@atlasauth/pca-bbs 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,60 @@
-# Temporary Holding Version
+# @atlasauth/pca-bbs
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+BBS signatures (BLS12-381-SHA-256, following the IRTF CFRG BBS draft) for Proof-Carrying Authority (PCA). A PCA capability is issued as a multi-message BBS credential, then presented with selective disclosure and an unlinkable zero-knowledge proof of possession. An agent can reveal only the attributes a tool needs (for example the scope caveat) while hiding the rest (holder, budget, expiry), and two presentations of the same credential cannot be correlated.
+
+There are two layers:
+
+- the BBS core: `keyGen`, `createGenerators`, `messagesToScalars`, `sign`, `verify`, `proofGen`, `proofVerify`;
+- the PCA layer: map a capability to an ordered attribute vector (`iss`, `sub`, then `cav:<i>:<type>` per caveat), issue it, present a subset, verify the presentation.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-bbs
+```
+
+Depends on `@atlasauth/pca`, `@noble/curves` and `@noble/hashes` (installed automatically).
+
+## Usage
+
+```ts
+import {
+  generateKeyPair, issueCapabilityCredential, presentCredential, verifyCredential, verifyPresentation,
+} from '@atlasauth/pca-bbs';
+
+const bytes = (s: string) => new TextEncoder().encode(s);
+
+const capability = {
+  issuer: 'issuer-public-key',
+  holder: 'agent-public-key',
+  caveats: [
+    { type: 'scope', actions: ['search:read'] },
+    { type: 'budget_alloc', limit: 100 },
+  ],
+};
+
+const { sk, pk } = generateKeyPair();
+const cred = issueCapabilityCredential(capability, { sk, pk });
+verifyCredential(cred); // true: every attribute is signed by the issuer
+
+// Reveal only the scope caveat, bound to one action so the proof cannot be replayed elsewhere.
+const pres = presentCredential(cred, {
+  disclose: ['cav:0:scope'],
+  presentationHeader: bytes('action:search?q=atlas'),
+});
+
+verifyPresentation(pres); // true
+verifyPresentation(pres, { pk, presentationHeader: bytes('action:search?q=atlas') }); // pin issuer + context
+```
+
+`presentCredential` throws if a requested attribute name does not exist. Pass a pinned `pk` and your own `presentationHeader` to `verifyPresentation` so the verifier asserts its own expectations rather than trusting the values carried in the presentation.
+
+## Status
+
+Cryptography is unaudited. The BBS implementation follows the CFRG draft and is checked against its test vectors, but the draft is not a final standard. BBS on BLS12-381 is not post-quantum.
+
+Source and issues: https://github.com/Atlas-Authorization/pca
+
+## License
+
+MIT - see LICENSE

package/dist/bbs.d.ts

@@ -0,0 +1,85 @@
+/**
+ * BBS signatures over BLS12-381, faithful to draft-irtf-cfrg-bbs-signatures (the 2023–2024 CFRG
+ * draft; this implementation follows draft-07's core protocol and octet encodings).
+ *
+ * Ciphersuite: **BLS12-381-SHA-256** — `BBS_BLS12381G1_XMD:SHA-256_SSWU_RO_`.
+ *   - signatures/generators live in G1 (48-byte compressed points), public keys in G2 (96-byte
+ *     compressed points), scalars are 32 bytes big-endian in the field of order `r`;
+ *   - hashing uses `expand_message_xmd` with SHA-256 (RFC 9380), `expand_len = 48`;
+ *   - the api_id is `ciphersuite_id || "H2G_HM2S_"`.
+ *
+ * A BBS signature covers an ORDERED VECTOR of messages. From one signature a holder can produce an
+ * unlimited number of zero-knowledge proofs, each revealing an arbitrary SUBSET of the messages and
+ * proving knowledge of the rest — with two properties that make this the privacy frontier for agent
+ * authority:
+ *   - SELECTIVE DISCLOSURE: the verifier learns only the disclosed messages;
+ *   - UNLINKABILITY: the signature value `A` is never shown (it is blinded into `Ā`, `B̄`, `D` with
+ *     fresh randomness every time), so two presentations of the same credential cannot be correlated.
+ *
+ * Implementation notes:
+ *   - Scalar arithmetic uses the curve's own scalar field `Fr` (order `r`); point arithmetic uses
+ *     `multiplyUnsafe` (variable-time). This mirrors the draft's reference clarity and is appropriate
+ *     for the public blinding operations here; it is NOT a constant-time implementation and callers
+ *     holding long-lived secret keys in an adversarial co-tenant should keep that in mind.
+ *   - All cross-language octet encodings (point/scalar/integer serialization, challenge and domain
+ *     inputs) follow the draft so a conforming verifier in another language interoperates.
+ */
+import { bls12_381 } from '@noble/curves/bls12-381';
+/** A point of G1 (signatures, generators, proof commitments). */
+export type G1Point = InstanceType<typeof bls12_381.G1.ProjectivePoint>;
+/** A point of G2 (public keys). */
+export type G2Point = InstanceType<typeof bls12_381.G2.ProjectivePoint>;
+/** Order of the BBS scalar field (the prime subgroup order `r`). */
+export declare const R: bigint;
+/** The ciphersuite identifier (without the api_id suffix). */
+export declare const CIPHERSUITE_ID = "BBS_BLS12381G1_XMD:SHA-256_SSWU_RO_";
+/** api_id = ciphersuite_id || "H2G_HM2S_". */
+export declare const API_ID = "BBS_BLS12381G1_XMD:SHA-256_SSWU_RO_H2G_HM2S_";
+/** hash_to_scalar(msg, dst) = OS2IP(expand_message_xmd(msg, dst, 48)) mod r (draft §4.2.2). */
+export declare function hashToScalar(msg: Uint8Array, dst: string): bigint;
+/** MapMessageToScalarAsHash: one message octet string -> one scalar (draft §4.2). */
+export declare function mapMessageToScalarAsHash(message: Uint8Array): bigint;
+/** messages_to_scalars: map each message octet string to its scalar (draft §4.2). */
+export declare function messagesToScalars(messages: readonly Uint8Array[]): bigint[];
+/**
+ * create_generators(count): the deterministic generator sequence `(Q_1, H_1, ..., H_{count-1})`
+ * (draft §4.1). Each generator is the hash-to-curve of a chained `expand_message` ratchet.
+ */
+export declare function createGenerators(count: number): G1Point[];
+/**
+ * KeyGen: derive a secret scalar `SK` from key material and optional context info (draft §3.4.1).
+ * Requires at least 32 octets of key material. Returns the scalar; never 0.
+ */
+export declare function keyGen(keyMaterial: Uint8Array, keyInfo?: Uint8Array): bigint;
+/** SkToPk: the public key octets `point_to_octets_E2(SK · BP2)` (draft §3.4.2). */
+export declare function skToPk(sk: bigint): Uint8Array;
+/** Convenience: generate a fresh (SK scalar, PK octets) pair from the system CSPRNG. */
+export declare function generateKeyPair(): {
+    sk: bigint;
+    pk: Uint8Array;
+};
+/** A 32-octet big-endian secret scalar (e.g. to serialize or parse a given SK). */
+export declare function skToBytes(sk: bigint): Uint8Array;
+export declare function skFromBytes(bytes: Uint8Array): bigint;
+/**
+ * Sign(SK, PK, header, messages): produce an 80-octet BBS signature over the ordered message vector.
+ * `header` is an optional application-bound context signed into the credential (not selectively
+ * disclosable). Returns `signature_to_octets(A, e)`.
