@bounded-authority-protocol/verifier 0.2.0

package/dist/src/bounds.js

@@ -0,0 +1,114 @@
+import { fail } from "./error.js";
+// The fixed v1 profile maxima — the 38-row Hard maxima table (spec/bap-v1.md).
+// Pinned by the corpus bounds.new cases so any mistyped constant fails. Fixed-width keys
+// (REQ1-BOUNDS-fixed-widths, L395): digest_bytes, public_key_bytes, signature_bytes are the immutable
+// cryptographic constants of suite BAP1-Ed25519-SHA256 — they MUST equal the maximum exactly (widening
+// is forbidden); all others may be tightened to a positive integer at most the maximum.
+export const MAXIMA = {
+    compact_bytes: 65536,
+    encoded_segment_bytes: 32768,
+    decoded_segment_bytes: 24576,
+    json_bytes: 65536,
+    depth: 32,
+    object_members: 64,
+    array_items: 256,
+    total_nodes: 4096,
+    string_bytes: 8192,
+    key_bytes: 128,
+    number_lexeme_bytes: 64,
+    integer_magnitude: 9007199254740991,
+    float_magnitude: 9007199254740991,
+    kid_bytes: 128,
+    jcs_bytes: 65536,
+    uri_bytes: 8192,
+    identifier_bytes: 512,
+    nonce_bytes: 512,
+    method_bytes: 32,
+    operation_bytes: 128,
+    audiences: 64,
+    operations: 64,
+    selectors: 64,
+    path_segments: 32,
+    one_of_values: 256,
+    public_key_bytes: 32,
+    signature_bytes: 64,
+    digest_bytes: 32,
+    clock_skew: 60,
+    proof_max_age: 300,
+    chain_row_bytes: 4096,
+    chain_rows: 65536,
+    anchor_bytes: 8192,
+    archive_header_bytes: 8192,
+    archive_chunks: 65796,
+    archive_bytes: 270820384,
+    object_version_bytes: 512,
+    key_transitions: 256,
+};
+export const MAXIMUM_BOUNDS = { maximum: MAXIMA, overrides: new Map() };
+export function boundsMaximum() {
+    // Return a FRESH Bounds each call so a caller cannot mutate a shared singleton's overrides Map
+    // to widen the profile maximum globally (ReadonlyMap is compile-time only; runtime mutation is
+    // otherwise possible). REQ1-BOUNDS-tighten-only.
+    return { maximum: MAXIMA, overrides: new Map() };
+}
+// REQ1-BOUNDS-reject-list (L397): unknown, non-integer, zero, negative, widening, or fixed-width-
+// changing limits are invalid. Fixed-width keys (L395) cannot be tightened or widened.
+const FIXED_WIDTH_KEYS = new Set([
+    "digest_bytes",
+    "public_key_bytes",
+    "signature_bytes",
+]);
+export function boundsNew(tightening) {
+    if (tightening === undefined)
+        return MAXIMUM_BOUNDS;
+    const overrides = new Map();
+    for (const [key, value] of Object.entries(tightening)) {
+        if (!(key in MAXIMA))
+            fail(`bounds.new: unknown limit ${key}`);
+        if (!Number.isInteger(value))
+            fail(`bounds.new: non-integer limit ${key}`);
+        const mk = key;
+        if (FIXED_WIDTH_KEYS.has(mk)) {
+            // REQ1-BOUNDS-fixed-widths: fixed-width keys cannot be tightened or widened, but setting to
+            // the exact maximum is an identity no-op (valid). Any other value rejects.
+            if (value !== MAXIMA[mk])
+                fail(`bounds.new: fixed-width key ${key} must equal maximum`);
+        }
+        else {
+            if (value <= 0)
+                fail(`bounds.new: non-positive limit ${key}`);
+            if (value > MAXIMA[mk])
+                fail(`bounds.new: widening limit ${key}`);
+        }
+        overrides.set(mk, value);
+    }
+    return { maximum: MAXIMA, overrides };
+}
+// Re-validate a Bounds object (mirrors the reference's Bounds.coerce/1, anchored_export_codec.ex:33
+// + runtime.ex:123 etc.). Bounds is an exported structural interface, so a caller can hand-craft a
+// {maximum, overrides} object that bypasses boundsNew — including a WIDENING override (compact_bytes
+// > MAXIMA). resolve() trusts the override directly; without this gate the verify/decode paths would
+// honor the forged widening (cross-vendor F2). coerceBounds re-runs the boundsNew validation over the
+// override map so every entry point that resolves caller-supplied bounds fails closed on a forgery.
+export function coerceBounds(b) {
+    for (const [key, value] of b.overrides) {
+        if (!Number.isInteger(value))
+            fail(`bounds.coerce: non-integer limit ${key}`);
+        if (FIXED_WIDTH_KEYS.has(key)) {
+            if (value !== MAXIMA[key])
+                fail(`bounds.coerce: fixed-width key ${key} must equal maximum`);
+        }
+        else {
+            if (value <= 0)
+                fail(`bounds.coerce: non-positive limit ${key}`);
+            if (value > MAXIMA[key])
+                fail(`bounds.coerce: widening limit ${key}`);
+        }
+    }
+    return b;
+}
+// Resolve a bound: the override if present, else the maximum.
+export function resolve(b, key) {
+    return b.overrides.get(key) ?? MAXIMA[key];
+}
+//# sourceMappingURL=bounds.js.map

