@atlasauth/pca-abe 0.0.0-stage → 0.2.0

package/dist/attributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes.js","sourceRoot":"","sources":["../src/attributes.ts"],"names":[],"mappings":";;;AA8CA,oDAcC;AA5DD,wCAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AAEU,QAAA,IAAI,GAAG;IAClB,MAAM,EAAE,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,GAAG,EAAE;IAChD,IAAI,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,YAAY,CAAC,EAAE;IAChD,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,SAAS,CAAC,EAAE;CAClC,CAAC;AAEX,SAAS,OAAO,CAAC,GAAgB,EAAE,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAClD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAA0D;IAC7F,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,GAAe;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAClD,OAAO,CAAC,GAAG,EAAG,CAAwB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAI,CAA4B,CAAC,QAAQ,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/bls.d.ts

@@ -0,0 +1,52 @@
+import { bls12_381 } from '@noble/curves/bls12-381';
+/**
+ * Low-level BLS12-381 helpers for the ABE scheme. All group/field work goes through `@noble/curves`'s
+ * audited `bls12_381` implementation (G1/G2/GT, the ate pairing, RFC 9380 hash-to-curve); nothing here
+ * re-implements field or point arithmetic.
+ *
+ * Group placement (type-3 / asymmetric pairing `e: G1 x G2 -> GT`):
+ *   - attribute identity points `Q_attr = H1(attr)` live in G1 (hash-to-curve),
+ *   - the master public `P_pub = s * g2` and ephemerals `U = x * g2` live in G2,
+ *   - decryption keys `d_attr = s * Q_attr` live in G1,
+ *   - KEM secrets live in GT.
+ */
+/** Curve subgroup (scalar field) order r — a 255-bit prime, so every scalar fits in 32 bytes. */
+export declare const R: bigint;
+/** The fixed G2 generator the whole system is parameterised over. */
+export declare const G2_BASE: import("@noble/curves/abstract/weierstrass").ProjPointType<import("@noble/curves/abstract/tower").Fp2>;
+export type G1Point = ReturnType<typeof bls12_381.G1.ProjectivePoint.fromAffine>;
+export type G2Point = ReturnType<typeof bls12_381.G2.ProjectivePoint.fromAffine>;
+/** Reduce a bigint into the canonical scalar field Z_r. */
+export declare function frCreate(n: bigint): bigint;
+export declare function frAdd(a: bigint, b: bigint): bigint;
+export declare function frSub(a: bigint, b: bigint): bigint;
+export declare function frMul(a: bigint, b: bigint): bigint;
+export declare function frInv(a: bigint): bigint;
+/** A uniformly random NON-ZERO scalar in Z_r (48 bytes of entropy reduced mod r — negligible bias). */
+export declare function randomScalar(): bigint;
+/** Fixed 32-byte big-endian encoding of a scalar (r < 2^255, so 32 bytes always suffice). */
+export declare function scalarToBytes(v: bigint): Uint8Array;
+/** Decode a 32-byte big-endian scalar back into Z_r. Returns null if not exactly 32 bytes. */
+export declare function bytesToScalar(bytes: Uint8Array): bigint | null;
+/** Hash an attribute string to its identity point `Q_attr` in G1 (prime-order subgroup, RO model). */
+export declare function hashAttrToG1(attr: string): G1Point;
+/** Scalar-multiply a G1 point. */
+export declare function g1Mul(p: G1Point, k: bigint): G1Point;
+/** Scalar-multiply a G2 point. */
+export declare function g2Mul(p: G2Point, k: bigint): G2Point;
+/** Serialise a G1 point (compressed, 48 bytes). */
+export declare function g1ToBytes(p: G1Point): Uint8Array;
+/** Serialise a G2 point (compressed, 96 bytes). */
+export declare function g2ToBytes(p: G2Point): Uint8Array;
+/** Parse a compressed G1 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+export declare function g1FromBytes(bytes: Uint8Array): G1Point | null;
+/** Parse a compressed G2 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+export declare function g2FromBytes(bytes: Uint8Array): G2Point | null;
+/** The (final-exponentiated) ate pairing `e(P, Q)` in GT. */
+export declare function pairing(p: G1Point, q: G2Point): ReturnType<typeof bls12_381.pairing>;
+/** Raise a GT element to a scalar power. */
+export declare function gtPow(gt: ReturnType<typeof bls12_381.pairing>, k: bigint): ReturnType<typeof bls12_381.pairing>;
+/** Canonical byte serialisation of a GT element (576 bytes) — the KEM secret material fed into the KDF. */
+export declare function gtToBytes(gt: ReturnType<typeof bls12_381.pairing>): Uint8Array;
+/** HKDF-SHA256 to exactly 32 bytes, with explicit salt + info domain separation. */
+export declare function kdf32(ikm: Uint8Array, salt: Uint8Array, info: string): Uint8Array;

package/dist/bls.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.G2_BASE = exports.R = void 0;
+exports.frCreate = frCreate;
+exports.frAdd = frAdd;
+exports.frSub = frSub;
+exports.frMul = frMul;
+exports.frInv = frInv;
+exports.randomScalar = randomScalar;
+exports.scalarToBytes = scalarToBytes;
+exports.bytesToScalar = bytesToScalar;
+exports.hashAttrToG1 = hashAttrToG1;
+exports.g1Mul = g1Mul;
+exports.g2Mul = g2Mul;
+exports.g1ToBytes = g1ToBytes;
+exports.g2ToBytes = g2ToBytes;
+exports.g1FromBytes = g1FromBytes;
+exports.g2FromBytes = g2FromBytes;
+exports.pairing = pairing;
+exports.gtPow = gtPow;
+exports.gtToBytes = gtToBytes;
+exports.kdf32 = kdf32;
+const bls12_381_1 = require("@noble/curves/bls12-381");
+const utils_1 = require("@noble/curves/abstract/utils");
+const hkdf_1 = require("@noble/hashes/hkdf");
+const sha256_1 = require("@noble/hashes/sha256");
+const utils_2 = require("@noble/hashes/utils");
+/**
+ * Low-level BLS12-381 helpers for the ABE scheme. All group/field work goes through `@noble/curves`'s
+ * audited `bls12_381` implementation (G1/G2/GT, the ate pairing, RFC 9380 hash-to-curve); nothing here
+ * re-implements field or point arithmetic.