+ */
+export declare function sign(sk: bigint, pk: Uint8Array, header: Uint8Array, messages: readonly Uint8Array[]): Uint8Array;
+/** Verify(PK, signature, header, messages): true iff the signature covers exactly these messages. */
+export declare function verify(pk: Uint8Array, signature: Uint8Array, header: Uint8Array, messages: readonly Uint8Array[]): boolean;
+/**
+ * ProofGen(PK, signature, header, ph, messages, disclosed_indexes): a zero-knowledge
+ * proof-of-knowledge of the signature that selectively discloses the messages at
+ * `disclosed_indexes`. `ph` is the presentation header (binds the proof to a context, e.g. a nonce
+ * or the request it authorizes). The proof is randomized: each call produces different octets.
+ */
+export declare function proofGen(pk: Uint8Array, signature: Uint8Array, header: Uint8Array, ph: Uint8Array, messages: readonly Uint8Array[], disclosedIndexes: readonly number[]): Uint8Array;
+/**
+ * ProofVerify(PK, proof, header, ph, disclosed_messages, disclosed_indexes): true iff `proof` is a
+ * valid selective-disclosure proof under `PK` revealing exactly `disclosed_messages` at
+ * `disclosed_indexes`, bound to `header` and `ph`. `disclosed_messages[k]` must correspond to
+ * `disclosed_indexes[k]`.
+ */
+export declare function proofVerify(pk: Uint8Array, proof: Uint8Array, header: Uint8Array, ph: Uint8Array, disclosedMessages: readonly Uint8Array[], disclosedIndexes: readonly number[]): boolean;

package/dist/bbs.js

@@ -0,0 +1,454 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.API_ID = exports.CIPHERSUITE_ID = exports.R = void 0;
+exports.hashToScalar = hashToScalar;
+exports.mapMessageToScalarAsHash = mapMessageToScalarAsHash;
+exports.messagesToScalars = messagesToScalars;
+exports.createGenerators = createGenerators;
+exports.keyGen = keyGen;
+exports.skToPk = skToPk;
+exports.generateKeyPair = generateKeyPair;
+exports.skToBytes = skToBytes;
+exports.skFromBytes = skFromBytes;
+exports.sign = sign;
+exports.verify = verify;
+exports.proofGen = proofGen;
+exports.proofVerify = proofVerify;
+/**
+ * BBS signatures over BLS12-381, faithful to draft-irtf-cfrg-bbs-signatures (the 2023–2024 CFRG
+ * draft; this implementation follows draft-07's core protocol and octet encodings).
+ *
+ * Ciphersuite: **BLS12-381-SHA-256** — `BBS_BLS12381G1_XMD:SHA-256_SSWU_RO_`.
+ *   - signatures/generators live in G1 (48-byte compressed points), public keys in G2 (96-byte
+ *     compressed points), scalars are 32 bytes big-endian in the field of order `r`;
+ *   - hashing uses `expand_message_xmd` with SHA-256 (RFC 9380), `expand_len = 48`;
+ *   - the api_id is `ciphersuite_id || "H2G_HM2S_"`.
+ *
+ * A BBS signature covers an ORDERED VECTOR of messages. From one signature a holder can produce an
+ * unlimited number of zero-knowledge proofs, each revealing an arbitrary SUBSET of the messages and
+ * proving knowledge of the rest — with two properties that make this the privacy frontier for agent
+ * authority:
+ *   - SELECTIVE DISCLOSURE: the verifier learns only the disclosed messages;
+ *   - UNLINKABILITY: the signature value `A` is never shown (it is blinded into `Ā`, `B̄`, `D` with
+ *     fresh randomness every time), so two presentations of the same credential cannot be correlated.
+ *
+ * Implementation notes:
+ *   - Scalar arithmetic uses the curve's own scalar field `Fr` (order `r`); point arithmetic uses
+ *     `multiplyUnsafe` (variable-time). This mirrors the draft's reference clarity and is appropriate
+ *     for the public blinding operations here; it is NOT a constant-time implementation and callers
+ *     holding long-lived secret keys in an adversarial co-tenant should keep that in mind.
+ *   - All cross-language octet encodings (point/scalar/integer serialization, challenge and domain
+ *     inputs) follow the draft so a conforming verifier in another language interoperates.
+ */
+const bls12_381_1 = require("@noble/curves/bls12-381");
+const hash_to_curve_1 = require("@noble/curves/abstract/hash-to-curve");
+const utils_1 = require("@noble/curves/abstract/utils");
+const sha256_1 = require("@noble/hashes/sha256");
+const utils_2 = require("@noble/hashes/utils");
+// ---- curve handles ----------------------------------------------------------------------------
+const G1 = bls12_381_1.bls12_381.G1.ProjectivePoint;
+const G2 = bls12_381_1.bls12_381.G2.ProjectivePoint;
+const Fr = bls12_381_1.bls12_381.fields.Fr;
+const Fp12 = bls12_381_1.bls12_381.fields.Fp12;
+/** Order of the BBS scalar field (the prime subgroup order `r`). */
+exports.R = Fr.ORDER;
+// ---- ciphersuite constants (BLS12-381-SHA-256) ------------------------------------------------
+/** The ciphersuite identifier (without the api_id suffix). */
+exports.CIPHERSUITE_ID = 'BBS_BLS12381G1_XMD:SHA-256_SSWU_RO_';
+/** api_id = ciphersuite_id || "H2G_HM2S_". */
+exports.API_ID = `${exports.CIPHERSUITE_ID}H2G_HM2S_`;
+const OCTET_SCALAR_LENGTH = 32;
+const OCTET_POINT_LENGTH = 48; // G1, compressed
+const EXPAND_LEN = 48;
+const H2S_DST = `${exports.API_ID}H2S_`;
+const MAP_DST = `${exports.API_ID}MAP_MSG_TO_SCALAR_AS_HASH_`;
+const SEED_DST = `${exports.API_ID}SIG_GENERATOR_SEED_`;
+const GEN_DST = `${exports.API_ID}SIG_GENERATOR_DST_`;
+const GEN_SEED = `${exports.API_ID}MESSAGE_GENERATOR_SEED`;
+const KEYGEN_DST = `${exports.CIPHERSUITE_ID}KEYGEN_DST_`;
+/**
+ * P1: the fixed G1 generator of the BLS12-381-SHA-256 ciphersuite (draft §7.2.2), as published.
+ * Signing commits the message vector against P1, Q_1 and the per-message generators H_i.
+ */
+const P1_HEX = 'a8ce256102840821a3e94ea9025e4662b205762f9776b3a766c872b948f1fd225e7c59698588e70d11406d161b4e28c9';
+const P1 = G1.fromHex(P1_HEX);
+/** The base point of G2 (public keys are `SK · BP2`). */
+const BP2 = G2.BASE;
+// ---- small octet / scalar helpers -------------------------------------------------------------
+const TEXT = new TextEncoder();
+function ascii(s) {
+    return TEXT.encode(s);
+}
+/** I2OSP: non-negative integer -> fixed-length big-endian octets (RFC 8017 §4.1). */
+function i2osp(n, len) {
+    return (0, utils_1.numberToBytesBE)(n, len);
+}
+/** OS2IP: big-endian octets -> non-negative integer (RFC 8017 §4.2). */
+function os2ip(b) {
+    return (0, utils_1.bytesToNumberBE)(b);
+}
+/** Checked array read (keeps `noUncheckedIndexedAccess` honest without non-null assertions). */
+function at(arr, i) {
+    const v = arr[i];
+    if (v === undefined)
+        throw new RangeError(`bbs: index ${i} out of range (len ${arr.length})`);
+    return v;
+}
+/** expand_message_xmd with SHA-256 (RFC 9380 §5.3.1). */
+function expand(msg, dst, len) {
+    return (0, hash_to_curve_1.expand_message_xmd)(msg, ascii(dst), len, sha256_1.sha256);
+}
+/** hash_to_scalar(msg, dst) = OS2IP(expand_message_xmd(msg, dst, 48)) mod r (draft §4.2.2). */
+function hashToScalar(msg, dst) {
+    return Fr.create(os2ip(expand(msg, dst, EXPAND_LEN)));
+}
+/** MapMessageToScalarAsHash: one message octet string -> one scalar (draft §4.2). */
+function mapMessageToScalarAsHash(message) {
+    return hashToScalar(message, MAP_DST);
+}
+/** messages_to_scalars: map each message octet string to its scalar (draft §4.2). */
+function messagesToScalars(messages) {
+    return messages.map((m) => mapMessageToScalarAsHash(m));
+}
+/**
+ * create_generators(count): the deterministic generator sequence `(Q_1, H_1, ..., H_{count-1})`
+ * (draft §4.1). Each generator is the hash-to-curve of a chained `expand_message` ratchet.