package/dist/src/bounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounds.js","sourceRoot":"","sources":["../../src/bounds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,+EAA+E;AAC/E,yFAAyF;AACzF,sGAAsG;AACtG,uGAAuG;AACvG,wFAAwF;AACxF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,aAAa,EAAE,KAAK;IACpB,qBAAqB,EAAE,KAAK;IAC5B,qBAAqB,EAAE,KAAK;IAC5B,UAAU,EAAE,KAAK;IACjB,KAAK,EAAE,EAAE;IACT,cAAc,EAAE,EAAE;IAClB,WAAW,EAAE,GAAG;IAChB,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,GAAG;IACd,mBAAmB,EAAE,EAAE;IACvB,iBAAiB,EAAE,gBAAgB;IACnC,eAAe,EAAE,gBAAgB;IACjC,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,GAAG;IACrB,WAAW,EAAE,GAAG;IAChB,YAAY,EAAE,EAAE;IAChB,eAAe,EAAE,GAAG;IACpB,SAAS,EAAE,EAAE;IACb,UAAU,EAAE,EAAE;IACd,SAAS,EAAE,EAAE;IACb,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,EAAE;IACpB,eAAe,EAAE,EAAE;IACnB,YAAY,EAAE,EAAE;IAChB,UAAU,EAAE,EAAE;IACd,aAAa,EAAE,GAAG;IAClB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,KAAK;IACjB,YAAY,EAAE,IAAI;IAClB,oBAAoB,EAAE,IAAI;IAC1B,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,SAAS;IACxB,oBAAoB,EAAE,GAAG;IACzB,eAAe,EAAE,GAAG;CACZ,CAAC;AAUX,MAAM,CAAC,MAAM,cAAc,GAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAEhF,MAAM,UAAU,aAAa;IAC3B,+FAA+F;IAC/F,+FAA+F;IAC/F,iDAAiD;IACjD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,kGAAkG;AAClG,uFAAuF;AACvF,MAAM,gBAAgB,GAA2B,IAAI,GAAG,CAAY;IAClE,cAAc;IACd,kBAAkB;IAClB,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,UAA6C;IACrE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,cAAc,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;YAAE,IAAI,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,GAAgB,CAAC;QAC5B,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,4FAA4F;YAC5F,2EAA2E;YAC3E,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,+BAA+B,GAAG,qBAAqB,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YAC9D,IAAI,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAC9E,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,kCAAkC,GAAG,qBAAqB,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,CAAS,EAAE,GAAc;IAC/C,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/dist/src/compact.d.ts

@@ -0,0 +1,19 @@
+import { type Result } from "./error.js";
+import { type Bounds } from "./bounds.js";
+export interface CompactSegments {
+    readonly protectedSegment: Uint8Array;
+    readonly payloadSegment: Uint8Array;
+    readonly signature: Uint8Array;
+    readonly protectedBytes: Uint8Array;
+    readonly payloadBytes: Uint8Array;
+    readonly signingInput: Uint8Array;
+}
+export declare function parseCompact(input: Uint8Array, bounds?: Bounds): CompactSegments;
+export declare function scanCompact(input: Uint8Array, bounds?: Bounds): void;
+export type SigningInputKind = "grant" | "proof" | "local_loopback_http_proof" | "boundary_anchor" | "key_transition";
+export interface SigningInput {
+    readonly kind: SigningInputKind;
+    readonly protectedSegment: Uint8Array;
+    readonly payloadSegment: Uint8Array;
+}
+export declare function assembleSegments(input: SigningInput, signature: Uint8Array): Result<Uint8Array>;

