@cardanowall/crypto-core 0.0.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,192 @@
+# @cardanowall/crypto-core — closed-catalogue cryptographic primitives for CIP-309
+
+Low-level, independently auditable building blocks for [CIP-309](https://cips.cardano.org/)
+Proof-of-Existence tooling: hash, KDF, signature, KEM, AEAD, canonical CBOR, COSE_Sign1,
+deterministic seed derivation, multi-recipient sealed-PoE construction, envelope discovery,
+RFC 9162 Merkle trees, and age-style recipient encoding.
+
+## What it is
+
+`crypto-core` is the bottom layer of the CIP-309 package family. It is a **closed catalogue**:
+it exposes only the named, vetted algorithms the CIP-309 wire format references — there is no
+general-purpose "bring your own algorithm" surface. Every construction is byte-pinned against
+known-answer test vectors so an independent implementation can reproduce identical bytes.
+
+The package is portable and standalone — it produces and consumes bytes and depends on no
+gateway, operator, or server. It is the TypeScript reference; a byte-identical Python parity
+twin (`@cardanowall/sdk-py`) and a Rust twin (the `cardanowall` crate) track the same
+conformance vectors. The higher-level wire-format library (`@cardanowall/poe-standard`) and
+the SDKs (`@cardanowall/sdk-ts`, `@cardanowall/sdk-py`) are built on top of these primitives.
+
+Hybrid post-quantum is first-class: the X-Wing KEM (`mlkem768x25519`, ML-KEM-768 + X25519 per
+draft-connolly-cfrg-xwing-kem) is a supported sealed-PoE branch alongside classical X25519, and
+every seed-derived identity carries an X-Wing keypair so it can always *receive* hybrid records.
+
+## Install
+
+The package is pre-1.0 and not yet published. Build it from the workspace:
+
+```sh
+pnpm install
+pnpm --filter @cardanowall/crypto-core typecheck
+```
+
+Once published, it will install as:
+
+```sh
+npm install @cardanowall/crypto-core   # once published
+```
+
+It ships as ESM, targets modern Node.js and browsers, and uses Web Crypto / `crypto.getRandomValues`
+for randomness. The cryptography is built on the audited [`@noble/*`](https://paulmillr.com/noble/)
+primitives plus `@noble/post-quantum`, `cbor2`, and `hash-wasm`.
+
+## Usage
+
+Import from the package root, or cherry-pick a subpath export (`@cardanowall/crypto-core/hash`,
+`/seed-derive`, `/sealed-poe`, `/merkle`, …).
+
+### Hash content for a Proof-of-Existence
+
+```ts
+import { dualHash } from '@cardanowall/crypto-core';
+
+const { sha256, blake2b256 } = dualHash(new TextEncoder().encode('hello world'));
+// sha256 and blake2b256 are 32-byte Uint8Arrays
+```
+
+For large content, stream it without buffering the whole input:
+
+```ts
+import { dualHashStream } from '@cardanowall/crypto-core';
+
+const { sha256, blake2b256 } = await dualHashStream(fileChunkAsyncIterable);
+```
+
+### Derive an identity and sign
+
+```ts
+import {
+  deriveEd25519KeypairFromSeed,
+  signEd25519,
+  verifyEd25519,
+} from '@cardanowall/crypto-core';
+
+const seed = crypto.getRandomValues(new Uint8Array(32)); // 32-byte identity seed
+const { secretKey, publicKey } = deriveEd25519KeypairFromSeed(seed);
+
+const message = new TextEncoder().encode('attest this');
+const signature = signEd25519({ seed: secretKey, message });
+const ok = verifyEd25519({ publicKey, message, signature }); // true
+```
+
+`deriveX25519KeypairFromSeed` and `deriveMlKem768X25519KeypairFromSeed` derive the encryption
+keypairs from the same 32-byte seed using fixed CIP-309 HKDF labels — so one passphrase-protected
+seed yields a complete, deterministic identity.