+ */
+function createGenerators(count) {
+    if (!Number.isInteger(count) || count < 0)
+        throw new RangeError('bbs: generator count must be a non-negative integer');
+    const gens = [];
+    let v = expand(ascii(GEN_SEED), SEED_DST, EXPAND_LEN);
+    for (let i = 1; i <= count; i++) {
+        v = expand((0, utils_1.concatBytes)(v, i2osp(BigInt(i), 8)), SEED_DST, EXPAND_LEN);
+        const h2c = bls12_381_1.bls12_381.G1.hashToCurve(v, { DST: GEN_DST });
+        gens.push(G1.fromAffine(h2c.toAffine()));
+    }
+    return gens;
+}
+function serialize(els) {
+    const parts = [];
+    for (const el of els) {
+        switch (el.t) {
+            case 'g1':
+                parts.push(el.v.toRawBytes(true));
+                break;
+            case 'g2':
+                parts.push(el.v.toRawBytes(true));
+                break;
+            case 'scalar':
+                parts.push(i2osp(el.v, OCTET_SCALAR_LENGTH));
+                break;
+            case 'int':
+                parts.push(i2osp(BigInt(el.v), 8));
+                break;
+        }
+    }
+    return (0, utils_1.concatBytes)(...parts);
+}
+// ---- point arithmetic helpers -----------------------------------------------------------------
+function g1mul(P, s) {
+    const sc = Fr.create(s);
+    return sc === 0n ? G1.ZERO : P.multiplyUnsafe(sc);
+}
+function g2mul(P, s) {
+    const sc = Fr.create(s);
+    return sc === 0n ? G2.ZERO : P.multiplyUnsafe(sc);
+}
+// ---- key generation (draft §3.4) --------------------------------------------------------------
+/**
+ * KeyGen: derive a secret scalar `SK` from key material and optional context info (draft §3.4.1).
+ * Requires at least 32 octets of key material. Returns the scalar; never 0.
+ */
+function keyGen(keyMaterial, keyInfo = new Uint8Array(0)) {
+    if (keyMaterial.length < 32)
+        throw new RangeError('bbs: key material must be at least 32 octets');
+    if (keyInfo.length > 65535)
+        throw new RangeError('bbs: key info must be at most 65535 octets');
+    const deriveInput = (0, utils_1.concatBytes)(keyMaterial, i2osp(BigInt(keyInfo.length), 2), keyInfo);
+    const sk = hashToScalar(deriveInput, KEYGEN_DST);
+    if (sk === 0n)
+        throw new Error('bbs: derived SK is zero (retry with different key material)');
+    return sk;
+}
+/** SkToPk: the public key octets `point_to_octets_E2(SK · BP2)` (draft §3.4.2). */
+function skToPk(sk) {
+    return g2mul(BP2, sk).toRawBytes(true);
+}
+/** Convenience: generate a fresh (SK scalar, PK octets) pair from the system CSPRNG. */
+function generateKeyPair() {
+    const sk = keyGen((0, utils_2.randomBytes)(32));
+    return { sk, pk: skToPk(sk) };
+}
+/** A 32-octet big-endian secret scalar (e.g. to serialize or parse a given SK). */
+function skToBytes(sk) {
+    return i2osp(sk, OCTET_SCALAR_LENGTH);
+}
+function skFromBytes(bytes) {
+    if (bytes.length !== OCTET_SCALAR_LENGTH)
+        throw new RangeError('bbs: SK must be 32 octets');
+    const sk = os2ip(bytes);
+    if (sk === 0n || sk >= exports.R)
+        throw new RangeError('bbs: SK out of range');
+    return sk;
+}
+function signatureToOctets(A, e) {
+    return (0, utils_1.concatBytes)(A.toRawBytes(true), i2osp(e, OCTET_SCALAR_LENGTH));
+}
+function octetsToSignature(sig) {
+    if (sig.length !== OCTET_POINT_LENGTH + OCTET_SCALAR_LENGTH) {
+        throw new RangeError('bbs: signature must be 80 octets');
+    }
+    const A = G1.fromHex(sig.subarray(0, OCTET_POINT_LENGTH));
+    if (A.equals(G1.ZERO))
+        throw new Error('bbs: signature point A is the identity');
+    const e = os2ip(sig.subarray(OCTET_POINT_LENGTH));
+    if (e <= 0n || e >= exports.R)
+        throw new RangeError('bbs: signature scalar e out of range');
+    return { A, e };
+}
+// ---- domain (draft §4.2.3) --------------------------------------------------------------------
+function calculateDomain(pk, Q1, H, header) {
+    const els = [{ t: 'int', v: H.length }, { t: 'g1', v: Q1 }];
+    for (const h of H)
+        els.push({ t: 'g1', v: h });
+    const domOcts = (0, utils_1.concatBytes)(serialize(els), ascii(exports.API_ID));
+    const domInput = (0, utils_1.concatBytes)(pk, domOcts, i2osp(BigInt(header.length), 8), header);
+    return hashToScalar(domInput, H2S_DST);
+}
+/** B = P1 + Q_1·domain + Σ H_i·msg_i (the common commitment used by Sign/Verify/ProofGen). */
+function computeB(Q1, H, domain, msgScalars) {
+    let B = P1.add(g1mul(Q1, domain));
+    for (let i = 0; i < msgScalars.length; i++) {
+        B = B.add(g1mul(at(H, i), at(msgScalars, i)));
+    }
+    return B;
+}
+// ---- Sign / Verify (draft §3.5.1 / §3.5.2, cores §3.6.1 / §3.6.2) -----------------------------
+/**
+ * Sign(SK, PK, header, messages): produce an 80-octet BBS signature over the ordered message vector.
+ * `header` is an optional application-bound context signed into the credential (not selectively
+ * disclosable). Returns `signature_to_octets(A, e)`.