package/dist/src/compact.js

@@ -0,0 +1,111 @@
+import { fail, assert, trying } from "./error.js";
+import { base64urlDecode, base64urlEncode } from "./base64url.js";
+import { resolve, coerceBounds, MAXIMUM_BOUNDS } from "./bounds.js";
+const DOT = 0x2e;
+// Parse + bound a compact input into 3 segments. Validates the segment count, bounds, canonical
+// base64url of each segment, and decodes protected + payload (signature kept raw after decode).
+export function parseCompact(input, bounds = MAXIMUM_BOUNDS) {
+    // Cross-vendor F2: re-validate caller-supplied bounds (a hand-crafted Bounds can widen limits past
+    // MAXIMA, bypassing boundsNew). Mirrors the reference's Bounds.coerce on every entry point.
+    const b = coerceBounds(bounds);
+    if (input.length > resolve(b, "compact_bytes"))
+        fail("compact: byte bound");
+    if (input.length === 0)
+        fail("compact: empty");
+    // Split into exactly 3 segments on '.'.
+    const dots = [];
+    for (let i = 0; i < input.length; i++)
+        if (input[i] === DOT)
+            dots.push(i);
+    if (dots.length !== 2)
+        fail("compact: three segments");
+    const d0 = dots[0];
+    const d1 = dots[1];
+    if (d0 === 0 || d1 === d0 + 1 || d1 === input.length - 1)
+        fail("compact: empty segment");
+    const protectedText = input.subarray(0, d0);
+    const payloadText = input.subarray(d0 + 1, d1);
+    const signatureText = input.subarray(d1 + 1);
+    if (protectedText.length > resolve(b, "encoded_segment_bytes"))
+        fail("compact: protected segment bound");
+    if (payloadText.length > resolve(b, "encoded_segment_bytes"))
+        fail("compact: payload segment bound");
+    const protectedBytes = base64urlDecode(protectedText, resolve(b, "decoded_segment_bytes"));
+    const payloadBytes = base64urlDecode(payloadText, resolve(b, "decoded_segment_bytes"));
+    const signature = base64urlDecode(signatureText);
+    // Decoded signature-width gate (runtime.ex:237 parse_grant, :259 parse_proof,
+    // boundary_anchor_codec.ex:88, key_transition_codec.ex:120 all enforce byte_size(signature) ==
+    // signature_bytes). scanCompact (the ath/hash gate) intentionally does NOT — it mirrors
+    // CompactJws.scan (shape+size only); the decoded-width check belongs to the decode path.
+    if (signature.length !== resolve(b, "signature_bytes"))
+        fail("compact: signature width");
+    return {
+        protectedSegment: protectedText,
+        payloadSegment: payloadText,
+        signature,
+        protectedBytes,
+        payloadBytes,
+        signingInput: concat(protectedText, DOTB, payloadText),
+    };
+}
+const DOTB = new Uint8Array([DOT]);
+// scan_compact — faithful port of the reference CompactJws.scan (compact_jws.ex:16-27): the
+// shape+size gate that `ath`/`hash` run BEFORE hashing a compact. It validates structure + bounds
+// only — NOT base64url canonicity (canonicity is the full verify path's job via parseCompact). The
+// producer ath (proof_signing_input) and the verify grant-hash both gate on this so a non-compact
+// grant (wrong segment count, oversized, dotted signature) is rejected rather than hashed. Mirrors
+// the Rust scan_compact gate added in the BAP-15 closeout.
+export function scanCompact(input, bounds = MAXIMUM_BOUNDS) {
+    const b = coerceBounds(bounds);
+    if (input.length > resolve(b, "compact_bytes"))
+        fail("compact: byte bound");
+    if (input.length === 0)
+        fail("compact: empty");
+    const dots = [];
+    for (let i = 0; i < input.length; i++)
+        if (input[i] === DOT)
+            dots.push(i);
+    if (dots.length !== 2)
+        fail("compact: three segments");
+    const d0 = dots[0], d1 = dots[1];
+    if (d0 === 0 || d1 === d0 + 1 || d1 === input.length - 1)
+        fail("compact: empty segment");
+    const segBytes = resolve(b, "encoded_segment_bytes");
+    if (d0 > segBytes)
+        fail("compact: protected segment bound");
+    if (d1 - d0 - 1 > segBytes)
+        fail("compact: payload segment bound");
+    if (input.length - d1 - 1 > segBytes)
+        fail("compact: signature segment bound");
+    // signature dot-free: dots.length === 2 guarantees no dot inside the signature segment.
+}
+function concat(...parts) {
+    let len = 0;
+    for (const p of parts)
+        len += p.length;
+    const out = new Uint8Array(len);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.length;
+    }
+    return out;
+}
+// assemble_segments: the LOW-LEVEL compact assembler (mirrors CompactJws.assemble's byte assembly,
+// compact_jws.ex:41-43). Validates only the kind closed-set + 64-byte signature width, then
+// concatenates protected.payload.base64url(signature). It does NOT validate the signing-input
+// header/payload content — that is the v1.ts assemble_compact FAÇADE's job (re-parse per kind,
+// runtime.ex:151 validate_assembled_compact). Test helpers and conformance use this to build
+// compacts freely; the public contract is the façade (assembleCompact in v1.ts).
+export function assembleSegments(input, signature) {
+    return trying(() => {
+        const KINDS = ["grant", "proof", "local_loopback_http_proof", "boundary_anchor", "key_transition"];
+        if (!KINDS.includes(input.kind))
+            fail("assemble_segments: kind closed set");
+        assert(signature.length === 64, "assemble_segments: signature width 64");
+        // compact = protected "." payload "." base64url(signature).
+        const sigB64 = base64urlEncode(signature);
+        return concat(input.protectedSegment, DOTB, input.payloadSegment, DOTB, sigB64);
+    });
+}
+//# sourceMappingURL=compact.js.map