+
+### Seal a record to multiple recipients and unwrap it
+
+```ts
+import {
+  deriveX25519KeypairFromSeed,
+  eciesSealedPoeWrap,
+  eciesSealedPoeUnwrap,
+} from '@cardanowall/crypto-core';
+
+const recipient = deriveX25519KeypairFromSeed(crypto.getRandomValues(new Uint8Array(32)));
+
+// Default KEM is classical X25519; pass kem: 'mlkem768x25519' for the hybrid PQ branch.
+const { envelope, ciphertext } = eciesSealedPoeWrap({
+  plaintext: new TextEncoder().encode('secret payload'),
+  recipientPublicKeys: [recipient.publicKey],
+});
+
+const result = eciesSealedPoeUnwrap({
+  envelope,
+  ciphertext,
+  recipientSecretKey: recipient.secretKey,
+});
+
+if (result.matched) {
+  // result.plaintext recovers the original bytes
+} else {
+  // result.reason is 'WRONG_RECIPIENT_KEY' | 'TAMPERED_HEADER' | 'TAMPERED_CIPHERTEXT'
+}
+```
+
+Recipients holding a rotated identity (current key plus archived keys, across both KEMs) pass the
+whole `recipientKeyBundle` instead of a single key; the trial-decrypt loop is constant-time over the
+slot count by default. `eciesSealedPoeTrialDecrypt` recovers the content key and slot index *without*
+the off-chain ciphertext — the operation an inbox scanner runs to discover readable records before
+fetching their blobs.
+
+### Address a recipient as an age-style string
+
+```ts
+import {
+  encodeAgeX25519Recipient,
+  encodeAgeXWingRecipient,
+  parseAgeRecipient,
+} from '@cardanowall/crypto-core';
+
+const classical = encodeAgeX25519Recipient(recipient.publicKey); // "age1…"
+const hybrid = encodeAgeXWingRecipient(xwingPublicKey);          // "age1pqc…"
+
+const parsed = parseAgeRecipient(classical);
+// { kem: 'x25519' | 'mlkem768x25519', publicKey: Uint8Array } — routed on the bech32 prefix
+```
+
+## API overview — the primitive catalogue
+
+Each group is also a subpath export. Names below are the actual exported symbols.
+
+| Group         | Catalogue                                                                                                                                                                  |
+| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `hash`        | `sha256` (FIPS 180-4), `blake2b256` / `blake2b224` (RFC 7693, CIP-19), `dualHash` / `dualHashStream`, `merkleSha2256Root` and inclusion-proof helpers (RFC 9162)          |
+| `kdf`         | `hkdfSha256` (RFC 5869), `argon2idV13` (RFC 9106), `pbkdf2Sha256` (RFC 8018)                                                                                              |
+| `sig`         | `signEd25519` / `verifyEd25519` / `getPublicKeyEd25519` (RFC 8032, strict non-cofactored verification), identity-link challenge builder                                    |
+| `kem`         | `x25519Keygen` / `x25519PublicKey` / `x25519Ecdh` (RFC 7748, low-order-point rejection); `mlkem768x25519Keygen` / `…Encapsulate` / `…Decapsulate` (X-Wing hybrid PQ KEM)  |
+| `aead`        | `chacha20Poly1305*` (RFC 8439), `xchacha20Poly1305*`, `aes256Gcm*`                                                                                                        |
+| `cbor`        | `encodeCanonicalCbor` / `decodeCanonicalCbor` (RFC 8949 §4.2.1) plus a permissive outer-wire decoder                                                                      |
+| `cose`        | `coseSign1Cip309Build` / `coseSign1Cip309Verify`, `encodeCoseSign1` / `decodeCoseSign1`, `buildCip309SigStructure` (COSE_Sign1, RFC 9052)                                 |
+| `seed-derive` | `deriveEd25519KeypairFromSeed`, `deriveX25519KeypairFromSeed`, `deriveMlKem768X25519KeypairFromSeed` — deterministic long-term identity keys from one 32-byte seed         |
+| `discovery`   | `derivePassphraseDiscoveryTag` (Argon2id → HMAC), `deriveWebauthnDiscoveryTagFromPrf` — envelope-discovery tags                                                           |
+| `sealed-poe`  | `eciesSealedPoeWrap` / `eciesSealedPoeUnwrap` / `eciesSealedPoeTrialDecrypt`, the slots codec, and `RecipientKeyBundle` (age-style ECIES with AEAD-bound slots)            |
+| `merkle`      | `encodeLeavesList` / `decodeLeavesList` — canonical-CBOR codec for the off-chain Merkle leaves-list artefact                                                              |
+| `recipient`   | `encodeAgeX25519Recipient` / `encodeAgeXWingRecipient` / `parseAgeRecipient`, bech32 codec                                                                                |
+| `util`        | `compareCt` (constant-time comparison), `hexToBytes`                                                                                                                      |
+
+See `src/index.ts` and each submodule's `index.ts` for the exhaustive surface.