+ */
+function sign(sk, pk, header, messages) {
+    const msgScalars = messagesToScalars(messages);
+    const L = msgScalars.length;
+    const gens = createGenerators(L + 1);
+    const Q1 = at(gens, 0);
+    const H = gens.slice(1);
+    const domain = calculateDomain(pk, Q1, H, header);
+    // e = hash_to_scalar(serialize(SK, msg_1, ..., msg_L, domain), H2S_DST)   (deterministic nonce)
+    const eEls = [{ t: 'scalar', v: sk }];
+    for (const m of msgScalars)
+        eEls.push({ t: 'scalar', v: m });
+    eEls.push({ t: 'scalar', v: domain });
+    const e = hashToScalar(serialize(eEls), H2S_DST);
+    const B = computeB(Q1, H, domain, msgScalars);
+    const A = g1mul(B, Fr.inv(Fr.add(sk, e))); // A = B · 1/(SK + e)
+    return signatureToOctets(A, e);
+}
+/** Verify(PK, signature, header, messages): true iff the signature covers exactly these messages. */
+function verify(pk, signature, header, messages) {
+    let parsed;
+    let W;
+    try {
+        parsed = octetsToSignature(signature);
+        W = G2.fromHex(pk);
+    }
+    catch {
+        return false;
+    }
+    if (W.equals(G2.ZERO))
+        return false;
+    const msgScalars = messagesToScalars(messages);
+    const L = msgScalars.length;
+    const gens = createGenerators(L + 1);
+    const Q1 = at(gens, 0);
+    const H = gens.slice(1);
+    const domain = calculateDomain(pk, Q1, H, header);
+    const B = computeB(Q1, H, domain, msgScalars);
+    // Pairing check: e(A, W + BP2·e) == e(B, BP2)  ⇔  e(A, (SK+e)·BP2) == e(B, BP2).
+    const lhs = bls12_381_1.bls12_381.pairing(parsed.A, W.add(g2mul(BP2, parsed.e)));
+    const rhs = bls12_381_1.bls12_381.pairing(B, BP2);
+    return Fp12.eql(lhs, rhs);
+}
+// ---- random scalars (draft §4.2.1) ------------------------------------------------------------
+function calculateRandomScalars(count) {
+    const out = [];
+    for (let i = 0; i < count; i++)
+        out.push(Fr.create(os2ip((0, utils_2.randomBytes)(EXPAND_LEN))));
+    return out;
+}
+// ---- challenge (draft §3.7.4 ProofChallengeCalculate) -----------------------------------------
+function calculateChallenge(Abar, Bbar, D, T1, T2, disclosedIndexes, disclosedMsgs, domain, ph) {
+    const els = [{ t: 'int', v: disclosedIndexes.length }];
+    for (let k = 0; k < disclosedIndexes.length; k++) {
+        els.push({ t: 'int', v: at(disclosedIndexes, k) });
+        els.push({ t: 'scalar', v: at(disclosedMsgs, k) });
+    }
+    els.push({ t: 'g1', v: Abar }, { t: 'g1', v: Bbar }, { t: 'g1', v: D }, { t: 'g1', v: T1 }, { t: 'g1', v: T2 }, { t: 'scalar', v: domain });
+    const cOcts = (0, utils_1.concatBytes)(serialize(els), i2osp(BigInt(ph.length), 8), ph);
+    return hashToScalar(cOcts, H2S_DST);
+}
+function proofToOctets(p) {
+    const parts = [p.Abar.toRawBytes(true), p.Bbar.toRawBytes(true), p.D.toRawBytes(true)];
+    parts.push(i2osp(p.eHat, OCTET_SCALAR_LENGTH), i2osp(p.r1Hat, OCTET_SCALAR_LENGTH), i2osp(p.r3Hat, OCTET_SCALAR_LENGTH));
+    for (const m of p.mHat)
+        parts.push(i2osp(m, OCTET_SCALAR_LENGTH));
+    parts.push(i2osp(p.c, OCTET_SCALAR_LENGTH));
+    return (0, utils_1.concatBytes)(...parts);
+}
+function readScalar(proof, offset) {
+    const v = os2ip(proof.subarray(offset, offset + OCTET_SCALAR_LENGTH));
+    if (v >= exports.R)
+        throw new RangeError('bbs: proof scalar out of range');
+    return v;
+}
+function octetsToProof(proof) {
+    const fixed = 3 * OCTET_POINT_LENGTH + 4 * OCTET_SCALAR_LENGTH; // 3 points + eHat,r1Hat,r3Hat,c
+    if (proof.length < fixed || (proof.length - fixed) % OCTET_SCALAR_LENGTH !== 0) {
+        throw new RangeError('bbs: malformed proof length');
+    }
+    let o = 0;
+    const Abar = G1.fromHex(proof.subarray(o, (o += OCTET_POINT_LENGTH)));
+    const Bbar = G1.fromHex(proof.subarray(o, (o += OCTET_POINT_LENGTH)));
+    const D = G1.fromHex(proof.subarray(o, (o += OCTET_POINT_LENGTH)));
+    const eHat = readScalar(proof, o);
+    o += OCTET_SCALAR_LENGTH;
+    const r1Hat = readScalar(proof, o);
+    o += OCTET_SCALAR_LENGTH;
+    const r3Hat = readScalar(proof, o);
+    o += OCTET_SCALAR_LENGTH;
+    const U = (proof.length - fixed) / OCTET_SCALAR_LENGTH;
+    const mHat = [];
+    for (let i = 0; i < U; i++) {
+        mHat.push(readScalar(proof, o));
+        o += OCTET_SCALAR_LENGTH;
+    }
+    const c = readScalar(proof, o);
+    if (Abar.equals(G1.ZERO) || Bbar.equals(G1.ZERO) || D.equals(G1.ZERO)) {
+        throw new Error('bbs: proof contains the identity point');
+    }
+    return { Abar, Bbar, D, eHat, r1Hat, r3Hat, mHat, c };
+}
+// ---- index-set helpers ------------------------------------------------------------------------
+function validateIndexes(indexes, L) {
+    const seen = new Set();
+    for (const i of indexes) {
+        if (!Number.isInteger(i) || i < 0 || i >= L)
+            throw new RangeError(`bbs: disclosed index ${i} out of range [0, ${L})`);
+        if (seen.has(i))
+            throw new RangeError(`bbs: duplicate disclosed index ${i}`);
+        seen.add(i);
+    }
+}
+function undisclosedAscending(disclosed, L) {
+    const out = [];
+    for (let i = 0; i < L; i++)
+        if (!disclosed.has(i))
+            out.push(i);
+    return out;
+}
+// ---- ProofGen (draft §3.5.3, core §3.6.3) -----------------------------------------------------
+/**
+ * ProofGen(PK, signature, header, ph, messages, disclosed_indexes): a zero-knowledge
+ * proof-of-knowledge of the signature that selectively discloses the messages at
+ * `disclosed_indexes`. `ph` is the presentation header (binds the proof to a context, e.g. a nonce
+ * or the request it authorizes). The proof is randomized: each call produces different octets.
+ */
+function proofGen(pk, signature, header, ph, messages, disclosedIndexes) {
+    const { A, e } = octetsToSignature(signature);
+    const msgScalars = messagesToScalars(messages);
+    const L = msgScalars.length;
+    validateIndexes(disclosedIndexes, L);
+    const disclosedSet = new Set(disclosedIndexes);
+    const disclosed = [...disclosedSet].sort((a, b) => a - b);
+    const undisclosed = undisclosedAscending(disclosedSet, L);
+    const U = undisclosed.length;
+    const gens = createGenerators(L + 1);
+    const Q1 = at(gens, 0);
+    const H = gens.slice(1);
+    const domain = calculateDomain(pk, Q1, H, header);
+    const B = computeB(Q1, H, domain, msgScalars);
+    const rs = calculateRandomScalars(5 + U);
+    const r1 = at(rs, 0);
+    const r2 = at(rs, 1);
+    const eTilde = at(rs, 2);
+    const r1Tilde = at(rs, 3);
+    const r3Tilde = at(rs, 4);
+    const mTilde = rs.slice(5);
+    const D = g1mul(B, r2);
+    const Abar = g1mul(A, Fr.mul(r1, r2));
+    const Bbar = g1mul(D, r1).subtract(g1mul(Abar, e));
+    const T1 = g1mul(Abar, eTilde).add(g1mul(D, r1Tilde));
+    let T2 = g1mul(D, r3Tilde);
+    for (let k = 0; k < U; k++)
+        T2 = T2.add(g1mul(at(H, at(undisclosed, k)), at(mTilde, k)));
+    const disclosedMsgs = disclosed.map((i) => at(msgScalars, i));
+    const c = calculateChallenge(Abar, Bbar, D, T1, T2, disclosed, disclosedMsgs, domain, ph);
+    const r3 = Fr.inv(r2);
+    const eHat = Fr.add(eTilde, Fr.mul(e, c));
+    const r1Hat = Fr.sub(r1Tilde, Fr.mul(r1, c));
+    const r3Hat = Fr.sub(r3Tilde, Fr.mul(r3, c));
+    const mHat = [];
+    for (let k = 0; k < U; k++)
+        mHat.push(Fr.add(at(mTilde, k), Fr.mul(at(msgScalars, at(undisclosed, k)), c)));
+    return proofToOctets({ Abar, Bbar, D, eHat, r1Hat, r3Hat, mHat, c });
+}
+// ---- ProofVerify (draft §3.5.4, core §3.6.4) --------------------------------------------------
+/**
+ * ProofVerify(PK, proof, header, ph, disclosed_messages, disclosed_indexes): true iff `proof` is a
+ * valid selective-disclosure proof under `PK` revealing exactly `disclosed_messages` at
+ * `disclosed_indexes`, bound to `header` and `ph`. `disclosed_messages[k]` must correspond to
+ * `disclosed_indexes[k]`.