package/dist/src/compact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact.js","sourceRoot":"","sources":["../../src/compact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAe,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAe,cAAc,EAAkB,MAAM,aAAa,CAAC;AAejG,MAAM,GAAG,GAAG,IAAI,CAAC;AAEjB,gGAAgG;AAChG,gGAAgG;AAChG,MAAM,UAAU,YAAY,CAAC,KAAiB,EAAE,SAAiB,cAAc;IAC7E,mGAAmG;IACnG,4FAA4F;IAC5F,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,eAA4B,CAAC;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,wCAAwC;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,aAAa,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,uBAAoC,CAAC;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACtH,IAAI,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,uBAAoC,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAClH,MAAM,cAAc,GAAG,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,EAAE,uBAAoC,CAAC,CAAC,CAAC;IACxG,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,EAAE,uBAAoC,CAAC,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACjD,8EAA8E;IAC9E,+FAA+F;IAC/F,wFAAwF;IACxF,yFAAyF;IACzF,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,EAAE,iBAA8B,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtG,OAAO;QACL,gBAAgB,EAAE,aAAa;QAC/B,cAAc,EAAE,WAAW;QAC3B,SAAS;QACT,cAAc;QACd,YAAY;QACZ,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAEnC,4FAA4F;AAC5F,kGAAkG;AAClG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,KAAiB,EAAE,SAAiB,cAAc;IAC5E,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,eAA4B,CAAC;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACnC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,EAAE,uBAAoC,CAAC,CAAC;IAClE,IAAI,EAAE,GAAG,QAAQ;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC5D,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC/E,wFAAwF;AAC1F,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAaD,mGAAmG;AACnG,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,6FAA6F;AAC7F,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,KAAmB,EAAE,SAAqB;IACzE,OAAO,MAAM,CAAC,GAAG,EAAE;QACjB,MAAM,KAAK,GAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QACvH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC5E,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;QACzE,4DAA4D;QAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/digest.d.ts

@@ -0,0 +1,8 @@
+import { type Result } from "./error.js";
+import { type Tagged } from "./json.js";
+import { type Bounds } from "./bounds.js";
+export declare const REQUEST_PREFIX: Uint8Array<ArrayBuffer>;
+export declare function typedProject(value: Tagged): Tagged;
+export declare function requestDigest(operation: string, castArguments: Tagged, bounds?: Bounds): Uint8Array;
+export declare function digestWithPrefix(prefix: Uint8Array, operation: string, castArguments: Tagged, bounds?: Bounds): Uint8Array;
+export declare function requestDigestB64url(operation: string, castArguments: Tagged, bounds?: Bounds): Result<string>;

