@brightchain/brightchain-lib 0.13.0 → 0.15.0

package/src/lib/services/crypto/ethereumWalletService.js

@@ -0,0 +1,345 @@
+"use strict";
+/**
+ * Ethereum Wallet Service for the BrightChain identity system.
+ *
+ * Derives Ethereum addresses from BrightChain member identities using
+ * BIP44 hierarchical deterministic derivation. Provides message signing
+ * and signature verification for dApp authentication and transaction
+ * signing.
+ *
+ * Derivation path: m/44'/60'/0'/0/0 (BIP44 standard for Ethereum)
+ * - purpose = 44 (BIP44)
+ * - coin_type = 60 (Ethereum)
+ * - account = 0 (default account)
+ * - change = 0 (external chain — wallet addresses)
+ * - index = 0 (first address)
+ *
+ * Requirements: 6.1, 6.2, 6.3, 6.7, 6.8
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EthereumWalletService = exports.EthereumSigningError = exports.EthereumDerivationError = void 0;
+const sha3_1 = require("@noble/hashes/sha3");
+const bip32_1 = require("@scure/bip32");
+const bip39_1 = require("@scure/bip39");
+const secp256k1 = require("secp256k1");
+const paperKeyService_1 = require("../identity/paperKeyService");
+// ─── Constants ──────────────────────────────────────────────────────────────
+/**
+ * BIP44 derivation path for Ethereum wallets.
+ * m / 44' / 60' / 0' / 0 / 0
+ */
+const ETH_DERIVATION_PATH = "m/44'/60'/0'/0/0";
+/**
+ * Ethereum signed message prefix per EIP-191.
+ */
+const ETH_MESSAGE_PREFIX = '\x19Ethereum Signed Message:\n';
+// ─── Error classes ──────────────────────────────────────────────────────────
+/**
+ * Error thrown when Ethereum address derivation fails.
+ */
+class EthereumDerivationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'EthereumDerivationError';
+    }
+}
+exports.EthereumDerivationError = EthereumDerivationError;
+/**
+ * Error thrown when message signing fails.
+ */
+class EthereumSigningError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'EthereumSigningError';
+    }
+}
+exports.EthereumSigningError = EthereumSigningError;
+// ─── Utility functions ──────────────────────────────────────────────────────
+/**
+ * Convert a byte array to a hex string (no 0x prefix).
+ */
+function bytesToHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Convert a hex string (with or without 0x prefix) to a byte array.
+ */
+function hexToBytes(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+/**
+ * Derive an Ethereum address from an uncompressed public key.
+ *
+ * Takes the last 20 bytes of the keccak256 hash of the public key
+ * (without the 0x04 prefix byte), then applies EIP-55 checksum encoding.
+ *
+ * @param uncompressedPublicKey - 65-byte uncompressed SECP256k1 public key
+ * @returns EIP-55 checksummed Ethereum address
+ */
+function publicKeyToAddress(uncompressedPublicKey) {
+    // Remove the 0x04 prefix (first byte) from uncompressed key
+    const keyWithoutPrefix = uncompressedPublicKey.slice(1);
+    // Keccak-256 hash of the public key bytes
+    const hash = (0, sha3_1.keccak_256)(keyWithoutPrefix);
+    // Take the last 20 bytes as the raw address
+    const rawAddress = bytesToHex(hash.slice(12));
+    // Apply EIP-55 checksum
+    return toChecksumAddress(rawAddress);
+}
+/**
+ * Apply EIP-55 mixed-case checksum encoding to an Ethereum address.