+ */
+function proofVerify(pk, proof, header, ph, disclosedMessages, disclosedIndexes) {
+    let p;
+    let W;
+    try {
+        p = octetsToProof(proof);
+        W = G2.fromHex(pk);
+    }
+    catch {
+        return false;
+    }
+    if (W.equals(G2.ZERO))
+        return false;
+    if (disclosedMessages.length !== disclosedIndexes.length)
+        return false;
+    const U = p.mHat.length;
+    const R_count = disclosedIndexes.length;
+    const L = R_count + U;
+    let disclosed;
+    try {
+        validateIndexes(disclosedIndexes, L);
+        const disclosedScalars = messagesToScalars(disclosedMessages);
+        disclosed = disclosedIndexes.map((idx, k) => ({ idx, msg: at(disclosedScalars, k) }));
+    }
+    catch {
+        return false;
+    }
+    disclosed.sort((a, b) => a.idx - b.idx);
+    const disclosedSet = new Set(disclosed.map((d) => d.idx));
+    const undisclosed = undisclosedAscending(disclosedSet, L);
+    const gens = createGenerators(L + 1);
+    const Q1 = at(gens, 0);
+    const H = gens.slice(1);
+    const domain = calculateDomain(pk, Q1, H, header);
+    // T1 = B̄·c + Ā·ê + D·r̂1
+    const T1 = g1mul(p.Bbar, p.c).add(g1mul(p.Abar, p.eHat)).add(g1mul(p.D, p.r1Hat));
+    // Bv = P1 + Q_1·domain + Σ_{disclosed} H_i·msg_i
+    let Bv = P1.add(g1mul(Q1, domain));
+    for (const d of disclosed)
+        Bv = Bv.add(g1mul(at(H, d.idx), d.msg));
+    // T2 = Bv·c + D·r̂3 + Σ_{undisclosed} H_j·m̂_j
+    let T2 = g1mul(Bv, p.c).add(g1mul(p.D, p.r3Hat));
+    for (let k = 0; k < U; k++)
+        T2 = T2.add(g1mul(at(H, at(undisclosed, k)), at(p.mHat, k)));
+    const cv = calculateChallenge(p.Abar, p.Bbar, p.D, T1, T2, disclosed.map((d) => d.idx), disclosed.map((d) => d.msg), domain, ph);
+    if (cv !== p.c)
+        return false;
+    // Final pairing: e(Ā, W) == e(B̄, BP2).
+    return Fp12.eql(bls12_381_1.bls12_381.pairing(p.Abar, W), bls12_381_1.bls12_381.pairing(p.Bbar, BP2));
+}
+//# sourceMappingURL=bbs.js.map

package/dist/bbs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bbs.js","sourceRoot":"","sources":["../src/bbs.ts"],"names":[],"mappings":";;;AAwGA,oCAEC;AAGD,4DAEC;AAGD,8CAEC;AAMD,4CAUC;AAiDD,wBAOC;AAGD,wBAEC;AAGD,0CAGC;AAGD,8BAEC;AACD,kCAKC;AAkDD,oBAiBC;AAGD,wBAsBC;AAiHD,4BAkDC;AAUD,kCAgEC;AA3hBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,uDAAoD;AACpD,wEAA0E;AAC1E,wDAA6F;AAC7F,iDAA8C;AAC9C,+CAAkD;AAElD,kGAAkG;AAElG,MAAM,EAAE,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC;AACxC,MAAM,EAAE,GAAG,qBAAS,CAAC,EAAE,CAAC,eAAe,CAAC;AACxC,MAAM,EAAE,GAAG,qBAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/B,MAAM,IAAI,GAAG,qBAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AAOnC,oEAAoE;AACvD,QAAA,CAAC,GAAW,EAAE,CAAC,KAAK,CAAC;AAElC,kGAAkG;AAElG,8DAA8D;AACjD,QAAA,cAAc,GAAG,qCAAqC,CAAC;AACpE,8CAA8C;AACjC,QAAA,MAAM,GAAG,GAAG,sBAAc,WAAW,CAAC;AAEnD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,kBAAkB,GAAG,EAAE,CAAC,CAAC,iBAAiB;AAChD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,MAAM,OAAO,GAAG,GAAG,cAAM,MAAM,CAAC;AAChC,MAAM,OAAO,GAAG,GAAG,cAAM,4BAA4B,CAAC;AACtD,MAAM,QAAQ,GAAG,GAAG,cAAM,qBAAqB,CAAC;AAChD,MAAM,OAAO,GAAG,GAAG,cAAM,oBAAoB,CAAC;AAC9C,MAAM,QAAQ,GAAG,GAAG,cAAM,wBAAwB,CAAC;AACnD,MAAM,UAAU,GAAG,GAAG,sBAAc,aAAa,CAAC;AAElD;;;GAGG;AACH,MAAM,MAAM,GAAG,kGAAkG,CAAC;AAClH,MAAM,EAAE,GAAY,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACvC,yDAAyD;AACzD,MAAM,GAAG,GAAY,EAAE,CAAC,IAAI,CAAC;AAE7B,kGAAkG;AAElG,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAC/B,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,qFAAqF;AACrF,SAAS,KAAK,CAAC,CAAS,EAAE,GAAW;IACnC,OAAO,IAAA,uBAAe,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,wEAAwE;AACxE,SAAS,KAAK,CAAC,CAAa;IAC1B,OAAO,IAAA,uBAAe,EAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,gGAAgG;AAChG,SAAS,EAAE,CAAI,GAAiB,EAAE,CAAS;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,cAAc,CAAC,sBAAsB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,yDAAyD;AACzD,SAAS,MAAM,CAAC,GAAe,EAAE,GAAW,EAAE,GAAW;IACvD,OAAO,IAAA,kCAAkB,EAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,eAAM,CAAC,CAAC;AAC1D,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAAC,GAAe,EAAE,GAAW;IACvD,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,qFAAqF;AACrF,SAAgB,wBAAwB,CAAC,OAAmB;IAC1D,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,qFAAqF;AACrF,SAAgB,iBAAiB,CAAC,QAA+B;IAC/D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IACvH,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,CAAC,GAAG,MAAM,CAAC,IAAA,mBAAW,EAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,qBAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,SAAS,SAAS,CAAC,GAAqB;IACtC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC;YACb,KAAK,IAAI;gBACP,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClC,MAAM;YACR,KAAK,IAAI;gBACP,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClC,MAAM;YACR,KAAK,QAAQ;gBACX,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAC7C,MAAM;YACR,KAAK,KAAK;gBACR,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnC,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAA,mBAAW,EAAC,GAAG,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,kGAAkG;AAElG,SAAS,KAAK,CAAC,CAAU,EAAE,CAAS;IAClC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,KAAK,CAAC,CAAU,EAAE,CAAS;IAClC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,kGAAkG;AAElG;;;GAGG;AACH,SAAgB,MAAM,CAAC,WAAuB,EAAE,UAAsB,IAAI,UAAU,CAAC,CAAC,CAAC;IACrF,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IAC/F,MAAM,WAAW,GAAG,IAAA,mBAAW,EAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,mFAAmF;AACnF,SAAgB,MAAM,CAAC,EAAU;IAC/B,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,SAAgB,eAAe;IAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,mFAAmF;AACnF,SAAgB,SAAS,CAAC,EAAU;IAClC,OAAO,KAAK,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACxC,CAAC;AACD,SAAgB,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC5F,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,SAAC;QAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IACvE,OAAO,EAAE,CAAC;AACZ,CAAC;AASD,SAAS,iBAAiB,CAAC,CAAU,EAAE,CAAS;IAC9C,OAAO,IAAA,mBAAW,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAe;IACxC,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,GAAG,mBAAmB,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACjF,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,SAAC;QAAE,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC;IACpF,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,kGAAkG;AAElG,SAAS,eAAe,CAAC,EAAc,EAAE,EAAW,EAAE,CAAqB,EAAE,MAAkB;IAC7F,MAAM,GAAG,GAAY,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAA,mBAAW,EAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,cAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnF,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