@atlasauth/pca-aggsig 0.0.0-stage → 0.1.0

package/dist/bls.d.ts

@@ -0,0 +1,77 @@
+/**
+ * BLS signatures on BLS12-381, aggregation-ready.
+ *
+ * SCHEME — Proof-of-Possession (PoP), per draft-irtf-cfrg-bls-signature-05 §3.3.
+ * Variant: "minimal-pubkey-size" — public keys live in G1 (48 bytes compressed), signatures in
+ * G2 (96 bytes compressed). This is the eth2 / Ethereum-consensus convention.
+ *
+ * WHY PoP (not message-augmentation / basic): the whole point of this package is to aggregate
+ * signatures from DIFFERENT keys — a delegation chain's per-hop keys, and a quorum of transparency
+ * witnesses cosigning the SAME statement. Same-message aggregation is exactly where the rogue-key
+ * attack lives: an adversary who registers pk_adv = pk_victim^-1 · g^a can forge an aggregate that
+ * "verifies" against {pk_victim, pk_adv}. PoP closes this: every key must ship a proof-of-possession
+ * (a signature, under a DISTINCT domain, over its own public key) that only the true secret-key
+ * holder can produce, so a rogue key chosen as a function of other keys cannot pass {@link popVerify}.
+ * The signing and PoP ciphersuites therefore use the `_POP_` domain separation tags below.
+ *
+ * Every function is total: verification never throws, it returns `false` on any malformed input.
+ */
+/** Ciphersuite ID / hash-to-curve DST for SIGNATURES (PoP variant, signatures in G2). */
+export declare const SIG_DST = "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_";
+/** DISTINCT DST for proofs-of-possession, so a PoP can never be replayed as a message signature. */
+export declare const POP_DST = "BLS_POP_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_";
+/** Compressed G1 public-key length in bytes. */
+export declare const PUBLIC_KEY_LENGTH = 48;
+/** Compressed G2 signature length in bytes. */
+export declare const SIGNATURE_LENGTH = 96;
+export interface BlsKeyPair {
+    /** 32-byte scalar (mod r). */
+    secretKey: Uint8Array;
+    /** 48-byte compressed G1 point. */
+    publicKey: Uint8Array;
+}
+/** Fresh key pair: a random scalar mod r and its G1 public key. */
+export declare function keyGen(): BlsKeyPair;
+/** Public key (compressed G1) for a secret scalar. */
+export declare function publicKeyOf(secretKey: Uint8Array): Uint8Array;
+/**
+ * KeyValidate (draft §2.5): the public key decodes to a valid point, is NOT the identity, and lies
+ * in the prime-order subgroup. A key that fails this is rejected everywhere before it can contribute
+ * to an aggregate. Never throws.
+ */
+export declare function keyValidate(publicKey: Uint8Array): boolean;
+/** CoreSign: H(msg) in G2 under the signature DST, multiplied by the secret scalar. */
+export declare function sign(secretKey: Uint8Array, msg: Uint8Array): Uint8Array;
+/** CoreVerify of a single signature: e(pk, H(msg)) == e(g1, sig). Never throws. */
+export declare function verify(publicKey: Uint8Array, msg: Uint8Array, sig: Uint8Array): boolean;
+/**
+ * Aggregate: sum the G2 signature points into one 96-byte aggregate. Order-independent. Requires at
+ * least one signature.
+ */
+export declare function aggregate(sigs: Uint8Array[]): Uint8Array;
+/** Aggregate a set of G1 public keys into one 48-byte key (used by {@link fastAggregateVerify}). */
+export declare function aggregatePublicKeys(publicKeys: Uint8Array[]): Uint8Array;
+/**
+ * AggregateVerify (draft §3.1.1) for DISTINCT messages: one pairing-product check that all N hops'
+ * signatures are present in the aggregate — e(g1, aggSig) == Π e(pk_i, H(msg_i)).
+ *
+ * The draft REQUIRES the messages be pairwise distinct (same-message aggregation across different keys
+ * must go through {@link fastAggregateVerify}); we enforce that as defence-in-depth even though PoP
+ * already defeats the rogue-key attack. Every public key is KeyValidate'd first. Never throws; returns
+ * `false` on length mismatch, a repeated message, a bad key, or a failed pairing check.
+ */
+export declare function aggregateVerify(publicKeys: Uint8Array[], msgs: Uint8Array[], aggSig: Uint8Array): boolean;
+/**
+ * FastAggregateVerify (draft §3.3.4): all signers signed the SAME message. Aggregate the public keys
+ * into one, then a single CoreVerify — e(g1, aggSig) == e(Σ pk_i, H(msg)). This is the surface for a
+ * quorum of transparency witnesses cosigning one tree head. KeyValidate'd; never throws.
+ */
+export declare function fastAggregateVerify(publicKeys: Uint8Array[], msg: Uint8Array, aggSig: Uint8Array): boolean;
+/**
+ * PopProve (draft §3.3.2): sign one's OWN public key under the PoP DST. Only the holder of the secret
+ * scalar can produce this, so a rogue key defined as a function of other keys cannot.
+ */
+export declare function popProve(secretKey: Uint8Array): Uint8Array;
+/** PopVerify (draft §3.3.3): the proof-of-possession is a valid PoP-DST signature by `publicKey` over
+ *  `publicKey`. A key must pass this before it is admitted to any aggregate. Never throws. */
+export declare function popVerify(publicKey: Uint8Array, pop: Uint8Array): boolean;

package/dist/bls.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNATURE_LENGTH = exports.PUBLIC_KEY_LENGTH = exports.POP_DST = exports.SIG_DST = void 0;
+exports.keyGen = keyGen;
+exports.publicKeyOf = publicKeyOf;
+exports.keyValidate = keyValidate;
+exports.sign = sign;
+exports.verify = verify;
+exports.aggregate = aggregate;
+exports.aggregatePublicKeys = aggregatePublicKeys;
+exports.aggregateVerify = aggregateVerify;
+exports.fastAggregateVerify = fastAggregateVerify;
+exports.popProve = popProve;
+exports.popVerify = popVerify;
+const bls12_381_1 = require("@noble/curves/bls12-381");
+const utils_1 = require("@noble/hashes/utils");
+/**
+ * BLS signatures on BLS12-381, aggregation-ready.