+ *
+ * @param address - Lowercase hex address (without 0x prefix)
+ * @returns Checksummed address with 0x prefix
+ */
+function toChecksumAddress(address) {
+    const lower = address.toLowerCase();
+    const hash = bytesToHex((0, sha3_1.keccak_256)(new TextEncoder().encode(lower)));
+    let checksummed = '0x';
+    for (let i = 0; i < lower.length; i++) {
+        const char = lower[i];
+        // If the corresponding nibble of the hash is >= 8, uppercase the char
+        if (parseInt(hash[i], 16) >= 8) {
+            checksummed += char.toUpperCase();
+        }
+        else {
+            checksummed += char;
+        }
+    }
+    return checksummed;
+}
+/**
+ * Validate an EIP-55 checksummed Ethereum address.
+ *
+ * @param address - The address to validate (with 0x prefix)
+ * @returns `true` if the address has a valid EIP-55 checksum
+ */
+function isValidChecksumAddress(address) {
+    if (!/^0x[0-9a-fA-F]{40}$/.test(address))
+        return false;
+    const stripped = address.slice(2);
+    const lower = stripped.toLowerCase();
+    const hash = bytesToHex((0, sha3_1.keccak_256)(new TextEncoder().encode(lower)));
+    for (let i = 0; i < 40; i++) {
+        const hashNibble = parseInt(hash[i], 16);
+        if (hashNibble >= 8 && stripped[i] !== stripped[i].toUpperCase()) {
+            return false;
+        }
+        if (hashNibble < 8 && stripped[i] !== stripped[i].toLowerCase()) {
+            return false;
+        }
+    }
+    return true;
+}
+// ─── Service ────────────────────────────────────────────────────────────────
+/**
+ * Service for deriving Ethereum wallets from BrightChain member identities
+ * and performing Ethereum-compatible message signing.
+ *
+ * All methods are static — the service is stateless and safe to call
+ * from any context (browser or Node.js).
+ *
+ * @example
+ * ```typescript
+ * const eciesService = ServiceProvider.getInstance().eciesService;
+ *
+ * // Derive Ethereum address from paper key
+ * const result = EthereumWalletService.deriveAddress(paperKey);
+ * console.log(result.address); // 0x1234...abcd (EIP-55 checksummed)
+ *
+ * // Sign a message
+ * const sig = EthereumWalletService.signMessage(paperKey, 'Hello World');
+ *
+ * // Verify the signature
+ * const valid = EthereumWalletService.verifySignature(
+ *   'Hello World',
+ *   sig.signature,
+ *   result.address,
+ * );
+ * ```
+ */
+class EthereumWalletService {
+    /**
+     * Derive an Ethereum address from a BIP39 mnemonic paper key.
+     *
+     * Uses BIP44 path m/44'/60'/0'/0/0 to derive the first Ethereum
+     * address. The address is returned in EIP-55 checksummed format.
+     *
+     * **Validates: Requirements 6.1, 6.4**
+     *
+     * @param paperKey - The 24-word BIP39 mnemonic
+     * @returns The derived Ethereum address, public key, and derivation path
+     * @throws {EthereumDerivationError} If derivation fails
+     */
+    static deriveAddress(paperKey) {
+        try {
+            const seed = (0, bip39_1.mnemonicToSeedSync)(paperKey);
+            const masterKey = bip32_1.HDKey.fromMasterSeed(seed);
+            const childKey = masterKey.derive(ETH_DERIVATION_PATH);
+            const compressedPublicKey = childKey.publicKey;
+            if (!compressedPublicKey) {
+                throw new EthereumDerivationError('BIP32 derivation produced no public key');
+            }
+            // Convert compressed to uncompressed public key for address derivation
+            const uncompressed = secp256k1.publicKeyConvert(compressedPublicKey, false);
+            const address = publicKeyToAddress(uncompressed);
+            return {
+                address,
+                publicKeyHex: bytesToHex(uncompressed),
+                derivationPath: ETH_DERIVATION_PATH,
+            };
+        }
+        catch (error) {
+            if (error instanceof EthereumDerivationError)
+                throw error;
+            const msg = error instanceof Error ? error.message : String(error);
+            throw new EthereumDerivationError(`Failed to derive Ethereum address: ${msg}`);
+        }
+    }
+    /**
+     * Derive an Ethereum address from a paper key after validating it.
