@bsv/sdk 1.2.19 → 1.2.21

package/dist/cjs/src/auth/{Certificate.js → certificates/Certificate.js}

@@ -1,10 +1,6 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const index_js_1 = require("../primitives/index.js");
-const ProtoWallet_js_1 = __importDefault(require("../wallet/ProtoWallet.js"));
+const mod_js_1 = require("../../../mod.js");
 /**
  * Represents an Identity Certificate as per the Wallet interface specifications.
  *
@@ -38,22 +34,22 @@ class Certificate {
      * @returns {number[]} - The serialized certificate in binary format.
      */
     toBin(includeSignature = true) {
-        const writer = new index_js_1.Utils.Writer();
+        const writer = new mod_js_1.Utils.Writer();
         // Write type (Base64String, 32 bytes)
-        const typeBytes = index_js_1.Utils.toArray(this.type, 'base64');
+        const typeBytes = mod_js_1.Utils.toArray(this.type, 'base64');
         writer.write(typeBytes);
         // Write serialNumber (Base64String, 32 bytes)
-        const serialNumberBytes = index_js_1.Utils.toArray(this.serialNumber, 'base64');
+        const serialNumberBytes = mod_js_1.Utils.toArray(this.serialNumber, 'base64');
         writer.write(serialNumberBytes);
         // Write subject (33 bytes compressed PubKeyHex)
-        const subjectBytes = index_js_1.Utils.toArray(this.subject, 'hex');
+        const subjectBytes = mod_js_1.Utils.toArray(this.subject, 'hex');
         writer.write(subjectBytes);
         // Write certifier (33 bytes compressed PubKeyHex)
-        const certifierBytes = index_js_1.Utils.toArray(this.certifier, 'hex');
+        const certifierBytes = mod_js_1.Utils.toArray(this.certifier, 'hex');
         writer.write(certifierBytes);
         // Write revocationOutpoint (TXID + OutputIndex)
         const [txid, outputIndex] = this.revocationOutpoint.split('.');
-        const txidBytes = index_js_1.Utils.toArray(txid, 'hex');
+        const txidBytes = mod_js_1.Utils.toArray(txid, 'hex');
         writer.write(txidBytes);
         writer.writeVarIntNum(Number(outputIndex));
         // Write fields
@@ -61,17 +57,17 @@ class Certificate {
         writer.writeVarIntNum(fieldEntries.length);
         for (const [fieldName, fieldValue] of fieldEntries) {
             // Field name
-            const fieldNameBytes = index_js_1.Utils.toArray(fieldName, 'utf8');
+            const fieldNameBytes = mod_js_1.Utils.toArray(fieldName, 'utf8');
             writer.writeVarIntNum(fieldNameBytes.length);
             writer.write(fieldNameBytes);
             // Field value
-            const fieldValueBytes = index_js_1.Utils.toArray(fieldValue, 'utf8');
+            const fieldValueBytes = mod_js_1.Utils.toArray(fieldValue, 'utf8');
             writer.writeVarIntNum(fieldValueBytes.length);
             writer.write(fieldValueBytes);
         }
         // Write signature if included
         if (includeSignature && this.signature && this.signature.length > 0) {
-            const signatureBytes = index_js_1.Utils.toArray(this.signature, 'hex');
+            const signatureBytes = mod_js_1.Utils.toArray(this.signature, 'hex');
             writer.writeVarIntNum(signatureBytes.length);
             writer.write(signatureBytes);
         }
@@ -84,22 +80,22 @@ class Certificate {
      * @returns {Certificate} - The deserialized Certificate object.