package/dist/src/digest.js

@@ -0,0 +1,116 @@
+import { fail, trying } from "./error.js";
+import { sha256 } from "./ed25519.js";
+import { jcsEncode } from "./jcs.js";
+import { base64urlEncode } from "./base64url.js";
+import { strUtf8 } from "./json.js";
+import { resolve, coerceBounds, MAXIMUM_BOUNDS } from "./bounds.js";
+// The request digest (spec/bap-v1.md § Signing and digest inputs, L238-264):
+//   base64url(SHA-256("BAP1-REQUEST\0" || JCS([operation, typed(cast_arguments)])))
+// The prefix is exact ASCII including its final zero byte (REQ1-SIGNING-digest-prefix). typed()
+// projects the tagged JSON algebra to the closed ["tag", value] JSON form before JCS, preserving the
+// int/float distinction (REQ1-SELECTOR-semantic-identity depends on it).
+export const REQUEST_PREFIX = new Uint8Array([
+    0x42, 0x41, 0x50, 0x31, 0x2d, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x00, // "BAP1-REQUEST\0"
+]);
+// typed() projection: tagged value → ["tag", value] JSON array (spec/bap-v1.md).
+//   :null → ["null"]; bool → ["boolean",v]; int → ["integer",v]; float → ["float",v];
+//   string → ["string",v]; array → ["array", [typed(v)...]]; object → ["object", {k: typed(v)...}]
+export function typedProject(value) {
+    switch (value.t) {
+        case "null": return { t: "array", v: [{ t: "string", v: strUtf8("null") }] };
+        case "bool": return { t: "array", v: [{ t: "string", v: strUtf8("boolean") }, { t: "bool", v: value.v }] };
+        case "int": return { t: "array", v: [{ t: "string", v: strUtf8("integer") }, { t: "int", v: value.v }] };
+        case "float": return { t: "array", v: [{ t: "string", v: strUtf8("float") }, { t: "float", v: value.v }] };
+        case "string": return { t: "array", v: [{ t: "string", v: strUtf8("string") }, { t: "string", v: value.v }] };
+        case "array": return { t: "array", v: [{ t: "string", v: strUtf8("array") }, { t: "array", v: value.v.map(typedProject) }] };
+        case "object": {
+            const out = new Map();
+            for (const [k, v] of value.v)
+                out.set(k, typedProject(v));
+            return { t: "array", v: [{ t: "string", v: strUtf8("object") }, { t: "object", v: out }] };
+        }
+        default: fail("typed: unknown tag");
+    }
+}
+// request_digest(operation, cast_arguments, bounds?). operation is validated printable ASCII 1..128.
+// Pins the v1 domain separator (BAP1-REQUEST\0); the v2 façade calls digestWithPrefix with the
+// BAP2-REQUEST\0 separator — everything else in the digest is major-independent.
+export function requestDigest(operation, castArguments, bounds = MAXIMUM_BOUNDS) {
+    return digestWithPrefix(REQUEST_PREFIX, operation, castArguments, bounds);
+}
+// The major-independent digest core: SHA-256(prefix || JCS([operation, typed(cast_arguments)])).
+// The domain separator is the only per-major input (REQ1-SIGNING-digest-prefix; the v2 profile
+// carries BAP2-REQUEST\0 per ADR 0028's contract-major activation).
+export function digestWithPrefix(prefix, operation, castArguments, bounds = MAXIMUM_BOUNDS) {
+    // Cross-vendor F2: re-validate caller-supplied bounds (Bounds is a structural interface; a caller
+    // can hand-craft widening overrides that bypass boundsNew). Mirrors the reference's Bounds.coerce.
+    const b = coerceBounds(bounds);
+    // operation: 1..operation_bytes, printable ASCII.
+    const opBytes = strUtf8(operation);
+    if (opBytes.length < 1 || opBytes.length > resolve(b, "operation_bytes")) {
+        fail("request_digest: operation bound");
+    }
+    for (let i = 0; i < opBytes.length; i++) {
+        const byte = opBytes[i];
+        if (byte < 0x20 || byte > 0x7e)
+            fail("request_digest: operation printable ASCII");
+    }
+    // The projection: [operation_string, typed(cast_arguments)].
+    const projected = typedProject(castArguments);
+    const array = { t: "array", v: [{ t: "string", v: opBytes }, projected] };
+    // Per-node bounds on the TYPED projection (not the raw args): `typed` deepens/triples the tree, so
+    // the depth boundary is ~15 (not 32) and total_nodes is reachable inline. Mirrors the official
+    // Jcs.encode per-node gate (corpus_independent.mjs:1913 withinJsonBounds + countJsonNodes).
+    if (!withinTaggedBounds(array, 0, b))
+        fail("request_digest: cast_arguments bounds");
+    if (countTaggedNodes(array) > resolve(b, "total_nodes"))
+        fail("request_digest: total_nodes");
+    // JCS over the projection, enforcing jcs_bytes bound.
+    const jcs = jcsEncode(array, b);
+    if (jcs.length > resolve(b, "jcs_bytes"))
+        fail("request_digest: jcs_bytes bound");
+    const digest = sha256(prefix, jcs);
+    return digest; // raw 32 bytes
+}
+// Per-node-type bounds gate over the tagged algebra: a SCALAR is valid at level <= depth; a
+// CONTAINER at level < depth (its children sit at level+1). Root value at level 0. Also enforces
+// members/items/string-bytes/magnitude per node.
+function withinTaggedBounds(v, level, bounds) {
+    switch (v.t) {
+        case "null":
+        case "bool":
+            return level <= resolve(bounds, "depth");
+        case "int":
+            return level <= resolve(bounds, "depth") && Math.abs(v.v) <= resolve(bounds, "integer_magnitude");
+        case "float":
+            return level <= resolve(bounds, "depth") && Number.isFinite(v.v) && Math.abs(v.v) <= resolve(bounds, "float_magnitude");
+        case "string":
+            return level <= resolve(bounds, "depth") && v.v.length <= resolve(bounds, "string_bytes");
+        case "array":
+            return level < resolve(bounds, "depth")
+                && v.v.length <= resolve(bounds, "array_items")
+                && v.v.every((item) => withinTaggedBounds(item, level + 1, bounds));
+        case "object":
+            return level < resolve(bounds, "depth")
+                && v.v.size <= resolve(bounds, "object_members")
+                && [...v.v.values()].every((val) => withinTaggedBounds(val, level + 1, bounds));
+    }
+}
+// Node count: one node per value (scalar OR container); object keys are not nodes. Mirrors the
+// official next_node! (jcs.ex:105) for the total_nodes gate on the typed projection.
+function countTaggedNodes(v) {
+    switch (v.t) {
+        case "array": return 1 + v.v.reduce((n, item) => n + countTaggedNodes(item), 0);
+        case "object": return 1 + [...v.v.values()].reduce((n, val) => n + countTaggedNodes(val), 0);
+        default: return 1;
+    }
+}
+// base64url-encoded form (for comparison against proof.ba_req which is base64url). Returns
+// Ok<string> | Err (cross-vendor #21 + the bounds-ignored note: thread bounds into the digest).
+export function requestDigestB64url(operation, castArguments, bounds = MAXIMUM_BOUNDS) {
+    return trying(() => {
+        const raw = requestDigest(operation, castArguments, bounds);
+        return new TextDecoder().decode(base64urlEncode(raw));
+    });
+}
+//# sourceMappingURL=digest.js.map

