertext = parseCiphertext;
+exports.decrypt = decrypt;
+exports.decryptText = decryptText;
+const pca_1 = require("@atlasauth/pca");
+const bls_1 = require("./bls");
+const ibe_1 = require("./ibe");
+const aead_1 = require("./aead");
+const sss_1 = require("./sss");
+const attributes_1 = require("./attributes");
+const policy_1 = require("./policy");
+const wire_1 = require("./wire");
+const utils_1 = require("@noble/hashes/utils");
+/**
+ * Proof-carrying encryption: Ciphertext-Policy attribute/policy-based encryption built from a
+ * Boneh-Franklin IBE KEM on BLS12-381, composed over a monotone access structure by Shamir
+ * secret-sharing (an LSSS), sealing the payload with AES-256-GCM.
+ *
+ * CONSTRUCTION
+ *   setup()             -> master key pair (s, P_pub = s*g2).
+ *   keygen(attrs)       -> one BF decryption key d_A = s*H1(A) per attribute A the holder owns.
+ *   encrypt(policy, m)  -> pick a random root secret S; share it down the policy's threshold tree with
+ *                          Shamir (AND = n-of-n, OR = 1-of-n, threshold = k-of-n); at each leaf attribute
+ *                          A, BF-encapsulate a fresh KEM key and XOR-mask that leaf's assigned share.
+ *                          The content-encryption key is HKDF(S); the payload is AES-256-GCM sealed with
+ *                          the whole KEM header as AAD.
+ *   decrypt(key, ct)    -> at every leaf the key owns, decapsulate -> unmask that share; interpolate each
+ *                          gate once >= t shares are recovered; recover S iff the key's attribute set
+ *                          satisfies the policy; derive the CEK and open the AEAD. Else fail (null).
+ *
+ * SECURITY PROPERTY (honest)
+ *   Confidentiality holds under the Bilinear Diffie-Hellman assumption on BLS12-381 in the random-oracle
+ *   model (standard BF-IBE), and the Shamir sharing is information-theoretic (fewer than `t` shares of a
+ *   gate reveal nothing about its secret). A holder whose attribute set does NOT satisfy the policy
+ *   cannot recover enough shares to reconstruct S and therefore cannot derive the CEK. Payload and header
+ *   integrity are guaranteed by AES-256-GCM.
+ *
+ *   This is NOT a proof-of-knowledge / NIZK: it binds confidentiality to POSSESSION of capability-derived
+ *   attribute keys, not to a verified proof. Like any IBE-KEM-composed access structure (as opposed to a
+ *   single monolithic CP-ABE with per-key randomisation), it is collusion-resistant only within a single
+ *   issued key: two SEPARATELY issued keys under the same master, each holding part of the required
+ *   attributes, could in principle pool their attribute keys. Atlas issues exactly one key per capability
+ *   (`keygenForCapability`), and decryption is evaluated against that one key's attribute set — so the
+ *   enforced statement is precisely "this capability's authority satisfies the policy".
+ */
+exports.ABE_ALG = 'bf-ibe-bls12381/lsss/aes-256-gcm';
+const CEK_INFO = 'atlas-pca-abe/cek/v1';
+const SALT_LEN = 16;
+class PcaEncryptionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PcaEncryptionError';
+    }
+}
+exports.PcaEncryptionError = PcaEncryptionError;
+// ---- setup / keygen ---------------------------------------------------------------------------
+/** Generate a fresh master key pair. */
+function setup() {
+    const { scalar, bytes } = (0, sss_1.randomSecret)();
+    return {
+        msk: { v: 1, curve: 'bls12-381', s: (0, wire_1.b64u)(bytes) },
+        mpk: { v: 1, curve: 'bls12-381', pPub: (0, wire_1.b64u)((0, ibe_1.masterPublic)(scalar)) },
+    };
+}
+function mskScalar(msk) {
+    const bytes = (0, wire_1.unb64u)(msk?.s);
+    const s = bytes === null ? null : (0, bls_1.bytesToScalar)(bytes);
+    if (s === null || s === 0n)
+        throw new PcaEncryptionError('invalid master secret key');
+    return s;
+}
+/** Issue a decryption key for an explicit set of attribute tokens. */
+function keygenForAttributes(msk, attrs) {
+    const s = mskScalar(msk);
+    const out = {};
+    for (const a of attrs) {
+        if (typeof a === 'string' && a.length > 0)
+            out[a] = (0, wire_1.b64u)((0, ibe_1.keygenAttr)(s, a));
+    }
+    return { v: 1, curve: 'bls12-381', attrs: out };
+}
+/**
+ * Issue a decryption key BOUND to a PCA capability: its attributes are exactly those the (signed)
+ * capability carries — holder, and the verbs/resources/scopes of its policy envelope — optionally
+ * extended with explicit extra tokens. The key can decrypt only ciphertexts whose policy is satisfied
+ * by this capability's authority.
