@cardanowall/crypto-core 0.0.0

package/dist/merkle.d.cts

@@ -0,0 +1,24 @@
+declare const LEAVES_LIST_FORMAT_V1: "cardano-poe-merkle-leaves-v1";
+declare const TREE_ALG_RFC9162: "rfc9162-sha256";
+type MerkleLeavesListErrorCode = 'SCHEMA_MERKLE_LEAVES_FORMAT_UNSUPPORTED' | 'SCHEMA_MERKLE_LEAVES_MALFORMED' | 'SCHEMA_MERKLE_LEAF_COUNT_MISMATCH' | 'MERKLE_ROOT_MISMATCH';
+declare class MerkleLeavesListError extends Error {
+    readonly code: MerkleLeavesListErrorCode;
+    constructor(code: MerkleLeavesListErrorCode, message?: string);
+}
+interface EncodeLeavesListArgs {
+    readonly leaves: ReadonlyArray<Uint8Array>;
+    readonly root: Uint8Array;
+    readonly leafAlg?: string;
+}
+interface DecodedLeavesList {
+    readonly format: typeof LEAVES_LIST_FORMAT_V1;
+    readonly treeAlg: typeof TREE_ALG_RFC9162;
+    readonly root: Uint8Array;
+    readonly leaves: Uint8Array[];
+    readonly leafCount: number;
+    readonly leafAlg?: string;
+}
+declare function encodeLeavesList(args: EncodeLeavesListArgs): Uint8Array;
+declare function decodeLeavesList(bytes: Uint8Array): DecodedLeavesList;
+
+export { type DecodedLeavesList, type EncodeLeavesListArgs, LEAVES_LIST_FORMAT_V1, MerkleLeavesListError, type MerkleLeavesListErrorCode, decodeLeavesList, encodeLeavesList };

package/dist/merkle.d.ts

@@ -0,0 +1,24 @@
+declare const LEAVES_LIST_FORMAT_V1: "cardano-poe-merkle-leaves-v1";
+declare const TREE_ALG_RFC9162: "rfc9162-sha256";
+type MerkleLeavesListErrorCode = 'SCHEMA_MERKLE_LEAVES_FORMAT_UNSUPPORTED' | 'SCHEMA_MERKLE_LEAVES_MALFORMED' | 'SCHEMA_MERKLE_LEAF_COUNT_MISMATCH' | 'MERKLE_ROOT_MISMATCH';
+declare class MerkleLeavesListError extends Error {
+    readonly code: MerkleLeavesListErrorCode;
+    constructor(code: MerkleLeavesListErrorCode, message?: string);
+}
+interface EncodeLeavesListArgs {
+    readonly leaves: ReadonlyArray<Uint8Array>;
+    readonly root: Uint8Array;
+    readonly leafAlg?: string;
+}
+interface DecodedLeavesList {
+    readonly format: typeof LEAVES_LIST_FORMAT_V1;
+    readonly treeAlg: typeof TREE_ALG_RFC9162;
+    readonly root: Uint8Array;
+    readonly leaves: Uint8Array[];
+    readonly leafCount: number;
+    readonly leafAlg?: string;
+}
+declare function encodeLeavesList(args: EncodeLeavesListArgs): Uint8Array;
+declare function decodeLeavesList(bytes: Uint8Array): DecodedLeavesList;
+
+export { type DecodedLeavesList, type EncodeLeavesListArgs, LEAVES_LIST_FORMAT_V1, MerkleLeavesListError, type MerkleLeavesListErrorCode, decodeLeavesList, encodeLeavesList };