+ *
+ * SCHEME — Proof-of-Possession (PoP), per draft-irtf-cfrg-bls-signature-05 §3.3.
+ * Variant: "minimal-pubkey-size" — public keys live in G1 (48 bytes compressed), signatures in
+ * G2 (96 bytes compressed). This is the eth2 / Ethereum-consensus convention.
+ *
+ * WHY PoP (not message-augmentation / basic): the whole point of this package is to aggregate
+ * signatures from DIFFERENT keys — a delegation chain's per-hop keys, and a quorum of transparency
+ * witnesses cosigning the SAME statement. Same-message aggregation is exactly where the rogue-key
+ * attack lives: an adversary who registers pk_adv = pk_victim^-1 · g^a can forge an aggregate that
+ * "verifies" against {pk_victim, pk_adv}. PoP closes this: every key must ship a proof-of-possession
+ * (a signature, under a DISTINCT domain, over its own public key) that only the true secret-key
+ * holder can produce, so a rogue key chosen as a function of other keys cannot pass {@link popVerify}.
+ * The signing and PoP ciphersuites therefore use the `_POP_` domain separation tags below.
+ *
+ * Every function is total: verification never throws, it returns `false` on any malformed input.
+ */
+/** Ciphersuite ID / hash-to-curve DST for SIGNATURES (PoP variant, signatures in G2). */
+exports.SIG_DST = 'BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_';
+/** DISTINCT DST for proofs-of-possession, so a PoP can never be replayed as a message signature. */
+exports.POP_DST = 'BLS_POP_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_';
+/** Compressed G1 public-key length in bytes. */
+exports.PUBLIC_KEY_LENGTH = 48;
+/** Compressed G2 signature length in bytes. */
+exports.SIGNATURE_LENGTH = 96;
+const SIG_OPTS = { DST: exports.SIG_DST };
+const POP_OPTS = { DST: exports.POP_DST };
+/** Fresh key pair: a random scalar mod r and its G1 public key. */
+function keyGen() {
+    const secretKey = bls12_381_1.bls12_381.utils.randomPrivateKey();
+    return { secretKey, publicKey: bls12_381_1.bls12_381.getPublicKey(secretKey) };
+}
+/** Public key (compressed G1) for a secret scalar. */
+function publicKeyOf(secretKey) {
+    return bls12_381_1.bls12_381.getPublicKey(secretKey);
+}
+/**
+ * KeyValidate (draft §2.5): the public key decodes to a valid point, is NOT the identity, and lies
+ * in the prime-order subgroup. A key that fails this is rejected everywhere before it can contribute
+ * to an aggregate. Never throws.
+ */
+function keyValidate(publicKey) {
+    try {
+        const P = bls12_381_1.bls12_381.G1.ProjectivePoint.fromHex(publicKey);
+        if (P.equals(bls12_381_1.bls12_381.G1.ProjectivePoint.ZERO))
+            return false;
+        P.assertValidity();
+        return P.isTorsionFree();
+    }
+    catch {
+        return false;
+    }
+}
+/** CoreSign: H(msg) in G2 under the signature DST, multiplied by the secret scalar. */
+function sign(secretKey, msg) {
+    return bls12_381_1.bls12_381.sign(msg, secretKey, SIG_OPTS);
+}
+/** CoreVerify of a single signature: e(pk, H(msg)) == e(g1, sig). Never throws. */
+function verify(publicKey, msg, sig) {
+    try {
+        if (!keyValidate(publicKey))
+            return false;
+        return bls12_381_1.bls12_381.verify(sig, msg, publicKey, SIG_OPTS);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Aggregate: sum the G2 signature points into one 96-byte aggregate. Order-independent. Requires at
+ * least one signature.
+ */
+function aggregate(sigs) {
+    if (sigs.length === 0)
+        throw new RangeError('aggregate: need at least one signature');
+    return bls12_381_1.bls12_381.aggregateSignatures(sigs);
+}
+/** Aggregate a set of G1 public keys into one 48-byte key (used by {@link fastAggregateVerify}). */
+function aggregatePublicKeys(publicKeys) {
+    if (publicKeys.length === 0)
+        throw new RangeError('aggregatePublicKeys: need at least one key');
+    return bls12_381_1.bls12_381.aggregatePublicKeys(publicKeys);
+}
+function hasDistinctMessages(msgs) {
+    const seen = new Set();
+    for (const m of msgs) {
+        const h = (0, utils_1.bytesToHex)(m);
+        if (seen.has(h))
+            return false;
+        seen.add(h);
+    }
+    return true;
+}
+/**
+ * AggregateVerify (draft §3.1.1) for DISTINCT messages: one pairing-product check that all N hops'
+ * signatures are present in the aggregate — e(g1, aggSig) == Π e(pk_i, H(msg_i)).
+ *
+ * The draft REQUIRES the messages be pairwise distinct (same-message aggregation across different keys
+ * must go through {@link fastAggregateVerify}); we enforce that as defence-in-depth even though PoP
+ * already defeats the rogue-key attack. Every public key is KeyValidate'd first. Never throws; returns
+ * `false` on length mismatch, a repeated message, a bad key, or a failed pairing check.
+ */
+function aggregateVerify(publicKeys, msgs, aggSig) {
+    try {
+        if (publicKeys.length === 0 || publicKeys.length !== msgs.length)
+            return false;
+        if (!hasDistinctMessages(msgs))
+            return false;
+        for (const pk of publicKeys) {
+            if (!keyValidate(pk))
+                return false;
+        }
+        return bls12_381_1.bls12_381.verifyBatch(aggSig, msgs, publicKeys, SIG_OPTS);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * FastAggregateVerify (draft §3.3.4): all signers signed the SAME message. Aggregate the public keys
+ * into one, then a single CoreVerify — e(g1, aggSig) == e(Σ pk_i, H(msg)). This is the surface for a
+ * quorum of transparency witnesses cosigning one tree head. KeyValidate'd; never throws.