+ */
+function keygenForCapability(msk, capability, extraAttributes = []) {
+    const attrs = (0, attributes_1.capabilityAttributes)(capability);
+    for (const a of extraAttributes)
+        if (typeof a === 'string' && a.length > 0)
+            attrs.add(a);
+    const key = keygenForAttributes(msk, attrs);
+    if (typeof capability.holder === 'string')
+        key.holder = capability.holder;
+    return key;
+}
+// ---- encrypt ----------------------------------------------------------------------------------
+function distribute(mpkPub, node, nodeSecret, salt) {
+    if (node.kind === 'leaf') {
+        const enc = (0, ibe_1.encapsulate)(mpkPub, node.attr, salt);
+        if (enc === null)
+            throw new PcaEncryptionError('invalid master public key');
+        const wrap = (0, wire_1.xorBytes)((0, bls_1.scalarToBytes)(nodeSecret), enc.key);
+        if (wrap === null)
+            throw new PcaEncryptionError('internal: wrap length mismatch');
+        return { kind: 'leaf', attr: node.attr, U: (0, wire_1.b64u)(enc.U), wrap: (0, wire_1.b64u)(wrap) };
+    }
+    const shares = (0, sss_1.splitSecret)(nodeSecret, node.t, node.of.length);
+    const of = [];
+    for (let idx = 0; idx < node.of.length; idx++) {
+        const child = node.of[idx];
+        const share = shares[idx];
+        if (child === undefined || share === undefined)
+            throw new PcaEncryptionError('internal: share/child mismatch');
+        of.push({ i: Number(share.x), sub: distribute(mpkPub, child, share.y, salt) });
+    }
+    return { kind: 'gate', t: node.t, of };
+}
+function aad(c) {
+    return (0, pca_1.canonicalBytes)({ v: c.v, alg: c.alg, salt: c.salt, kem: c.kem });
+}
+/**
+ * Encrypt `plaintext` so that it decrypts only for a holder whose attribute set satisfies `policy`.
+ * Throws {@link PcaEncryptionError} on an invalid policy or master public key.
+ */
+function encryptForPolicy(mpk, policy, plaintext) {
+    const norm = (0, policy_1.normalizePolicy)(policy);
+    if (!norm.ok)
+        throw new PcaEncryptionError(`invalid policy: ${norm.reason}`);
+    const mpkPub = (0, wire_1.unb64u)(mpk?.pPub);
+    if (mpkPub === null)
+        throw new PcaEncryptionError('invalid master public key');
+    const salt = new Uint8Array((0, utils_1.randomBytes)(SALT_LEN));
+    const { scalar: rootSecret, bytes: rootBytes } = (0, sss_1.randomSecret)();
+    const kem = distribute(mpkPub, norm.tree, rootSecret, salt);
+    const header = { v: 1, alg: exports.ABE_ALG, salt: (0, wire_1.b64u)(salt), kem };
+    const cek = (0, bls_1.kdf32)(rootBytes, salt, CEK_INFO);
+    const pt = typeof plaintext === 'string' ? new TextEncoder().encode(plaintext) : plaintext;
+    const sealed = (0, aead_1.seal)(cek, pt, aad(header));
+    return {
+        ciphertext: { ...header, iv: (0, wire_1.b64u)(sealed.iv), ct: (0, wire_1.b64u)(sealed.ct), tag: (0, wire_1.b64u)(sealed.tag) },
+    };
+}
+// ---- decrypt ----------------------------------------------------------------------------------
+function parseKemTree(x, depth) {
+    if (depth > 64 || !(0, wire_1.isObject)(x))
+        return null;
+    if (x.kind === 'leaf') {
+        if (!(0, wire_1.isString)(x.attr) || !(0, wire_1.isString)(x.U) || !(0, wire_1.isString)(x.wrap))
+            return null;
+        if ((0, wire_1.unb64u)(x.U) === null || (0, wire_1.unb64u)(x.wrap) === null)
+            return null;
+        return { kind: 'leaf', attr: x.attr, U: x.U, wrap: x.wrap };
+    }
+    if (x.kind === 'gate') {
+        if (!(0, wire_1.isPosInt)(x.t) || !Array.isArray(x.of) || x.of.length === 0)
+            return null;
+        if (x.t > x.of.length)
+            return null;