package/dist/merkle.js

@@ -0,0 +1,279 @@
+import { encode, decode, cdeDecodeOptions } from 'cbor2';
+import { sortCoreDeterministic } from 'cbor2/sorts';
+import { sha256 } from '@noble/hashes/sha2.js';
+
+// src/cbor/canonical.ts
+
+// src/cbor/errors.ts
+var CanonicalCborError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "CanonicalCborError";
+    this.code = code;
+  }
+};
+
+// src/cbor/canonical.ts
+function encodeCanonicalCbor(value) {
+  return encode(value, {
+    cde: true,
+    collapseBigInts: true,
+    rejectDuplicateKeys: true,
+    sortKeys: sortCoreDeterministic
+  });
+}
+function decodeCanonicalCbor(bytes) {
+  try {
+    return decode(bytes, {
+      ...cdeDecodeOptions,
+      rejectStreaming: true,
+      rejectDuplicateKeys: true,
+      // A CIP-309 record carries integers, byte/text strings, arrays, maps and
+      // `null` — and nothing else. Without these rejections the major-type-7
+      // surface leaks into the decoder: a float16/32/64 that happens to hold an
+      // integral value (e.g. 1.0) silently decodes to the integer 1 and passes
+      // a `z.literal(1)` / Number.isInteger schema check, so two byte strings
+      // that are NOT byte-identical canonicalise to the same record. That
+      // breaks the cross-implementation parity invariant (the Python twin
+      // already rejects non-integer `v` / `enc.scheme` outright). Reject the
+      // whole non-record surface — floats, negative zero, undefined, and
+      // non-{true,false,null} simple values — so any such input surfaces as
+      // MALFORMED_CBOR via mapDecodeError rather than decoding to a look-alike.
+      rejectFloats: true,
+      rejectNegativeZero: true,
+      rejectUndefined: true,
+      rejectSimple: true
+    });
+  } catch (cause) {
+    throw mapDecodeError(cause);
+  }
+}
+function mapDecodeError(cause) {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  const lower = message.toLowerCase();
+  const isIndefinite = lower.includes("streaming") || lower.includes("indefinite");
+  const detail = isIndefinite ? `indefinite-length items are not permitted in canonical CBOR: ${message}` : message;
+  return new CanonicalCborError("MALFORMED_CBOR", `cbor decode failed: ${detail}`, { cause });
+}
+
+// src/util/compare-ct.ts
+function compareCt(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var LEAF_PREFIX = 0;
+var NODE_PREFIX = 1;
+var DIGEST_LENGTH = 32;
+function validateLeaves(leaves, fnName) {
+  if (leaves.length === 0) {
+    throw new Error(`${fnName}: empty leaf list (n == 0 is forbidden by RFC 9162 \xA72.1.1)`);
+  }
+  for (let i = 0; i < leaves.length; i++) {
+    const leaf = leaves[i];
+    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH) {
+      throw new Error(
+        `${fnName}: leaf[${i}] must be a Uint8Array(${DIGEST_LENGTH}); got length ${leaf instanceof Uint8Array ? leaf.length : "non-Uint8Array"}`
+      );
+    }
+  }
+}
+function merkleSha2256Root(leaves) {
+  validateLeaves(leaves, "merkleSha2256Root");
+  return mthRecursive(leaves, 0, leaves.length);
+}
+function largestPow2Lt(n) {
+  let k = 1;
+  while (k * 2 < n) k *= 2;
+  return k;
+}
+function hashLeaf(d) {
+  const buf = new Uint8Array(1 + d.length);
+  buf[0] = LEAF_PREFIX;
+  buf.set(d, 1);
+  return sha256(buf);
+}
+function hashNode(left, right) {
+  const buf = new Uint8Array(1 + left.length + right.length);
+  buf[0] = NODE_PREFIX;
+  buf.set(left, 1);
+  buf.set(right, 1 + left.length);
+  return sha256(buf);
+}
+function mthRecursive(leaves, start, end) {
+  const n = end - start;
+  if (n === 1) {
+    return hashLeaf(leaves[start]);
+  }
+  const k = largestPow2Lt(n);
+  const left = mthRecursive(leaves, start, start + k);
+  const right = mthRecursive(leaves, start + k, end);
+  return hashNode(left, right);
+}
+
+// src/merkle/leaves-list.ts
+var LEAVES_LIST_FORMAT_V1 = "cardano-poe-merkle-leaves-v1";
+var TREE_ALG_RFC9162 = "rfc9162-sha256";
+var DIGEST_LENGTH2 = 32;
+var REGISTERED_FORMATS = /* @__PURE__ */ new Set([LEAVES_LIST_FORMAT_V1]);
+var MerkleLeavesListError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message ? `${code}: ${message}` : code);
+    this.code = code;
+    this.name = "MerkleLeavesListError";
+  }
+};
+function encodeLeavesList(args) {