+ *
+ * Group placement (type-3 / asymmetric pairing `e: G1 x G2 -> GT`):
+ *   - attribute identity points `Q_attr = H1(attr)` live in G1 (hash-to-curve),
+ *   - the master public `P_pub = s * g2` and ephemerals `U = x * g2` live in G2,
+ *   - decryption keys `d_attr = s * Q_attr` live in G1,
+ *   - KEM secrets live in GT.
+ */
+/** Curve subgroup (scalar field) order r — a 255-bit prime, so every scalar fits in 32 bytes. */
+exports.R = bls12_381_1.bls12_381.params.r;
+const Fr = bls12_381_1.bls12_381.fields.Fr;
+const Fp12 = bls12_381_1.bls12_381.fields.Fp12;
+/** Domain-separation tag for hashing an attribute string to a point in G1 (RFC 9380 SSWU_RO). */
+const ATTR_DST = 'ATLAS-PCA-ABE:BF-IBE:G1:SHA256-SSWU-RO:v1';
+/** The fixed G2 generator the whole system is parameterised over. */
+exports.G2_BASE = bls12_381_1.bls12_381.G2.ProjectivePoint.BASE;
+// ---- field scalars (Z_r) --------------------------------------------------------------------
+/** Reduce a bigint into the canonical scalar field Z_r. */
+function frCreate(n) {
+    return Fr.create(n);
+}
+function frAdd(a, b) {
+    return Fr.add(a, b);
+}
+function frSub(a, b) {
+    return Fr.sub(a, b);
+}
+function frMul(a, b) {
+    return Fr.mul(a, b);
+}
+function frInv(a) {
+    return Fr.inv(a);
+}
+/** A uniformly random NON-ZERO scalar in Z_r (48 bytes of entropy reduced mod r — negligible bias). */
+function randomScalar() {
+    for (;;) {
+        const v = Fr.create((0, utils_1.bytesToNumberBE)((0, utils_2.randomBytes)(48)));
+        if (v !== 0n)
+            return v;
+    }
+}
+/** Fixed 32-byte big-endian encoding of a scalar (r < 2^255, so 32 bytes always suffice). */
+function scalarToBytes(v) {
+    return (0, utils_1.numberToBytesBE)(Fr.create(v), 32);
+}
+/** Decode a 32-byte big-endian scalar back into Z_r. Returns null if not exactly 32 bytes. */
+function bytesToScalar(bytes) {
+    if (bytes.length !== 32)
+        return null;
+    return Fr.create((0, utils_1.bytesToNumberBE)(bytes));
+}
+// ---- points ---------------------------------------------------------------------------------
+/** Hash an attribute string to its identity point `Q_attr` in G1 (prime-order subgroup, RO model). */
+function hashAttrToG1(attr) {
+    const msg = new TextEncoder().encode(attr);
+    const h = bls12_381_1.bls12_381.G1.hashToCurve(msg, { DST: ATTR_DST });
+    // Normalise the hash-to-curve result into a ProjectivePoint so the full (de)serialisation API is available.