+        const of = [];
+        for (const branch of x.of) {
+            if (!(0, wire_1.isObject)(branch) || !(0, wire_1.isPosInt)(branch.i))
+                return null;
+            const sub = parseKemTree(branch.sub, depth + 1);
+            if (sub === null)
+                return null;
+            of.push({ i: branch.i, sub });
+        }
+        return { kind: 'gate', t: x.t, of };
+    }
+    return null;
+}
+/** Validate an untrusted value as an {@link AbeCiphertext}; null (fail-closed) on any deviation. */
+function parseCiphertext(x) {
+    if (!(0, wire_1.isObject)(x) || x.v !== 1 || x.alg !== exports.ABE_ALG)
+        return null;
+    if (!(0, wire_1.isString)(x.salt) || !(0, wire_1.isString)(x.iv) || !(0, wire_1.isString)(x.ct) || !(0, wire_1.isString)(x.tag))
+        return null;
+    if ((0, wire_1.unb64u)(x.salt) === null || (0, wire_1.unb64u)(x.iv) === null || (0, wire_1.unb64u)(x.ct) === null || (0, wire_1.unb64u)(x.tag) === null)
+        return null;
+    const kem = parseKemTree(x.kem, 0);
+    if (kem === null)
+        return null;
+    return { v: 1, alg: exports.ABE_ALG, salt: x.salt, kem, iv: x.iv, ct: x.ct, tag: x.tag };
+}
+function recover(node, keys, salt) {
+    if (node.kind === 'leaf') {
+        const dA = keys.get(node.attr);
+        if (dA === undefined)
+            return null; // the key does not own this attribute: nothing to recover here.
+        const uBytes = (0, wire_1.unb64u)(node.U);
+        const wrapBytes = (0, wire_1.unb64u)(node.wrap);
+        if (uBytes === null || wrapBytes === null)
+            return null;
+        const kemKey = (0, ibe_1.decapsulate)(dA, node.attr, uBytes, salt);
+        if (kemKey === null)
+            return null;
+        const shareBytes = (0, wire_1.xorBytes)(wrapBytes, kemKey);
+        if (shareBytes === null)
+            return null;
+        return (0, bls_1.bytesToScalar)(shareBytes);
+    }
+    const shares = [];
+    for (const branch of node.of) {
+        const y = recover(branch.sub, keys, salt);
+        if (y !== null)
+            shares.push({ x: BigInt(branch.i), y });
+        if (shares.length >= node.t)
+            break; // enough branches recovered; no need to decrypt more.
+    }
+    if (shares.length < node.t)
+        return null;
+    return (0, sss_1.recoverSecret)(shares);
+}
+/**
+ * Decrypt. Returns the plaintext iff the key's attribute set satisfies the ciphertext's policy AND the
+ * AEAD authenticates; otherwise returns null (never throws). A key missing a required attribute cannot
+ * recover the root secret and therefore cannot derive the content-encryption key.
+ */
+function decrypt(key, ciphertext) {
+    const ct = parseCiphertext(ciphertext);
+    if (ct === null)
+        return null;
+    if (!(0, wire_1.isObject)(key) || !(0, wire_1.isObject)(key.attrs))
+        return null;
+    const salt = (0, wire_1.unb64u)(ct.salt);
+    const iv = (0, wire_1.unb64u)(ct.iv);
+    const body = (0, wire_1.unb64u)(ct.ct);
+    const tag = (0, wire_1.unb64u)(ct.tag);
+    if (salt === null || iv === null || body === null || tag === null)
+        return null;
+    // Decode the attribute decryption keys we hold (skip any malformed point: fail-closed per attribute).
+    const keys = new Map();
+    for (const [attr, enc] of Object.entries(key.attrs)) {
+        const bytes = (0, wire_1.unb64u)(enc);
+        if (bytes === null)
+            continue;
+        const pt = (0, bls_1.g1FromBytes)(bytes);
+        if (pt !== null)
+            keys.set(attr, pt);
+    }
+    const rootSecret = recover(ct.kem, keys, salt);
+    if (rootSecret === null)
+        return null; // attribute set does not satisfy the policy.
