@atlasauth/pca-abe 0.3.0 → 0.4.1

package/dist/attributes.d.ts

@@ -1,9 +1,10 @@
-import { type Capability } from '@atlasauth/pca';
+import { type Capability, type CapabilityChain } from '@atlasauth/pca';
 /**
  * Canonical attribute strings derived from a real PCA capability (see `@atlasauth/pca`'s `Capability`
  * and the signed policy `Envelope`). An "attribute" is a lowercase `kind:value` token; a policy
- * references attributes by exactly these tokens, and `keygenForCapability` issues one BF-IBE decryption
- * key per token the capability carries.
+ * references attributes by exactly these tokens, and `keygenForCapability` issues one per-attribute
+ * decryption key (the collusion-resistant per-holder-randomised scheme in `index.ts`, not plain
+ * Boneh-Franklin IBE) per token the capability carries.
  *
  * Four kinds are derived, matching the capability's authority surface (verb / resource / scopes /
  * holder):
@@ -13,18 +14,38 @@ import { type Capability } from '@atlasauth/pca';
  *   - `scope:<s>`           every scope carried in a `{ type:'scope', value }` or
  *                           `{ type:'scopes', values:[...] }` caveat.
  *
- * Because the envelope and caveats are SIGNED into the capability (and attenuation is append-only), the
- * attribute set a capability yields cannot be widened by a holder — it is exactly what the principal
- * authorised.
+ *   - `act:["<v>","<r>"]`    a BOUND (verb, resource) pair, one per verb x resource of each predicate.
+ *
+ * With a single predicate the flat `verb:` / `resource:` tokens are exact and are also emitted. With
+ * two or more predicates only the pair tokens (plus holder/scope) are emitted, so the pairing cannot
+ * be recombined (RT-08, breaking). Predicate `where` conditions and non-predicate caveats are NOT
+ * reflected in any token: a policy that depends on them must also require a `scope:` or `holder:`.
+ *
+ * `scope:` tokens, and (R3-09) the envelope predicates behind `act:`/`verb:`/`resource:`, come ONLY from the ROOT capability (R2-07). Attenuation may append ANY caveat, so a
+ * delegated hop's own `scope` caveats are restrictions, never grants: reading them as positive attributes would let a
+ * delegatee append `scope:admin` and obtain a key for it. A delegated capability (one with a `parent`) therefore yields
+ * `scope:`/`act:`/`verb:`/`resource:` tokens only when the verified `chain` (root first, ending in that capability) is supplied, and then from
+ * `chain[0]` alone. Without a chain a delegated capability gets no `scope:` tokens; a supplied chain that fails
+ * verification yields NO attributes (fail closed).
  */
+export interface CapabilityAttributeOpts {
+    /** The capability chain, root first, whose last element is the capability. Required for `scope:` tokens on a delegated hop. */
+    chain?: CapabilityChain;
+    /** The principal key the root must be issued by (recommended: pin it; defaults to the chain's own root issuer). */
+    principal?: string;
+    /** verifier-side PQ pins by Ed25519 identity (R3-01). A pure-PQ / hybrid ROOT is accepted only if the root issuer has a pin equal to its `pq_pk` (a signed binding from `pqPinFor`, or your own registry); without one it is refused. */
+    pqPins?: Readonly<Record<string, string>>;
+}
 export declare const Attr: {
     readonly holder: (key: string) => string;
     readonly verb: (v: string) => string;
     readonly resource: (r: string) => string;
     readonly scope: (s: string) => string;
+    /** A bound (verb, resource) pair: only a predicate that grants exactly this verb ON exactly this resource yields it. */
+    readonly act: (verb: string, resource: string) => string;
 };
 /**
  * Derive the canonical attribute set a capability possesses. Deterministic and total (never throws): a
  * capability with no signed envelope still yields its `holder:` attribute (plus any scope caveats).
  */
-export declare function capabilityAttributes(cap: Capability): Set<string>;
+export declare function capabilityAttributes(cap: Capability, opts?: CapabilityAttributeOpts): Set<string>;