      */
     static fromBin(bin) {
-        const reader = new index_js_1.Utils.Reader(bin);
+        const reader = new mod_js_1.Utils.Reader(bin);
         // Read type
         const typeBytes = reader.read(32);
-        const type = index_js_1.Utils.toBase64(typeBytes);
+        const type = mod_js_1.Utils.toBase64(typeBytes);
         // Read serialNumber
         const serialNumberBytes = reader.read(32);
-        const serialNumber = index_js_1.Utils.toBase64(serialNumberBytes);
+        const serialNumber = mod_js_1.Utils.toBase64(serialNumberBytes);
         // Read subject (33 bytes)
         const subjectBytes = reader.read(33);
-        const subject = index_js_1.Utils.toHex(subjectBytes);
+        const subject = mod_js_1.Utils.toHex(subjectBytes);
         // Read certifier (33 bytes)
         const certifierBytes = reader.read(33);
-        const certifier = index_js_1.Utils.toHex(certifierBytes);
+        const certifier = mod_js_1.Utils.toHex(certifierBytes);
         // Read revocationOutpoint
         const txidBytes = reader.read(32);
-        const txid = index_js_1.Utils.toHex(txidBytes);
+        const txid = mod_js_1.Utils.toHex(txidBytes);
         const outputIndex = reader.readVarIntNum();
         const revocationOutpoint = `${txid}.${outputIndex}`;
         // Read fields
@@ -109,11 +105,11 @@ class Certificate {
             // Field name
             const fieldNameLength = reader.readVarIntNum();
             const fieldNameBytes = reader.read(fieldNameLength);
-            const fieldName = index_js_1.Utils.toUTF8(fieldNameBytes);
+            const fieldName = mod_js_1.Utils.toUTF8(fieldNameBytes);
             // Field value
             const fieldValueLength = reader.readVarIntNum();
             const fieldValueBytes = reader.read(fieldValueLength);
-            const fieldValue = index_js_1.Utils.toUTF8(fieldValueBytes);
+            const fieldValue = mod_js_1.Utils.toUTF8(fieldValueBytes);
             fields[fieldName] = fieldValue;
         }
         // Read signature if present
@@ -121,7 +117,7 @@ class Certificate {
         if (!reader.eof()) {
             const signatureLength = reader.readVarIntNum();
             const signatureBytes = reader.read(signatureLength);
-            signature = index_js_1.Utils.toHex(signatureBytes);
+            signature = mod_js_1.Utils.toHex(signatureBytes);
         }
         return new Certificate(type, serialNumber, subject, certifier, revocationOutpoint, fields, signature);
     }
@@ -132,10 +128,10 @@ class Certificate {
      */
     async verify() {
         // A verifier can be any wallet capable of verifying signatures
-        const verifier = new ProtoWallet_js_1.default('anyone');
+        const verifier = new mod_js_1.ProtoWallet('anyone');
         const verificationData = this.toBin(false); // Exclude the signature from the verification data
         const { valid } = await verifier.verifySignature({
-            signature: index_js_1.Utils.toArray(this.signature, 'hex'),
+            signature: mod_js_1.Utils.toArray(this.signature, 'hex'),
             data: verificationData,
             protocolID: [2, 'certificate signature'],
             keyID: `${this.type} ${this.serialNumber}`,
@@ -156,7 +152,7 @@ class Certificate {
             protocolID: [2, 'certificate signature'],
             keyID: `${this.type} ${this.serialNumber}`
         });
-        this.signature = index_js_1.Utils.toHex(signature);
+        this.signature = mod_js_1.Utils.toHex(signature);
     }
 }
 exports.default = Certificate;

package/dist/cjs/src/auth/certificates/Certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Certificate.js","sourceRoot":"","sources":["../../../../../src/auth/certificates/Certificate.ts"],"names":[],"mappings":";;AAAA,4CASwB;AAExB;;;;GAIG;AACH,MAAqB,WAAW;IAoC9B;;;;;;;;;;OAUG;IACH,YACE,IAAkB,EAClB,YAA0B,EAC1B,OAAkB,EAClB,SAAoB,EACpB,kBAAkC,EAClC,MAAwD,EACxD,SAAqB;QAErB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAA;QAC5C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAA4B,IAAI;QACpC,MAAM,MAAM,GAAG,IAAI,cAAK,CAAC,MAAM,EAAE,CAAA;QAEjC,sCAAsC;QACtC,MAAM,SAAS,GAAG,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACpD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAEvB,8CAA8C;QAC9C,MAAM,iBAAiB,GAAG,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QACpE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAE/B,gDAAgD;QAChD,MAAM,YAAY,GAAG,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACvD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE1B,kDAAkD;QAClD,MAAM,cAAc,GAAG,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QAE5B,gDAAgD;QAChD,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9D,MAAM,SAAS,GAAG,cAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACvB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QAE1C,eAAe;QACf,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,YAAY,EAAE,CAAC;YACnD,aAAa;YACb,MAAM,cAAc,GAAG,cAAK,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YACvD,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAC5C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;YAE5B,cAAc;YACd,MAAM,eAAe,GAAG,cAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YACzD,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YAC7C,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QAC/B,CAAC;QAED,8BAA8B;QAC9B,IAAI,gBAAgB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,cAAc,GAAG,