+    const cek = (0, bls_1.kdf32)((0, bls_1.scalarToBytes)(rootSecret), salt, CEK_INFO);
+    // The AEAD is the final integrity gate: a wrong reconstructed secret (cross-master key / tamper) or a
+    // tampered payload/header yields a null here.
+    return (0, aead_1.open)(cek, { iv, ct: body, tag }, aad(ct));
+}
+/** Like {@link decrypt} but returns the plaintext decoded as UTF-8 text, or null. */
+function decryptText(key, ciphertext) {
+    const pt = decrypt(key, ciphertext);
+    return pt === null ? null : new TextDecoder().decode(pt);
+}
+//# sourceMappingURL=abe.js.map

package/dist/abe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abe.js","sourceRoot":"","sources":["../src/abe.ts"],"names":[],"mappings":";;;AAwGA,sBAMC;AAUD,kDAOC;AAQD,kDAUC;AAoCD,4CAsBC;AA2BD,0CAOC;AAkCD,0BA2BC;AAGD,kCAGC;AAhTD,wCAAiE;AACjE,+BAAuF;AACvF,+BAA2E;AAC3E,iCAAoC;AACpC,+BAA6E;AAC7E,6CAAoD;AACpD,qCAA4E;AAC5E,iCAA8E;AAC9E,+CAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEU,QAAA,OAAO,GAAG,kCAAkC,CAAC;AAC1D,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAiDpB,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED,kGAAkG;AAElG,wCAAwC;AACxC,SAAgB,KAAK;IACnB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,kBAAY,GAAE,CAAC;IACzC,OAAO;QACL,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,IAAA,WAAI,EAAC,KAAK,CAAC,EAAE;QACjD,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAA,WAAI,EAAC,IAAA,kBAAY,EAAC,MAAM,CAAC,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB;IACrC,MAAM,KAAK,GAAG,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,mBAAa,EAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,SAAgB,mBAAmB,CAAC,GAAoB,EAAE,KAAuB;IAC/E,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAA,WAAI,EAAC,IAAA,gBAAU,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,GAAoB,EACpB,UAAsB,EACtB,kBAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,IAAA,iCAAoB,EAAC,UAAU,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,eAAe;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kGAAkG;AAElG,SAAS,UAAU,CACjB,MAAkB,EAClB,IAAmB,EACnB,UAAkB,EAClB,IAAgB;IAEhB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAA,iBAAW,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAA,eAAQ,EAAC,IAAA,mBAAa,EAAC,UAAU,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,CAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAA,WAAI,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAY,IAAA,iBAAW,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,EAAE,GAAkC,EAAE,CAAC;IAC7C,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,CAAC,CAAC;QAC/G,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,GAAG,CAAC,CAAoD;IAC/D,OAAO,IAAA,oBAAc,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,GAAoB,EACpB,MAAc,EACd,SAA8B;IAE9B,MAAM,IAAI,GAAG,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAA,aAAM,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAE/E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAA,mBAAW,EAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,kBAAY,GAAE,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAsD,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,eAAO,EAAE,IAAI,EAAE,IAAA,WAAI,EAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IAChH,MAAM,GAAG,GAAG,IAAA,WAAK,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAE1C,OAAO;QACL,UAAU,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAA,WAAI,EAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,WAAI,EAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAA,WAAI,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE;KAC3F,CAAC;AACJ,CAAC;AAED,kGAAkG;AAElG,SAAS,YAAY,CAAC,CAAU,EAAE,KAAa;IAC7C,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,IAAA,aAAM,EAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAA,aAAM,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,EAAE,GAAkC,EAAE,CAAC;QAC7C,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAA,eAAQ,EAAC,MAAM,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1D,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,SAAgB,eAAe,CAAC,CAAU;IACxC,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,eAAO;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7F,IAAI,IAAA,aAAM,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAA,aAAM,EAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAA,aAAM,EAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAA,aAAM,EAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,eAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,OAAO,CACd,IAAa,EACb,IAAkC,EAClC,IAAgB;IAEhB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,gEAAgE;QACnG,MAAM,MAAM,GAAG,IAAA,aAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,iBAAW,EAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,UAAU,GAAG,IAAA,eAAQ,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAA,mBAAa,EAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;YAAE,MAAM,CAAC,sDAAsD;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAA,mBAAa,EAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAgB,OAAO,CAAC,GAAkB,EAAE,UAAmB;IAC7D,MAAM,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAA,eAAQ,EAAC,GAAG,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,MAAM,IAAI,GAAG,IAAA,aAAM,EAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAA,aAAM,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAA,aAAM,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAA,aAAM,EAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/E,sGAAsG;IACtG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAA,aAAM,EAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,EAAE,GAAG,IAAA,iBAAW,EAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAEnF,MAAM,GAAG,GAAG,IAAA,WAAK,EAAC,IAAA,mBAAa,EAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7D,sGAAsG;IACtG,8CAA8C;IAC9C,OAAO,IAAA,WAAI,EAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,SAAgB,WAAW,CAAC,GAAkB,EAAE,UAAmB;IACjE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpC,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/aead.d.ts

@@ -0,0 +1,12 @@
+export interface Sealed {
+    iv: Uint8Array;
+    ct: Uint8Array;
+    tag: Uint8Array;
+}
+/** AES-256-GCM seal. `key` must be 32 bytes. A fresh random 96-bit IV is used per call. */
+export declare function seal(key: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Sealed;
+/**
+ * AES-256-GCM open. Returns the plaintext, or null (never throws) if the key is wrong, the tag/AAD does
+ * not authenticate, or any field is malformed.