+    return bls12_381_1.bls12_381.G1.ProjectivePoint.fromAffine(h.toAffine());
+}
+/** Scalar-multiply a G1 point. */
+function g1Mul(p, k) {
+    return p.multiply(Fr.create(k));
+}
+/** Scalar-multiply a G2 point. */
+function g2Mul(p, k) {
+    return p.multiply(Fr.create(k));
+}
+/** Serialise a G1 point (compressed, 48 bytes). */
+function g1ToBytes(p) {
+    return p.toRawBytes(true);
+}
+/** Serialise a G2 point (compressed, 96 bytes). */
+function g2ToBytes(p) {
+    return p.toRawBytes(true);
+}
+/** Parse a compressed G1 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+function g1FromBytes(bytes) {
+    try {
+        const p = bls12_381_1.bls12_381.G1.ProjectivePoint.fromHex(bytes);
+        p.assertValidity();
+        return p;
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse a compressed G2 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+function g2FromBytes(bytes) {
+    try {
+        const p = bls12_381_1.bls12_381.G2.ProjectivePoint.fromHex(bytes);
+        p.assertValidity();
+        return p;
+    }
+    catch {
+        return null;
+    }
+}
+// ---- pairing / GT ---------------------------------------------------------------------------
+/** The (final-exponentiated) ate pairing `e(P, Q)` in GT. */
+function pairing(p, q) {
+    return bls12_381_1.bls12_381.pairing(p, q, true);
+}
+/** Raise a GT element to a scalar power. */
+function gtPow(gt, k) {
+    return Fp12.pow(gt, Fr.create(k));
+}
+/** Canonical byte serialisation of a GT element (576 bytes) — the KEM secret material fed into the KDF. */
+function gtToBytes(gt) {
+    return Fp12.toBytes(gt);
+}
+// ---- symmetric KDF --------------------------------------------------------------------------
+/** HKDF-SHA256 to exactly 32 bytes, with explicit salt + info domain separation. */
+function kdf32(ikm, salt, info) {
+    return (0, hkdf_1.hkdf)(sha256_1.sha256, ikm, salt, new TextEncoder().encode(info), 32);
+}
+//# sourceMappingURL=bls.js.map

package/dist/bls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bls.js","sourceRoot":"","sources":["../src/bls.ts"],"names":[],"mappings":";;;AAoCA,4BAEC;AAED,sBAEC;AAED,sBAEC;AAED,sBAEC;AAED,sBAEC;AAGD,oCAKC;AAGD,sCAEC;AAGD,sCAGC;AAKD,oCAKC;AAGD,sBAEC;AAGD,sBAEC;AAGD,8BAEC;AAGD,8BAEC;AAGD,kCAQC;AAGD,kCAQC;AAKD,0BAEC;AAGD,sBAEC;AAGD,8BAEC;AAKD,sBAEC;AArJD,uDAAoD;AACpD,wDAAgF;AAChF,6CAA0C;AAC1C,iDAA8C;AAC9C,+CAAkD;AAElD;;;;;;;;;;GAUG;AAEH,iGAAiG;AACpF,QAAA,CAAC,GAAW,qBAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,MAAM,EAAE,GAAG,qBAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/B,MAAM,IAAI,GAAG,qBAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AAEnC,iGAAiG;AACjG,MAAM,QAAQ,GAAG,2CAA2C,CAAC;AAE7D,qEAAqE;AACxD,QAAA,OAAO,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAKzD,gGAAgG;AAEhG,2DAA2D;AAC3D,SAAgB,QAAQ,CAAC,CAAS;IAChC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS;IAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,SAAgB,YAAY;IAC1B,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAA,uBAAe,EAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,aAAa,CAAC,CAAS;IACrC,OAAO,IAAA,uBAAe,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,8FAA8F;AAC9F,SAAgB,aAAa,CAAC,KAAiB;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAEhG,sGAAsG;AACtG,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,4GAA4G;IAC5G,OAAO,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,kCAAkC;AAClC,SAAgB,KAAK,CAAC,CAAU,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,kCAAkC;AAClC,SAAgB,KAAK,CAAC,CAAU,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,mDAAmD;AACnD,SAAgB,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,mDAAmD;AACnD,SAAgB,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,4GAA4G;AAC5G,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gGAAgG;AAEhG,6DAA6D;AAC7D,SAAgB,OAAO,CAAC,CAAU,EAAE,CAAU;IAC5C,OAAO,qBAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,4CAA4C;AAC5C,SAAgB,KAAK,CAAC,EAAwC,EAAE,CAAS;IACvE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,2GAA2G;AAC3G,SAAgB,SAAS,CAAC,EAAwC;IAChE,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAEhG,oFAAoF;AACpF,SAAgB,KAAK,CAAC,GAAe,EAAE,IAAgB,EAAE,IAAY;IACnE,OAAO,IAAA,WAAI,EAAC,eAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/ibe.d.ts

@@ -0,0 +1,24 @@
+import { type G1Point } from './bls';
+/** A per-leaf encapsulation: the ephemeral `U` (G2, compressed) that pins the derived KEM key. */
+export interface Encapsulation {
+    /** Compressed G2 ephemeral `U = x * g2`. */
+    U: Uint8Array;
+    /** 32-byte symmetric key derived from the GT secret (encryptor side). */
+    key: Uint8Array;
+}
+/** Compute `P_pub = s * g2` (the master public element) for master secret `s`. */
+export declare function masterPublic(s: bigint): Uint8Array;
+/** Issue the BF decryption key `d_A = s * H1(A)` (G1, compressed) for attribute `A`. */
+export declare function keygenAttr(s: bigint, attr: string): Uint8Array;
+/**
+ * Encapsulate to attribute `A` under master public `pPubBytes`. Returns the ephemeral `U` and the
+ * 32-byte KEM key. `salt` is the ciphertext-wide HKDF salt (bound into every derived key). Returns null
+ * only if `pPubBytes` is not a valid G2 point.
+ */
+export declare function encapsulate(pPubBytes: Uint8Array, attr: string, salt: Uint8Array): Encapsulation | null;
+/**
+ * Decapsulate: recover the 32-byte KEM key from decryption key `dA` (G1) and ephemeral `uBytes` (G2).