package/dist/src/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../src/digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAe,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAe,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAe,cAAc,EAAkB,MAAM,aAAa,CAAC;AAEjG,6EAA6E;AAC7E,oFAAoF;AACpF,gGAAgG;AAChG,qGAAqG;AACrG,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC;IAC3C,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB;CAClG,CAAC,CAAC;AAEH,iFAAiF;AACjF,sFAAsF;AACtF,mGAAmG;AACnG,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7E,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3G,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzG,KAAK,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3G,KAAK,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9G,KAAK,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7H,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;YACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,+FAA+F;AAC/F,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,aAAqB,EAAE,SAAiB,cAAc;IACrG,OAAO,gBAAgB,CAAC,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,iGAAiG;AACjG,+FAA+F;AAC/F,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAC9B,MAAkB,EAClB,SAAiB,EACjB,aAAqB,EACrB,SAAiB,cAAc;IAE/B,kGAAkG;IAClG,mGAAmG;IACnG,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,kDAAkD;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,iBAA8B,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI;YAAE,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,6DAA6D;IAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;IAClF,mGAAmG;IACnG,+FAA+F;IAC/F,4FAA4F;IAC5F,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACpF,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,aAA0B,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1G,sDAAsD;IACtD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,WAAwB,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,CAAC,eAAe;AAChC,CAAC;AAED,4FAA4F;AAC5F,iGAAiG;AACjG,iDAAiD;AACjD,SAAS,kBAAkB,CAAC,CAAS,EAAE,KAAa,EAAE,MAAc;IAClE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,OAAoB,CAAC,CAAC;QACxD,KAAK,KAAK;YACR,OAAO,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,OAAoB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,mBAAgC,CAAC,CAAC;QAC9H,KAAK,OAAO;YACV,OAAO,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,OAAoB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,iBAA8B,CAAC,CAAC;QACpJ,KAAK,QAAQ;YACX,OAAO,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,OAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,cAA2B,CAAC,CAAC;QACtH,KAAK,OAAO;YACV,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,OAAoB,CAAC;mBAC/C,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,aAA0B,CAAC;mBACzD,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,KAAK,QAAQ;YACX,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,OAAoB,CAAC;mBAC/C,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,gBAA6B,CAAC;mBAC1D,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,CAAS;IACjC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,aAAqB,EAAE,SAAiB,cAAc;IAC3G,OAAO,MAAM,CAAC,GAAG,EAAE;QACjB,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/ed25519.d.ts

@@ -0,0 +1,7 @@
+import { createPublicKey } from "node:crypto";
+export declare function _importedFingerprints(): Set<string>;
+export declare function _resetCensus(): void;
+export declare function importPublicKey(rawKey: Uint8Array, fingerprint: string): ReturnType<typeof createPublicKey>;
+export declare function ed25519Verify(message: Uint8Array, signature: Uint8Array, publicKey: ReturnType<typeof createPublicKey>): boolean;
+export declare function sha256(...parts: Uint8Array[]): Uint8Array;
+export declare function sha256Concat(parts: Uint8Array[]): Uint8Array;