+ */
+export declare function open(key: Uint8Array, sealed: Sealed, aad: Uint8Array): Uint8Array | null;

package/dist/aead.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.seal = seal;
+exports.open = open;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Authenticated symmetric encryption: AES-256-GCM (via `node:crypto`). The content-encryption key is
+ * derived from the ABE/KEM layer; this module only turns a 32-byte key into a sealed payload and back.
+ * The ABE header is passed as Additional Authenticated Data so any tampering with the policy or the KEM
+ * ciphertext — not just the payload — fails the GCM tag.
+ */
+const IV_LEN = 12;
+const TAG_LEN = 16;
+/** AES-256-GCM seal. `key` must be 32 bytes. A fresh random 96-bit IV is used per call. */
+function seal(key, plaintext, aad) {
+    if (key.length !== 32)
+        throw new RangeError('aead.seal: key must be 32 bytes');
+    const iv = new Uint8Array((0, node_crypto_1.randomBytes)(IV_LEN));
+    const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', key, iv);
+    cipher.setAAD(aad);
+    const ct = new Uint8Array(Buffer.concat([cipher.update(plaintext), cipher.final()]));
+    const tag = new Uint8Array(cipher.getAuthTag());
+    return { iv, ct, tag };
+}
+/**
+ * AES-256-GCM open. Returns the plaintext, or null (never throws) if the key is wrong, the tag/AAD does
+ * not authenticate, or any field is malformed.
+ */
+function open(key, sealed, aad) {
+    if (key.length !== 32 || sealed.iv.length !== IV_LEN || sealed.tag.length !== TAG_LEN)
+        return null;
+    try {
+        const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, sealed.iv);
+        decipher.setAAD(aad);
+        decipher.setAuthTag(sealed.tag);
+        return new Uint8Array(Buffer.concat([decipher.update(sealed.ct), decipher.final()]));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=aead.js.map

package/dist/aead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.js","sourceRoot":"","sources":["../src/aead.ts"],"names":[],"mappings":";;AAmBA,oBAQC;AAMD,oBAUC;AA3CD,6CAA4E;AAE5E;;;;;GAKG;AAEH,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AAQnB,2FAA2F;AAC3F,SAAgB,IAAI,CAAC,GAAe,EAAE,SAAqB,EAAE,GAAe;IAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,iCAAiC,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,IAAA,yBAAW,EAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,IAAI,CAAC,GAAe,EAAE,MAAc,EAAE,GAAe;IACnE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACnG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/attributes.d.ts

@@ -0,0 +1,30 @@
+import { type Capability } from '@atlasauth/pca';
+/**
+ * Canonical attribute strings derived from a real PCA capability (see `@atlasauth/pca`'s `Capability`
+ * and the signed policy `Envelope`). An "attribute" is a lowercase `kind:value` token; a policy
+ * references attributes by exactly these tokens, and `keygenForCapability` issues one BF-IBE decryption
+ * key per token the capability carries.