+ * Returns null (fail-closed) if either point is malformed. The attribute string must match the one used
+ * at encapsulation (it is bound into the KDF).
+ */
+export declare function decapsulate(dA: G1Point, attr: string, uBytes: Uint8Array, salt: Uint8Array): Uint8Array | null;

package/dist/ibe.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.masterPublic = masterPublic;
+exports.keygenAttr = keygenAttr;
+exports.encapsulate = encapsulate;
+exports.decapsulate = decapsulate;
+const bls_1 = require("./bls");
+/**
+ * Boneh-Franklin Identity-Based Encryption as a Key-Encapsulation Mechanism (BF-IBE KEM) on BLS12-381.
+ *
+ * Treat each ATTRIBUTE string as a BF "identity". For master secret `s` and public `P_pub = s * g2`:
+ *   - the decryption key for attribute `A` is `d_A = s * H1(A)` in G1 (issued by `keygen`),
+ *   - encapsulation to `A` picks a fresh ephemeral `x`, publishes `U = x * g2` in G2, and derives the
+ *     shared GT secret `K_GT = e(H1(A), P_pub)^x = e(H1(A), g2)^{s*x}`,
+ *   - decapsulation with `d_A` recomputes `K_GT = e(d_A, U) = e(s*H1(A), x*g2) = e(H1(A), g2)^{s*x}`.
+ *
+ * The two sides agree, and a holder WITHOUT `d_A` cannot compute `K_GT` without solving Bilinear
+ * Diffie-Hellman. The GT secret is run through HKDF-SHA256 (modelled as a random oracle) to a 32-byte
+ * symmetric key that masks the payload share.
+ *
+ * SECURITY: confidentiality holds under the Bilinear Diffie-Hellman assumption in the random-oracle
+ * model (standard BF-IBE). This is NOT a proof of knowledge / NIZK: it binds confidentiality to
+ * possession of attribute keys, not to an interactive or non-interactive proof.
+ */
+const KEM_KDF_INFO = 'atlas-pca-abe/kem/v1';
+/** Compute `P_pub = s * g2` (the master public element) for master secret `s`. */
+function masterPublic(s) {
+    return (0, bls_1.g2ToBytes)((0, bls_1.g2Mul)(bls_1.G2_BASE, s));
+}
+/** Issue the BF decryption key `d_A = s * H1(A)` (G1, compressed) for attribute `A`. */
+function keygenAttr(s, attr) {
+    const qA = (0, bls_1.hashAttrToG1)(attr);
+    return (0, bls_1.g1ToBytes)(qA.multiply(s));
+}
+function kemKey(gtBytes, salt, attr, uBytes) {
+    // Bind the derived key to BOTH the attribute and the specific ephemeral so a key cannot be replayed
+    // across attributes or ciphertexts even if (hypothetically) a GT value repeated.
+    const info = `${KEM_KDF_INFO}|${attr}|${Buffer.from(uBytes).toString('base64url')}`;
+    return (0, bls_1.kdf32)(gtBytes, salt, info);
+}
+/**
+ * Encapsulate to attribute `A` under master public `pPubBytes`. Returns the ephemeral `U` and the
+ * 32-byte KEM key. `salt` is the ciphertext-wide HKDF salt (bound into every derived key). Returns null
+ * only if `pPubBytes` is not a valid G2 point.
+ */
+function encapsulate(pPubBytes, attr, salt) {
+    const pPub = (0, bls_1.g2FromBytes)(pPubBytes);
+    if (pPub === null)
+        return null;
+    const qA = (0, bls_1.hashAttrToG1)(attr);
+    const x = (0, bls_1.randomScalar)();
+    const uBytes = (0, bls_1.g2ToBytes)((0, bls_1.g2Mul)(bls_1.G2_BASE, x));
+    // K_GT = e(Q_A, P_pub)^x
+    const kGt = (0, bls_1.gtPow)((0, bls_1.pairing)(qA, pPub), x);
+    const key = kemKey((0, bls_1.gtToBytes)(kGt), salt, attr, uBytes);
+    return { U: uBytes, key };
+}
+/**
+ * Decapsulate: recover the 32-byte KEM key from decryption key `dA` (G1) and ephemeral `uBytes` (G2).
+ * Returns null (fail-closed) if either point is malformed. The attribute string must match the one used
+ * at encapsulation (it is bound into the KDF).