package/dist/src/ed25519.js

@@ -0,0 +1,61 @@
+import { createPublicKey, verify as verifySig } from "node:crypto";
+import { assert, fail } from "./error.js";
+// Ed25519 verification via node:crypto (the crypto import boundary the two-boundary census tracks).
+// Per spec/bap-v1.md § Signing and digest inputs + RFC 8032. The verifier validates the fixed 32-byte
+// public-key and 64-byte signature encodings, then delegates Ed25519 verification to the backend. A
+// backend rejection or exception returns exactly Invalid (REQ1-SIGNING-backend-reject).
+// Census tracking: every key imported via importPublicKey is recorded here, so the conformance runner
+// can assert discovery == verify-import == index public_key_fingerprints (both directions).
+const importedFingerprints = new Set();
+export function _importedFingerprints() {
+    return new Set(importedFingerprints);
+}
+export function _resetCensus() {
+    importedFingerprints.clear();
+}
+// Import a raw 32-byte Ed25519 public key as a node:crypto KeyObject, recording the fingerprint for the
+// census. Returns the KeyObject. Throws InvalidError on a malformed key.
+export function importPublicKey(rawKey, fingerprint) {
+    assert(rawKey.length === 32, "ed25519: public key must be 32 bytes");
+    // Build the SPKI DER for an Ed25519 public key: SEQUENCE { AlgId, BIT STRING <32 raw bytes> }.
+    // This matches the runner's SPKI_ED25519_PREFIX (corpus_independent.mjs:27).
+    const SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+    const der = Buffer.concat([SPKI_PREFIX, Buffer.from(rawKey)]);
+    try {
+        const key = createPublicKey({ key: der, format: "der", type: "spki" });
+        importedFingerprints.add(fingerprint);
+        return key;
+    }
+    catch {
+        fail("ed25519: invalid public key");
+    }
+}
+// Verify an Ed25519 signature. Returns true if the signature is valid, false otherwise. Maps backend
+// exceptions to InvalidError (REQ1-SIGNING-backend-reject).
+export function ed25519Verify(message, signature, publicKey) {
+    assert(signature.length === 64, "ed25519: signature must be 64 bytes");
+    try {
+        return verifySig(undefined, Buffer.from(message), publicKey, Buffer.from(signature));
+    }
+    catch {
+        fail("ed25519: backend rejected");
+    }
+}
+// SHA-256 helper (FIPS 180-4), used by thumbprints + digests.
+import { createHash } from "node:crypto";
+export function sha256(...parts) {
+    const h = createHash("sha256");
+    for (const p of parts)
+        h.update(Buffer.from(p));
+    return new Uint8Array(h.digest());
+}
+// SHA-256 over an ARRAY of chunks (no spread). Used by archive-verify, which hashes a caller-supplied
+// chunk list that may hold up to archive_chunks (65796) entries — beyond V8's ~65534 call-argument
+// ceiling, so the chunk list MUST be fed as an array, not spread into sha256(...chunks).
+export function sha256Concat(parts) {
+    const h = createHash("sha256");
+    for (const p of parts)
+        h.update(Buffer.from(p));
+    return new Uint8Array(h.digest());
+}
+//# sourceMappingURL=ed25519.js.map

package/dist/src/ed25519.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../../src/ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE1C,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AACpG,wFAAwF;AAExF,sGAAsG;AACtG,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC/C,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACvC,CAAC;AACD,MAAM,UAAU,YAAY;IAC1B,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,wGAAwG;AACxG,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,WAAmB;IACrE,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,sCAAsC,CAAC,CAAC;IACrE,+FAA+F;IAC/F,6EAA6E;IAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAC3B,OAAmB,EACnB,SAAqB,EACrB,SAA6C;IAE7C,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,qCAAqC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,MAAM,UAAU,MAAM,CAAC,GAAG,KAAmB;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,sGAAsG;AACtG,mGAAmG;AACnG,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC"}

package/dist/src/error.d.ts

@@ -0,0 +1,15 @@
+export declare class InvalidError extends Error {
+    readonly name = "InvalidError";
+    constructor(message?: string);
+}
+export type Result<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+};
+export declare const ok: <T>(value: T) => Result<T>;
+export declare const err: () => Result<never>;
+export declare function trying<T>(fn: () => T): Result<T>;
+export declare function fail(message?: string): never;
+export declare function assert(condition: unknown, message?: string): asserts condition;

package/dist/src/error.js

@@ -0,0 +1,34 @@
+// The single closed error value. Mirrors the Elixir {:error, :invalid} — no reason, no partial.
+// AGENTS rule 1: verification is not authority; rule 3: fail closed. Every public façade function
+// returns Ok<T> | Err on this. A GENUINE protocol rejection throws/returns InvalidError; a runner/SDK
+// bug (TypeError, RangeError, uncaught library throw) is a distinct class that must NOT map to Invalid
+// (mirrors the Node runner's InvalidError whitelist discipline, corpus_independent.mjs:88-102 — only a
+// genuine protocol rejection maps to INVALID; everything else is a bug).
+export class InvalidError extends Error {
+    name = "InvalidError";
+    constructor(message = "invalid") {
+        super(message);
+    }
+}
+export const ok = (value) => ({ ok: true, value });
+export const err = () => ({ ok: false });
+// Convenience: run a thunk that may throw InvalidError; convert to Result. Any NON-Invalid throw
+// propagates (a bug, not a verdict) — this is the whitelist.
+export function trying(fn) {
+    try {
+        return ok(fn());
+    }
+    catch (e) {
+        if (e instanceof InvalidError)
+            return err();
+        throw e;
+    }
+}
+export function fail(message) {
+    throw new InvalidError(message);
+}
+export function assert(condition, message) {
+    if (!condition)
+        fail(message);
+}
+//# sourceMappingURL=error.js.map