+ */
+function fastAggregateVerify(publicKeys, msg, aggSig) {
+    try {
+        if (publicKeys.length === 0)
+            return false;
+        for (const pk of publicKeys) {
+            if (!keyValidate(pk))
+                return false;
+        }
+        const aggPk = bls12_381_1.bls12_381.aggregatePublicKeys(publicKeys);
+        return bls12_381_1.bls12_381.verify(aggSig, msg, aggPk, SIG_OPTS);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * PopProve (draft §3.3.2): sign one's OWN public key under the PoP DST. Only the holder of the secret
+ * scalar can produce this, so a rogue key defined as a function of other keys cannot.
+ */
+function popProve(secretKey) {
+    const pk = bls12_381_1.bls12_381.getPublicKey(secretKey);
+    return bls12_381_1.bls12_381.sign(pk, secretKey, POP_OPTS);
+}
+/** PopVerify (draft §3.3.3): the proof-of-possession is a valid PoP-DST signature by `publicKey` over
+ *  `publicKey`. A key must pass this before it is admitted to any aggregate. Never throws. */
+function popVerify(publicKey, pop) {
+    try {
+        if (!keyValidate(publicKey))
+            return false;
+        return bls12_381_1.bls12_381.verify(pop, publicKey, publicKey, POP_OPTS);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=bls.js.map

package/dist/bls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bls.js","sourceRoot":"","sources":["../src/bls.ts"],"names":[],"mappings":";;;AA2CA,wBAGC;AAGD,kCAEC;AAOD,kCASC;AAGD,oBAEC;AAGD,wBAOC;AAMD,8BAGC;AAGD,kDAGC;AAqBD,0CAWC;AAOD,kDAWC;AAMD,4BAGC;AAID,8BAOC;AAvKD,uDAAoD;AACpD,+CAAiD;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AAEH,yFAAyF;AAC5E,QAAA,OAAO,GAAG,6CAA6C,CAAC;AACrE,oGAAoG;AACvF,QAAA,OAAO,GAAG,6CAA6C,CAAC;AAErE,gDAAgD;AACnC,QAAA,iBAAiB,GAAG,EAAE,CAAC;AACpC,+CAA+C;AAClC,QAAA,gBAAgB,GAAG,EAAE,CAAC;AAEnC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,eAAO,EAAW,CAAC;AAC3C,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,eAAO,EAAW,CAAC;AAS3C,mEAAmE;AACnE,SAAgB,MAAM;IACpB,MAAM,SAAS,GAAG,qBAAS,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACrD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,qBAAS,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,sDAAsD;AACtD,SAAgB,WAAW,CAAC,SAAqB;IAC/C,OAAO,qBAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,SAAqB;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,MAAM,CAAC,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,CAAC,CAAC,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAgB,IAAI,CAAC,SAAqB,EAAE,GAAe;IACzD,OAAO,qBAAS,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,SAAgB,MAAM,CAAC,SAAqB,EAAE,GAAe,EAAE,GAAe;IAC5E,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,qBAAS,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,IAAkB;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;IACtF,OAAO,qBAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,oGAAoG;AACpG,SAAgB,mBAAmB,CAAC,UAAwB;IAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IAChG,OAAO,qBAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAkB;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,IAAA,kBAAU,EAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,UAAwB,EAAE,IAAkB,EAAE,MAAkB;IAC9F,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrC,CAAC;QACD,OAAO,qBAAS,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,UAAwB,EAAE,GAAe,EAAE,MAAkB;IAC/F,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,GAAG,qBAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACxD,OAAO,qBAAS,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,SAAqB;IAC5C,MAAM,EAAE,GAAG,qBAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO,qBAAS,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;8FAC8F;AAC9F,SAAgB,SAAS,CAAC,SAAqB,EAAE,GAAe;IAC9D,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,qBAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/chain.d.ts

@@ -0,0 +1,53 @@
+import { type Caveat, type ChainResult } from '@atlasauth/pca';
+/** The signature suite tag carried on every BLS hop. */
+export declare const BLS_SUITE: "bls12-381-pop";
+export interface BlsCapability {
+    /** Content address of the signed body (== `body_digest`). */
+    id: string;
+    /** b64u BLS12-381 G1 public key that signed this hop. Root: the principal; child: the parent's holder. */
+    issuer: string;
+    /** b64u BLS12-381 G1 public key this capability is bound to (cnf). */
+    holder: string;
+    caveats: Caveat[];
+    /** {@link capHash} of the parent capability; absent on the root. */
+    parent?: string;
+    body_digest: string;
+    /** b64u BLS12-381 G2 signature over the domain-separated hop body. */
+    sig: string;
+    suite: typeof BLS_SUITE;
+}
+export type BlsCapabilityChain = BlsCapability[];
+/** Longest delegation chain accepted (bounds verification cost; mirrors the core chain's limit). */
+export declare const MAX_CHAIN_DEPTH = 16;
+/** Hash of a full capability (signature included); used as the child's `parent` link. */
+export declare function capHash(c: BlsCapability): string;
+/** b64u BLS G1 public key for a secret scalar — the identity a chain is rooted at / delegated to. */
+export declare function blsPublicKey(secretKey: Uint8Array): string;
+/** Mint a root capability, signed by the principal (root issuer). */
+export declare function mintBlsRoot(args: {
+    principalSecret: Uint8Array;
+    /** b64u BLS G1 principal key. */
+    principalPublic: string;
+    /** b64u BLS G1 holder key. */
+    holder: string;
+    caveats: Caveat[];
+}): BlsCapability;
+/** Child with the SAME holder; caveats = parent.caveats ++ added. Signed by the parent's holder. */
+export declare function blsAttenuate(parent: BlsCapability, addedCaveats: Caveat[], signerSecret: Uint8Array): BlsCapability;
+/** Like {@link blsAttenuate}, but rebinds `holder` to a new sub-agent key. */
+export declare function blsDelegate(parent: BlsCapability, toHolder: string, addedCaveats: Caveat[], signerSecret: Uint8Array): BlsCapability;
+/**
+ * Collapse every per-hop BLS signature in `chain` into ONE 96-byte aggregate. The chain's hop bodies
+ * are not re-derived here — only the signatures are summed; {@link verifyAggregatedChain} re-derives
+ * and checks them. Throws on an empty chain or a hop whose `sig` is not valid b64u.