package/dist/attributes.js

@@ -3,29 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Attr = void 0;
 exports.capabilityAttributes = capabilityAttributes;
 const pca_1 = require("@atlasauth/pca");
-/**
- * Canonical attribute strings derived from a real PCA capability (see `@atlasauth/pca`'s `Capability`
- * and the signed policy `Envelope`). An "attribute" is a lowercase `kind:value` token; a policy
- * references attributes by exactly these tokens, and `keygenForCapability` issues one BF-IBE decryption
- * key per token the capability carries.
- *
- * Four kinds are derived, matching the capability's authority surface (verb / resource / scopes /
- * holder):
- *   - `holder:<b64u key>`   the key the capability is bound to (`capability.holder`),
- *   - `verb:<v>`            every literal verb named in the signed envelope's predicates,
- *   - `resource:<r>`        every resource matcher named in those predicates,
- *   - `scope:<s>`           every scope carried in a `{ type:'scope', value }` or
- *                           `{ type:'scopes', values:[...] }` caveat.
- *
- * Because the envelope and caveats are SIGNED into the capability (and attenuation is append-only), the
- * attribute set a capability yields cannot be widened by a holder — it is exactly what the principal
- * authorised.
- */
 exports.Attr = {
     holder: (key) => `holder:${key}`,
     verb: (v) => `verb:${v}`,
     resource: (r) => `resource:${r}`,
     scope: (s) => `scope:${s}`,
+    /** A bound (verb, resource) pair: only a predicate that grants exactly this verb ON exactly this resource yields it. */
+    act: (verb, resource) => `act:${JSON.stringify([verb, resource])}`,
 };
 function addVerb(out, verb) {
     if (typeof verb === 'string')
@@ -35,6 +19,13 @@ function addVerb(out, verb) {
             if (typeof v === 'string')
                 out.add(exports.Attr.verb(v));
 }
+function verbsOf(verb) {
+    if (typeof verb === 'string')
+        return [verb];
+    if (Array.isArray(verb))
+        return verb.filter((v) => typeof v === 'string');
+    return [];
+}
 function addScopes(out, caveats) {
     for (const cv of caveats) {
         if (cv.type === 'scope' && typeof cv.value === 'string')
@@ -50,21 +41,51 @@ function addScopes(out, caveats) {
  * Derive the canonical attribute set a capability possesses. Deterministic and total (never throws): a
  * capability with no signed envelope still yields its `holder:` attribute (plus any scope caveats).
  */
-function capabilityAttributes(cap) {
+function capabilityAttributes(cap, opts = {}) {
     const out = new Set();
+    let scopeSource;
+    // R3-09: the envelope (act/verb/resource tokens) is read from the ROOT only, like scopes: a delegatee may append
+    // its own envelope caveat, which is a restriction, never a grant.
+    let envSource;
+    if (opts.chain !== undefined) {
+        const chain = opts.chain;
+        const root = chain[0];
+        if (!Array.isArray(chain) || chain.length === 0 || chain[chain.length - 1]?.id !== cap.id || root === undefined)
+            return out;
+        const v = (0, pca_1.verifyChain)(chain, opts.principal ?? root.issuer, { pqPins: opts.pqPins });
+        if (!v.ok)
+            return out;
+        scopeSource = root.caveats;
+        envSource = root;
+    }
+    else if (cap.parent === undefined) {
+        scopeSource = cap.caveats; // a root capability
+        envSource = cap;
+    }
     if (typeof cap.holder === 'string' && cap.holder.length > 0)
         out.add(exports.Attr.holder(cap.holder));
-    if (Array.isArray(cap.caveats))
-        addScopes(out, cap.caveats);
-    const env = (0, pca_1.readEnvelope)(cap);
+    if (Array.isArray(scopeSource))
+        addScopes(out, scopeSource);
+    const env = envSource === undefined ? null : (0, pca_1.readEnvelope)(envSource);
     if (env !== null && Array.isArray(env.predicates)) {
-        for (const p of env.predicates) {
-            if (p === null || typeof p !== 'object')
-                continue;
-            addVerb(out, p.verb);
+        const preds = env.predicates.filter((p) => p !== null && typeof p === 'object');
+        // Paired tokens: one per (verb, resource) of each predicate. These are the ONLY tokens that
+        // carry authority when the envelope holds more than one predicate (RT-08).
+        for (const p of preds) {
+            const verbs = verbsOf(p.verb);
             const r = p.resource;
             if (typeof r === 'string')
-                out.add(exports.Attr.resource(r));
+                for (const v of verbs)
+                    out.add(exports.Attr.act(v, r));
+        }
+        // Flat verb:/resource: tokens are exact only for a single predicate (verbs x ONE resource), so
+        // they are emitted only then; with several predicates they would cross-pair (read of A + write
+        // of B would also open "read B").
+        if (preds.length === 1) {
+            const p = preds[0];
+            addVerb(out, p.verb);
+            if (typeof p.resource === 'string')
+                out.add(exports.Attr.resource(p.resource));
         }
     }
     return out;

package/dist/attributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"attributes.js","sourceRoot":"","sources":["../src/attributes.ts"],"names":[],"mappings":";;;AA8CA,oDAcC;AA5DD,wCAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AAEU,QAAA,IAAI,GAAG;IAClB,MAAM,EAAE,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,GAAG,EAAE;IAChD,IAAI,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,YAAY,CAAC,EAAE;IAChD,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,SAAS,CAAC,EAAE;CAClC,CAAC;AAEX,SAAS,OAAO,CAAC,GAAgB,EAAE,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAClD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAA0D;IAC7F,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,GAAe;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAA,kBAAY,EAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAClD,OAAO,CAAC,GAAG,EAAG,CAAwB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAI,CAA4B,CAAC,QAAQ,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"attributes.js","sourceRoot":"","sources":["../src/attributes.ts"],"names":[],"mappings":";;;AA0EA,oDAwCC;AAlHD,wCAAkG;AAyCrF,QAAA,IAAI,GAAG;IAClB,MAAM,EAAE,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,GAAG,EAAE;IAChD,IAAI,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,YAAY,CAAC,EAAE;IAChD,KAAK,EAAE,CAAC,CAAS,EAAU,EAAE,CAAC,SAAS,CAAC,EAAE;IAC1C,wHAAwH;IACxH,GAAG,EAAE,CAAC,IAAY,EAAE,QAAgB,EAAU,EAAE,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE;CAClF,CAAC;AAEX,SAAS,OAAO,CAAC,GAAgB,EAAE,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAClD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,OAAO,CAAC,IAAa;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAA0D;IAC7F,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,GAAe,EAAE,OAAgC,EAAE;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,WAA0E,CAAC;IAC/E,iHAAiH;IACjH,kEAAkE;IAClE,IAAI,SAAiC,CAAC;IACtC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QAC5H,MAAM,CAAC,GAAG,IAAA,iBAAW,EAAC,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC;QACtB,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,oBAAoB;QAC/C,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,kBAAY,EAAC,SAAS,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAChF,4FAA4F;QAC5F,2EAA2E;QAC3E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,OAAO,CAAE,CAAwB,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,CAAC,GAAI,CAA4B,CAAC,QAAQ,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,KAAK,MAAM,CAAC,IAAI,KAAK;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,kCAAkC;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAA2C,CAAC;YAC7D,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/bls.d.ts