+ */
+function decapsulate(dA, attr, uBytes, salt) {
+    const U = (0, bls_1.g2FromBytes)(uBytes);
+    if (U === null)
+        return null;
+    // K_GT = e(d_A, U)
+    const kGt = (0, bls_1.pairing)(dA, U);
+    return kemKey((0, bls_1.gtToBytes)(kGt), salt, attr, uBytes);
+}
+//# sourceMappingURL=ibe.js.map

package/dist/ibe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ibe.js","sourceRoot":"","sources":["../src/ibe.ts"],"names":[],"mappings":";;AA4CA,oCAEC;AAGD,gCAGC;AAcD,kCAUC;AAOD,kCAMC;AAzFD,+BAae;AAEf;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAU5C,kFAAkF;AAClF,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,IAAA,eAAS,EAAC,IAAA,WAAK,EAAC,aAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,wFAAwF;AACxF,SAAgB,UAAU,CAAC,CAAS,EAAE,IAAY;IAChD,MAAM,EAAE,GAAG,IAAA,kBAAY,EAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAA,eAAS,EAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,OAAmB,EAAE,IAAgB,EAAE,IAAY,EAAE,MAAkB;IACrF,oGAAoG;IACpG,iFAAiF;IACjF,MAAM,IAAI,GAAG,GAAG,YAAY,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACpF,OAAO,IAAA,WAAK,EAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,SAAqB,EAAE,IAAY,EAAE,IAAgB;IAC/E,MAAM,IAAI,GAAG,IAAA,iBAAW,EAAC,SAAS,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,EAAE,GAAG,IAAA,kBAAY,EAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAA,kBAAY,GAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAA,eAAS,EAAC,IAAA,WAAK,EAAC,aAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,yBAAyB;IACzB,MAAM,GAAG,GAAG,IAAA,WAAK,EAAC,IAAA,aAAO,EAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAA,eAAS,EAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,EAAW,EAAE,IAAY,EAAE,MAAkB,EAAE,IAAgB;IACzF,MAAM,CAAC,GAAG,IAAA,iBAAW,EAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,mBAAmB;IACnB,MAAM,GAAG,GAAG,IAAA,aAAO,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,IAAA,eAAS,EAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @atlasauth/pca-abe — proof-carrying encryption.
+ *
+ * Ciphertext-policy attribute/policy-based encryption on BLS12-381 (a Boneh-Franklin IBE KEM composed
+ * over a monotone access structure by Shamir secret sharing, sealed with AES-256-GCM) so a tool payload
+ * or result decrypts ONLY for a holder whose PCA capability satisfies the policy. See `abe.ts` for the
+ * full construction and security property.
+ */
+export { ABE_ALG, PcaEncryptionError, setup, keygenForAttributes, keygenForCapability, encryptForPolicy, decrypt, decryptText, parseCiphertext, type MasterPublicKey, type MasterSecretKey, type DecryptionKey, type AbeCiphertext, type KemTree, } from './abe';
+export { encryptToolPayload, decryptWithCapability, type DecryptedPayload } from './pca';
+export { normalizePolicy, satisfies, policyAttributes, MAX_POLICY_NODES, type Policy, type ThresholdTree, type PolicyResult, } from './policy';
+export { Attr, capabilityAttributes } from './attributes';

package/dist/index.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * @atlasauth/pca-abe — proof-carrying encryption.
+ *
+ * Ciphertext-policy attribute/policy-based encryption on BLS12-381 (a Boneh-Franklin IBE KEM composed
+ * over a monotone access structure by Shamir secret sharing, sealed with AES-256-GCM) so a tool payload
+ * or result decrypts ONLY for a holder whose PCA capability satisfies the policy. See `abe.ts` for the
+ * full construction and security property.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capabilityAttributes = exports.Attr = exports.MAX_POLICY_NODES = exports.policyAttributes = exports.satisfies = exports.normalizePolicy = exports.decryptWithCapability = exports.encryptToolPayload = exports.parseCiphertext = exports.decryptText = exports.decrypt = exports.encryptForPolicy = exports.keygenForCapability = exports.keygenForAttributes = exports.setup = exports.PcaEncryptionError = exports.ABE_ALG = void 0;
+var abe_1 = require("./abe");
+Object.defineProperty(exports, "ABE_ALG", { enumerable: true, get: function () { return abe_1.ABE_ALG; } });
+Object.defineProperty(exports, "PcaEncryptionError", { enumerable: true, get: function () { return abe_1.PcaEncryptionError; } });
+Object.defineProperty(exports, "setup", { enumerable: true, get: function () { return abe_1.setup; } });
+Object.defineProperty(exports, "keygenForAttributes", { enumerable: true, get: function () { return abe_1.keygenForAttributes; } });
+Object.defineProperty(exports, "keygenForCapability", { enumerable: true, get: function () { return abe_1.keygenForCapability; } });
+Object.defineProperty(exports, "encryptForPolicy", { enumerable: true, get: function () { return abe_1.encryptForPolicy; } });
+Object.defineProperty(exports, "decrypt", { enumerable: true, get: function () { return abe_1.decrypt; } });
+Object.defineProperty(exports, "decryptText", { enumerable: true, get: function () { return abe_1.decryptText; } });
+Object.defineProperty(exports, "parseCiphertext", { enumerable: true, get: function () { return abe_1.parseCiphertext; } });
+var pca_1 = require("./pca");
+Object.defineProperty(exports, "encryptToolPayload", { enumerable: true, get: function () { return pca_1.encryptToolPayload; } });
+Object.defineProperty(exports, "decryptWithCapability", { enumerable: true, get: function () { return pca_1.decryptWithCapability; } });