+ */
+export declare function aggregateChainSignatures(chain: BlsCapabilityChain): Uint8Array;
+/**
+ * Verify an ENTIRE BLS capability chain against one aggregate signature.
+ *
+ * Does all the structural checks the core `verifyChain` does — depth bound, well-typedness, root has
+ * no parent, optional expected root principal, parent hash-links, holder→issuer continuity, and
+ * append-only caveat prefixes — then verifies all M hop signatures at once with a single
+ * distinct-message AggregateVerify over each hop's (issuer key, signed body) pair. Never throws.
+ */
+export declare function verifyAggregatedChain(chain: BlsCapabilityChain, aggSig: Uint8Array, expectedRootPrincipal?: string): ChainResult;

package/dist/chain.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_CHAIN_DEPTH = exports.BLS_SUITE = void 0;
+exports.capHash = capHash;
+exports.blsPublicKey = blsPublicKey;
+exports.mintBlsRoot = mintBlsRoot;
+exports.blsAttenuate = blsAttenuate;
+exports.blsDelegate = blsDelegate;
+exports.aggregateChainSignatures = aggregateChainSignatures;
+exports.verifyAggregatedChain = verifyAggregatedChain;
+const pca_1 = require("@atlasauth/pca");
+const bls_1 = require("./bls");
+/**
+ * A BLS-suite attenuable capability chain — the compact alternative to the core PCA chain's N
+ * separate Ed25519 hop signatures.
+ *
+ * The chain's STRUCTURE is identical to `@atlasauth/pca`'s Ed25519 `Capability`: each hop signs the
+ * canonical body `{ issuer, holder, caveats, parent }`, caveats are append-only (a child's array
+ * starts with the parent's exact prefix), holders bind to the next issuer, and parents are
+ * hash-linked. The ONLY difference is the signature: every hop is signed with the BLS12-381 PoP
+ * scheme (keys in G1, signatures in G2) instead of Ed25519.
+ *
+ * The payoff is {@link aggregateChainSignatures}: an M-hop chain's M per-hop signatures collapse into
+ * ONE 96-byte aggregate, and {@link verifyAggregatedChain} checks ALL M hops with a single
+ * pairing-product AggregateVerify instead of M separate verifications. Each hop signs a DISTINCT body
+ * (the parent hash-link alone differs per depth), so the distinct-message AggregateVerify applies.
+ */
+/** Domain separator for a BLS capability hop — distinct from the core chain's `atlas-pca/cap/v1`. */
+const CAP_BLS_DOMAIN = 'atlas-pca/cap-bls/v1\0';
+/** The signature suite tag carried on every BLS hop. */
+exports.BLS_SUITE = 'bls12-381-pop';
+/** Longest delegation chain accepted (bounds verification cost; mirrors the core chain's limit). */
+exports.MAX_CHAIN_DEPTH = 16;
+function bodyOf(c) {
+    return { issuer: c.issuer, holder: c.holder, caveats: c.caveats, parent: c.parent ?? null };
+}
+/** The exact bytes a hop signs: the domain separator followed by the raw body digest. */
+function sigMessage(bodyDigest) {
+    const d = (0, pca_1.unb64u)(bodyDigest);
+    const p = (0, pca_1.utf8)(CAP_BLS_DOMAIN);
+    const m = new Uint8Array(p.length + d.length);
+    m.set(p);
+    m.set(d, p.length);
+    return m;
+}
+/** Hash of a full capability (signature included); used as the child's `parent` link. */
+function capHash(c) {
+    return (0, pca_1.hashCanonical)(c);
+}
+function cloneCaveats(cs) {
+    const parsed = JSON.parse(new TextDecoder().decode((0, pca_1.canonicalBytes)(cs)));
+    return parsed;
+}
+function seal(body, signerSecret) {
+    const body_digest = (0, pca_1.hashCanonical)(bodyOf(body));
+    const sig = (0, pca_1.b64u)((0, bls_1.sign)(signerSecret, sigMessage(body_digest)));
+    const cap = {
+        id: body_digest,
+        issuer: body.issuer,
+        holder: body.holder,
+        caveats: body.caveats,
+        body_digest,
+        sig,
+        suite: exports.BLS_SUITE,
+    };
+    if (body.parent !== undefined)
+        cap.parent = body.parent;
+    return cap;
+}
+/** b64u BLS G1 public key for a secret scalar — the identity a chain is rooted at / delegated to. */
+function blsPublicKey(secretKey) {
+    return (0, pca_1.b64u)((0, bls_1.publicKeyOf)(secretKey));
+}
+/** Mint a root capability, signed by the principal (root issuer). */
+function mintBlsRoot(args) {
+    return seal({ issuer: args.principalPublic, holder: args.holder, caveats: cloneCaveats(args.caveats) }, args.principalSecret);
+}
+/** Child with the SAME holder; caveats = parent.caveats ++ added. Signed by the parent's holder. */
+function blsAttenuate(parent, addedCaveats, signerSecret) {
+    return blsDelegate(parent, parent.holder, addedCaveats, signerSecret);
+}
+/** Like {@link blsAttenuate}, but rebinds `holder` to a new sub-agent key. */
+function blsDelegate(parent, toHolder, addedCaveats, signerSecret) {
+    return seal({
+        issuer: parent.holder,
+        holder: toHolder,
+        caveats: [...cloneCaveats(parent.caveats), ...cloneCaveats(addedCaveats)],
+        parent: capHash(parent),
+    }, signerSecret);
+}
+function wellTyped(c) {
+    if (c === null || typeof c !== 'object')
+        return false;
+    const x = c;
+    return (typeof x.id === 'string' &&
+        typeof x.issuer === 'string' &&
+        typeof x.holder === 'string' &&
+        typeof x.body_digest === 'string' &&
+        typeof x.sig === 'string' &&
+        x.suite === exports.BLS_SUITE &&
+        (x.parent === undefined || typeof x.parent === 'string') &&
+        Array.isArray(x.caveats) &&
+        x.caveats.every((cv) => cv !== null && typeof cv === 'object' && !Array.isArray(cv) && typeof cv.type === 'string'));
+}
+/**
+ * Collapse every per-hop BLS signature in `chain` into ONE 96-byte aggregate. The chain's hop bodies
+ * are not re-derived here — only the signatures are summed; {@link verifyAggregatedChain} re-derives
+ * and checks them. Throws on an empty chain or a hop whose `sig` is not valid b64u.