+ *
+ * Four kinds are derived, matching the capability's authority surface (verb / resource / scopes /
+ * holder):
+ *   - `holder:<b64u key>`   the key the capability is bound to (`capability.holder`),
+ *   - `verb:<v>`            every literal verb named in the signed envelope's predicates,
+ *   - `resource:<r>`        every resource matcher named in those predicates,
+ *   - `scope:<s>`           every scope carried in a `{ type:'scope', value }` or
+ *                           `{ type:'scopes', values:[...] }` caveat.
+ *
+ * Because the envelope and caveats are SIGNED into the capability (and attenuation is append-only), the
+ * attribute set a capability yields cannot be widened by a holder — it is exactly what the principal
+ * authorised.
+ */
+export declare const Attr: {
+    readonly holder: (key: string) => string;
+    readonly verb: (v: string) => string;
+    readonly resource: (r: string) => string;
+    readonly scope: (s: string) => string;
+};
+/**
+ * Derive the canonical attribute set a capability possesses. Deterministic and total (never throws): a
+ * capability with no signed envelope still yields its `holder:` attribute (plus any scope caveats).
+ */
+export declare function capabilityAttributes(cap: Capability): Set<string>;

package/dist/attributes.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Attr = void 0;
+exports.capabilityAttributes = capabilityAttributes;
+const pca_1 = require("@atlasauth/pca");
+/**
+ * Canonical attribute strings derived from a real PCA capability (see `@atlasauth/pca`'s `Capability`
+ * and the signed policy `Envelope`). An "attribute" is a lowercase `kind:value` token; a policy
+ * references attributes by exactly these tokens, and `keygenForCapability` issues one BF-IBE decryption
+ * key per token the capability carries.
+ *
+ * Four kinds are derived, matching the capability's authority surface (verb / resource / scopes /
+ * holder):
+ *   - `holder:<b64u key>`   the key the capability is bound to (`capability.holder`),
+ *   - `verb:<v>`            every literal verb named in the signed envelope's predicates,
+ *   - `resource:<r>`        every resource matcher named in those predicates,
+ *   - `scope:<s>`           every scope carried in a `{ type:'scope', value }` or
+ *                           `{ type:'scopes', values:[...] }` caveat.
+ *
+ * Because the envelope and caveats are SIGNED into the capability (and attenuation is append-only), the
+ * attribute set a capability yields cannot be widened by a holder — it is exactly what the principal
+ * authorised.
+ */
+exports.Attr = {
+    holder: (key) => `holder:${key}`,
+    verb: (v) => `verb:${v}`,
+    resource: (r) => `resource:${r}`,
+    scope: (s) => `scope:${s}`,
+};
+function addVerb(out, verb) {
+    if (typeof verb === 'string')
+        out.add(exports.Attr.verb(verb));
+    else if (Array.isArray(verb))
+        for (const v of verb)
+            if (typeof v === 'string')
+                out.add(exports.Attr.verb(v));
+}
+function addScopes(out, caveats) {
+    for (const cv of caveats) {
+        if (cv.type === 'scope' && typeof cv.value === 'string')
+            out.add(exports.Attr.scope(cv.value));
+        if (cv.type === 'scopes' && Array.isArray(cv.values)) {
+            for (const s of cv.values)
+                if (typeof s === 'string')
+                    out.add(exports.Attr.scope(s));
+        }
+    }
+}
+/**
+ * Derive the canonical attribute set a capability possesses. Deterministic and total (never throws): a
+ * capability with no signed envelope still yields its `holder:` attribute (plus any scope caveats).
+ */
+function capabilityAttributes(cap) {
+    const out = new Set();
+    if (typeof cap.holder === 'string' && cap.holder.length > 0)
+        out.add(exports.Attr.holder(cap.holder));
+    if (Array.isArray(cap.caveats))
+        addScopes(out, cap.caveats);
+    const env = (0, pca_1.readEnvelope)(cap);
+    if (env !== null && Array.isArray(env.predicates)) {
+        for (const p of env.predicates) {
+            if (p === null || typeof p !== 'object')
+                continue;
+            addVerb(out, p.verb);
+            const r = p.resource;
+            if (typeof r === 'string')
+                out.add(exports.Attr.resource(r));
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=attributes.js.map

package/dist/attributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes.js","sourceRoot":"","sources":["../src/attributes.ts"],"names":[],"mappings":";;;AA8CA,oDAcC;AA5DD,wCAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AAEU,QAAA,IAAI,GAAG;IAClB,MAAM,EAAE,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,GAAG,EAAE;IAChD,IAAI,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,YAAY,CAAC,EAAE;IAChD,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,SAAS,CAAC,EAAE;CAClC,CAAC;AAEX,SAAS,OAAO,CAAC,GAAgB,EAAE,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAClD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAA0D;IAC7F,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,GAAe;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAClD,OAAO,CAAC,GAAG,EAAG,CAAwB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAI,CAA4B,CAAC,QAAQ,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/bls.d.ts

@@ -0,0 +1,52 @@
+import { bls12_381 } from '@noble/curves/bls12-381';
+/**
+ * Low-level BLS12-381 helpers for the ABE scheme. All group/field work goes through `@noble/curves`'s
+ * audited `bls12_381` implementation (G1/G2/GT, the ate pairing, RFC 9380 hash-to-curve); nothing here
+ * re-implements field or point arithmetic.