+
+## Cross-implementation parity
+
+`crypto-core` is the TypeScript reference. Its outputs are byte-identical to the Python twin
+(`@cardanowall/sdk-py`) and the Rust twin (the `cardanowall` crate) across a shared set of
+known-answer test vectors — public standards-derived vectors (RFC 7748, RFC 8032, RFC 8439,
+RFC 8949, RFC 9106, FIPS 180-4) alongside the CIP-309 record, envelope, sealed-PoE, and
+seed-derivation vectors. A divergence between any two implementations turns the parity check red.
+This is what lets a record sealed or signed by one implementation be opened or verified by any
+other, on any platform.
+
+## Standard / service independence
+
+These primitives carry no notion of a publisher or a server. A sealed PoE is opened, a record
+signature is verified, and a Merkle proof is checked entirely from bytes the caller already holds —
+the on-chain metadata, the optional content (or ciphertext) blob, and a recipient's own private
+key. There is no issuer server in the loop at any step. `cardanowall.com` is one example deployment
+of CIP-309 tooling; nothing here depends on it.
+
+## Relation to the other packages
+
+- **`@cardanowall/crypto-core`** (this package) — the closed-catalogue primitives; portable and
+  independently auditable building blocks.
+- **`@cardanowall/poe-standard`** — the CIP-309 wire-format library: record schema, canonical-CBOR
+  encoder, pure structural validator, and the error-code catalogue.
+- **`@cardanowall/sdk-ts`** — the browser + Node TypeScript SDK: the standalone verifier, the
+  gateway-agnostic HTTP client, off-host signing, and seed-derived identity helpers.
+- **`@cardanowall/sdk-py`** — the Python SDK: a byte-identical parity twin of `sdk-ts`.
+- **`cardanowall`** (Rust crate) — the Rust SDK twin; blocking HTTP, secure-by-default.
+
+## License
+
+Apache-2.0

package/dist/aead.cjs

@@ -0,0 +1,44 @@
+'use strict';
+
+var chacha_js = require('@noble/ciphers/chacha.js');
+
+// src/aead/chacha20-poly1305.ts
+
+// src/aead/errors.ts
+var AeadVerificationError = class extends Error {
+  code = "aead_verification_failed";
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AeadVerificationError";
+  }
+};
+
+// src/aead/chacha20-poly1305.ts
+function chacha20Poly1305Encrypt(opts) {
+  return chacha_js.chacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);
+}
+function chacha20Poly1305Decrypt(opts) {
+  try {
+    return chacha_js.chacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);
+  } catch (cause) {
+    throw new AeadVerificationError("chacha20-poly1305 decrypt failed", { cause });
+  }
+}
+function xchacha20Poly1305Encrypt(opts) {
+  return chacha_js.xchacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);
+}
+function xchacha20Poly1305Decrypt(opts) {
+  try {
+    return chacha_js.xchacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);
+  } catch (cause) {
+    throw new AeadVerificationError("xchacha20-poly1305 decrypt failed", { cause });
+  }
+}
+
+exports.AeadVerificationError = AeadVerificationError;
+exports.chacha20Poly1305Decrypt = chacha20Poly1305Decrypt;
+exports.chacha20Poly1305Encrypt = chacha20Poly1305Encrypt;
+exports.xchacha20Poly1305Decrypt = xchacha20Poly1305Decrypt;
+exports.xchacha20Poly1305Encrypt = xchacha20Poly1305Encrypt;
+//# sourceMappingURL=aead.cjs.map
+//# sourceMappingURL=aead.cjs.map