@@ -4,17 +4,20 @@ import { bls12_381 } from '@noble/curves/bls12-381';
  * audited `bls12_381` implementation (G1/G2/GT, the ate pairing, RFC 9380 hash-to-curve); nothing here
  * re-implements field or point arithmetic.
  *
- * Group placement (type-3 / asymmetric pairing `e: G1 x G2 -> GT`):
- *   - attribute identity points `Q_attr = H1(attr)` live in G1 (hash-to-curve),
- *   - the master public `P_pub = s * g2` and ephemerals `U = x * g2` live in G2,
- *   - decryption keys `d_attr = s * Q_attr` live in G1,
- *   - KEM secrets live in GT.
+ * Group placement (type-3 / asymmetric pairing `e: G1 x G2 -> GT`), see `abe.ts` for the scheme:
+ *   - the attribute hash `H(attr)` lives in G1 (hash-to-curve),
+ *   - user-key components D, D_j live in G1 and D'_j in G2,
+ *   - ciphertext components C_0 and C_x live in G2 and C'_x in G1,
+ *   - the blinding value e(g1,g2)^alpha and every recovered quantity live in GT.
  */
 /** Curve subgroup (scalar field) order r — a 255-bit prime, so every scalar fits in 32 bytes. */
 export declare const R: bigint;
+/** The fixed G1 generator the whole system is parameterised over. */
+export declare const G1_BASE: import("@noble/curves/abstract/weierstrass").ProjPointType<bigint>;
 /** The fixed G2 generator the whole system is parameterised over. */
 export declare const G2_BASE: import("@noble/curves/abstract/weierstrass").ProjPointType<import("@noble/curves/abstract/tower").Fp2>;
 export type G1Point = ReturnType<typeof bls12_381.G1.ProjectivePoint.fromAffine>;
+export type GtElement = ReturnType<typeof bls12_381.pairing>;
 export type G2Point = ReturnType<typeof bls12_381.G2.ProjectivePoint.fromAffine>;
 /** Reduce a bigint into the canonical scalar field Z_r. */
 export declare function frCreate(n: bigint): bigint;
@@ -28,7 +31,13 @@ export declare function randomScalar(): bigint;
 export declare function scalarToBytes(v: bigint): Uint8Array;
 /** Decode a 32-byte big-endian scalar back into Z_r. Returns null if not exactly 32 bytes. */
 export declare function bytesToScalar(bytes: Uint8Array): bigint | null;
-/** Hash an attribute string to its identity point `Q_attr` in G1 (prime-order subgroup, RO model). */
+/** True iff `s` contains an unpaired UTF-16 surrogate (such strings alias each other once UTF-8 encoded). */
+export declare function isIllFormedUtf16(s: string): boolean;
+/**
+ * Hash an attribute string to its identity point `Q_attr` in G1 (prime-order subgroup, RO model).
+ * Throws on ill-formed UTF-16: `TextEncoder` maps every lone surrogate to U+FFFD, so two different JS strings
+ * would otherwise hash to the SAME identity and a key issued for one would open ciphertexts for the other.
+ */
 export declare function hashAttrToG1(attr: string): G1Point;
 /** Scalar-multiply a G1 point. */
 export declare function g1Mul(p: G1Point, k: bigint): G1Point;
@@ -38,15 +47,29 @@ export declare function g2Mul(p: G2Point, k: bigint): G2Point;
 export declare function g1ToBytes(p: G1Point): Uint8Array;
 /** Serialise a G2 point (compressed, 96 bytes). */
 export declare function g2ToBytes(p: G2Point): Uint8Array;
-/** Parse a compressed G1 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+/**
+ * Parse a G1 point; null (never throws) on any malformed / off-curve / wrong-subgroup input AND on the point at
+ * infinity (no honest key, ephemeral or public element is ever the identity, and pairing with it is undefined).
+ */
 export declare function g1FromBytes(bytes: Uint8Array): G1Point | null;
-/** Parse a compressed G2 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+/** Parse a G2 point; null (never throws) on any malformed / off-curve / wrong-subgroup / identity input. */
 export declare function g2FromBytes(bytes: Uint8Array): G2Point | null;
 /** The (final-exponentiated) ate pairing `e(P, Q)` in GT. */
-export declare function pairing(p: G1Point, q: G2Point): ReturnType<typeof bls12_381.pairing>;
+export declare function pairing(p: G1Point, q: G2Point): GtElement;
 /** Raise a GT element to a scalar power. */
-export declare function gtPow(gt: ReturnType<typeof bls12_381.pairing>, k: bigint): ReturnType<typeof bls12_381.pairing>;
-/** Canonical byte serialisation of a GT element (576 bytes) — the KEM secret material fed into the KDF. */
-export declare function gtToBytes(gt: ReturnType<typeof bls12_381.pairing>): Uint8Array;
+export declare function gtPow(gt: GtElement, k: bigint): GtElement;
+/** Product of pairings `prod e(P_i, Q_i)` with ONE shared final exponentiation (a multi-Miller loop). Throws on an identity point. */
+export declare function pairingProduct(pairs: readonly {
+    g1: G1Point;
+    g2: G2Point;
+}[]): GtElement;
+export declare function gtEql(a: GtElement, b: GtElement): boolean;
+/**
+ * Parse a GT element (576 bytes). Null unless the bytes are the canonical encoding of an element of the
+ * prime-order subgroup GT (x^r = 1) other than the identity.
+ */
+export declare function gtFromBytes(bytes: Uint8Array): GtElement | null;
+/** Canonical byte serialisation of a GT element (576 bytes) — the secret material fed into the KDF. */
+export declare function gtToBytes(gt: GtElement): Uint8Array;
 /** HKDF-SHA256 to exactly 32 bytes, with explicit salt + info domain separation. */
 export declare function kdf32(ikm: Uint8Array, salt: Uint8Array, info: string): Uint8Array;