+ *
+ * Group placement (type-3 / asymmetric pairing `e: G1 x G2 -> GT`):
+ *   - attribute identity points `Q_attr = H1(attr)` live in G1 (hash-to-curve),
+ *   - the master public `P_pub = s * g2` and ephemerals `U = x * g2` live in G2,
+ *   - decryption keys `d_attr = s * Q_attr` live in G1,
+ *   - KEM secrets live in GT.
+ */
+/** Curve subgroup (scalar field) order r — a 255-bit prime, so every scalar fits in 32 bytes. */
+export declare const R: bigint;
+/** The fixed G2 generator the whole system is parameterised over. */
+export declare const G2_BASE: import("@noble/curves/abstract/weierstrass").ProjPointType<import("@noble/curves/abstract/tower").Fp2>;
+export type G1Point = ReturnType<typeof bls12_381.G1.ProjectivePoint.fromAffine>;
+export type G2Point = ReturnType<typeof bls12_381.G2.ProjectivePoint.fromAffine>;
+/** Reduce a bigint into the canonical scalar field Z_r. */
+export declare function frCreate(n: bigint): bigint;
+export declare function frAdd(a: bigint, b: bigint): bigint;
+export declare function frSub(a: bigint, b: bigint): bigint;
+export declare function frMul(a: bigint, b: bigint): bigint;
+export declare function frInv(a: bigint): bigint;
+/** A uniformly random NON-ZERO scalar in Z_r (48 bytes of entropy reduced mod r — negligible bias). */
+export declare function randomScalar(): bigint;
+/** Fixed 32-byte big-endian encoding of a scalar (r < 2^255, so 32 bytes always suffice). */
+export declare function scalarToBytes(v: bigint): Uint8Array;
+/** Decode a 32-byte big-endian scalar back into Z_r. Returns null if not exactly 32 bytes. */
+export declare function bytesToScalar(bytes: Uint8Array): bigint | null;
+/** Hash an attribute string to its identity point `Q_attr` in G1 (prime-order subgroup, RO model). */
+export declare function hashAttrToG1(attr: string): G1Point;
+/** Scalar-multiply a G1 point. */
+export declare function g1Mul(p: G1Point, k: bigint): G1Point;
+/** Scalar-multiply a G2 point. */
+export declare function g2Mul(p: G2Point, k: bigint): G2Point;
+/** Serialise a G1 point (compressed, 48 bytes). */
+export declare function g1ToBytes(p: G1Point): Uint8Array;
+/** Serialise a G2 point (compressed, 96 bytes). */
+export declare function g2ToBytes(p: G2Point): Uint8Array;
+/** Parse a compressed G1 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+export declare function g1FromBytes(bytes: Uint8Array): G1Point | null;
+/** Parse a compressed G2 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+export declare function g2FromBytes(bytes: Uint8Array): G2Point | null;
+/** The (final-exponentiated) ate pairing `e(P, Q)` in GT. */
+export declare function pairing(p: G1Point, q: G2Point): ReturnType<typeof bls12_381.pairing>;
+/** Raise a GT element to a scalar power. */
+export declare function gtPow(gt: ReturnType<typeof bls12_381.pairing>, k: bigint): ReturnType<typeof bls12_381.pairing>;
+/** Canonical byte serialisation of a GT element (576 bytes) — the KEM secret material fed into the KDF. */
+export declare function gtToBytes(gt: ReturnType<typeof bls12_381.pairing>): Uint8Array;
+/** HKDF-SHA256 to exactly 32 bytes, with explicit salt + info domain separation. */
+export declare function kdf32(ikm: Uint8Array, salt: Uint8Array, info: string): Uint8Array;