,EAAW,EAAE,CAAqB,EAAE,MAAc,EAAE,UAA6B;IACjG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kGAAkG;AAElG;;;;GAIG;AACH,SAAgB,IAAI,CAAC,EAAU,EAAE,EAAc,EAAE,MAAkB,EAAE,QAA+B;IAClG,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAElD,gGAAgG;IAChG,MAAM,IAAI,GAAY,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAEjD,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;IAChE,OAAO,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,qGAAqG;AACrG,SAAgB,MAAM,CAAC,EAAc,EAAE,SAAqB,EAAE,MAAkB,EAAE,QAA+B;IAC/G,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9C,iFAAiF;IACjF,MAAM,GAAG,GAAG,qBAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,qBAAS,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,kGAAkG;AAElG,SAAS,sBAAsB,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,mBAAW,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kGAAkG;AAElG,SAAS,kBAAkB,CACzB,IAAa,EACb,IAAa,EACb,CAAU,EACV,EAAW,EACX,EAAW,EACX,gBAAmC,EACnC,aAAgC,EAChC,MAAc,EACd,EAAc;IAEd,MAAM,GAAG,GAAY,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5I,MAAM,KAAK,GAAG,IAAA,mBAAW,EAAC,SAAS,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAeD,SAAS,aAAa,CAAC,CAAc;IACnC,MAAM,KAAK,GAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACrG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACzH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAA,mBAAW,EAAC,GAAG,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB,EAAE,MAAc;IACnD,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,SAAC;QAAE,MAAM,IAAI,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,KAAK,GAAG,CAAC,GAAG,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC,gCAAgC;IAChG,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,mBAAmB,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC,IAAI,mBAAmB,CAAC;IACzB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC,IAAI,mBAAmB,CAAC;IACzB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC,IAAI,mBAAmB,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,mBAAmB,CAAC;IACvD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,IAAI,mBAAmB,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,kGAAkG;AAElG,SAAS,eAAe,CAAC,OAA0B,EAAE,CAAS;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACtH,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAA8B,EAAE,CAAS;IACrE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kGAAkG;AAElG;;;;;GAKG;AACH,SAAgB,QAAQ,CACtB,EAAc,EACd,SAAqB,EACrB,MAAkB,EAClB,EAAc,EACd,QAA+B,EAC/B,gBAAmC;IAEnC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,eAAe,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;IAE7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAE9C,MAAM,EAAE,GAAG,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAE1F,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5G,OAAO,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,kGAAkG;AAElG;;;;;GAKG;AACH,SAAgB,WAAW,CACzB,EAAc,EACd,KAAiB,EACjB,MAAkB,EAClB,EAAc,EACd,iBAAwC,EACxC,gBAAmC;IAEnC,IAAI,CAAc,CAAC;IACnB,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,iBAAiB,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAEvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACxB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACxC,MAAM,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAEtB,IAAI,SAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,eAAe,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QAC9D,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAElD,0BAA0B;IAC1B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,iDAAiD;IACjD,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,+CAA+C;IAC/C,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzF,MAAM,EAAE,GAAG,kBAAkB,CAC3B,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,EACH,EAAE,EACF,EAAE,EACF,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAC3B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAC3B,MAAM,EACN,EAAE,CACH,CAAC;IACF,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7B,wCAAwC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,qBAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC"}

package/dist/credential.d.ts

@@ -0,0 +1,112 @@
+/**
+ * PCA layer: a Proof-Carrying Authority capability as a multi-message BBS credential.
+ *
+ * A PCA {@link Capability} authorizes a holder under an issuer, constrained by an append-only list
+ * of caveats (scopes/limits). Normally a capability travels as a signed chain and is presented
+ * whole — every attribute is visible to whoever verifies it. That is fine for a server, but it
+ * leaks: a tool that only needs to know "the holder may call search" also learns the budget caveat,
+ * the delegation lineage, and a stable signature value it can use to correlate requests.
+ *
+ * Here we map the capability's attributes to an ORDERED BBS message vector and sign it once. The
+ * holder can then present it with SELECTIVE DISCLOSURE: reveal only the attributes a given tool
+ * needs, and prove in zero knowledge that the issuer signed the rest — without showing them, and
+ * without showing the signature. Because every presentation re-randomizes the signature, two
+ * presentations of the same credential are UNLINKABLE.
+ *
+ * ## Attribute ↔ message mapping
+ *
+ * The message vector is, in order:
+ *   - index 0: `iss` — the issuer public key
+ *   - index 1: `sub` — the holder (subject) public key
+ *   - index 2..: one message per caveat, name `cav:<i>:<type>`, value the strict-canonical JSON of
+ *     the caveat object (so a caveat's full content is one atomically-disclosable attribute).
+ *
+ * Each message's octets are `utf8(name) || 0x00 || utf8(value)`: the NUL separator makes the name
+ * unambiguous, and binding the name into the signed message means a verifier that reconstructs a
+ * disclosed attribute from `{name, value}` gets byte-identical octets, so disclosing index `i` as a
+ * different attribute cannot verify.
+ *
+ * ## Relationship to a PCActn
+ *
+ * A PCActn (proof-carrying action) normally carries the capability chain plus a signed action/plan
+ * commitment, which the adjudicator verifies in full. For privacy-sensitive flows, the capability
+ * component can instead be carried as a {@link BBSPresentation}: the agent discloses only the
+ * attributes the action needs (e.g. the scope caveat that authorizes this exact tool call) and
+ * proves knowledge of the issuer's signature over the whole credential. The presentation header
+ * (`ph`) binds the proof to the action — pass the PCActn's action/nonce digest as `presentationHeader`
+ * so a proof minted for one action cannot be replayed against another. The adjudicator then checks
+ * the BBS proof in place of the raw signed chain; the undisclosed attributes stay hidden and the
+ * action is still cryptographically bound to an issuer-signed grant.