+ */
+function aggregateChainSignatures(chain) {
+    if (!Array.isArray(chain) || chain.length === 0)
+        throw new RangeError('aggregateChainSignatures: empty chain');
+    return (0, bls_1.aggregate)(chain.map((c) => (0, pca_1.unb64u)(c.sig)));
+}
+/**
+ * Verify an ENTIRE BLS capability chain against one aggregate signature.
+ *
+ * Does all the structural checks the core `verifyChain` does — depth bound, well-typedness, root has
+ * no parent, optional expected root principal, parent hash-links, holder→issuer continuity, and
+ * append-only caveat prefixes — then verifies all M hop signatures at once with a single
+ * distinct-message AggregateVerify over each hop's (issuer key, signed body) pair. Never throws.
+ */
+function verifyAggregatedChain(chain, aggSig, expectedRootPrincipal) {
+    if (!Array.isArray(chain) || chain.length === 0)
+        return { ok: false, reason: 'empty chain' };
+    if (chain.length > exports.MAX_CHAIN_DEPTH)
+        return { ok: false, reason: `chain too long (max ${exports.MAX_CHAIN_DEPTH} hops)` };
+    for (let i = 0; i < chain.length; i++) {
+        if (!wellTyped(chain[i]))
+            return { ok: false, reason: `hop ${i}: malformed capability` };
+    }
+    const pks = [];
+    const msgs = [];
+    const root = chain[0];
+    if (root === undefined)
+        return { ok: false, reason: 'empty chain' };
+    if (root.parent !== undefined)
+        return { ok: false, reason: 'hop 0: root must not have a parent' };
+    if (expectedRootPrincipal !== undefined && root.issuer !== expectedRootPrincipal) {
+        return { ok: false, reason: 'hop 0: root issuer is not the expected principal' };
+    }
+    for (let i = 0; i < chain.length; i++) {
+        const c = chain[i];
+        if (c === undefined)
+            return { ok: false, reason: `hop ${i}: missing` };
+        let digest;
+        try {
+            digest = (0, pca_1.hashCanonical)(bodyOf(c));
+        }
+        catch {
+            return { ok: false, reason: `hop ${i}: malformed body` };
+        }
+        if (digest !== c.body_digest || c.id !== c.body_digest)
+            return { ok: false, reason: `hop ${i}: body digest mismatch` };
+        let pk;
+        try {
+            pk = (0, pca_1.unb64u)(c.issuer);
+        }
+        catch {
+            return { ok: false, reason: `hop ${i}: malformed issuer key` };
+        }
+        if (i > 0) {
+            const parent = chain[i - 1];
+            if (parent === undefined)
+                return { ok: false, reason: `hop ${i}: missing parent` };
+            if (c.parent !== capHash(parent))
+                return { ok: false, reason: `hop ${i}: broken parent link` };
+            if (c.issuer !== parent.holder)
+                return { ok: false, reason: `hop ${i}: issuer is not the parent's bound holder` };
+            if (c.caveats.length < parent.caveats.length)
+                return { ok: false, reason: `hop ${i}: drops parent caveat(s)` };
+            for (let j = 0; j < parent.caveats.length; j++) {
+                if ((0, pca_1.hashCanonical)(c.caveats[j]) !== (0, pca_1.hashCanonical)(parent.caveats[j])) {
+                    return { ok: false, reason: `hop ${i}: caveat ${j} altered or reordered` };
+                }
+            }
+        }
+        pks.push(pk);
+        msgs.push(sigMessage(c.body_digest));
+    }
+    if (!(0, bls_1.aggregateVerify)(pks, msgs, aggSig)) {
+        return { ok: false, reason: 'aggregate signature does not verify over all hops' };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=chain.js.map

package/dist/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":";;;AA4EA,0BAEC;AAwBD,oCAEC;AAGD,kCASC;AAGD,oCAEC;AAGD,kCAUC;AAuBD,4DAGC;AAUD,sDAwDC;AAlOD,wCAQwB;AACxB,+BAAiF;AAEjF;;;;;;;;;;;;;;GAcG;AAEH,qGAAqG;AACrG,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEhD,wDAAwD;AAC3C,QAAA,SAAS,GAAG,eAAwB,CAAC;AAoBlD,oGAAoG;AACvF,QAAA,eAAe,GAAG,EAAE,CAAC;AASlC,SAAS,MAAM,CAAC,CAAyE;IACvF,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;AAC9F,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,CAAC,GAAG,IAAA,YAAM,EAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAA,UAAI,EAAC,cAAc,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACT,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,yFAAyF;AACzF,SAAgB,OAAO,CAAC,CAAgB;IACtC,OAAO,IAAA,mBAAa,EAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,EAAqB;IACzC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAA,oBAAc,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,MAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,IAA4E,EAAE,YAAwB;IAClH,MAAM,WAAW,GAAG,IAAA,mBAAa,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAA,UAAI,EAAC,IAAA,UAAO,EAAC,YAAY,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAkB;QACzB,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW;QACX,GAAG;QACH,KAAK,EAAE,iBAAS;KACjB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,SAAgB,YAAY,CAAC,SAAqB;IAChD,OAAO,IAAA,UAAI,EAAC,IAAA,iBAAW,EAAC,SAAS,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,SAAgB,WAAW,CAAC,IAO3B;IACC,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AAChI,CAAC;AAED,oGAAoG;AACpG,SAAgB,YAAY,CAAC,MAAqB,EAAE,YAAsB,EAAE,YAAwB;IAClG,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,SAAgB,WAAW,CAAC,MAAqB,EAAE,QAAgB,EAAE,YAAsB,EAAE,YAAwB;IACnH,OAAO,IAAI,CACT;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;KACxB,EACD,YAAY,CACb,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,KAAK,KAAK,iBAAS;QACrB,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAQ,EAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,CAChI,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,KAAyB;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;IAC/G,OAAO,IAAA,eAAS,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,KAAyB,EAAE,MAAkB,EAAE,qBAA8B;IACjH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC7F,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,uBAAe,QAAQ,EAAE,CAAC;IACjH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAiB,EAAE,CAAC;IAE9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAClG,IAAI,qBAAqB,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAA,mBAAa,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,wBAAwB,EAAE,CAAC;QAEvH,IAAI,EAAc,CAAC;QACnB,IAAI,CAAC;YACH,EAAE,GAAG,IAAA,YAAM,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACnF,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC;YAC/F,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,2CAA2C,EAAE,CAAC;YAClH,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,0BAA0B,EAAE,CAAC;YAC/G,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,IAAI,IAAA,mBAAa,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,IAAA,mBAAa,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,uBAAuB,EAAE,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,IAAA,qBAAe,EAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @atlasauth/pca-aggsig — BLS12-381 signature aggregation for Proof-Carrying Authority.