+  if (!(args.root instanceof Uint8Array) || args.root.length !== DIGEST_LENGTH2) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      `root must be a Uint8Array(${DIGEST_LENGTH2})`
+    );
+  }
+  if (args.leaves.length < 1) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "leaves array must be non-empty"
+    );
+  }
+  const leavesCopy = [];
+  for (let i = 0; i < args.leaves.length; i++) {
+    const leaf = args.leaves[i];
+    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH2) {
+      throw new MerkleLeavesListError(
+        "SCHEMA_MERKLE_LEAVES_MALFORMED",
+        `leaves[${i}] must be a Uint8Array(${DIGEST_LENGTH2})`
+      );
+    }
+    leavesCopy.push(leaf);
+  }
+  if (args.leafAlg !== void 0 && typeof args.leafAlg !== "string") {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "leaf_alg must be a string when present"
+    );
+  }
+  const map = {
+    format: LEAVES_LIST_FORMAT_V1,
+    tree_alg: TREE_ALG_RFC9162,
+    root: args.root,
+    leaves: leavesCopy,
+    leaf_count: leavesCopy.length
+  };
+  if (args.leafAlg !== void 0) {
+    map["leaf_alg"] = args.leafAlg;
+  }
+  return encodeCanonicalCbor(map);
+}
+function decodeLeavesList(bytes) {
+  const decoded = decodeCanonicalCbor(bytes);
+  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "leaves-list MUST be a CBOR map"
+    );
+  }
+  const m = decoded;
+  const format = m["format"];
+  if (typeof format !== "string") {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "format must be a text string"
+    );
+  }
+  if (!REGISTERED_FORMATS.has(format)) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_FORMAT_UNSUPPORTED",
+      `format '${format}' is not in the registered set`
+    );
+  }
+  const treeAlg = m["tree_alg"];
+  if (treeAlg !== TREE_ALG_RFC9162) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      `tree_alg '${String(treeAlg)}' is not '${TREE_ALG_RFC9162}'`
+    );
+  }
+  const root = m["root"];
+  if (!(root instanceof Uint8Array) || root.length !== DIGEST_LENGTH2) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      `root must be a ${DIGEST_LENGTH2}-byte byte string`
+    );
+  }
+  const leavesRaw = m["leaves"];
+  if (!Array.isArray(leavesRaw) || leavesRaw.length < 1) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "leaves must be a non-empty array"
+    );
+  }
+  const leaves = [];
+  for (let i = 0; i < leavesRaw.length; i++) {
+    const leaf = leavesRaw[i];
+    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH2) {
+      throw new MerkleLeavesListError(
+        "SCHEMA_MERKLE_LEAVES_MALFORMED",
+        `leaves[${i}] must be a ${DIGEST_LENGTH2}-byte byte string`
+      );
+    }
+    leaves.push(leaf);
+  }
+  const leafCountRaw = m["leaf_count"];
+  let leafCount;
+  if (typeof leafCountRaw === "number" && Number.isInteger(leafCountRaw) && leafCountRaw >= 0) {
+    leafCount = leafCountRaw;
+  } else if (typeof leafCountRaw === "bigint" && leafCountRaw >= 0n) {
+    if (leafCountRaw > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new MerkleLeavesListError(
+        "SCHEMA_MERKLE_LEAVES_MALFORMED",
+        "leaf_count exceeds Number.MAX_SAFE_INTEGER"
+      );
+    }
+    leafCount = Number(leafCountRaw);
+  } else {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAVES_MALFORMED",
+      "leaf_count must be a non-negative CBOR uint"
+    );
+  }
+  if (leaves.length !== leafCount) {
+    throw new MerkleLeavesListError(
+      "SCHEMA_MERKLE_LEAF_COUNT_MISMATCH",
+      `leaves.length (${leaves.length}) != leaf_count (${leafCount})`
+    );
+  }
+  let leafAlg;
+  if (m["leaf_alg"] !== void 0) {
+    if (typeof m["leaf_alg"] !== "string") {
+      throw new MerkleLeavesListError(
+        "SCHEMA_MERKLE_LEAVES_MALFORMED",
+        "leaf_alg must be a text string when present"
+      );
+    }
+    leafAlg = m["leaf_alg"];
+  }
+  const recomputed = merkleSha2256Root(leaves);
+  if (!compareCt(recomputed, root)) {
+    throw new MerkleLeavesListError(
+      "MERKLE_ROOT_MISMATCH",
+      "leaves recompute does not match declared root"
+    );
+  }
+  const out = {
+    format: LEAVES_LIST_FORMAT_V1,
+    treeAlg: TREE_ALG_RFC9162,
+    root,
+    leaves,
+    leafCount,
+    ...leafAlg !== void 0 ? { leafAlg } : {}
+  };
+  return out;
+}
+
+export { LEAVES_LIST_FORMAT_V1, MerkleLeavesListError, decodeLeavesList, encodeLeavesList };
+//# sourceMappingURL=merkle.js.map
+//# sourceMappingURL=merkle.js.map