+     *
+     * Convenience method that validates the paper key before derivation.
+     *
+     * @param paperKey     - The 24-word BIP39 mnemonic
+     * @param eciesService - The ECIES service for paper key validation
+     * @returns The derived Ethereum address result
+     * @throws {EthereumDerivationError} If the paper key is invalid or derivation fails
+     */
+    static deriveAddressFromValidatedKey(paperKey, eciesService) {
+        if (!paperKeyService_1.PaperKeyService.validatePaperKey(paperKey, eciesService)) {
+            throw new EthereumDerivationError('Invalid paper key');
+        }
+        return EthereumWalletService.deriveAddress(paperKey);
+    }
+    /**
+     * Sign a message using the Ethereum personal_sign format (EIP-191).
+     *
+     * Prepends the standard Ethereum message prefix before signing,
+     * making the signature compatible with MetaMask's personal_sign
+     * and web3.eth.personal.sign.
+     *
+     * **Validates: Requirements 6.2, 6.3**
+     *
+     * @param paperKey - The 24-word BIP39 mnemonic (private key source)
+     * @param message  - The message to sign
+     * @returns The signature result with hex-encoded signature and recovery param
+     * @throws {EthereumSigningError} If signing fails
+     */
+    static signMessage(paperKey, message) {
+        try {
+            const seed = (0, bip39_1.mnemonicToSeedSync)(paperKey);
+            const masterKey = bip32_1.HDKey.fromMasterSeed(seed);
+            const childKey = masterKey.derive(ETH_DERIVATION_PATH);
+            const privateKey = childKey.privateKey;
+            if (!privateKey) {
+                throw new EthereumSigningError('BIP32 derivation produced no private key');
+            }
+            // EIP-191 message hash
+            const messageHash = EthereumWalletService.hashMessage(message);
+            // Sign with SECP256k1
+            const sigObj = secp256k1.ecdsaSign(messageHash, privateKey);
+            // Combine r + s + v into a 65-byte signature
+            const signature = new Uint8Array(65);
+            signature.set(sigObj.signature);
+            signature[64] = sigObj.recid + 27; // Ethereum v = recid + 27
+            return {
+                message,
+                signature: '0x' + bytesToHex(signature),
+                recoveryParam: sigObj.recid,
+            };
+        }
+        catch (error) {
+            if (error instanceof EthereumSigningError)
+                throw error;
+            const msg = error instanceof Error ? error.message : String(error);
+            throw new EthereumSigningError(`Failed to sign message: ${msg}`);
+        }
+    }
+    /**
+     * Verify an Ethereum personal_sign signature.
+     *
+     * Recovers the signer's address from the signature and compares it
+     * to the expected address.
+     *
+     * **Validates: Requirements 6.7, 6.8**
+     *
+     * @param message   - The original message that was signed
+     * @param signature - The hex-encoded 65-byte signature (0x-prefixed)
+     * @param address   - The expected signer's Ethereum address (EIP-55)
+     * @returns `true` if the signature was produced by the address owner
+     */
+    static verifySignature(message, signature, address) {
+        try {
+            const recoveredAddress = EthereumWalletService.recoverAddress(message, signature);
+            return recoveredAddress.toLowerCase() === address.toLowerCase();
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Recover the signer's Ethereum address from a signed message.