package/dist/bls.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.G2_BASE = exports.R = void 0;
+exports.G2_BASE = exports.G1_BASE = exports.R = void 0;
 exports.frCreate = frCreate;
 exports.frAdd = frAdd;
 exports.frSub = frSub;
@@ -9,6 +9,7 @@ exports.frInv = frInv;
 exports.randomScalar = randomScalar;
 exports.scalarToBytes = scalarToBytes;
 exports.bytesToScalar = bytesToScalar;
+exports.isIllFormedUtf16 = isIllFormedUtf16;
 exports.hashAttrToG1 = hashAttrToG1;
 exports.g1Mul = g1Mul;
 exports.g2Mul = g2Mul;
@@ -18,6 +19,9 @@ exports.g1FromBytes = g1FromBytes;
 exports.g2FromBytes = g2FromBytes;
 exports.pairing = pairing;
 exports.gtPow = gtPow;
+exports.pairingProduct = pairingProduct;
+exports.gtEql = gtEql;
+exports.gtFromBytes = gtFromBytes;
 exports.gtToBytes = gtToBytes;
 exports.kdf32 = kdf32;
 const bls12_381_1 = require("@noble/curves/bls12-381");
@@ -30,18 +34,21 @@ const utils_2 = require("@noble/hashes/utils");
  * audited `bls12_381` implementation (G1/G2/GT, the ate pairing, RFC 9380 hash-to-curve); nothing here
  * re-implements field or point arithmetic.
  *
- * Group placement (type-3 / asymmetric pairing `e: G1 x G2 -> GT`):
- *   - attribute identity points `Q_attr = H1(attr)` live in G1 (hash-to-curve),
- *   - the master public `P_pub = s * g2` and ephemerals `U = x * g2` live in G2,
- *   - decryption keys `d_attr = s * Q_attr` live in G1,
- *   - KEM secrets live in GT.
+ * Group placement (type-3 / asymmetric pairing `e: G1 x G2 -> GT`), see `abe.ts` for the scheme:
+ *   - the attribute hash `H(attr)` lives in G1 (hash-to-curve),
+ *   - user-key components D, D_j live in G1 and D'_j in G2,
+ *   - ciphertext components C_0 and C_x live in G2 and C'_x in G1,
+ *   - the blinding value e(g1,g2)^alpha and every recovered quantity live in GT.
  */
 /** Curve subgroup (scalar field) order r — a 255-bit prime, so every scalar fits in 32 bytes. */
 exports.R = bls12_381_1.bls12_381.params.r;
 const Fr = bls12_381_1.bls12_381.fields.Fr;
+const Fp = bls12_381_1.bls12_381.fields.Fp;
 const Fp12 = bls12_381_1.bls12_381.fields.Fp12;
 /** Domain-separation tag for hashing an attribute string to a point in G1 (RFC 9380 SSWU_RO). */
-const ATTR_DST = 'ATLAS-PCA-ABE:BF-IBE:G1:SHA256-SSWU-RO:v1';
+const ATTR_DST = 'ATLAS-PCA-ABE:BSW07:H-G1:SHA256-SSWU-RO:v2';
+/** The fixed G1 generator the whole system is parameterised over. */
+exports.G1_BASE = bls12_381_1.bls12_381.G1.ProjectivePoint.BASE;
 /** The fixed G2 generator the whole system is parameterised over. */
 exports.G2_BASE = bls12_381_1.bls12_381.G2.ProjectivePoint.BASE;
 // ---- field scalars (Z_r) --------------------------------------------------------------------
@@ -80,8 +87,18 @@ function bytesToScalar(bytes) {
     return Fr.create((0, utils_1.bytesToNumberBE)(bytes));
 }
 // ---- points ---------------------------------------------------------------------------------
-/** Hash an attribute string to its identity point `Q_attr` in G1 (prime-order subgroup, RO model). */
+/** True iff `s` contains an unpaired UTF-16 surrogate (such strings alias each other once UTF-8 encoded). */
+function isIllFormedUtf16(s) {
+    return /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/.test(s);
+}
+/**
+ * Hash an attribute string to its identity point `Q_attr` in G1 (prime-order subgroup, RO model).
+ * Throws on ill-formed UTF-16: `TextEncoder` maps every lone surrogate to U+FFFD, so two different JS strings
+ * would otherwise hash to the SAME identity and a key issued for one would open ciphertexts for the other.
+ */
 function hashAttrToG1(attr) {
+    if (isIllFormedUtf16(attr))
+        throw new RangeError('attribute is not well-formed UTF-16');