+ */
+import type { Capability } from '@atlasauth/pca';
+/** One disclosable attribute of a capability credential, at its position in the message vector. */
+export interface CredentialAttribute {
+    /** Position in the BBS message vector (0 = issuer, 1 = holder, 2.. = caveats). */
+    index: number;
+    /** Stable attribute name (`iss`, `sub`, or `cav:<i>:<type>`). */
+    name: string;
+    /** The attribute's value (a key for `iss`/`sub`, strict-canonical JSON for a caveat). */
+    value: string;
+}
+/** A capability signed as a BBS credential. Portable; `signature` is the issuer's BBS signature. */
+export interface BBSCredential {
+    /** b64u of the issuer's BBS public key (G2 point). */
+    issuerPublicKey: string;
+    /** b64u of the signed header (application context bound into the signature). */
+    header: string;
+    /** The ordered attribute vector that was signed. */
+    attributes: CredentialAttribute[];
+    /** b64u of the 80-octet BBS signature. */
+    signature: string;
+}
+/** A selective-disclosure presentation of a {@link BBSCredential}. Self-contained and verifiable. */
+export interface BBSPresentation {
+    /** b64u of the issuer's BBS public key the proof is under. */
+    issuerPublicKey: string;
+    /** b64u of the credential header the proof was made over. */
+    header: string;
+    /** b64u of the presentation header (`ph`) binding the proof to a context/action. */
+    presentationHeader: string;
+    /** Total number of messages in the credential (L). */
+    messageCount: number;
+    /** The attributes actually revealed, each at its original index. */
+    disclosed: CredentialAttribute[];
+    /** b64u of the BBS proof octets. */
+    proof: string;
+}
+/** Build the ordered attribute vector for a capability (issuer, holder, then each caveat). */
+export declare function capabilityAttributes(capability: Pick<Capability, 'issuer' | 'holder' | 'caveats'>): CredentialAttribute[];
+/**
+ * issueCapabilityCredential: sign a capability's attributes as a BBS credential.
+ * `header` is optional application context bound into the signature (not selectively disclosable).
+ */
+export declare function issueCapabilityCredential(capability: Pick<Capability, 'issuer' | 'holder' | 'caveats'>, opts: {
+    sk: bigint;
+    pk: Uint8Array;
+    header?: Uint8Array;
+}): BBSCredential;
+/** Verify a whole credential against its issuer key (no disclosure — checks every attribute). */
+export declare function verifyCredential(cred: BBSCredential): boolean;
+/**
+ * presentCredential: produce a selective-disclosure proof revealing only the named attributes.
+ * `presentationHeader` binds the proof to a context (e.g. the PCActn action digest / a nonce).
+ */
+export declare function presentCredential(cred: BBSCredential, opts: {
+    disclose: readonly string[];
+    presentationHeader?: Uint8Array;
+}): BBSPresentation;
+/**
+ * verifyPresentation: check a selective-disclosure proof. Verifies that the issuer (`pk`) signed a
+ * credential whose disclosed attributes are exactly `disclosed` at their indexes, bound to
+ * `presentationHeader`. The undisclosed attributes stay hidden.
+ *
+ * `pk`, `disclosed` and `presentationHeader` default to the values carried in the presentation, so
+ * `verifyPresentation(pres)` checks it as-is; pass them to assert the verifier's own expectations
+ * (e.g. a pinned issuer key, the exact attributes the tool requires, or the action digest the proof
+ * must be bound to).
+ */
+export declare function verifyPresentation(pres: BBSPresentation, opts?: {
+    pk?: Uint8Array;
+    disclosed?: readonly CredentialAttribute[];
+    presentationHeader?: Uint8Array;
+}): boolean;

package/dist/credential.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capabilityAttributes = capabilityAttributes;
+exports.issueCapabilityCredential = issueCapabilityCredential;
+exports.verifyCredential = verifyCredential;
+exports.presentCredential = presentCredential;
+exports.verifyPresentation = verifyPresentation;
+const pca_1 = require("@atlasauth/pca");
+const bbs_1 = require("./bbs");
+const NAME_ISSUER = 'iss';
+const NAME_HOLDER = 'sub';
+const NUL = 0x00;
+const TEXT = new TextEncoder();
+/** Deterministic message octets for one attribute: utf8(name) || 0x00 || utf8(value). */
+function encodeAttribute(name, value) {
+    const n = TEXT.encode(name);
+    const v = TEXT.encode(value);
+    const out = new Uint8Array(n.length + 1 + v.length);
+    out.set(n, 0);
+    out[n.length] = NUL;
+    out.set(v, n.length + 1);
+    return out;
+}
+function encode(attr) {
+    return encodeAttribute(attr.name, attr.value);
+}
+/** Build the ordered attribute vector for a capability (issuer, holder, then each caveat). */
+function capabilityAttributes(capability) {
+    const attrs = [
+        { index: 0, name: NAME_ISSUER, value: capability.issuer },
+        { index: 1, name: NAME_HOLDER, value: capability.holder },
+    ];
+    const caveats = Array.isArray(capability.caveats) ? capability.caveats : [];
+    caveats.forEach((cv, i) => {
+        attrs.push({ index: i + 2, name: `cav:${i}:${cv.type}`, value: (0, pca_1.canonicalizeStrict)(cv) });
+    });
+    return attrs;
+}
+/**
+ * issueCapabilityCredential: sign a capability's attributes as a BBS credential.
+ * `header` is optional application context bound into the signature (not selectively disclosable).
+ */
+function issueCapabilityCredential(capability, opts) {
+    const attributes = capabilityAttributes(capability);
+    const header = opts.header ?? new Uint8Array(0);
+    const messages = attributes.map(encode);
+    const signature = (0, bbs_1.sign)(opts.sk, opts.pk, header, messages);
+    return {
+        issuerPublicKey: (0, pca_1.b64u)(opts.pk),
+        header: (0, pca_1.b64u)(header),
+        attributes,
+        signature: (0, pca_1.b64u)(signature),
+    };
+}
+/** Verify a whole credential against its issuer key (no disclosure — checks every attribute). */
+function verifyCredential(cred) {
+    let pk;
+    let header;
+    let signature;
+    try {
+        pk = (0, pca_1.unb64u)(cred.issuerPublicKey);
+        header = (0, pca_1.unb64u)(cred.header);
+        signature = (0, pca_1.unb64u)(cred.signature);
+    }
+    catch {
+        return false;
+    }
+    const messages = cred.attributes.map(encode);
+    return (0, bbs_1.verify)(pk, signature, header, messages);
+}
+/**
+ * presentCredential: produce a selective-disclosure proof revealing only the named attributes.
+ * `presentationHeader` binds the proof to a context (e.g. the PCActn action digest / a nonce).
+ */
+function presentCredential(cred, opts) {
+    const pk = (0, pca_1.unb64u)(cred.issuerPublicKey);
+    const header = (0, pca_1.unb64u)(cred.header);
+    const signature = (0, pca_1.unb64u)(cred.signature);
+    const ph = opts.presentationHeader ?? new Uint8Array(0);
+    const wanted = new Set(opts.disclose);
+    const messages = cred.attributes.map(encode);
+    const disclosedIndexes = [];
+    const disclosed = [];
+    for (const attr of cred.attributes) {
+        if (wanted.has(attr.name)) {
+            disclosedIndexes.push(attr.index);
+            disclosed.push(attr);
+        }
+    }
+    const missing = [...wanted].filter((name) => !disclosed.some((d) => d.name === name));
+    if (missing.length > 0)
+        throw new RangeError(`presentCredential: unknown attribute(s): ${missing.join(', ')}`);
+    const proof = (0, bbs_1.proofGen)(pk, signature, header, ph, messages, disclosedIndexes);
+    return {
+        issuerPublicKey: cred.issuerPublicKey,
+        header: cred.header,
+        presentationHeader: (0, pca_1.b64u)(ph),
+        messageCount: cred.attributes.length,
+        disclosed,
+        proof: (0, pca_1.b64u)(proof),
+    };
+}
+/**
+ * verifyPresentation: check a selective-disclosure proof. Verifies that the issuer (`pk`) signed a
+ * credential whose disclosed attributes are exactly `disclosed` at their indexes, bound to
+ * `presentationHeader`. The undisclosed attributes stay hidden.