+ *
+ * A whole delegation chain's per-hop signatures, and a transparency-ledger witness quorum's
+ * cosignatures, collapse into ONE compact aggregate signature verified with a single pairing-product
+ * check. Scheme: BLS (Boneh-Lynn-Shacham) with Proof-of-Possession (draft-irtf-cfrg-bls-signature),
+ * minimal-pubkey-size variant (G1 keys, G2 signatures). See {@link ./bls}.
+ */
+export { SIG_DST, POP_DST, PUBLIC_KEY_LENGTH, SIGNATURE_LENGTH, type BlsKeyPair, keyGen, publicKeyOf, keyValidate, sign, verify, aggregate, aggregatePublicKeys, aggregateVerify, fastAggregateVerify, popProve, popVerify, } from './bls';
+export { BLS_SUITE, MAX_CHAIN_DEPTH, type BlsCapability, type BlsCapabilityChain, capHash, blsPublicKey, mintBlsRoot, blsAttenuate, blsDelegate, aggregateChainSignatures, verifyAggregatedChain, } from './chain';
+export { type SthStatement, type BlsWitnessCosignature, cosignTreeHead, verifyWitnessCosignature, aggregateWitnessCosignatures, verifyAggregatedWitnessCosignatures, } from './witness';

package/dist/index.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * @atlasauth/pca-aggsig — BLS12-381 signature aggregation for Proof-Carrying Authority.
+ *
+ * A whole delegation chain's per-hop signatures, and a transparency-ledger witness quorum's
+ * cosignatures, collapse into ONE compact aggregate signature verified with a single pairing-product
+ * check. Scheme: BLS (Boneh-Lynn-Shacham) with Proof-of-Possession (draft-irtf-cfrg-bls-signature),
+ * minimal-pubkey-size variant (G1 keys, G2 signatures). See {@link ./bls}.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAggregatedWitnessCosignatures = exports.aggregateWitnessCosignatures = exports.verifyWitnessCosignature = exports.cosignTreeHead = exports.verifyAggregatedChain = exports.aggregateChainSignatures = exports.blsDelegate = exports.blsAttenuate = exports.mintBlsRoot = exports.blsPublicKey = exports.capHash = exports.MAX_CHAIN_DEPTH = exports.BLS_SUITE = exports.popVerify = exports.popProve = exports.fastAggregateVerify = exports.aggregateVerify = exports.aggregatePublicKeys = exports.aggregate = exports.verify = exports.sign = exports.keyValidate = exports.publicKeyOf = exports.keyGen = exports.SIGNATURE_LENGTH = exports.PUBLIC_KEY_LENGTH = exports.POP_DST = exports.SIG_DST = void 0;
+// Core BLS scheme + aggregation.
+var bls_1 = require("./bls");
+Object.defineProperty(exports, "SIG_DST", { enumerable: true, get: function () { return bls_1.SIG_DST; } });
+Object.defineProperty(exports, "POP_DST", { enumerable: true, get: function () { return bls_1.POP_DST; } });
+Object.defineProperty(exports, "PUBLIC_KEY_LENGTH", { enumerable: true, get: function () { return bls_1.PUBLIC_KEY_LENGTH; } });
+Object.defineProperty(exports, "SIGNATURE_LENGTH", { enumerable: true, get: function () { return bls_1.SIGNATURE_LENGTH; } });
+Object.defineProperty(exports, "keyGen", { enumerable: true, get: function () { return bls_1.keyGen; } });
+Object.defineProperty(exports, "publicKeyOf", { enumerable: true, get: function () { return bls_1.publicKeyOf; } });
+Object.defineProperty(exports, "keyValidate", { enumerable: true, get: function () { return bls_1.keyValidate; } });
+Object.defineProperty(exports, "sign", { enumerable: true, get: function () { return bls_1.sign; } });
+Object.defineProperty(exports, "verify", { enumerable: true, get: function () { return bls_1.verify; } });
+Object.defineProperty(exports, "aggregate", { enumerable: true, get: function () { return bls_1.aggregate; } });
+Object.defineProperty(exports, "aggregatePublicKeys", { enumerable: true, get: function () { return bls_1.aggregatePublicKeys; } });
+Object.defineProperty(exports, "aggregateVerify", { enumerable: true, get: function () { return bls_1.aggregateVerify; } });
+Object.defineProperty(exports, "fastAggregateVerify", { enumerable: true, get: function () { return bls_1.fastAggregateVerify; } });
+Object.defineProperty(exports, "popProve", { enumerable: true, get: function () { return bls_1.popProve; } });
+Object.defineProperty(exports, "popVerify", { enumerable: true, get: function () { return bls_1.popVerify; } });
+// PCA BLS-suite capability chain.