     const msg = new TextEncoder().encode(attr);
     const h = bls12_381_1.bls12_381.G1.hashToCurve(msg, { DST: ATTR_DST });
     // Normalise the hash-to-curve result into a ProjectivePoint so the full (de)serialisation API is available.
@@ -103,22 +120,41 @@ function g1ToBytes(p) {
 function g2ToBytes(p) {
     return p.toRawBytes(true);
 }
-/** Parse a compressed G1 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let d = 0;
+    for (let i = 0; i < a.length; i++)
+        d |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    return d === 0;
+}
+/**
+ * Parse a G1 point; null (never throws) on any malformed / off-curve / wrong-subgroup input AND on the point at
+ * infinity (no honest key, ephemeral or public element is ever the identity, and pairing with it is undefined).
+ */
 function g1FromBytes(bytes) {
     try {
         const p = bls12_381_1.bls12_381.G1.ProjectivePoint.fromHex(bytes);
         p.assertValidity();
+        if (p.equals(bls12_381_1.bls12_381.G1.ProjectivePoint.ZERO))
+            return null;
+        if (!bytesEqual(p.toRawBytes(true), bytes))
+            return null; // strict: only the canonical compressed encoding
         return p;
     }
     catch {
         return null;
     }
 }
-/** Parse a compressed G2 point; null (never throws) on any malformed / off-curve / wrong-subgroup input. */
+/** Parse a G2 point; null (never throws) on any malformed / off-curve / wrong-subgroup / identity input. */
 function g2FromBytes(bytes) {
     try {
         const p = bls12_381_1.bls12_381.G2.ProjectivePoint.fromHex(bytes);
         p.assertValidity();
+        if (p.equals(bls12_381_1.bls12_381.G2.ProjectivePoint.ZERO))
+            return null;
+        if (!bytesEqual(p.toRawBytes(true), bytes))
+            return null; // strict: only the canonical compressed encoding
         return p;
     }
     catch {
@@ -134,7 +170,41 @@ function pairing(p, q) {
 function gtPow(gt, k) {
     return Fp12.pow(gt, Fr.create(k));
 }
-/** Canonical byte serialisation of a GT element (576 bytes) — the KEM secret material fed into the KDF. */
+/** Product of pairings `prod e(P_i, Q_i)` with ONE shared final exponentiation (a multi-Miller loop). Throws on an identity point. */
+function pairingProduct(pairs) {
+    return bls12_381_1.bls12_381.pairingBatch([...pairs], true);
+}
+function gtEql(a, b) {
+    return Fp12.eql(a, b);
+}
+/**
+ * Parse a GT element (576 bytes). Null unless the bytes are the canonical encoding of an element of the
+ * prime-order subgroup GT (x^r = 1) other than the identity.
+ */
+function gtFromBytes(bytes) {
+    if (bytes.length !== 576)
+        return null;
+    // @noble's Fp12.fromBytes does NOT reduce coordinates: a coordinate c + p parses as a distinct, structurally
+    // unequal value that still behaves as c in arithmetic (so 1 + p would slip past the identity test below) and
+    // re-serialises to the same unreduced bytes (so the round-trip check cannot see it). Require every Fp coordinate < p.
+    for (let off = 0; off < 576; off += 48)
+        if ((0, utils_1.bytesToNumberBE)(bytes.subarray(off, off + 48)) >= Fp.ORDER)
+            return null;
+    try {
+        const x = Fp12.fromBytes(bytes);
+        if (Fp12.eql(x, Fp12.ONE))
+            return null;
+        if (!Fp12.eql(Fp12.pow(x, exports.R), Fp12.ONE))
+            return null;
+        if (!bytesEqual(Fp12.toBytes(x), bytes))
+            return null;
+        return x;
+    }
+    catch {
+        return null;
+    }
+}
+/** Canonical byte serialisation of a GT element (576 bytes) — the secret material fed into the KDF. */
 function gtToBytes(gt) {
     return Fp12.toBytes(gt);
 }