package/dist/aead.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/aead/errors.ts","../src/aead/chacha20-poly1305.ts","../src/aead/xchacha20-poly1305.ts"],"names":["chacha20poly1305","xchacha20poly1305"],"mappings":";;;;;;;AAAO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,IAAA,GAAe,0BAAA;AAAA,EAExB,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;;;ACWO,SAAS,wBAAwB,IAAA,EAA+C;AACrF,EAAA,OAAOA,0BAAA,CAAiB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAChF;AAEO,SAAS,wBAAwB,IAAA,EAA+C;AACrF,EAAA,IAAI;AACF,IAAA,OAAOA,0BAAA,CAAiB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,EACjF,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,qBAAA,CAAsB,kCAAA,EAAoC,EAAE,OAAO,CAAA;AAAA,EAC/E;AACF;ACVO,SAAS,yBAAyB,IAAA,EAAgD;AACvF,EAAA,OAAOC,2BAAA,CAAkB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AACjF;AAEO,SAAS,yBAAyB,IAAA,EAAgD;AACvF,EAAA,IAAI;AACF,IAAA,OAAOA,2BAAA,CAAkB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,EAClF,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,qBAAA,CAAsB,mCAAA,EAAqC,EAAE,OAAO,CAAA;AAAA,EAChF;AACF","file":"aead.cjs","sourcesContent":["export class AeadVerificationError extends Error {\n  readonly code: string = 'aead_verification_failed';\n\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = 'AeadVerificationError';\n  }\n}\n","import { chacha20poly1305 } from '@noble/ciphers/chacha.js';\n\nimport { AeadVerificationError } from './errors';\n\nexport interface ChaCha20Poly1305EncryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly plaintext: Uint8Array;\n}\n\nexport interface ChaCha20Poly1305DecryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly ciphertext: Uint8Array;\n}\n\nexport function chacha20Poly1305Encrypt(opts: ChaCha20Poly1305EncryptOpts): Uint8Array {\n  return chacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);\n}\n\nexport function chacha20Poly1305Decrypt(opts: ChaCha20Poly1305DecryptOpts): Uint8Array {\n  try {\n    return chacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);\n  } catch (cause) {\n    throw new AeadVerificationError('chacha20-poly1305 decrypt failed', { cause });\n  }\n}\n","import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';\n\nimport { AeadVerificationError } from './errors';\n\nexport interface XChaCha20Poly1305EncryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly plaintext: Uint8Array;\n}\n\nexport interface XChaCha20Poly1305DecryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly ciphertext: Uint8Array;\n}\n\nexport function xchacha20Poly1305Encrypt(opts: XChaCha20Poly1305EncryptOpts): Uint8Array {\n  return xchacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);\n}\n\nexport function xchacha20Poly1305Decrypt(opts: XChaCha20Poly1305DecryptOpts): Uint8Array {\n  try {\n    return xchacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);\n  } catch (cause) {\n    throw new AeadVerificationError('xchacha20-poly1305 decrypt failed', { cause });\n  }\n}\n"]}

package/dist/aead.d.cts

@@ -0,0 +1,38 @@
+interface ChaCha20Poly1305EncryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly plaintext: Uint8Array;
+}
+interface ChaCha20Poly1305DecryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly ciphertext: Uint8Array;
+}
+declare function chacha20Poly1305Encrypt(opts: ChaCha20Poly1305EncryptOpts): Uint8Array;
+declare function chacha20Poly1305Decrypt(opts: ChaCha20Poly1305DecryptOpts): Uint8Array;
+
+interface XChaCha20Poly1305EncryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly plaintext: Uint8Array;
+}
+interface XChaCha20Poly1305DecryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly ciphertext: Uint8Array;
+}
+declare function xchacha20Poly1305Encrypt(opts: XChaCha20Poly1305EncryptOpts): Uint8Array;
+declare function xchacha20Poly1305Decrypt(opts: XChaCha20Poly1305DecryptOpts): Uint8Array;
+
+declare class AeadVerificationError extends Error {
+    readonly code: string;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+
+export { AeadVerificationError, type ChaCha20Poly1305DecryptOpts, type ChaCha20Poly1305EncryptOpts, type XChaCha20Poly1305DecryptOpts, type XChaCha20Poly1305EncryptOpts, chacha20Poly1305Decrypt, chacha20Poly1305Encrypt, xchacha20Poly1305Decrypt, xchacha20Poly1305Encrypt };

package/dist/aead.d.ts

@@ -0,0 +1,38 @@
+interface ChaCha20Poly1305EncryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly plaintext: Uint8Array;
+}
+interface ChaCha20Poly1305DecryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly ciphertext: Uint8Array;
+}
+declare function chacha20Poly1305Encrypt(opts: ChaCha20Poly1305EncryptOpts): Uint8Array;
+declare function chacha20Poly1305Decrypt(opts: ChaCha20Poly1305DecryptOpts): Uint8Array;
+
+interface XChaCha20Poly1305EncryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly plaintext: Uint8Array;
+}
+interface XChaCha20Poly1305DecryptOpts {
+    readonly key: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly ciphertext: Uint8Array;
+}
+declare function xchacha20Poly1305Encrypt(opts: XChaCha20Poly1305EncryptOpts): Uint8Array;
+declare function xchacha20Poly1305Decrypt(opts: XChaCha20Poly1305DecryptOpts): Uint8Array;
+
+declare class AeadVerificationError extends Error {
+    readonly code: string;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+
+export { AeadVerificationError, type ChaCha20Poly1305DecryptOpts, type ChaCha20Poly1305EncryptOpts, type XChaCha20Poly1305DecryptOpts, type XChaCha20Poly1305EncryptOpts, chacha20Poly1305Decrypt, chacha20Poly1305Encrypt, xchacha20Poly1305Decrypt, xchacha20Poly1305Encrypt };

package/dist/aead.js

@@ -0,0 +1,38 @@
+import { chacha20poly1305, xchacha20poly1305 } from '@noble/ciphers/chacha.js';
+
+// src/aead/chacha20-poly1305.ts
+
+// src/aead/errors.ts
+var AeadVerificationError = class extends Error {
+  code = "aead_verification_failed";
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AeadVerificationError";
+  }
+};
+
+// src/aead/chacha20-poly1305.ts
+function chacha20Poly1305Encrypt(opts) {
+  return chacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);
+}
+function chacha20Poly1305Decrypt(opts) {
+  try {
+    return chacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);
+  } catch (cause) {
+    throw new AeadVerificationError("chacha20-poly1305 decrypt failed", { cause });
+  }
+}
+function xchacha20Poly1305Encrypt(opts) {
+  return xchacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);
+}
+function xchacha20Poly1305Decrypt(opts) {
+  try {
+    return xchacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);
+  } catch (cause) {
+    throw new AeadVerificationError("xchacha20-poly1305 decrypt failed", { cause });
+  }
+}
+
+export { AeadVerificationError, chacha20Poly1305Decrypt, chacha20Poly1305Encrypt, xchacha20Poly1305Decrypt, xchacha20Poly1305Encrypt };
+//# sourceMappingURL=aead.js.map
+//# sourceMappingURL=aead.js.map

package/dist/aead.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/aead/errors.ts","../src/aead/chacha20-poly1305.ts","../src/aead/xchacha20-poly1305.ts"],"names":[],"mappings":";;;;;AAAO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,IAAA,GAAe,0BAAA;AAAA,EAExB,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;;;ACWO,SAAS,wBAAwB,IAAA,EAA+C;AACrF,EAAA,OAAO,gBAAA,CAAiB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AAChF;AAEO,SAAS,wBAAwB,IAAA,EAA+C;AACrF,EAAA,IAAI;AACF,IAAA,OAAO,gBAAA,CAAiB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,EACjF,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,qBAAA,CAAsB,kCAAA,EAAoC,EAAE,OAAO,CAAA;AAAA,EAC/E;AACF;ACVO,SAAS,yBAAyB,IAAA,EAAgD;AACvF,EAAA,OAAO,iBAAA,CAAkB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,SAAS,CAAA;AACjF;AAEO,SAAS,yBAAyB,IAAA,EAAgD;AACvF,EAAA,IAAI;AACF,IAAA,OAAO,iBAAA,CAAkB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAA,EAAO,KAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA;AAAA,EAClF,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,qBAAA,CAAsB,mCAAA,EAAqC,EAAE,OAAO,CAAA;AAAA,EAChF;AACF","file":"aead.js","sourcesContent":["export class AeadVerificationError extends Error {\n  readonly code: string = 'aead_verification_failed';\n\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = 'AeadVerificationError';\n  }\n}\n","import { chacha20poly1305 } from '@noble/ciphers/chacha.js';\n\nimport { AeadVerificationError } from './errors';\n\nexport interface ChaCha20Poly1305EncryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly plaintext: Uint8Array;\n}\n\nexport interface ChaCha20Poly1305DecryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly ciphertext: Uint8Array;\n}\n\nexport function chacha20Poly1305Encrypt(opts: ChaCha20Poly1305EncryptOpts): Uint8Array {\n  return chacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);\n}\n\nexport function chacha20Poly1305Decrypt(opts: ChaCha20Poly1305DecryptOpts): Uint8Array {\n  try {\n    return chacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);\n  } catch (cause) {\n    throw new AeadVerificationError('chacha20-poly1305 decrypt failed', { cause });\n  }\n}\n","import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';\n\nimport { AeadVerificationError } from './errors';\n\nexport interface XChaCha20Poly1305EncryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly plaintext: Uint8Array;\n}\n\nexport interface XChaCha20Poly1305DecryptOpts {\n  readonly key: Uint8Array;\n  readonly nonce: Uint8Array;\n  readonly aad: Uint8Array;\n  readonly ciphertext: Uint8Array;\n}\n\nexport function xchacha20Poly1305Encrypt(opts: XChaCha20Poly1305EncryptOpts): Uint8Array {\n  return xchacha20poly1305(opts.key, opts.nonce, opts.aad).encrypt(opts.plaintext);\n}\n\nexport function xchacha20Poly1305Decrypt(opts: XChaCha20Poly1305DecryptOpts): Uint8Array {\n  try {\n    return xchacha20poly1305(opts.key, opts.nonce, opts.aad).decrypt(opts.ciphertext);\n  } catch (cause) {\n    throw new AeadVerificationError('xchacha20-poly1305 decrypt failed', { cause });\n  }\n}\n"]}

package/dist/cbor.cjs

@@ -0,0 +1,69 @@
+'use strict';
+
+var cbor2 = require('cbor2');
+var sorts = require('cbor2/sorts');
+
+// src/cbor/canonical.ts
+
+// src/cbor/errors.ts
+var CanonicalCborError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "CanonicalCborError";
+    this.code = code;
+  }
+};
+
+// src/cbor/canonical.ts
+function encodeCanonicalCbor(value) {
+  return cbor2.encode(value, {
+    cde: true,
+    collapseBigInts: true,
+    rejectDuplicateKeys: true,
+    sortKeys: sorts.sortCoreDeterministic
+  });
+}
+function decodeCanonicalCbor(bytes) {
+  try {
+    return cbor2.decode(bytes, {
+      ...cbor2.cdeDecodeOptions,
+      rejectStreaming: true,
+      rejectDuplicateKeys: true,
+      // A CIP-309 record carries integers, byte/text strings, arrays, maps and
+      // `null` — and nothing else. Without these rejections the major-type-7
+      // surface leaks into the decoder: a float16/32/64 that happens to hold an
+      // integral value (e.g. 1.0) silently decodes to the integer 1 and passes
+      // a `z.literal(1)` / Number.isInteger schema check, so two byte strings
+      // that are NOT byte-identical canonicalise to the same record. That
+      // breaks the cross-implementation parity invariant (the Python twin
+      // already rejects non-integer `v` / `enc.scheme` outright). Reject the
+      // whole non-record surface — floats, negative zero, undefined, and
+      // non-{true,false,null} simple values — so any such input surfaces as
+      // MALFORMED_CBOR via mapDecodeError rather than decoding to a look-alike.
+      rejectFloats: true,
+      rejectNegativeZero: true,
+      rejectUndefined: true,
+      rejectSimple: true
+    });
+  } catch (cause) {
+    throw mapDecodeError(cause);
+  }
+}
+function mapDecodeError(cause) {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  const lower = message.toLowerCase();
+  const isIndefinite = lower.includes("streaming") || lower.includes("indefinite");
+  const detail = isIndefinite ? `indefinite-length items are not permitted in canonical CBOR: ${message}` : message;
+  return new CanonicalCborError("MALFORMED_CBOR", `cbor decode failed: ${detail}`, { cause });
+}
+function decodeCbor(bytes) {
+  return cbor2.decode(bytes);
+}
+
+exports.CanonicalCborError = CanonicalCborError;
+exports.decodeCanonicalCbor = decodeCanonicalCbor;
+exports.decodeCbor = decodeCbor;
+exports.encodeCanonicalCbor = encodeCanonicalCbor;
+//# sourceMappingURL=cbor.cjs.map
+//# sourceMappingURL=cbor.cjs.map

package/dist/cbor.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cbor/errors.ts","../src/cbor/canonical.ts","../src/cbor/permissive.ts"],"names":["encode","sortCoreDeterministic","decode","cdeDecodeOptions"],"mappings":";;;;;;;;AAQO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,IAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA8B,OAAA,EAAiB,OAAA,EAA+B;AACxF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;;;ACAO,SAAS,oBAAoB,KAAA,EAAuC;AACzE,EAAA,OAAOA,aAAO,KAAA,EAAO;AAAA,IACnB,GAAA,EAAK,IAAA;AAAA,IACL,eAAA,EAAiB,IAAA;AAAA,IACjB,mBAAA,EAAqB,IAAA;AAAA,IACrB,QAAA,EAAUC;AAAA,GACX,CAAA;AACH;AAEO,SAAS,oBAAoB,KAAA,EAA4B;AAC9D,EAAA,IAAI;AACF,IAAA,OAAOC,aAAO,KAAA,EAAO;AAAA,MACnB,GAAGC,sBAAA;AAAA,MACH,eAAA,EAAiB,IAAA;AAAA,MACjB,mBAAA,EAAqB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYrB,YAAA,EAAc,IAAA;AAAA,MACd,kBAAA,EAAoB,IAAA;AAAA,MACpB,eAAA,EAAiB,IAAA;AAAA,MACjB,YAAA,EAAc;AAAA,KACf,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,eAAe,KAAK,CAAA;AAAA,EAC5B;AACF;AAEA,SAAS,eAAe,KAAA,EAAoC;AAC1D,EAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,EAAA,MAAM,KAAA,GAAQ,QAAQ,WAAA,EAAY;AAUlC,EAAA,MAAM,eAAe,KAAA,CAAM,QAAA,CAAS,WAAW,CAAA,IAAK,KAAA,CAAM,SAAS,YAAY,CAAA;AAC/E,EAAA,MAAM,MAAA,GAAS,YAAA,GACX,CAAA,6DAAA,EAAgE,OAAO,CAAA,CAAA,GACvE,OAAA;AACJ,EAAA,OAAO,IAAI,mBAAmB,gBAAA,EAAkB,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA;AAC5F;AC1DO,SAAS,WAAW,KAAA,EAA4B;AACrD,EAAA,OAAOD,aAAO,KAAK,CAAA;AACrB","file":"cbor.cjs","sourcesContent":["// Every canonical-CBOR decode violation collapses to the single public CIP-309\n// taxonomy code MALFORMED_CBOR: indefinite-length (streaming) items, duplicate\n// keys, unsorted keys, non-minimal integer encodings, and invalid UTF-8 in text\n// strings. The taxonomy intentionally has one code for all of these; the\n// specific cause survives in the human-readable error message, not as a\n// separate code.\nexport type CanonicalCborErrorCode = 'MALFORMED_CBOR';\n\nexport class CanonicalCborError extends Error {\n  readonly code: CanonicalCborErrorCode;\n\n  constructor(code: CanonicalCborErrorCode, message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = 'CanonicalCborError';\n    this.code = code;\n  }\n}\n","import { cdeDecodeOptions, decode, encode } from 'cbor2';\nimport { sortCoreDeterministic } from 'cbor2/sorts';\n\nimport { CanonicalCborError } from './errors';\n\nexport type CanonicalCborValue =\n  | null\n  | boolean\n  | number\n  | bigint\n  | string\n  | Uint8Array\n  | readonly CanonicalCborValue[]\n  | { readonly [key: string]: CanonicalCborValue }\n  | ReadonlyMap<string | number, CanonicalCborValue>;\n\nexport function encodeCanonicalCbor(value: CanonicalCborValue): Uint8Array {\n  return encode(value, {\n    cde: true,\n    collapseBigInts: true,\n    rejectDuplicateKeys: true,\n    sortKeys: sortCoreDeterministic,\n  });\n}\n\nexport function decodeCanonicalCbor(bytes: Uint8Array): unknown {\n  try {\n    return decode(bytes, {\n      ...cdeDecodeOptions,\n      rejectStreaming: true,\n      rejectDuplicateKeys: true,\n      // A CIP-309 record carries integers, byte/text strings, arrays, maps and\n      // `null` — and nothing else. Without these rejections the major-type-7\n      // surface leaks into the decoder: a float16/32/64 that happens to hold an\n      // integral value (e.g. 1.0) silently decodes to the integer 1 and passes\n      // a `z.literal(1)` / Number.isInteger schema check, so two byte strings\n      // that are NOT byte-identical canonicalise to the same record. That\n      // breaks the cross-implementation parity invariant (the Python twin\n      // already rejects non-integer `v` / `enc.scheme` outright). Reject the\n      // whole non-record surface — floats, negative zero, undefined, and\n      // non-{true,false,null} simple values — so any such input surfaces as\n      // MALFORMED_CBOR via mapDecodeError rather than decoding to a look-alike.\n      rejectFloats: true,\n      rejectNegativeZero: true,\n      rejectUndefined: true,\n      rejectSimple: true,\n    });\n  } catch (cause) {\n    throw mapDecodeError(cause);\n  }\n}\n\nfunction mapDecodeError(cause: unknown): CanonicalCborError {\n  const message = cause instanceof Error ? cause.message : String(cause);\n  const lower = message.toLowerCase();\n  // Every canonical-decode violation collapses to the single public taxonomy\n  // code MALFORMED_CBOR: indefinite-length (streaming) items, duplicate keys,\n  // non-canonical (unsorted) key ordering, non-minimal integer encodings, and\n  // invalid UTF-8 in text strings. cbor2 raises the SAME \"Duplicate or out of\n  // order key\" message for both true duplicates AND distinct-but-unsorted keys,\n  // so the two are indistinguishable by message — and per the CIP-309 taxonomy\n  // both belong under MALFORMED_CBOR anyway. The specific cause survives in the\n  // human-readable message below; for indefinite-length we state it explicitly\n  // so the diagnostic is not lost when the code is collapsed.\n  const isIndefinite = lower.includes('streaming') || lower.includes('indefinite');\n  const detail = isIndefinite\n    ? `indefinite-length items are not permitted in canonical CBOR: ${message}`\n    : message;\n  return new CanonicalCborError('MALFORMED_CBOR', `cbor decode failed: ${detail}`, { cause });\n}\n","// Permissive (non-canonical) CBOR decoder for outer wire decode (e.g. Cardano tx CBOR),\n// where the input is not constrained to be canonical RFC 8949 §4.2.1 form.\n//\n// CIP-309 records themselves MUST be canonical and MUST go through\n// `decodeCanonicalCbor`. This decoder\n// exists to peel the outer Cardano tx structure ([body, witness_set, is_valid,\n// auxiliary_data]) so the label-309 byte string can be re-encoded canonically\n// for validator + signature verification.\n\nimport { decode } from 'cbor2';\n\nexport function decodeCbor(bytes: Uint8Array): unknown {\n  return decode(bytes);\n}\n"]}