+     *
+     * @param message   - The original message
+     * @param signature - The hex-encoded 65-byte signature (0x-prefixed)
+     * @returns The recovered EIP-55 checksummed Ethereum address
+     * @throws {EthereumSigningError} If recovery fails
+     */
+    static recoverAddress(message, signature) {
+        try {
+            const sigBytes = hexToBytes(signature);
+            if (sigBytes.length !== 65) {
+                throw new EthereumSigningError(`Invalid signature length: expected 65 bytes, got ${sigBytes.length}`);
+            }
+            const messageHash = EthereumWalletService.hashMessage(message);
+            // Extract r+s (first 64 bytes) and v (last byte)
+            const rs = sigBytes.slice(0, 64);
+            const v = sigBytes[64];
+            const recid = v >= 27 ? v - 27 : v;
+            // Recover the public key
+            const recoveredPublicKey = secp256k1.ecdsaRecover(rs, recid, messageHash, false);
+            return publicKeyToAddress(recoveredPublicKey);
+        }
+        catch (error) {
+            if (error instanceof EthereumSigningError)
+                throw error;
+            const msg = error instanceof Error ? error.message : String(error);
+            throw new EthereumSigningError(`Failed to recover address: ${msg}`);
+        }
+    }
+    /**
+     * Hash a message using the EIP-191 personal message format.
+     *
+     * Format: keccak256("\x19Ethereum Signed Message:\n" + len(message) + message)
+     *
+     * @param message - The message to hash
+     * @returns The 32-byte keccak256 hash
+     */
+    static hashMessage(message) {
+        const messageBytes = new TextEncoder().encode(message);
+        const prefix = new TextEncoder().encode(ETH_MESSAGE_PREFIX + messageBytes.length);
+        const combined = new Uint8Array(prefix.length + messageBytes.length);
+        combined.set(prefix);
+        combined.set(messageBytes, prefix.length);
+        return (0, sha3_1.keccak_256)(combined);
+    }
+    /**
+     * Validate an EIP-55 checksummed Ethereum address.
+     *
+     * @param address - The address to validate
+     * @returns `true` if the address is valid and properly checksummed
+     */
+    static isValidAddress(address) {
+        return isValidChecksumAddress(address);
+    }
+}
+exports.EthereumWalletService = EthereumWalletService;
+//# sourceMappingURL=ethereumWalletService.js.map

package/src/lib/services/crypto/ethereumWalletService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ethereumWalletService.js","sourceRoot":"","sources":["../../../../../../brightchain-lib/src/lib/services/crypto/ethereumWalletService.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAGH,6CAAgD;AAChD,wCAAqC;AACrC,wCAAkD;AAClD,uCAAuC;AAEvC,iEAA8D;AAE9D,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAE/C;;GAEG;AACH,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAE5D,+EAA+E;AAE/E;;GAEG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED;;GAEG;AACH,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAgCD,+EAA+E;AAE/E;;GAEG;AACH,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,qBAAiC;IAC3D,4DAA4D;IAC5D,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAExD,0CAA0C;IAC1C,MAAM,IAAI,GAAG,IAAA,iBAAU,EAAC,gBAAgB,CAAC,CAAC;IAE1C,4CAA4C;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9C,wBAAwB;IACxB,OAAO,iBAAiB,CAAC,UAAU,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAA,iBAAU,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAErE,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,sEAAsE;QACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,WAAW,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,WAAW,IAAI,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAA,iBAAU,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,UAAU,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAa,qBAAqB;IAChC;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,aAAa,CAAC,QAAgB;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,0BAAkB,EAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,aAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAEvD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,SAAS,CAAC;YAC/C,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,uBAAuB,CAC/B,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,MAAM,YAAY,GAAG,SAAS,CAAC,gBAAgB,CAC7C,mBAAmB,EACnB,KAAK,CACN,CAAC;YAEF,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAEjD,OAAO;gBACL,OAAO;gBACP,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC;gBACtC,cAAc,EAAE,mBAAmB;aACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAC;YAC1D,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,uBAAuB,CAC/B,sCAAsC,GAAG,EAAE,CAC5C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,6BAA6B,CAClC,QAAgB,EAChB,YAA+B;QAE/B,IAAI,CAAC,iCAAe,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,qBAAqB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAChB,QAAgB,EAChB,OAAe;QAEf,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,0BAAkB,EAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,aAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAEvD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACvC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,oBAAoB,CAC5B,0CAA0C,CAC3C,CAAC;YACJ,CAAC;YAED,uBAAuB;YACvB,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAE/D,sBAAsB;YACtB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAE5D,6CAA6C;YAC7C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;YACrC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,0BAA0B;YAE7D,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;gBACvC,aAAa,EAAE,MAAM,CAAC,KAAK;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB;gBAAE,MAAM,KAAK,CAAC;YACvD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,eAAe,CACpB,OAAe,EACf,SAAiB,EACjB,OAAe;QAEf,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,cAAc,CAC3D,OAAO,EACP,SAAS,CACV,CAAC;YACF,OAAO,gBAAgB,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,cAAc,CAAC,OAAe,EAAE,SAAiB;QACtD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC3B,MAAM,IAAI,oBAAoB,CAC5B,oDAAoD,QAAQ,CAAC,MAAM,EAAE,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAE/D,iDAAiD;YACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAEnC,yBAAyB;YACzB,MAAM,kBAAkB,GAAG,SAAS,CAAC,YAAY,CAC/C,EAAE,EACF,KAAK,EACL,WAAW,EACX,KAAK,CACN,CAAC;YAEF,OAAO,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB;gBAAE,MAAM,KAAK,CAAC;YACvD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,WAAW,CAAC,OAAe;QAChC,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACrC,kBAAkB,GAAG,YAAY,CAAC,MAAM,CACzC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACrE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,IAAA,iBAAU,EAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,OAAe;QACnC,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AA1ND,sDA0NC"}

package/src/lib/services/crypto/gitSigningService.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Git Signing Service for the BrightChain identity system.
+ *
+ * Provides GPG-compatible commit and tag signing using SECP256k1 keys
+ * derived from BrightChain member identities. Signatures are produced
+ * in a format that Git can verify using the member's exported public key.
+ *
+ * The service uses ECDSA signing over SHA-256 hashes, wrapped in a
+ * PGP-like armored format that Git recognises for signature verification.
+ *
+ * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5
+ */
+import { ECIESService, PlatformID } from '@digitaldefiance/ecies-lib';
+/**
+ * Error thrown when Git signing operations fail.
+ */
+export declare class GitSigningError extends Error {
+    constructor(message: string);
+}
+/**
+ * Result of a Git signing operation.
+ */
+export interface IGitSignatureResult {
+    /** The armored PGP-like signature block */
+    armoredSignature: string;
+    /** Raw ECDSA signature bytes (DER-encoded, hex) */
+    signatureHex: string;
+    /** SHA-256 hash of the signed content (hex) */
+    contentHashHex: string;
+    /** BIP44 derivation path used for the signing key */
+    derivationPath: string;
+}
+/**
+ * Result of exporting a public key in PGP-like format.
+ */
+export interface IGitPublicKeyExport {
+    /** Armored PGP-like public key block */
+    armoredPublicKey: string;
+    /** Compressed SECP256k1 public key (hex) */
+    publicKeyHex: string;
+    /** BIP44 derivation path */
+    derivationPath: string;
+    /** Key fingerprint (SHA-256 of the public key, first 20 bytes, hex) */
+    fingerprint: string;
+}
+/**
+ * Service for signing Git commits and tags using BrightChain member keys.
+ *
+ * Produces PGP-armored signatures compatible with `git verify-commit`
+ * and `git verify-tag` when the corresponding public key is imported
+ * into the user's GPG keyring.
+ *
+ * All methods are static and stateless.
+ *
+ * @example
+ * ```typescript
+ * // Sign a commit
+ * const sig = GitSigningService.signCommit(paperKey, commitContent);
+ *
+ * // Export public key for GPG import
+ * const pubKey = GitSigningService.exportPublicKey(paperKey);
+ *
+ * // Verify a signature
+ * const valid = GitSigningService.verify(commitContent, sig, paperKey);
+ * ```
+ */
+export declare class GitSigningService {
+    /**
+     * Sign a Git commit payload.
+     *
+     * Produces a PGP-armored ECDSA signature over the SHA-256 hash
+     * of the commit content.
+     *
+     * **Validates: Requirements 7.1, 7.2**
+     *
+     * @param paperKey      - The 24-word BIP39 mnemonic (private key source)
+     * @param commitContent - The raw commit object content to sign
+     * @returns The signature result with armored signature block
+     * @throws {GitSigningError} If signing fails
+     */
+    static signCommit(paperKey: string, commitContent: string): IGitSignatureResult;
+    /**
+     * Sign a Git tag payload.
+     *
+     * Produces a PGP-armored ECDSA signature over the SHA-256 hash
+     * of the tag content.
+     *
+     * **Validates: Requirements 7.3**
+     *
+     * @param paperKey   - The 24-word BIP39 mnemonic (private key source)
+     * @param tagContent - The raw tag object content to sign
+     * @returns The signature result with armored signature block
+     * @throws {GitSigningError} If signing fails
+     */
+    static signTag(paperKey: string, tagContent: string): IGitSignatureResult;
+    /**
+     * Verify a signature against content using the signer's paper key.
+     *
+     * Derives the public key from the paper key and verifies the ECDSA
+     * signature against the SHA-256 hash of the content.
+     *
+     * **Validates: Requirements 7.4**
+     *
+     * @param content   - The original content that was signed
+     * @param signature - The signature result to verify
+     * @param paperKey  - The signer's paper key (for public key derivation)
+     * @returns `true` if the signature is valid
+     */
+    static verify(content: string, signature: IGitSignatureResult, paperKey: string): boolean;
+    /**
+     * Verify a signature using a raw public key hex string.
+     *
+     * @param content      - The original content that was signed
+     * @param signature    - The signature result to verify
+     * @param publicKeyHex - The signer's compressed public key (hex)
+     * @returns `true` if the signature is valid
+     */
+    static verifyWithPublicKey(content: string, signature: IGitSignatureResult, publicKeyHex: string): boolean;
+    /**
+     * Export the Git signing public key in a PGP-armored format.
+     *
+     * The exported key can be added to a GPG keyring or uploaded to
+     * GitHub/GitLab for signature verification.
+     *
+     * **Validates: Requirements 7.5**
+     *
+     * @param paperKey - The 24-word BIP39 mnemonic
+     * @returns The public key export with armored block and fingerprint
+     * @throws {GitSigningError} If key derivation fails
+     */
+    static exportPublicKey(paperKey: string): IGitPublicKeyExport;
+    /**
+     * Validate a paper key before using it for Git signing.
+     *
+     * @param paperKey     - The paper key to validate
+     * @param eciesService - The ECIES service for validation
+     * @returns `true` if the paper key is valid
+     */
+    static validateKey<TID extends PlatformID = Uint8Array>(paperKey: string, eciesService: ECIESService<TID>): boolean;
+    /**
+     * Core signing implementation shared by signCommit and signTag.
+     */
+    private static sign;
+}
+//# sourceMappingURL=gitSigningService.d.ts.map

package/src/lib/services/crypto/gitSigningService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitSigningService.d.ts","sourceRoot":"","sources":["../../../../../../brightchain-lib/src/lib/services/crypto/gitSigningService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AA0BtE;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAID;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IAEzB,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IAErB,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IAEvB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IAErB,4BAA4B;IAC5B,cAAc,EAAE,MAAM,CAAC;IAEvB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AA4CD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,iBAAiB;IAC5B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,UAAU,CACf,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,mBAAmB;IAItB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB;IAIzE;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,mBAAmB,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO;IAgBV;;;;;;;OAOG;IACH,MAAM,CAAC,mBAAmB,CACxB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,mBAAmB,EAC9B,YAAY,EAAE,MAAM,GACnB,OAAO;IAaV;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB;IAoC7D;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,EACpD,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,GAC9B,OAAO;IAMV;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,IAAI;CAsCpB"}