+var chain_1 = require("./chain");
+Object.defineProperty(exports, "BLS_SUITE", { enumerable: true, get: function () { return chain_1.BLS_SUITE; } });
+Object.defineProperty(exports, "MAX_CHAIN_DEPTH", { enumerable: true, get: function () { return chain_1.MAX_CHAIN_DEPTH; } });
+Object.defineProperty(exports, "capHash", { enumerable: true, get: function () { return chain_1.capHash; } });
+Object.defineProperty(exports, "blsPublicKey", { enumerable: true, get: function () { return chain_1.blsPublicKey; } });
+Object.defineProperty(exports, "mintBlsRoot", { enumerable: true, get: function () { return chain_1.mintBlsRoot; } });
+Object.defineProperty(exports, "blsAttenuate", { enumerable: true, get: function () { return chain_1.blsAttenuate; } });
+Object.defineProperty(exports, "blsDelegate", { enumerable: true, get: function () { return chain_1.blsDelegate; } });
+Object.defineProperty(exports, "aggregateChainSignatures", { enumerable: true, get: function () { return chain_1.aggregateChainSignatures; } });
+Object.defineProperty(exports, "verifyAggregatedChain", { enumerable: true, get: function () { return chain_1.verifyAggregatedChain; } });
+// Transparency-ledger witness cosignature aggregation.
+var witness_1 = require("./witness");
+Object.defineProperty(exports, "cosignTreeHead", { enumerable: true, get: function () { return witness_1.cosignTreeHead; } });
+Object.defineProperty(exports, "verifyWitnessCosignature", { enumerable: true, get: function () { return witness_1.verifyWitnessCosignature; } });
+Object.defineProperty(exports, "aggregateWitnessCosignatures", { enumerable: true, get: function () { return witness_1.aggregateWitnessCosignatures; } });
+Object.defineProperty(exports, "verifyAggregatedWitnessCosignatures", { enumerable: true, get: function () { return witness_1.verifyAggregatedWitnessCosignatures; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,iCAAiC;AACjC,6BAiBe;AAhBb,8FAAA,OAAO,OAAA;AACP,8FAAA,OAAO,OAAA;AACP,wGAAA,iBAAiB,OAAA;AACjB,uGAAA,gBAAgB,OAAA;AAEhB,6FAAA,MAAM,OAAA;AACN,kGAAA,WAAW,OAAA;AACX,kGAAA,WAAW,OAAA;AACX,2FAAA,IAAI,OAAA;AACJ,6FAAA,MAAM,OAAA;AACN,gGAAA,SAAS,OAAA;AACT,0GAAA,mBAAmB,OAAA;AACnB,sGAAA,eAAe,OAAA;AACf,0GAAA,mBAAmB,OAAA;AACnB,+FAAA,QAAQ,OAAA;AACR,gGAAA,SAAS,OAAA;AAGX,kCAAkC;AAClC,iCAYiB;AAXf,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAGf,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA;AACX,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA;AACX,iHAAA,wBAAwB,OAAA;AACxB,8GAAA,qBAAqB,OAAA;AAGvB,uDAAuD;AACvD,qCAOmB;AAJjB,yGAAA,cAAc,OAAA;AACd,mHAAA,wBAAwB,OAAA;AACxB,uHAAA,4BAA4B,OAAA;AAC5B,8HAAA,mCAAmC,OAAA"}

package/dist/witness.d.ts

@@ -0,0 +1,28 @@
+import { type SignedTreeHead } from '@atlasauth/pca';
+import { BLS_SUITE } from './chain';
+/** The tree-head statement a witness binds to — the same fields the core ledger cosigns. */
+export type SthStatement = Pick<SignedTreeHead, 'size' | 'root' | 'prev_root' | 'guardian_epoch'>;
+/** A BLS C2SP tlog-witness cosignature. */
+export interface BlsWitnessCosignature {
+    /** b64u BLS12-381 G1 witness public key. */
+    key: string;
+    /** b64u BLS12-381 G2 signature over the domain-separated STH statement. */
+    sig: string;
+    suite: typeof BLS_SUITE;
+}
+/** A trusted witness cosigns the tree-head statement with its BLS secret key. */
+export declare function cosignTreeHead(statement: SthStatement, witnessSecret: Uint8Array): BlsWitnessCosignature;
+/** Verify ONE cosignature against the exact tree-head statement. Never throws. */
+export declare function verifyWitnessCosignature(statement: SthStatement, cosig: BlsWitnessCosignature): boolean;
+/**
+ * Collapse a quorum of witness cosignatures into ONE 96-byte aggregate. Throws on an empty set or a
+ * cosignature whose `sig` is not valid b64u.
+ */
+export declare function aggregateWitnessCosignatures(cosigs: BlsWitnessCosignature[]): Uint8Array;
+/**
+ * Verify an aggregate of witness cosignatures over ONE tree-head statement with a single
+ * FastAggregateVerify. `witnessKeys` are the b64u public keys whose cosignatures were aggregated (the
+ * caller supplies exactly the quorum it trusts); every key is KeyValidate'd. Never throws; returns
+ * `false` on an empty set, a malformed key, or a failed pairing check.
+ */
+export declare function verifyAggregatedWitnessCosignatures(statement: SthStatement, witnessKeys: string[], aggSig: Uint8Array): boolean;

package/dist/witness.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cosignTreeHead = cosignTreeHead;
+exports.verifyWitnessCosignature = verifyWitnessCosignature;
+exports.aggregateWitnessCosignatures = aggregateWitnessCosignatures;
+exports.verifyAggregatedWitnessCosignatures = verifyAggregatedWitnessCosignatures;
+const pca_1 = require("@atlasauth/pca");
+const bls_1 = require("./bls");
+const chain_1 = require("./chain");
+/**
+ * BLS aggregation of transparency-ledger witness cosignatures (the C2SP tlog-witness / Sigsum model).