+ *
+ * `pk`, `disclosed` and `presentationHeader` default to the values carried in the presentation, so
+ * `verifyPresentation(pres)` checks it as-is; pass them to assert the verifier's own expectations
+ * (e.g. a pinned issuer key, the exact attributes the tool requires, or the action digest the proof
+ * must be bound to).
+ */
+function verifyPresentation(pres, opts) {
+    let pk;
+    let header;
+    let proof;
+    try {
+        pk = opts?.pk ?? (0, pca_1.unb64u)(pres.issuerPublicKey);
+        header = (0, pca_1.unb64u)(pres.header);
+        proof = (0, pca_1.unb64u)(pres.proof);
+    }
+    catch {
+        return false;
+    }
+    // If the verifier pinned an issuer key, it must match the one the presentation claims.
+    if (opts?.pk !== undefined && (0, pca_1.b64u)(opts.pk) !== pres.issuerPublicKey)
+        return false;
+    const ph = opts?.presentationHeader ?? safeDecode(pres.presentationHeader);
+    if (ph === null)
+        return false;
+    // If the verifier pinned a presentation header, it must match the one the proof was made over.
+    if (opts?.presentationHeader !== undefined && opts.presentationHeader.length > 0 && (0, pca_1.b64u)(ph) !== pres.presentationHeader) {
+        return false;
+    }
+    const disclosed = opts?.disclosed ?? pres.disclosed;
+    // When the verifier asserts its own expected disclosure, it must match what the presentation shows.
+    if (opts?.disclosed !== undefined && !sameDisclosure(opts.disclosed, pres.disclosed))
+        return false;
+    const ordered = [...disclosed].sort((a, b) => a.index - b.index);
+    const disclosedMessages = ordered.map(encode);
+    const disclosedIndexes = ordered.map((d) => d.index);
+    if (disclosedIndexes.some((i) => i >= pres.messageCount || i < 0))
+        return false;
+    return (0, bbs_1.proofVerify)(pk, proof, header, ph, disclosedMessages, disclosedIndexes);
+}
+function safeDecode(s) {
+    try {
+        return (0, pca_1.unb64u)(s);
+    }
+    catch {
+        return null;
+    }
+}
+function sameDisclosure(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const key = (x) => `${x.index}\u0000${x.name}\u0000${x.value}`;
+    const sa = a.map(key).sort();
+    const sb = b.map(key).sort();
+    return sa.every((v, i) => v === sb[i]);
+}
+//# sourceMappingURL=credential.js.map

package/dist/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":";;AAuGA,oDAUC;AAMD,8DAcC;AAGD,4CAaC;AAMD,8CA+BC;AAYD,gDAmCC;AAhMD,wCAAkE;AAClE,+BAA4D;AAE5D,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,GAAG,GAAG,IAAI,CAAC;AACjB,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAwC/B,yFAAyF;AACzF,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC;IACpB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,IAAyB;IACvC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,8FAA8F;AAC9F,SAAgB,oBAAoB,CAAC,UAA6D;IAChG,MAAM,KAAK,GAA0B;QACnC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE;QACzD,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE;KAC1D,CAAC;IACF,MAAM,OAAO,GAAa,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAA,wBAAkB,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,UAA6D,EAC7D,IAAyD;IAEzD,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAA,UAAI,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3D,OAAO;QACL,eAAe,EAAE,IAAA,UAAI,EAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,IAAA,UAAI,EAAC,MAAM,CAAC;QACpB,UAAU;QACV,SAAS,EAAE,IAAA,UAAI,EAAC,SAAS,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAgB,gBAAgB,CAAC,IAAmB;IAClD,IAAI,EAAc,CAAC;IACnB,IAAI,MAAkB,CAAC;IACvB,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,EAAE,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAClC,MAAM,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,SAAS,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,IAAA,YAAM,EAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,IAAmB,EACnB,IAAsE;IAEtE,MAAM,EAAE,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,kBAAkB,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/G,MAAM,KAAK,GAAG,IAAA,cAAQ,EAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC9E,OAAO;QACL,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,kBAAkB,EAAE,IAAA,UAAI,EAAC,EAAE,CAAC;QAC5B,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;QACpC,SAAS;QACT,KAAK,EAAE,IAAA,UAAI,EAAC,KAAK,CAAC;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,IAAqB,EACrB,IAAuG;IAEvG,IAAI,EAAc,CAAC;IACnB,IAAI,MAAkB,CAAC;IACvB,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,IAAA,YAAM,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,GAAG,IAAA,YAAM,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uFAAuF;IACvF,IAAI,IAAI,EAAE,EAAE,KAAK,SAAS,IAAI,IAAA,UAAI,EAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAEnF,MAAM,EAAE,GAAG,IAAI,EAAE,kBAAkB,IAAI,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3E,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,+FAA+F;IAC/F,IAAI,IAAI,EAAE,kBAAkB,KAAK,SAAS,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,IAAA,UAAI,EAAC,EAAE,CAAC,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;IACpD,oGAAoG;IACpG,IAAI,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnG,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhF,OAAO,IAAA,iBAAW,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,YAAM,EAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAiC,EAAE,CAAiC;IAC1F,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,CAAsB,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5F,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @atlasauth/pca-bbs — BBS signatures (draft-irtf-cfrg-bbs-signatures, BLS12-381-SHA-256) for PCA.
+ *
+ * Two layers:
+ *   - the BBS core ({@link ./bbs}): KeyGen, create_generators, messages_to_scalars, Sign, Verify,
+ *     ProofGen, ProofVerify — faithful to the CFRG draft, verified against its test vector;
+ *   - the PCA layer ({@link ./credential}): a {@link Capability} issued as a multi-message BBS
+ *     credential, then presented with selective disclosure + an unlinkable proof of knowledge.
+ */
+export * from './bbs';
+export * from './credential';

package/dist/index.js

@@ -0,0 +1,28 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @atlasauth/pca-bbs — BBS signatures (draft-irtf-cfrg-bbs-signatures, BLS12-381-SHA-256) for PCA.
+ *
+ * Two layers:
+ *   - the BBS core ({@link ./bbs}): KeyGen, create_generators, messages_to_scalars, Sign, Verify,
+ *     ProofGen, ProofVerify — faithful to the CFRG draft, verified against its test vector;
+ *   - the PCA layer ({@link ./credential}): a {@link Capability} issued as a multi-message BBS
+ *     credential, then presented with selective disclosure + an unlinkable proof of knowledge.
+ */
+__exportStar(require("./bbs"), exports);
+__exportStar(require("./credential"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;GAQG;AACH,wCAAsB;AACtB,+CAA6B"}

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "@atlasauth/pca-bbs",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "BBS signatures (CFRG draft) for PCA: issue a capability as a multi-message BBS credential, then present it with selective disclosure + unlinkable zero-knowledge proof-of-possession, so an agent reveals only the attributes a tool needs and uses can't be correlated.",
+  "keywords": [
+    "bbs signatures",
+    "selective disclosure",
+    "zero-knowledge",
+    "credentials",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-bbs"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@noble/curves": "^1.6.0",
+    "@noble/hashes": "^1.5.0",
+    "@atlasauth/pca": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }