@brightchain/brightchain-lib 0.13.0 → 0.15.0

package/src/lib/services/crypto/gitSigningService.js

@@ -0,0 +1,291 @@
+"use strict";
+/**
+ * Git Signing Service for the BrightChain identity system.
+ *
+ * Provides GPG-compatible commit and tag signing using SECP256k1 keys
+ * derived from BrightChain member identities. Signatures are produced
+ * in a format that Git can verify using the member's exported public key.
+ *
+ * The service uses ECDSA signing over SHA-256 hashes, wrapped in a
+ * PGP-like armored format that Git recognises for signature verification.
+ *
+ * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitSigningService = exports.GitSigningError = void 0;
+const sha256_1 = require("@noble/hashes/sha256");
+const bip32_1 = require("@scure/bip32");
+const bip39_1 = require("@scure/bip39");
+const secp256k1 = require("secp256k1");
+const paperKeyService_1 = require("../identity/paperKeyService");
+// ─── Constants ──────────────────────────────────────────────────────────────
+/**
+ * BIP44 derivation path for Git signing keys.
+ * Uses change=2 to separate from wallet (change=0) and device (change=1) keys.
+ */
+const GIT_SIGNING_DERIVATION_PATH = "m/44'/60'/0'/2/0";
+/**
+ * PGP armor header for signatures.
+ */
+const PGP_SIG_BEGIN = '-----BEGIN PGP SIGNATURE-----';
+const PGP_SIG_END = '-----END PGP SIGNATURE-----';
+const PGP_KEY_BEGIN = '-----BEGIN PGP PUBLIC KEY BLOCK-----';
+const PGP_KEY_END = '-----END PGP PUBLIC KEY BLOCK-----';
+// ─── Error classes ──────────────────────────────────────────────────────────
+/**
+ * Error thrown when Git signing operations fail.
+ */
+class GitSigningError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitSigningError';
+    }
+}
+exports.GitSigningError = GitSigningError;
+// ─── Utility functions ──────────────────────────────────────────────────────
+function bytesToHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+function base64Encode(bytes) {
+    // Works in both Node.js and browser
+    if (typeof Buffer !== 'undefined') {
+        return Buffer.from(bytes).toString('base64');
+    }
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+/**
+ * Wrap a base64 string at 76 characters per line (PGP standard).
+ */
+function wrapBase64(b64) {
+    const lines = [];
+    for (let i = 0; i < b64.length; i += 76) {
+        lines.push(b64.substring(i, i + 76));
+    }
+    return lines.join('\n');
+}
+/**
+ * Derive the Git signing key pair from a paper key mnemonic.
+ */
+function deriveGitKey(paperKey) {
+    const seed = (0, bip39_1.mnemonicToSeedSync)(paperKey);
+    const masterKey = bip32_1.HDKey.fromMasterSeed(seed);
+    return masterKey.derive(GIT_SIGNING_DERIVATION_PATH);
+}
+// ─── Service ────────────────────────────────────────────────────────────────
+/**
+ * Service for signing Git commits and tags using BrightChain member keys.
+ *
+ * Produces PGP-armored signatures compatible with `git verify-commit`
+ * and `git verify-tag` when the corresponding public key is imported
+ * into the user's GPG keyring.
+ *
+ * All methods are static and stateless.
+ *
+ * @example
+ * ```typescript
+ * // Sign a commit
+ * const sig = GitSigningService.signCommit(paperKey, commitContent);
+ *
+ * // Export public key for GPG import
+ * const pubKey = GitSigningService.exportPublicKey(paperKey);
+ *
+ * // Verify a signature
+ * const valid = GitSigningService.verify(commitContent, sig, paperKey);
+ * ```
+ */
+class GitSigningService {
+    /**
+     * Sign a Git commit payload.
+     *
+     * Produces a PGP-armored ECDSA signature over the SHA-256 hash
+     * of the commit content.
+     *
+     * **Validates: Requirements 7.1, 7.2**
+     *
+     * @param paperKey      - The 24-word BIP39 mnemonic (private key source)
+     * @param commitContent - The raw commit object content to sign
+     * @returns The signature result with armored signature block
+     * @throws {GitSigningError} If signing fails
+     */
+    static signCommit(paperKey, commitContent) {
+        return GitSigningService.sign(paperKey, commitContent);
+    }
+    /**
+     * Sign a Git tag payload.
+     *
+     * Produces a PGP-armored ECDSA signature over the SHA-256 hash
+     * of the tag content.
+     *
+     * **Validates: Requirements 7.3**
+     *
+     * @param paperKey   - The 24-word BIP39 mnemonic (private key source)
+     * @param tagContent - The raw tag object content to sign
+     * @returns The signature result with armored signature block
+     * @throws {GitSigningError} If signing fails
+     */
+    static signTag(paperKey, tagContent) {
+        return GitSigningService.sign(paperKey, tagContent);
+    }
+    /**
+     * Verify a signature against content using the signer's paper key.
+     *
+     * Derives the public key from the paper key and verifies the ECDSA
+     * signature against the SHA-256 hash of the content.
+     *
+     * **Validates: Requirements 7.4**
+     *
+     * @param content   - The original content that was signed
+     * @param signature - The signature result to verify
+     * @param paperKey  - The signer's paper key (for public key derivation)
+     * @returns `true` if the signature is valid
+     */
+    static verify(content, signature, paperKey) {
+        try {
+            const childKey = deriveGitKey(paperKey);
+            const publicKey = childKey.publicKey;
+            if (!publicKey)
+                return false;
+            const contentBytes = new TextEncoder().encode(content);
+            const hash = (0, sha256_1.sha256)(contentBytes);
+            const sigBytes = hexToBytes(signature.signatureHex);
+            return secp256k1.ecdsaVerify(sigBytes, hash, publicKey);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Verify a signature using a raw public key hex string.
+     *
+     * @param content      - The original content that was signed
+     * @param signature    - The signature result to verify
+     * @param publicKeyHex - The signer's compressed public key (hex)
+     * @returns `true` if the signature is valid
+     */
+    static verifyWithPublicKey(content, signature, publicKeyHex) {
+        try {
+            const publicKey = hexToBytes(publicKeyHex);
+            const contentBytes = new TextEncoder().encode(content);
+            const hash = (0, sha256_1.sha256)(contentBytes);
+            const sigBytes = hexToBytes(signature.signatureHex);
+            return secp256k1.ecdsaVerify(sigBytes, hash, publicKey);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Export the Git signing public key in a PGP-armored format.
+     *
+     * The exported key can be added to a GPG keyring or uploaded to
+     * GitHub/GitLab for signature verification.
+     *
+     * **Validates: Requirements 7.5**
+     *
+     * @param paperKey - The 24-word BIP39 mnemonic
+     * @returns The public key export with armored block and fingerprint
+     * @throws {GitSigningError} If key derivation fails
+     */
+    static exportPublicKey(paperKey) {
+        try {
+            const childKey = deriveGitKey(paperKey);
+            const publicKey = childKey.publicKey;
+            if (!publicKey) {
+                throw new GitSigningError('Key derivation produced no public key');
+            }
+            const publicKeyHex = bytesToHex(new Uint8Array(publicKey));
+            // Fingerprint: first 20 bytes of SHA-256 of the public key
+            const keyHash = (0, sha256_1.sha256)(new Uint8Array(publicKey));
+            const fingerprint = bytesToHex(keyHash.slice(0, 20));
+            // Armored public key block
+            const b64Key = base64Encode(new Uint8Array(publicKey));
+            const armoredPublicKey = [
+                PGP_KEY_BEGIN,
+                '',
+                wrapBase64(b64Key),
+                PGP_KEY_END,
+            ].join('\n');
+            return {
+                armoredPublicKey,
+                publicKeyHex,
+                derivationPath: GIT_SIGNING_DERIVATION_PATH,
+                fingerprint,
+            };
+        }
+        catch (error) {
+            if (error instanceof GitSigningError)
+                throw error;
+            const msg = error instanceof Error ? error.message : String(error);
+            throw new GitSigningError(`Failed to export public key: ${msg}`);
+        }
+    }
+    /**
+     * Validate a paper key before using it for Git signing.
+     *
+     * @param paperKey     - The paper key to validate
+     * @param eciesService - The ECIES service for validation
+     * @returns `true` if the paper key is valid
+     */
+    static validateKey(paperKey, eciesService) {
+        return paperKeyService_1.PaperKeyService.validatePaperKey(paperKey, eciesService);
+    }
+    // ─── Private helpers ────────────────────────────────────────────────
+    /**
+     * Core signing implementation shared by signCommit and signTag.
+     */
+    static sign(paperKey, content) {
+        try {
+            const childKey = deriveGitKey(paperKey);
+            const privateKey = childKey.privateKey;
+            if (!privateKey) {
+                throw new GitSigningError('Key derivation produced no private key');
+            }
+            // SHA-256 hash of the content
+            const contentBytes = new TextEncoder().encode(content);
+            const hash = (0, sha256_1.sha256)(contentBytes);
+            const contentHashHex = bytesToHex(hash);
+            // ECDSA sign (DER-encoded)
+            const { signature } = secp256k1.ecdsaSign(hash, privateKey);
+            const signatureHex = bytesToHex(signature);
+            // Build PGP-armored signature block
+            const b64Sig = base64Encode(signature);
+            const armoredSignature = [
+                PGP_SIG_BEGIN,
+                '',
+                wrapBase64(b64Sig),
+                PGP_SIG_END,
+            ].join('\n');
+            return {
+                armoredSignature,
+                signatureHex,
+                contentHashHex,
+                derivationPath: GIT_SIGNING_DERIVATION_PATH,
+            };
+        }
+        catch (error) {
+            if (error instanceof GitSigningError)
+                throw error;
+            const msg = error instanceof Error ? error.message : String(error);
+            throw new GitSigningError(`Failed to sign content: ${msg}`);
+        }
+    }
+}
+exports.GitSigningService = GitSigningService;
+/**
+ * Convert a hex string to a Uint8Array.
+ */
+function hexToBytes(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+//# sourceMappingURL=gitSigningService.js.map

package/src/lib/services/crypto/gitSigningService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitSigningService.js","sourceRoot":"","sources":["../../../../../../brightchain-lib/src/lib/services/crypto/gitSigningService.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAGH,iDAA8C;AAC9C,wCAAqC;AACrC,wCAAkD;AAClD,uCAAuC;AAEvC,iEAA8D;AAE9D,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAEvD;;GAEG;AACH,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAEzD,+EAA+E;AAE/E;;GAEG;AACH,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAsCD,+EAA+E;AAE/E,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,oCAAoC;IACpC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,IAAI,GAAG,IAAA,0BAAkB,EAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,aAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,iBAAiB;IAC5B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,UAAU,CACf,QAAgB,EAChB,aAAqB;QAErB,OAAO,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAO,CAAC,QAAgB,EAAE,UAAkB;QACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,MAAM,CACX,OAAe,EACf,SAA8B,EAC9B,QAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE7B,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAEpD,OAAO,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,mBAAmB,CACxB,OAAe,EACf,SAA8B,EAC9B,YAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAEpD,OAAO,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,eAAe,CAAC,QAAgB;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,eAAe,CAAC,uCAAuC,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YAE3D,2DAA2D;YAC3D,MAAM,OAAO,GAAG,IAAA,eAAM,EAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAErD,2BAA2B;YAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,MAAM,gBAAgB,GAAG;gBACvB,aAAa;gBACb,EAAE;gBACF,UAAU,CAAC,MAAM,CAAC;gBAClB,WAAW;aACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,OAAO;gBACL,gBAAgB;gBAChB,YAAY;gBACZ,cAAc,EAAE,2BAA2B;gBAC3C,WAAW;aACZ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,eAAe,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,WAAW,CAChB,QAAgB,EAChB,YAA+B;QAE/B,OAAO,iCAAe,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,uEAAuE;IAEvE;;OAEG;IACK,MAAM,CAAC,IAAI,CAAC,QAAgB,EAAE,OAAe;QACnD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACvC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;YACtE,CAAC;YAED,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC;YAClC,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAExC,2BAA2B;YAC3B,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YAE3C,oCAAoC;YACpC,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,gBAAgB,GAAG;gBACvB,aAAa;gBACb,EAAE;gBACF,UAAU,CAAC,MAAM,CAAC;gBAClB,WAAW;aACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,OAAO;gBACL,gBAAgB;gBAChB,YAAY;gBACZ,cAAc;gBACd,cAAc,EAAE,2BAA2B;aAC5C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,eAAe,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF;AAzMD,8CAyMC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/lib/services/crypto/index.d.ts

@@ -0,0 +1,3 @@
+export * from './ethereumWalletService';
+export * from './gitSigningService';
+//# sourceMappingURL=index.d.ts.map

package/src/lib/services/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../brightchain-lib/src/lib/services/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC"}

package/src/lib/services/crypto/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./ethereumWalletService"), exports);
+tslib_1.__exportStar(require("./gitSigningService"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/services/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../brightchain-lib/src/lib/services/crypto/index.ts"],"names":[],"mappings":";;;AAAA,kEAAwC;AACxC,8DAAoC"}

package/src/lib/services/identity/deviceProvisioningService.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Device Provisioning Service for the BrightChain identity system.
+ *
+ * Handles the complete device provisioning workflow: validating a paper key,
+ * recovering the member identity, generating device-specific keys via BIP32
+ * hierarchical deterministic derivation, and persisting device metadata
+ * through a platform-independent storage interface.
+ *
+ * Device keys are derived using the BIP32 path `m/44'/60'/0'/1/<deviceIndex>`
+ * where `deviceIndex` is a monotonically increasing counter per member. This
+ * keeps device keys deterministic (reproducible from the same mnemonic) while
+ * ensuring each device gets a unique key pair.
+ *
+ * Requirements: 3.1, 3.2, 3.3, 3.4
+ */
+import { ECIESService, Member, PlatformID } from '@digitaldefiance/ecies-lib';
+import { DeviceType } from '../../enumerations/deviceType';
+import { IDeviceMetadata } from '../../interfaces/identity/device';
+import { IDeviceKeyStorage } from '../../interfaces/identity/deviceKeyStorage';
+/**
+ * Error thrown when a paper key fails validation during device provisioning.
+ */
+export declare class InvalidPaperKeyError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Error thrown when device key generation fails.
+ */
+export declare class DeviceKeyGenerationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Error thrown when device key storage fails.
+ */
+export declare class DeviceKeyStorageError extends Error {
+    constructor(message: string);
+}
+/**
+ * Result of device key generation containing the derived key pair
+ * and the public key in hex format for storage in device metadata.
+ */
+export interface IDeviceKeyResult {
+    /** Compressed SECP256k1 public key (33 bytes) */
+    publicKey: Uint8Array;
+    /** Compressed SECP256k1 public key as hex string */
+    publicKeyHex: string;
+    /** BIP32 derivation path used to derive this key */
+    derivationPath: string;
+    /** The device index used in the derivation path */
+    deviceIndex: number;
+}
+/**
+ * Full result of a successful device provisioning operation.
+ */
+export interface IProvisioningResult<TID extends PlatformID = Uint8Array> {
+    /** The provisioned device metadata */
+    deviceMetadata: IDeviceMetadata;
+    /** The recovered member identity */
+    member: Member<TID>;
+    /** The derived device key information */
+    deviceKeys: IDeviceKeyResult;
+}
+/**
+ * Service for provisioning new devices on a BrightChain member account.
+ *
+ * The provisioning flow:
+ * 1. Validate the paper key (Requirement 3.1)
+ * 2. Recover the member identity from the paper key (Requirement 3.2)
+ * 3. Generate device-specific keys via BIP32 derivation (Requirement 3.3)
+ * 4. Store device metadata in platform-independent storage (Requirement 3.4)
+ *
+ * All methods are static — the service is stateless and safe to call
+ * from any context (browser or Node.js).
+ *
+ * @example
+ * ```typescript
+ * const eciesService = ServiceProvider.getInstance().eciesService;
+ * const storage = new InMemoryDeviceKeyStorage();
+ *
+ * const result = await DeviceProvisioningService.provisionDevice(
+ *   'abandon abandon abandon ... about',
+ *   'Work Laptop',
+ *   DeviceType.DESKTOP,
+ *   eciesService,
+ *   storage,
+ *   0,
+ * );
+ *
+ * console.log(result.deviceMetadata.publicKey); // hex-encoded public key
+ * console.log(result.member.name);              // 'Recovered User'
+ * ```
+ */
+export declare class DeviceProvisioningService {
+    /**
+     * Provision a new device using a paper key.
+     *
+     * Performs the complete provisioning workflow: validates the paper key,
+     * recovers the member identity, generates device-specific keys, and
+     * stores the device metadata.
+     *
+     * **Validates: Requirements 3.1, 3.2, 3.3, 3.4**
+     *
+     * @param paperKey     - The 24-word BIP39 mnemonic paper key
+     * @param deviceName   - Human-readable name for the device (e.g. "Work Laptop")
+     * @param deviceType   - Category of the device (desktop, mobile, web)
+     * @param eciesService - The ECIES service instance for key operations
+     * @param storage      - Platform-independent device key storage
+     * @param deviceIndex  - The BIP32 child index for this device (0-based)
+     * @returns A promise resolving to the full provisioning result
+     * @throws {InvalidPaperKeyError} If the paper key is invalid
+     * @throws {DeviceKeyGenerationError} If key derivation fails
+     * @throws {DeviceKeyStorageError} If storage fails
+     */
+    static provisionDevice<TID extends PlatformID = Uint8Array>(paperKey: string, deviceName: string, deviceType: DeviceType, eciesService: ECIESService<TID>, storage: IDeviceKeyStorage, deviceIndex: number): Promise<IProvisioningResult<TID>>;
+    /**
+     * Generate device-specific keys from a paper key mnemonic using BIP32
+     * hierarchical deterministic derivation.
+     *
+     * The derivation path is `m/44'/60'/0'/1/<deviceIndex>` where the
+     * `change=1` branch is reserved for device keys (as opposed to
+     * `change=0` which is used for external wallet addresses).
+     *
+     * **Validates: Requirement 3.3** — Generate device-specific keys derived
+     * from member identity
+     *
+     * @param paperKey    - The 24-word BIP39 mnemonic
+     * @param deviceIndex - The child index for this device (0-based, non-hardened)
+     * @returns The derived device key result
+     * @throws {DeviceKeyGenerationError} If BIP32 derivation fails
+     */
+    static generateDeviceKeys(paperKey: string, deviceIndex: number): IDeviceKeyResult;
+    /**
+     * Store device metadata in the provided platform-independent storage.
+     *
+     * This method wraps the storage call with error handling to produce
+     * a consistent {@link DeviceKeyStorageError} on failure.
+     *
+     * **Validates: Requirement 3.4** — Store device keys in local secure storage
+     *
+     * @param deviceMetadata - The device metadata to persist
+     * @param storage        - The platform-independent storage implementation
+     * @throws {DeviceKeyStorageError} If the storage operation fails
+     */
+    static storeDeviceKeys(deviceMetadata: IDeviceMetadata, storage: IDeviceKeyStorage): Promise<void>;
+}
+//# sourceMappingURL=deviceProvisioningService.d.ts.map

package/src/lib/services/identity/deviceProvisioningService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceProvisioningService.d.ts","sourceRoot":"","sources":["../../../../../../brightchain-lib/src/lib/services/identity/deviceProvisioningService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,YAAY,EACZ,MAAM,EACN,UAAU,EAEX,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAqB/E;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBAE3C,OAAO,SAA0D;CAKpE;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAID;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,SAAS,EAAE,UAAU,CAAC;IAEtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IAErB,oDAAoD;IACpD,cAAc,EAAE,MAAM,CAAC;IAEvB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU;IACtE,sCAAsC;IACtC,cAAc,EAAE,eAAe,CAAC;IAEhC,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEpB,yCAAyC;IACzC,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,yBAAyB;IACpC;;;;;;;;;;;;;;;;;;;OAmBG;WACU,eAAe,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,EAC9D,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,EAC/B,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAqCpC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,kBAAkB,CACvB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,gBAAgB;IA2CnB;;;;;;;;;;;OAWG;WACU,eAAe,CAC1B,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,CAAC;CAUjB"}