+ *
+ * In `@atlasauth/pca`'s ledger, a quorum of trusted witnesses each cosign the SAME tree-head statement
+ * — `{ size, root, prev_root, guardian_epoch }` — under their own key, turning a self-attested Signed
+ * Tree Head into an anti-equivocation artefact. With Ed25519 that is N independent signatures the
+ * monitor verifies one by one. Here each witness cosigns with the BLS12-381 PoP scheme, so
+ * {@link aggregateWitnessCosignatures} collapses the whole quorum into ONE 96-byte aggregate and
+ * {@link verifyAggregatedWitnessCosignatures} checks it with a single FastAggregateVerify (all
+ * witnesses signed the identical STH statement → same-message aggregation).
+ */
+/** Domain separator — distinct from the Ed25519 ledger's `atlas-pca/sth-witness/v1`, so a BLS
+ *  cosignature can never be confused with (or replayed against) the core witness domain. */
+const STH_WITNESS_BLS_DOMAIN = 'atlas-pca/sth-witness-bls/v1\0';
+/** The exact bytes a witness cosigns: domain separator followed by the canonical STH statement. */
+function witnessMessage(h) {
+    const body = (0, pca_1.canonicalBytes)({
+        size: h.size,
+        root: h.root,
+        prev_root: h.prev_root,
+        guardian_epoch: h.guardian_epoch ?? 0,
+    });
+    const p = (0, pca_1.utf8)(STH_WITNESS_BLS_DOMAIN);
+    const m = new Uint8Array(p.length + body.length);
+    m.set(p);
+    m.set(body, p.length);
+    return m;
+}
+/** A trusted witness cosigns the tree-head statement with its BLS secret key. */
+function cosignTreeHead(statement, witnessSecret) {
+    return {
+        key: (0, pca_1.b64u)((0, bls_1.publicKeyOf)(witnessSecret)),
+        sig: (0, pca_1.b64u)((0, bls_1.sign)(witnessSecret, witnessMessage(statement))),
+        suite: chain_1.BLS_SUITE,
+    };
+}
+/** Verify ONE cosignature against the exact tree-head statement. Never throws. */
+function verifyWitnessCosignature(statement, cosig) {
+    try {
+        if (cosig === null || typeof cosig !== 'object' || cosig.suite !== chain_1.BLS_SUITE)
+            return false;
+        return (0, bls_1.fastAggregateVerify)([(0, pca_1.unb64u)(cosig.key)], witnessMessage(statement), (0, pca_1.unb64u)(cosig.sig));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Collapse a quorum of witness cosignatures into ONE 96-byte aggregate. Throws on an empty set or a
+ * cosignature whose `sig` is not valid b64u.
+ */
+function aggregateWitnessCosignatures(cosigs) {
+    if (!Array.isArray(cosigs) || cosigs.length === 0)
+        throw new RangeError('aggregateWitnessCosignatures: empty set');
+    return (0, bls_1.aggregate)(cosigs.map((c) => (0, pca_1.unb64u)(c.sig)));
+}
+/**
+ * Verify an aggregate of witness cosignatures over ONE tree-head statement with a single
+ * FastAggregateVerify. `witnessKeys` are the b64u public keys whose cosignatures were aggregated (the
+ * caller supplies exactly the quorum it trusts); every key is KeyValidate'd. Never throws; returns
+ * `false` on an empty set, a malformed key, or a failed pairing check.
+ */
+function verifyAggregatedWitnessCosignatures(statement, witnessKeys, aggSig) {
+    try {
+        if (!Array.isArray(witnessKeys) || witnessKeys.length === 0)
+            return false;
+        const pks = witnessKeys.map((k) => (0, pca_1.unb64u)(k));
+        return (0, bls_1.fastAggregateVerify)(pks, witnessMessage(statement), aggSig);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=witness.js.map

package/dist/witness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"witness.js","sourceRoot":"","sources":["../src/witness.ts"],"names":[],"mappings":";;AAgDA,wCAMC;AAGD,4DAOC;AAMD,oEAGC;AAQD,kFAQC;AAzFD,wCAAyF;AACzF,+BAA0E;AAC1E,mCAAoC;AAEpC;;;;;;;;;;GAUG;AAEH;4FAC4F;AAC5F,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAchE,mGAAmG;AACnG,SAAS,cAAc,CAAC,CAAe;IACrC,MAAM,IAAI,GAAG,IAAA,oBAAc,EAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,IAAA,UAAI,EAAC,sBAAsB,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACT,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,SAAgB,cAAc,CAAC,SAAuB,EAAE,aAAyB;IAC/E,OAAO;QACL,GAAG,EAAE,IAAA,UAAI,EAAC,IAAA,iBAAW,EAAC,aAAa,CAAC,CAAC;QACrC,GAAG,EAAE,IAAA,UAAI,EAAC,IAAA,UAAI,EAAC,aAAa,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,KAAK,EAAE,iBAAS;KACjB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAgB,wBAAwB,CAAC,SAAuB,EAAE,KAA4B;IAC5F,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAS;YAAE,OAAO,KAAK,CAAC;QAC3F,OAAO,IAAA,yBAAmB,EAAC,CAAC,IAAA,YAAM,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,IAAA,YAAM,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,4BAA4B,CAAC,MAA+B;IAC1E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,CAAC;IACnH,OAAO,IAAA,eAAS,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mCAAmC,CAAC,SAAuB,EAAE,WAAqB,EAAE,MAAkB;IACpH,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1E,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,IAAA,yBAAmB,EAAC,GAAG,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,35 @@
 {
   "name": "@atlasauth/pca-aggsig",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "BLS signature aggregation for PCA: collapse a delegation chain per-hop signatures and transparency-ledger witness cosignatures into one compact BLS12-381 aggregate with aggregate-verify.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@noble/curves": "^1.6.0",
+    "@noble/hashes": "^1.5.0",
+    "@atlasauth/pca": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.