package/dist/bls.js.map

@@ -1 +1 @@
-{"version":3,"file":"bls.js","sourceRoot":"","sources":["../src/bls.ts"],"names":[],"mappings":";;;AAoCA,4BAEC;AAED,sBAEC;AAED,sBAEC;AAED,sBAEC;AAED,sBAEC;AAGD,oCAKC;AAGD,sCAEC;AAGD,sCAGC;AAKD,oCAKC;AAGD,sBAEC;AAGD,sBAEC;AAGD,8BAEC;AAGD,8BAEC;AAGD,kCAQC;AAGD,kCAQC;AAKD,0BAEC;AAGD,sBAEC;AAGD,8BAEC;AAKD,sBAEC;AArJD,uDAAoD;AACpD,wDAAgF;AAChF,6CAA0C;AAC1C,iDAA8C;AAC9C,+CAAkD;AAElD;;;;;;;;;;GAUG;AAEH,iGAAiG;AACpF,QAAA,CAAC,GAAW,qBAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,MAAM,EAAE,GAAG,qBAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/B,MAAM,IAAI,GAAG,qBAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AAEnC,iGAAiG;AACjG,MAAM,QAAQ,GAAG,2CAA2C,CAAC;AAE7D,qEAAqE;AACxD,QAAA,OAAO,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAKzD,gGAAgG;AAEhG,2DAA2D;AAC3D,SAAgB,QAAQ,CAAC,CAAS;IAChC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS;IAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,SAAgB,YAAY;IAC1B,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAA,uBAAe,EAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,aAAa,CAAC,CAAS;IACrC,OAAO,IAAA,uBAAe,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,8FAA8F;AAC9F,SAAgB,aAAa,CAAC,KAAiB;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAEhG,sGAAsG;AACtG,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,4GAA4G;IAC5G,OAAO,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,kCAAkC;AAClC,SAAgB,KAAK,CAAC,CAAU,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,kCAAkC;AAClC,SAAgB,KAAK,CAAC,CAAU,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,mDAAmD;AACnD,SAAgB,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,mDAAmD;AACnD,SAAgB,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,4GAA4G;AAC5G,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gGAAgG;AAEhG,6DAA6D;AAC7D,SAAgB,OAAO,CAAC,CAAU,EAAE,CAAU;IAC5C,OAAO,qBAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,4CAA4C;AAC5C,SAAgB,KAAK,CAAC,EAAwC,EAAE,CAAS;IACvE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,2GAA2G;AAC3G,SAAgB,SAAS,CAAC,EAAwC;IAChE,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAEhG,oFAAoF;AACpF,SAAgB,KAAK,CAAC,GAAe,EAAE,IAAgB,EAAE,IAAY;IACnE,OAAO,IAAA,WAAI,EAAC,eAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"bls.js","sourceRoot":"","sources":["../src/bls.ts"],"names":[],"mappings":";;;AAyCA,4BAEC;AAED,sBAEC;AAED,sBAEC;AAED,sBAEC;AAED,sBAEC;AAGD,oCAKC;AAGD,sCAEC;AAGD,sCAGC;AAKD,4CAEC;AAOD,oCAMC;AAGD,sBAEC;AAGD,sBAEC;AAGD,8BAEC;AAGD,8BAEC;AAaD,kCAUC;AAGD,kCAUC;AAKD,0BAEC;AAGD,sBAEC;AAGD,wCAEC;AAED,sBAEC;AAMD,kCAeC;AAGD,8BAEC;AAKD,sBAEC;AAhND,uDAAoD;AACpD,wDAAgF;AAChF,6CAA0C;AAC1C,iDAA8C;AAC9C,+CAAkD;AAElD;;;;;;;;;;GAUG;AAEH,iGAAiG;AACpF,QAAA,CAAC,GAAW,qBAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,MAAM,EAAE,GAAG,qBAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/B,MAAM,EAAE,GAAG,qBAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/B,MAAM,IAAI,GAAG,qBAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AAEnC,iGAAiG;AACjG,MAAM,QAAQ,GAAG,4CAA4C,CAAC;AAE9D,qEAAqE;AACxD,QAAA,OAAO,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAEzD,qEAAqE;AACxD,QAAA,OAAO,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAMzD,gGAAgG;AAEhG,2DAA2D;AAC3D,SAAgB,QAAQ,CAAC,CAAS;IAChC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,KAAK,CAAC,CAAS;IAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,SAAgB,YAAY;IAC1B,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAA,uBAAe,EAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,aAAa,CAAC,CAAS;IACrC,OAAO,IAAA,uBAAe,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,8FAA8F;AAC9F,SAAgB,aAAa,CAAC,KAAiB;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAEhG,6GAA6G;AAC7G,SAAgB,gBAAgB,CAAC,CAAS;IACxC,OAAO,wEAAwE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAY;IACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,qCAAqC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,4GAA4G;IAC5G,OAAO,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,kCAAkC;AAClC,SAAgB,KAAK,CAAC,CAAU,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,kCAAkC;AAClC,SAAgB,KAAK,CAAC,CAAU,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,mDAAmD;AACnD,SAAgB,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,mDAAmD;AACnD,SAAgB,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,CAAC,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAC1G,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,CAAC,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAC1G,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gGAAgG;AAEhG,6DAA6D;AAC7D,SAAgB,OAAO,CAAC,CAAU,EAAE,CAAU;IAC5C,OAAO,qBAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,4CAA4C;AAC5C,SAAgB,KAAK,CAAC,EAAa,EAAE,CAAS;IAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,sIAAsI;AACtI,SAAgB,cAAc,CAAC,KAA8C;IAC3E,OAAO,qBAAS,CAAC,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,KAAK,CAAC,CAAY,EAAE,CAAY;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtC,6GAA6G;IAC7G,6GAA6G;IAC7G,sHAAsH;IACtH,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE;QAAE,IAAI,IAAA,uBAAe,EAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;IACpH,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,SAAgB,SAAS,CAAC,EAAa;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAEhG,oFAAoF;AACpF,SAAgB,KAAK,CAAC,GAAe,EAAE,IAAgB,EAAE,IAAY;IACnE,OAAO,IAAA,WAAI,EAAC,eAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 /**
  * @atlasauth/pca-abe — proof-carrying encryption.
  *
- * Ciphertext-policy attribute/policy-based encryption on BLS12-381 (a Boneh-Franklin IBE KEM composed
- * over a monotone access structure by Shamir secret sharing, sealed with AES-256-GCM) so a tool payload
- * or result decrypts ONLY for a holder whose PCA capability satisfies the policy. See `abe.ts` for the
+ * Collusion-resistant ciphertext-policy attribute-based encryption on BLS12-381 (Bethencourt-Sahai-Waters
+ * CP-ABE with a per-user key randomiser, type-3 pairing adaptation, Shamir access tree, AES-256-GCM) so a
+ * tool payload or result decrypts ONLY for a holder whose PCA capability satisfies the policy. See `abe.ts` for the
  * full construction and security property.
  */
-export { ABE_ALG, PcaEncryptionError, setup, keygenForAttributes, keygenForCapability, encryptForPolicy, decrypt, decryptText, parseCiphertext, type MasterPublicKey, type MasterSecretKey, type DecryptionKey, type AbeCiphertext, type KemTree, } from './abe';
+export { ABE_ALG, PcaEncryptionError, setup, keygenForAttributes, keygenForCapability, rerandomizeKey, encryptForPolicy, decrypt, decryptText, parseCiphertext, type MasterPublicKey, type MasterSecretKey, type DecryptionKey, type AbeCiphertext, type AttributeKey, type KemTree, } from './abe';
 export { encryptToolPayload, decryptWithCapability, type DecryptedPayload } from './pca';
-export { normalizePolicy, satisfies, policyAttributes, MAX_POLICY_NODES, type Policy, type ThresholdTree, type PolicyResult, } from './policy';
-export { Attr, capabilityAttributes } from './attributes';
+export { normalizePolicy, satisfies, policyAttributes, MAX_POLICY_NODES, MAX_POLICY_DEPTH, type Policy, type ThresholdTree, type PolicyResult, } from './policy';
+export { Attr, capabilityAttributes, type CapabilityAttributeOpts } from './attributes';

package/dist/index.js

@@ -2,19 +2,20 @@
 /**
  * @atlasauth/pca-abe — proof-carrying encryption.
  *
- * Ciphertext-policy attribute/policy-based encryption on BLS12-381 (a Boneh-Franklin IBE KEM composed
- * over a monotone access structure by Shamir secret sharing, sealed with AES-256-GCM) so a tool payload
- * or result decrypts ONLY for a holder whose PCA capability satisfies the policy. See `abe.ts` for the
+ * Collusion-resistant ciphertext-policy attribute-based encryption on BLS12-381 (Bethencourt-Sahai-Waters
+ * CP-ABE with a per-user key randomiser, type-3 pairing adaptation, Shamir access tree, AES-256-GCM) so a
+ * tool payload or result decrypts ONLY for a holder whose PCA capability satisfies the policy. See `abe.ts` for the
  * full construction and security property.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.capabilityAttributes = exports.Attr = exports.MAX_POLICY_NODES = exports.policyAttributes = exports.satisfies = exports.normalizePolicy = exports.decryptWithCapability = exports.encryptToolPayload = exports.parseCiphertext = exports.decryptText = exports.decrypt = exports.encryptForPolicy = exports.keygenForCapability = exports.keygenForAttributes = exports.setup = exports.PcaEncryptionError = exports.ABE_ALG = void 0;
+exports.capabilityAttributes = exports.Attr = exports.MAX_POLICY_DEPTH = exports.MAX_POLICY_NODES = exports.policyAttributes = exports.satisfies = exports.normalizePolicy = exports.decryptWithCapability = exports.encryptToolPayload = exports.parseCiphertext = exports.decryptText = exports.decrypt = exports.encryptForPolicy = exports.rerandomizeKey = exports.keygenForCapability = exports.keygenForAttributes = exports.setup = exports.PcaEncryptionError = exports.ABE_ALG = void 0;
 var abe_1 = require("./abe");
 Object.defineProperty(exports, "ABE_ALG", { enumerable: true, get: function () { return abe_1.ABE_ALG; } });
 Object.defineProperty(exports, "PcaEncryptionError", { enumerable: true, get: function () { return abe_1.PcaEncryptionError; } });
 Object.defineProperty(exports, "setup", { enumerable: true, get: function () { return abe_1.setup; } });
 Object.defineProperty(exports, "keygenForAttributes", { enumerable: true, get: function () { return abe_1.keygenForAttributes; } });
 Object.defineProperty(exports, "keygenForCapability", { enumerable: true, get: function () { return abe_1.keygenForCapability; } });
+Object.defineProperty(exports, "rerandomizeKey", { enumerable: true, get: function () { return abe_1.rerandomizeKey; } });
 Object.defineProperty(exports, "encryptForPolicy", { enumerable: true, get: function () { return abe_1.encryptForPolicy; } });
 Object.defineProperty(exports, "decrypt", { enumerable: true, get: function () { return abe_1.decrypt; } });
 Object.defineProperty(exports, "decryptText", { enumerable: true, get: function () { return abe_1.decryptText; } });
@@ -27,6 +28,7 @@ Object.defineProperty(exports, "normalizePolicy", { enumerable: true, get: funct
 Object.defineProperty(exports, "satisfies", { enumerable: true, get: function () { return policy_1.satisfies; } });
 Object.defineProperty(exports, "policyAttributes", { enumerable: true, get: function () { return policy_1.policyAttributes; } });
 Object.defineProperty(exports, "MAX_POLICY_NODES", { enumerable: true, get: function () { return policy_1.MAX_POLICY_NODES; } });
+Object.defineProperty(exports, "MAX_POLICY_DEPTH", { enumerable: true, get: function () { return policy_1.MAX_POLICY_DEPTH; } });
 var attributes_1 = require("./attributes");
 Object.defineProperty(exports, "Attr", { enumerable: true, get: function () { return attributes_1.Attr; } });
 Object.defineProperty(exports, "capabilityAttributes", { enumerable: true, get: function () { return attributes_1.capabilityAttributes; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAee;AAdb,8FAAA,OAAO,OAAA;AACP,yGAAA,kBAAkB,OAAA;AAClB,4FAAA,KAAK,OAAA;AACL,0GAAA,mBAAmB,OAAA;AACnB,0GAAA,mBAAmB,OAAA;AACnB,uGAAA,gBAAgB,OAAA;AAChB,8FAAA,OAAO,OAAA;AACP,kGAAA,WAAW,OAAA;AACX,sGAAA,eAAe,OAAA;AAQjB,6BAAyF;AAAhF,yGAAA,kBAAkB,OAAA;AAAE,4GAAA,qBAAqB,OAAA;AAElD,mCAQkB;AAPhB,yGAAA,eAAe,OAAA;AACf,mGAAA,SAAS,OAAA;AACT,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAMlB,2CAA0D;AAAjD,kGAAA,IAAI,OAAA;AAAE,kHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAiBe;AAhBb,8FAAA,OAAO,OAAA;AACP,yGAAA,kBAAkB,OAAA;AAClB,4FAAA,KAAK,OAAA;AACL,0GAAA,mBAAmB,OAAA;AACnB,0GAAA,mBAAmB,OAAA;AACnB,qGAAA,cAAc,OAAA;AACd,uGAAA,gBAAgB,OAAA;AAChB,8FAAA,OAAO,OAAA;AACP,kGAAA,WAAW,OAAA;AACX,sGAAA,eAAe,OAAA;AASjB,6BAAyF;AAAhF,yGAAA,kBAAkB,OAAA;AAAE,4GAAA,qBAAqB,OAAA;AAElD,mCASkB;AARhB,yGAAA,eAAe,OAAA;AACf,mGAAA,SAAS,OAAA;AACT,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAMlB,2CAAwF;AAA/E,kGAAA,IAAI,OAAA;AAAE,kHAAA,oBAAoB,OAAA"}

package/dist/pca.d.ts

@@ -25,8 +25,9 @@ import type { Policy } from './policy';
  *   derive from the same signed capability. Encryption adds CONFIDENTIALITY (a passive observer, or a
  *   holder of a different/weaker capability, learns nothing) on top of the PCActn's AUTHORISATION.
  *
- * SECURITY: as in `abe.ts` — confidentiality under Bilinear Diffie-Hellman (ROM), integrity under
- * AES-256-GCM. Not a NIZK; collusion resistance is within a single issued key (one key per capability).
+ * SECURITY: as in `abe.ts` — BSW07 CP-ABE (selective security in the paper's generic-group model, not
+ * re-proved for this type-3 adaptation), integrity under AES-256-GCM. Not a NIZK. Keys carry a per-key
+ * randomiser, so keys issued to different agents cannot be pooled to satisfy a policy neither satisfies.
  */
 /** Result of a payload decryption attempt. `ok:false` means the key's authority did not satisfy the policy (or the ciphertext was tampered/malformed). */
 export type DecryptedPayload = {

package/dist/pca.js.map

@@ -1 +1 @@
-{"version":3,"file":"pca.js","sourceRoot":"","sources":["../src/pca.ts"],"names":[],"mappings":";;AA6CA,gDAOC;AAMD,sDAQC;AAlED,+BAMe;AAmCf;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,GAAoB,EACpB,wBAAgC,EAChC,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAA,sBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,GAAkB,EAAE,UAAmB;IAC3E,MAAM,EAAE,GAAG,IAAA,aAAO,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAClH,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAY,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;AACH,CAAC"}
+{"version":3,"file":"pca.js","sourceRoot":"","sources":["../src/pca.ts"],"names":[],"mappings":";;AA8CA,gDAOC;AAMD,sDAQC;AAnED,+BAMe;AAoCf;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,GAAoB,EACpB,wBAAgC,EAChC,OAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAA,sBAAgB,EAAC,GAAG,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,GAAkB,EAAE,UAAmB;IAC3E,MAAM,EAAE,GAAG,IAAA,aAAO,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;IAClH,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAY,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/policy.d.ts

@@ -40,6 +40,13 @@ export interface PolicyOk {
 export type PolicyResult = PolicyOk | PolicyError;
 /** Upper bound on total nodes in a policy tree (bounds work on untrusted input). */
 export declare const MAX_POLICY_NODES = 1024;
+/**
+ * Upper bound on gate nesting along any root-to-leaf path. The ciphertext header is authenticated as canonical
+ * JSON, whose nesting is capped at 32 by the PCA canonicalizer; every gate level costs three JSON levels
+ * (gate object, `of` array, branch object) and the root sits at level 2, so 10 gate levels is the most that can
+ * ever be authenticated. Enforcing it here makes "encryptable" imply "decryptable".
+ */
+export declare const MAX_POLICY_DEPTH = 10;
 /**
  * Validate and normalise an access structure into a threshold tree. Fails closed (returns a reason)
  * on any malformed node, empty gate, out-of-range threshold, or oversized tree.

package/dist/policy.js

@@ -1,19 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_POLICY_NODES = void 0;
+exports.MAX_POLICY_DEPTH = exports.MAX_POLICY_NODES = void 0;
 exports.normalizePolicy = normalizePolicy;
 exports.satisfies = satisfies;
 exports.policyAttributes = policyAttributes;
+const bls_1 = require("./bls");
 const wire_1 = require("./wire");
 /** Upper bound on total nodes in a policy tree (bounds work on untrusted input). */
 exports.MAX_POLICY_NODES = 1024;
+/**
+ * Upper bound on gate nesting along any root-to-leaf path. The ciphertext header is authenticated as canonical
+ * JSON, whose nesting is capped at 32 by the PCA canonicalizer; every gate level costs three JSON levels
+ * (gate object, `of` array, branch object) and the root sits at level 2, so 10 gate levels is the most that can
+ * ever be authenticated. Enforcing it here makes "encryptable" imply "decryptable".
+ */
+exports.MAX_POLICY_DEPTH = 10;
 /**
  * Validate and normalise an access structure into a threshold tree. Fails closed (returns a reason)
  * on any malformed node, empty gate, out-of-range threshold, or oversized tree.
  */
 function normalizePolicy(policy) {
     let nodes = 0;
-    function walk(p, path) {
+    function walk(p, path, gates) {
         if (++nodes > exports.MAX_POLICY_NODES)
             return { ok: false, reason: `policy too large (> ${exports.MAX_POLICY_NODES} nodes)` };
         if (!(0, wire_1.isObject)(p))
@@ -21,17 +29,26 @@ function normalizePolicy(policy) {
         if ('attr' in p) {
             if (!(0, wire_1.isString)(p.attr) || p.attr.length === 0)
                 return { ok: false, reason: `${path}: 'attr' must be a non-empty string` };
+            if ((0, bls_1.isIllFormedUtf16)(p.attr))
+                return { ok: false, reason: `${path}: 'attr' is not well-formed UTF-16` };
             if ('allOf' in p || 'anyOf' in p || 'threshold' in p || 'of' in p) {
                 return { ok: false, reason: `${path}: a leaf must not mix 'attr' with a gate` };
             }
             return { kind: 'leaf', attr: p.attr };
         }
+        const gateKeys = ['allOf', 'anyOf', 'threshold', 'of'].filter((k) => k in p).filter((k) => k !== 'of' || !('threshold' in p));
+        if (gateKeys.length > 1) {
+            return { ok: false, reason: `${path}: ambiguous node (${gateKeys.join(', ')}); a gate must use exactly one of allOf/anyOf/threshold` };
+        }
+        if (gateKeys.length === 1 && gates + 1 > exports.MAX_POLICY_DEPTH) {
+            return { ok: false, reason: `${path}: policy nested deeper than ${exports.MAX_POLICY_DEPTH} gates` };
+        }
         const parseChildren = (raw, key) => {
             if (!Array.isArray(raw) || raw.length === 0)
                 return { ok: false, reason: `${path}: '${key}' must be a non-empty array` };
             const out = [];
             for (let i = 0; i < raw.length; i++) {
-                const child = walk(raw[i], `${path}.${key}[${i}]`);
+                const child = walk(raw[i], `${path}.${key}[${i}]`, gates + 1);
                 if ('ok' in child)
                     return child;
                 out.push(child);
@@ -63,7 +80,7 @@ function normalizePolicy(policy) {
         }
         return { ok: false, reason: `${path}: unknown policy node (expected attr/allOf/anyOf/threshold)` };
     }
-    const tree = walk(policy, 'policy');
+    const tree = walk(policy, 'policy', 0);
     if ('ok' in tree)
         return tree;
     return { ok: true, tree };