package/dist/src/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/error.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,kGAAkG;AAClG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,yEAAyE;AACzE,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,cAAc,CAAC;IACxC,YAAY,OAAO,GAAG,SAAS;QAC7B,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAKD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAI,KAAQ,EAAa,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpE,MAAM,CAAC,MAAM,GAAG,GAAG,GAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAExD,iGAAiG;AACjG,6DAA6D;AAC7D,MAAM,UAAU,MAAM,CAAI,EAAW;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,YAAY;YAAE,OAAO,GAAG,EAAE,CAAC;QAC5C,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAgB;IACnC,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAkB,EAAE,OAAgB;IACzD,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC"}

package/dist/src/facts.d.ts

@@ -0,0 +1,104 @@
+export interface GrantFacts {
+    readonly version: number;
+    readonly issuer: string;
+    readonly grantId: string;
+    readonly issuerKeyFingerprint: Uint8Array;
+    readonly holderThumbprint: Uint8Array;
+    readonly matchedAudience: string;
+    readonly issuedAt: number;
+    readonly notBefore: number;
+    readonly expiresAt: number;
+    readonly authorization: "not_evaluated";
+}
+export interface EnvelopeFacts {
+    readonly version: number;
+    readonly issuer: string;
+    readonly grantId: string;
+    readonly issuerKeyFingerprint: Uint8Array;
+    readonly holderThumbprint: Uint8Array;
+    readonly matchedAudience: string;
+    readonly grantIssuedAt: number;
+    readonly grantNotBefore: number;
+    readonly grantExpiresAt: number;
+    readonly proofId: string;
+    readonly invocationId: string;
+    readonly operation: string;
+    readonly uri: string;
+    readonly grantHash: Uint8Array;
+    readonly requestHash: Uint8Array;
+    readonly proofIssuedAt: number;
+    readonly authorization: "not_evaluated";
+}
+export interface ChainFacts {
+    readonly version: 1;
+    readonly chainId: string;
+    readonly firstSequence: number;
+    readonly lastSequence: number;
+    readonly rowCount: number;
+    readonly previousHash: Uint8Array;
+    readonly lastHash: Uint8Array;
+    readonly verification: "boundary_consistent";
+    readonly trust: "not_evaluated";
+}
+export interface AnchorFacts {
+    readonly version: 1;
+    readonly anchorId: string;
+    readonly anchoredAt: number;
+    readonly chainId: string;
+    readonly sequence: number;
+    readonly chainHash: Uint8Array;
+    readonly keyFingerprint: Uint8Array;
+    readonly verification: "signature_and_window";
+    readonly trust: "not_evaluated";
+}
+export interface KeyTransitionFacts {
+    readonly version: 1;
+    readonly transitionId: string;
+    readonly chainId: string;
+    readonly effectiveAt: number;
+    readonly currentKeyFingerprint: Uint8Array;
+    readonly nextKeyFingerprint: Uint8Array;
+    readonly verification: "authenticated_transition";
+    readonly trust: "not_evaluated";
+}
+export interface AnchoredExportFacts {
+    readonly version: 1;
+    readonly chainId: string;
+    readonly firstSequence: number;
+    readonly lastSequence: number;
+    readonly rowCount: number;
+    readonly previousHash: Uint8Array;
+    readonly lastHash: Uint8Array;
+    readonly digest: Uint8Array;
+    readonly startAnchorId: string;
+    readonly startAnchoredAt: number;
+    readonly startKeyFingerprint: Uint8Array;
+    readonly endAnchorId: string;
+    readonly endAnchoredAt: number;
+    readonly endKeyFingerprint: Uint8Array;
+    readonly transitionCount: number;
+    readonly objectVersion: string;
+    readonly verification: "anchored_export";
+    readonly trust: "not_evaluated";
+    readonly authorization: "not_evaluated";
+}
+export interface GrantDecoded {
+    readonly keyId: string;
+    readonly issuer: string;
+    readonly grantId: string;
+    readonly audiences: string[];
+    readonly issuedAt: number;
+    readonly notBefore: number;
+    readonly expiresAt: number;
+    readonly holderThumbprint: Uint8Array;
+    readonly verification: "not_evaluated";
+}
+export interface ProofDecoded {
+    readonly proofId: string;
+    readonly holderThumbprint: Uint8Array;
+    readonly verification: "not_evaluated";
+}
+export interface KeyLocator {
+    readonly keyId: string;
+    readonly trust: "not_evaluated";
+}

package/dist/src/facts.js

@@ -0,0 +1,6 @@
+// Value-bearing, redacted, non-authorizing facts (spec/bap-v1.md § Public verification contract,
+// REQ1-VERIFY-facts-redacted, REQ1-VERIFY-facts-not-credentials). No generic encoder, no `toJSON`,
+// no authorization/decision method (AGENTS rule 1). Grant/Envelope/Export carry
+// `authorization: "not_evaluated"`; Chain/Anchor/Transition carry `trust: "not_evaluated"`.
+export {};
+//# sourceMappingURL=facts.js.map