+var policy_1 = require("./policy");
+Object.defineProperty(exports, "normalizePolicy", { enumerable: true, get: function () { return policy_1.normalizePolicy; } });
+Object.defineProperty(exports, "satisfies", { enumerable: true, get: function () { return policy_1.satisfies; } });
+Object.defineProperty(exports, "policyAttributes", { enumerable: true, get: function () { return policy_1.policyAttributes; } });
+Object.defineProperty(exports, "MAX_POLICY_NODES", { enumerable: true, get: function () { return policy_1.MAX_POLICY_NODES; } });
+var attributes_1 = require("./attributes");
+Object.defineProperty(exports, "Attr", { enumerable: true, get: function () { return attributes_1.Attr; } });
+Object.defineProperty(exports, "capabilityAttributes", { enumerable: true, get: function () { return attributes_1.capabilityAttributes; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAee;AAdb,8FAAA,OAAO,OAAA;AACP,yGAAA,kBAAkB,OAAA;AAClB,4FAAA,KAAK,OAAA;AACL,0GAAA,mBAAmB,OAAA;AACnB,0GAAA,mBAAmB,OAAA;AACnB,uGAAA,gBAAgB,OAAA;AAChB,8FAAA,OAAO,OAAA;AACP,kGAAA,WAAW,OAAA;AACX,sGAAA,eAAe,OAAA;AAQjB,6BAAyF;AAAhF,yGAAA,kBAAkB,OAAA;AAAE,4GAAA,qBAAqB,OAAA;AAElD,mCAQkB;AAPhB,yGAAA,eAAe,OAAA;AACf,mGAAA,SAAS,OAAA;AACT,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAMlB,2CAA0D;AAAjD,kGAAA,IAAI,OAAA;AAAE,kHAAA,oBAAoB,OAAA"}

package/dist/pca.d.ts

@@ -0,0 +1,50 @@
+import { type AbeCiphertext, type DecryptionKey, type MasterPublicKey } from './abe';
+import type { Policy } from './policy';
+/**
+ * PCA integration: proof-carrying encryption for tool payloads and results.
+ *
+ * A tool result is sealed under an ACCESS STRUCTURE over the SAME canonical attributes a PCA capability
+ * carries (verb / resource / scope / holder — see `attributes.ts`). Only an agent holding a decryption
+ * key issued (via `keygenForCapability`) for a capability whose authority SATISFIES that structure can
+ * read the payload. Confidentiality is thus bound to proven authority, not merely to a bearer key.
+ *
+ * HOW THIS COMPOSES WITH A PCActn
+ *   A PCActn proves, to a resource server, that the agent's capability chain authorises a specific
+ *   action (verb/resource under the signed policy envelope). The ABE decryption key handed to that agent
+ *   is derived from the very SAME capability (`keygenForCapability(msk, capability)`). So:
+ *
+ *     1. The principal mints a capability (grant/attenuation) bounding the agent's authority.
+ *     2. The issuer derives an ABE key from that capability and gives it to the agent.
+ *     3. A tool/result is encrypted with `encryptToolPayload(mpk, policy, payload)`, where `policy`
+ *        restates the authority required to read it (e.g. "holder X AND verb:read on this resource").
+ *     4. The agent proves the action with a PCActn (the server verifies the chain + predicates), AND can
+ *        decrypt the payload ONLY because its capability-derived key satisfies the same policy.
+ *
+ *   The decrypt gate and the PCActn admission gate are therefore keyed to ONE authority: an agent that
+ *   cannot prove the action also cannot have been issued a key that decrypts its payload, because both
+ *   derive from the same signed capability. Encryption adds CONFIDENTIALITY (a passive observer, or a
+ *   holder of a different/weaker capability, learns nothing) on top of the PCActn's AUTHORISATION.
+ *
+ * SECURITY: as in `abe.ts` — confidentiality under Bilinear Diffie-Hellman (ROM), integrity under
+ * AES-256-GCM. Not a NIZK; collusion resistance is within a single issued key (one key per capability).
+ */
+/** Result of a payload decryption attempt. `ok:false` means the key's authority did not satisfy the policy (or the ciphertext was tampered/malformed). */
+export type DecryptedPayload = {
+    ok: true;
+    payload: unknown;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Encrypt a JSON-serialisable tool payload/result under `requiredCapabilityPolicy` — an access
+ * structure over capability attributes. Only a capability-derived key satisfying the policy can decrypt.
+ */
+export declare function encryptToolPayload(mpk: MasterPublicKey, requiredCapabilityPolicy: Policy, payload: unknown): {
+    ciphertext: AbeCiphertext;
+};
+/**
+ * Decrypt a tool payload with a capability-derived key. Returns the parsed payload iff the key's
+ * authority satisfies the policy and the AEAD authenticates; otherwise a typed failure.
+ */
+export declare function decryptWithCapability(key: DecryptionKey, ciphertext: unknown): DecryptedPayload;

package/dist/pca.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptToolPayload = encryptToolPayload;
+exports.decryptWithCapability = decryptWithCapability;
+const abe_1 = require("./abe");
+/**
+ * Encrypt a JSON-serialisable tool payload/result under `requiredCapabilityPolicy` — an access
+ * structure over capability attributes. Only a capability-derived key satisfying the policy can decrypt.
+ */
+function encryptToolPayload(mpk, requiredCapabilityPolicy, payload) {
+    const json = JSON.stringify(payload ?? null);
+    return (0, abe_1.encryptForPolicy)(mpk, requiredCapabilityPolicy, json);
+}
+/**
+ * Decrypt a tool payload with a capability-derived key. Returns the parsed payload iff the key's
+ * authority satisfies the policy and the AEAD authenticates; otherwise a typed failure.
+ */
+function decryptWithCapability(key, ciphertext) {
+    const pt = (0, abe_1.decrypt)(key, ciphertext);
+    if (pt === null)
+        return { ok: false, reason: 'capability does not satisfy the policy, or ciphertext is invalid' };
+    try {
+        return { ok: true, payload: JSON.parse(new TextDecoder().decode(pt)) };
+    }
+    catch {
+        return { ok: false, reason: 'decrypted payload is not valid JSON' };
+    }
+}
+//# sourceMappingURL=pca.js.map

package/dist/pca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pca.js","sourceRoot":"","sources":["../src/pca.ts"],"names":[],"mappings":";;AA6CA,gDAOC;AAMD,sDAQC;AAlED,+BAMe;AAmCf;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,GAAoB,EACpB,wBAAgC,EAChC,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAA,sBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,GAAkB,EAAE,UAAmB;IAC3E,MAAM,EAAE,GAAG,IAAA,aAAO,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAClH,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAY,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Access structure over attributes — a MONOTONE boolean formula expressed as a threshold tree.
+ *
+ *   - `{ attr }`                         leaf: the holder must own the decryption key for this attribute.
+ *   - `{ allOf: [...] }`                 AND  (n-of-n): every child subtree must be satisfied.
+ *   - `{ anyOf: [...] }`                 OR   (1-of-n): at least one child subtree.
+ *   - `{ threshold: k, of: [...] }`      k-of-n: at least k of the n child subtrees.
+ *
+ * Trees nest arbitrarily, so any monotone access structure (any AND/OR/threshold combination of
+ * attributes) is expressible. Negation is intentionally NOT supported: ABE access structures are
+ * monotone (you cannot grant decryption by LACKING an attribute).
+ */
+export type Policy = {
+    attr: string;
+} | {
+    allOf: Policy[];
+} | {
+    anyOf: Policy[];
+} | {
+    threshold: number;
+    of: Policy[];
+};
+/** Normalised internal form: every interior node is an explicit `t`-of-`n` threshold gate. */
+export type ThresholdTree = {
+    kind: 'leaf';
+    attr: string;
+} | {
+    kind: 'gate';
+    t: number;
+    of: ThresholdTree[];
+};
+export interface PolicyError {
+    ok: false;
+    reason: string;
+}
+export interface PolicyOk {
+    ok: true;
+    tree: ThresholdTree;
+}
+export type PolicyResult = PolicyOk | PolicyError;
+/** Upper bound on total nodes in a policy tree (bounds work on untrusted input). */
+export declare const MAX_POLICY_NODES = 1024;
+/**
+ * Validate and normalise an access structure into a threshold tree. Fails closed (returns a reason)
+ * on any malformed node, empty gate, out-of-range threshold, or oversized tree.
+ */
+export declare function normalizePolicy(policy: unknown): PolicyResult;
+/**
+ * Pure, non-cryptographic satisfaction check: does the attribute SET satisfy the access structure?
+ * This is a convenience / test oracle. The real enforcement is cryptographic (a key lacking an
+ * attribute cannot recover that leaf's share); this just predicts the outcome.
+ */
+export declare function satisfies(tree: ThresholdTree, attrs: ReadonlySet<string>): boolean;
+/** Collect every attribute referenced anywhere in the tree (for diagnostics / key provisioning). */
+export declare function policyAttributes(tree: ThresholdTree, into?: Set<string>): Set<string>;

package/dist/policy.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_POLICY_NODES = void 0;
+exports.normalizePolicy = normalizePolicy;
+exports.satisfies = satisfies;
+exports.policyAttributes = policyAttributes;
+const wire_1 = require("./wire");
+/** Upper bound on total nodes in a policy tree (bounds work on untrusted input). */
+exports.MAX_POLICY_NODES = 1024;
+/**
+ * Validate and normalise an access structure into a threshold tree. Fails closed (returns a reason)
+ * on any malformed node, empty gate, out-of-range threshold, or oversized tree.