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC3D,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAC5C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,EAAE,CAAA;IACzB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,GAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,cAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAEpC,YAAY;QACZ,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,cAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAEtC,oBAAoB;QACpB,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,cAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEtD,0BAA0B;QAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,cAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAEzC,4BAA4B;QAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,cAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QAE7C,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,cAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACnC,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;QAC1C,MAAM,kBAAkB,GAAG,GAAG,IAAI,IAAI,WAAW,EAAE,CAAA;QAEnD,cAAc;QACd,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;QACxC,MAAM,MAAM,GAAqD,EAAE,CAAA;QACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,aAAa;YACb,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;YAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,cAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;YAE9C,cAAc;YACd,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;YAC/C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;YACrD,MAAM,UAAU,GAAG,cAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;YAEhD,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAA;QAChC,CAAC;QAED,4BAA4B;QAC5B,IAAI,SAA6B,CAAA;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;YAClB,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa,EAAE,CAAA;YAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YACnD,SAAS,GAAG,cAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,IAAI,WAAW,CACpB,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,MAAM,EACN,SAAS,CACV,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAI,oBAAW,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA,CAAC,mDAAmD;QAE9F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC;YAC/C,SAAS,EAAE,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;YAC/C,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,CAAC,CAAC,EAAE,uBAAuB,CAAC;YACxC,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE;YAC1C,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,sDAAsD;SACpF,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA,CAAC,qCAAqC;QACxE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC;YACpD,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,CAAC,CAAC,EAAE,uBAAuB,CAAC;YACxC,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE;SAC3C,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,GAAG,cAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACzC,CAAC;CACF;AA/ND,8BA+NC"}

package/dist/cjs/src/auth/certificates/MasterCertificate.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MasterCertificate = void 0;
+const mod_js_1 = require("../../../mod.js");
+const Certificate_js_1 = __importDefault(require("./Certificate.js"));
+/**
+ * MasterCertificate extends the base Certificate class to manage a master keyring, enabling the creation of verifiable certificates.
+ *
+ * It allows for the selective disclosure of certificate fields by creating a `VerifiableCertificate` for a specific verifier.
+ * The `MasterCertificate` can securely decrypt each master key and re-encrypt it for a verifier, creating a customized
+ * keyring containing only the keys necessary for the verifier to access designated fields.
+ *
+ */
+class MasterCertificate extends Certificate_js_1.default {
+    constructor(type, serialNumber, subject, certifier, revocationOutpoint, fields, masterKeyring, signature) {
+        super(type, serialNumber, subject, certifier, revocationOutpoint, fields, signature);
+        this.masterKeyring = masterKeyring;
+    }
+    /**
+     * Creates a verifiable certificate structure for a specific verifier, allowing them access to specified fields.
+     * This method decrypts the master field keys for each field specified in `fieldsToReveal` and re-encrypts them
+     * for the verifier's identity key. The resulting certificate structure includes only the fields intended to be
+     * revealed and a verifier-specific keyring for field decryption.
+     *
+     * @param {Wallet} subjectWallet - The wallet instance of the subject, used to decrypt and re-encrypt field keys.
+     * @param {string} verifierIdentityKey - The public identity key of the verifier who will receive access to the specified fields.
+     * @param {string[]} fieldsToReveal - An array of field names to be revealed to the verifier. Must be a subset of the certificate's fields.
+     * @param {string} [originator] - Optional originator identifier, used if additional context is needed for decryption and encryption operations.
+     * @returns {Promise<Object>} - A new certificate structure containing the original encrypted fields, the verifier-specific field decryption keyring, and essential certificate metadata.
+     * @throws {Error} Throws an error if:
+     *   - fieldsToReveal is empty or a field in `fieldsToReveal` does not exist in the certificate.
+     *   - The decrypted master field key fails to decrypt the corresponding field (indicating an invalid key).
+     */
+    async createKeyringForVerifier(subjectWallet, verifierIdentityKey, fieldsToReveal, originator) {
+        if (!Array.isArray(fieldsToReveal)) {
+            throw new Error('fieldsToReveal must be an array of strings');
+        }
+        const fieldRevelationKeyring = {};
+        for (const fieldName of fieldsToReveal) {
+            // Make sure that fields to reveal is a subset of the certificate fields
+            if (!this.fields[fieldName]) {
+                throw new Error(`Fields to reveal must be a subset of the certificate fields. Missing the "${fieldName}" field.`);
+            }
+            // Create a keyID
+            const keyID = `${this.serialNumber} ${fieldName}`;
+            const encryptedMasterFieldKey = this.masterKeyring[fieldName];
+            // Decrypt the master field key
+            const { plaintext: masterFieldKey } = await subjectWallet.decrypt({
+                ciphertext: mod_js_1.Utils.toArray(encryptedMasterFieldKey, 'base64'),
+                protocolID: [2, 'certificate field encryption'],
+                keyID,
+                counterparty: 'self'
+            }, originator);
+            // Verify that derived key actually decrypts requested field
+            try {
+                new mod_js_1.SymmetricKey(masterFieldKey).decrypt(mod_js_1.Utils.toArray(this.fields[fieldName], 'base64'));
+            }
+            catch (_) {
+                throw new Error(`Decryption of the "${fieldName}" field with its revelation key failed.`);
+            }
+            // Encrypt derived fieldRevelationKey for verifier
+            const { ciphertext: encryptedFieldRevelationKey } = await subjectWallet.encrypt({
+                plaintext: masterFieldKey,
+                protocolID: [2, 'certificate field encryption'],
+                keyID: `${this.serialNumber} ${fieldName}`,
+                counterparty: verifierIdentityKey
+            }, originator);
+            // Add encryptedFieldRevelationKey to fieldRevelationKeyring
+            fieldRevelationKeyring[fieldName] = mod_js_1.Utils.toBase64(encryptedFieldRevelationKey);
+        }
+        // Return the field revelation keyring which can be used to create a verifiable certificate for a verifier.
+        return fieldRevelationKeyring;
+    }
+}
+exports.MasterCertificate = MasterCertificate;
+//# sourceMappingURL=MasterCertificate.js.map

package/dist/cjs/src/auth/certificates/MasterCertificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MasterCertificate.js","sourceRoot":"","sources":["../../../../../src/auth/certificates/MasterCertificate.ts"],"names":[],"mappings":";;;;;;AAAA,4CASwB;AACxB,sEAA0C;AAE1C;;;;;;;GAOG;AACH,MAAa,iBAAkB,SAAQ,wBAAW;IAWhD,YACE,IAAkB,EAClB,YAA0B,EAC1B,OAAkB,EAClB,SAAoB,EACpB,kBAAkC,EAClC,MAAwD,EACxD,aAA+D,EAC/D,SAAqB;QAErB,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACpF,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,wBAAwB,CAAC,aAAqB,EAAE,mBAA2B,EAAE,cAAwB,EAAE,UAAmB;QAC9H,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,sBAAsB,GAAG,EAAE,CAAA;QACjC,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;YACvC,wEAAwE;YACxE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,6EAA6E,SAAS,UAAU,CAAC,CAAA;YACnH,CAAC;YAED,iBAAiB;YACjB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,CAAA;YACjD,MAAM,uBAAuB,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;YAE7D,+BAA+B;YAC/B,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC;gBAChE,UAAU,EAAE,cAAK,CAAC,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC;gBAC5D,UAAU,EAAE,CAAC,CAAC,EAAE,8BAA8B,CAAC;gBAC/C,KAAK;gBACL,YAAY,EAAE,MAAM;aACrB,EAAE,UAAU,CAAC,CAAA;YAEd,4DAA4D;YAC5D,IAAI,CAAC;gBACH,IAAI,qBAAY,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC3F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,yCAAyC,CAAC,CAAA;YAC3F,CAAC;YAED,kDAAkD;YAClD,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC;gBAC9E,SAAS,EAAE,cAAc;gBACzB,UAAU,EAAE,CAAC,CAAC,EAAE,8BAA8B,CAAC;gBAC/C,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE;gBAC1C,YAAY,EAAE,mBAAmB;aAClC,EAAE,UAAU,CAAC,CAAA;YAEd,4DAA4D;YAC5D,sBAAsB,CAAC,SAAS,CAAC,GAAG,cAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;QACjF,CAAC;QAED,2GAA2G;QAC3G,OAAO,sBAAsB,CAAA;IAC/B,CAAC;CACF;AArFD,8CAqFC"}

package/dist/cjs/src/auth/certificates/VerifiableCertificate.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerifiableCertificate = void 0;
+const mod_js_1 = require("../../../mod.js");
+const Certificate_js_1 = __importDefault(require("./Certificate.js"));
+/**
+ * VerifiableCertificate extends the Certificate class, adding functionality to manage a verifier-specific keyring.
+ * This keyring allows selective decryption of certificate fields for authorized verifiers.
+ */
+class VerifiableCertificate extends Certificate_js_1.default {
+    constructor(type, serialNumber, subject, certifier, revocationOutpoint, fields, signature, keyring, decryptedFields) {
+        super(type, serialNumber, subject, certifier, revocationOutpoint, fields, signature);
+        this.keyring = keyring;
+        this.decryptedFields = decryptedFields;
+    }
+    /**
+     * Decrypts certificate fields using the provided keyring and verifier wallet
+     * @param {Wallet} verifierWallet - The wallet instance of the certificate's verifier, used to decrypt field keys.
+     * @returns {Promise<Record<CertificateFieldNameUnder50Bytes, string>>} - A promise that resolves to an object where each key is a field name and each value is the decrypted field value as a string.
+     * @throws {Error} Throws an error if any of the decryption operations fail, with a message indicating the failure context.
+     */
+    async decryptFields(verifierWallet) {
+        if (!this.keyring || Object.keys(this.keyring).length === 0) {
+            throw new Error('A keyring is required to decrypt certificate fields for the verifier.');
+        }
+        try {
+            const decryptedFields = {};
+            for (const fieldName in this.keyring) {
+                const { plaintext: fieldRevelationKey } = await verifierWallet.decrypt({
+                    ciphertext: mod_js_1.Utils.toArray(this.keyring[fieldName], 'base64'),
+                    protocolID: [2, 'certificate field encryption'],
+                    keyID: `${this.serialNumber} ${fieldName}`,
+                    counterparty: this.subject
+                });
+                const fieldValue = new mod_js_1.SymmetricKey(fieldRevelationKey).decrypt(mod_js_1.Utils.toArray(this.fields[fieldName], 'base64'));
+                decryptedFields[fieldName] = mod_js_1.Utils.toUTF8(fieldValue);
+            }
+            return decryptedFields;
+        }
+        catch (error) {
+            throw new Error(`Failed to decrypt certificate fields using keyring: ${error instanceof Error ? error.message : error}`);
+        }
+    }
+}
+exports.VerifiableCertificate = VerifiableCertificate;
+//# sourceMappingURL=VerifiableCertificate.js.map

package/dist/cjs/src/auth/certificates/VerifiableCertificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerifiableCertificate.js","sourceRoot":"","sources":["../../../../../src/auth/certificates/VerifiableCertificate.ts"],"names":[],"mappings":";;;;;;AAAA,4CASwB;AACxB,sEAA0C;AAE1C;;;GAGG;AACH,MAAa,qBAAsB,SAAQ,wBAAW;IAYpD,YACE,IAAkB,EAClB,YAA0B,EAC1B,OAAkB,EAClB,SAAoB,EACpB,kBAAkC,EAClC,MAAwD,EACxD,SAAqB,EACrB,OAA0D,EAC1D,eAAwE;QAExE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACpF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,cAAsB;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,EAAE,CAAA;YAC1B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrC,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;oBACrE,UAAU,EAAE,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;oBAC5D,UAAU,EAAE,CAAC,CAAC,EAAE,8BAA8B,CAAC;oBAC/C,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE;oBAC1C,YAAY,EAAE,IAAI,CAAC,OAAO;iBAC3B,CAAC,CAAA;gBAEF,MAAM,UAAU,GAAG,IAAI,qBAAY,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,cAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAChH,eAAe,CAAC,SAAS,CAAC,GAAG,cAAK,CAAC,MAAM,CAAC,UAAsB,CAAC,CAAA;YACnE,CAAC;YACD,OAAO,eAAe,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC1H,CAAC;IACH,CAAC;CACF;AAxDD,sDAwDC"}

package/dist/cjs/src/auth/certificates/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Certificate = void 0;
+var Certificate_js_1 = require("./Certificate.js");
+Object.defineProperty(exports, "Certificate", { enumerable: true, get: function () { return __importDefault(Certificate_js_1).default; } });
+__exportStar(require("./MasterCertificate.js"), exports);
+__exportStar(require("./VerifiableCertificate.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/src/auth/certificates/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/auth/certificates/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,mDAAyD;AAAhD,8HAAA,OAAO,OAAe;AAC/B,yDAAsC;AACtC,6DAA0C"}