+ */
+function normalizePolicy(policy) {
+    let nodes = 0;
+    function walk(p, path) {
+        if (++nodes > exports.MAX_POLICY_NODES)
+            return { ok: false, reason: `policy too large (> ${exports.MAX_POLICY_NODES} nodes)` };
+        if (!(0, wire_1.isObject)(p))
+            return { ok: false, reason: `${path}: not an object` };
+        if ('attr' in p) {
+            if (!(0, wire_1.isString)(p.attr) || p.attr.length === 0)
+                return { ok: false, reason: `${path}: 'attr' must be a non-empty string` };
+            if ('allOf' in p || 'anyOf' in p || 'threshold' in p || 'of' in p) {
+                return { ok: false, reason: `${path}: a leaf must not mix 'attr' with a gate` };
+            }
+            return { kind: 'leaf', attr: p.attr };
+        }
+        const parseChildren = (raw, key) => {
+            if (!Array.isArray(raw) || raw.length === 0)
+                return { ok: false, reason: `${path}: '${key}' must be a non-empty array` };
+            const out = [];
+            for (let i = 0; i < raw.length; i++) {
+                const child = walk(raw[i], `${path}.${key}[${i}]`);
+                if ('ok' in child)
+                    return child;
+                out.push(child);
+            }
+            return out;
+        };
+        if ('allOf' in p) {
+            const kids = parseChildren(p.allOf, 'allOf');
+            if ('ok' in kids)
+                return kids;
+            return { kind: 'gate', t: kids.length, of: kids };
+        }
+        if ('anyOf' in p) {
+            const kids = parseChildren(p.anyOf, 'anyOf');
+            if ('ok' in kids)
+                return kids;
+            return { kind: 'gate', t: 1, of: kids };
+        }
+        if ('threshold' in p) {
+            if (!(0, wire_1.isPosInt)(p.threshold))
+                return { ok: false, reason: `${path}: 'threshold' must be a positive integer` };
+            const kids = parseChildren(p.of, 'of');
+            if ('ok' in kids)
+                return kids;
+            if (p.threshold > kids.length) {
+                return { ok: false, reason: `${path}: threshold ${p.threshold} exceeds the number of branches (${kids.length})` };
+            }
+            return { kind: 'gate', t: p.threshold, of: kids };
+        }
+        return { ok: false, reason: `${path}: unknown policy node (expected attr/allOf/anyOf/threshold)` };
+    }
+    const tree = walk(policy, 'policy');
+    if ('ok' in tree)
+        return tree;
+    return { ok: true, tree };
+}
+/**
+ * Pure, non-cryptographic satisfaction check: does the attribute SET satisfy the access structure?
+ * This is a convenience / test oracle. The real enforcement is cryptographic (a key lacking an
+ * attribute cannot recover that leaf's share); this just predicts the outcome.
+ */
+function satisfies(tree, attrs) {
+    if (tree.kind === 'leaf')
+        return attrs.has(tree.attr);
+    let met = 0;
+    for (const child of tree.of)
+        if (satisfies(child, attrs))
+            met++;
+    return met >= tree.t;
+}
+/** Collect every attribute referenced anywhere in the tree (for diagnostics / key provisioning). */
+function policyAttributes(tree, into = new Set()) {
+    if (tree.kind === 'leaf')
+        into.add(tree.attr);
+    else
+        for (const child of tree.of)
+            policyAttributes(child, into);
+    return into;
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":";;;AAwCA,0CAkDC;AAOD,8BAKC;AAGD,4CAIC;AA7GD,iCAAsD;AAiCtD,oFAAoF;AACvE,QAAA,gBAAgB,GAAG,IAAI,CAAC;AAErC;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAAe;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,IAAI,CAAC,CAAU,EAAE,IAAY;QACpC,IAAI,EAAE,KAAK,GAAG,wBAAgB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,wBAAgB,SAAS,EAAE,CAAC;QAC/G,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAEzE,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,qCAAqC,EAAE,CAAC;YACzH,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,0CAA0C,EAAE,CAAC;YAClF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,GAAW,EAAiC,EAAE;YACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM,GAAG,6BAA6B,EAAE,CAAC;YACzH,MAAM,GAAG,GAAoB,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,IAAI,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QAEF,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,IAAA,eAAQ,EAAC,CAAC,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,0CAA0C,EAAE,CAAC;YAC5G,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC,SAAS,oCAAoC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACpH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,6DAA6D,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,IAAmB,EAAE,KAA0B;IACvE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,EAAE;QAAE,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,CAAC;IAChE,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,oGAAoG;AACpG,SAAgB,gBAAgB,CAAC,IAAmB,EAAE,OAAoB,IAAI,GAAG,EAAE;IACjF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,EAAE;YAAE,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sss.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shamir secret sharing over the scalar field Z_r (prime r = the BLS12-381 subgroup order). This is the
+ * Linear Secret-Sharing Scheme (LSSS) that realises the monotone access structure: a `t`-of-`n` gate
+ * shares its secret along a degree `t-1` polynomial `f` with `f(0)` = the secret, handing child `i` the
+ * evaluation `f(i)`. Fewer than `t` shares leave the secret information-theoretically undetermined; any
+ * `t` (or more, consistent) shares reconstruct it by Lagrange interpolation at 0.
+ */
+export interface Share {
+    /** Evaluation point (1-based branch index); never 0. */
+    x: bigint;
+    /** f(x) in Z_r. */
+    y: bigint;
+}
+/**
+ * Split `secret` into `n` shares with reconstruction threshold `t` (1 <= t <= n). Share `i` (1-based)
+ * is `f(i)` for a random degree `t-1` polynomial with `f(0) = secret`.
+ */
+export declare function splitSecret(secret: bigint, t: number, n: number): Share[];
+/**
+ * Reconstruct `f(0)` by Lagrange interpolation at 0 over Z_r. Requires at least one share and distinct,
+ * non-zero `x` coordinates. Given `>= t` consistent shares of a degree `t-1` sharing, this returns the
+ * original secret; with duplicate x's it returns null (fail-closed).
+ */
+export declare function recoverSecret(shares: Share[]): bigint | null;
+/** Convenience: a fresh random secret scalar together with its 32-byte big-endian encoding. */
+export declare function randomSecret(): {
+    scalar: bigint;
+    bytes: Uint8Array;
+};