package/dist/merkle.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cbor/errors.ts","../src/cbor/canonical.ts","../src/util/compare-ct.ts","../src/hash/merkle-sha2-256.ts","../src/merkle/leaves-list.ts"],"names":["DIGEST_LENGTH"],"mappings":";;;;;;;AAQO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EACnC,IAAA;AAAA,EAET,WAAA,CAAY,IAAA,EAA8B,OAAA,EAAiB,OAAA,EAA+B;AACxF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF,CAAA;;;ACAO,SAAS,oBAAoB,KAAA,EAAuC;AACzE,EAAA,OAAO,OAAO,KAAA,EAAO;AAAA,IACnB,GAAA,EAAK,IAAA;AAAA,IACL,eAAA,EAAiB,IAAA;AAAA,IACjB,mBAAA,EAAqB,IAAA;AAAA,IACrB,QAAA,EAAU;AAAA,GACX,CAAA;AACH;AAEO,SAAS,oBAAoB,KAAA,EAA4B;AAC9D,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,KAAA,EAAO;AAAA,MACnB,GAAG,gBAAA;AAAA,MACH,eAAA,EAAiB,IAAA;AAAA,MACjB,mBAAA,EAAqB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYrB,YAAA,EAAc,IAAA;AAAA,MACd,kBAAA,EAAoB,IAAA;AAAA,MACpB,eAAA,EAAiB,IAAA;AAAA,MACjB,YAAA,EAAc;AAAA,KACf,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,eAAe,KAAK,CAAA;AAAA,EAC5B;AACF;AAEA,SAAS,eAAe,KAAA,EAAoC;AAC1D,EAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,EAAA,MAAM,KAAA,GAAQ,QAAQ,WAAA,EAAY;AAUlC,EAAA,MAAM,eAAe,KAAA,CAAM,QAAA,CAAS,WAAW,CAAA,IAAK,KAAA,CAAM,SAAS,YAAY,CAAA;AAC/E,EAAA,MAAM,MAAA,GAAS,YAAA,GACX,CAAA,6DAAA,EAAgE,OAAO,CAAA,CAAA,GACvE,OAAA;AACJ,EAAA,OAAO,IAAI,mBAAmB,gBAAA,EAAkB,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,EAAI,EAAE,OAAO,CAAA;AAC5F;;;AChEO,SAAS,SAAA,CAAU,GAAe,CAAA,EAAwB;AAC/D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AAIX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAS,CAAA,CAAE,CAAC,CAAA,GAAgB,CAAA,CAAE,CAAC,CAAA;AAClE,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;ACKA,IAAM,WAAA,GAAc,CAAA;AACpB,IAAM,WAAA,GAAc,CAAA;AACpB,IAAM,aAAA,GAAgB,EAAA;AAEtB,SAAS,cAAA,CAAe,QAAmC,MAAA,EAAsB;AAC/E,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,MAAM,CAAA,6DAAA,CAA4D,CAAA;AAAA,EACvF;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,IAAA,IAAI,EAAE,IAAA,YAAgB,UAAA,CAAA,IAAe,IAAA,CAAK,WAAW,aAAA,EAAe;AAClE,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,EAAG,MAAM,CAAA,OAAA,EAAU,CAAC,CAAA,uBAAA,EAA0B,aAAa,CAAA,cAAA,EACzD,IAAA,YAAgB,UAAA,GAAa,IAAA,CAAK,MAAA,GAAS,gBAC7C,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,kBAAkB,MAAA,EAA+C;AAC/E,EAAA,cAAA,CAAe,QAAQ,mBAAmB,CAAA;AAC1C,EAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA;AAC9C;AA+EA,SAAS,cAAc,CAAA,EAAmB;AACxC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,CAAA,GAAI,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,CAAA;AACvB,EAAA,OAAO,CAAA;AACT;AAEA,SAAS,SAAS,CAAA,EAA2B;AAC3C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,GAAI,EAAE,MAAM,CAAA;AACvC,EAAA,GAAA,CAAI,CAAC,CAAA,GAAI,WAAA;AACT,EAAA,GAAA,CAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AACZ,EAAA,OAAO,OAAO,GAAG,CAAA;AACnB;AAEA,SAAS,QAAA,CAAS,MAAkB,KAAA,EAA+B;AACjE,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,IAAI,IAAA,CAAK,MAAA,GAAS,MAAM,MAAM,CAAA;AACzD,EAAA,GAAA,CAAI,CAAC,CAAA,GAAI,WAAA;AACT,EAAA,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AACf,EAAA,GAAA,CAAI,GAAA,CAAI,KAAA,EAAO,CAAA,GAAI,IAAA,CAAK,MAAM,CAAA;AAC9B,EAAA,OAAO,OAAO,GAAG,CAAA;AACnB;AAEA,SAAS,YAAA,CAAa,MAAA,EAAmC,KAAA,EAAe,GAAA,EAAyB;AAC/F,EAAA,MAAM,IAAI,GAAA,GAAM,KAAA;AAChB,EAAA,IAAI,MAAM,CAAA,EAAG;AACX,IAAA,OAAO,QAAA,CAAS,MAAA,CAAO,KAAK,CAAe,CAAA;AAAA,EAC7C;AACA,EAAA,MAAM,CAAA,GAAI,cAAc,CAAC,CAAA;AACzB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,KAAA,EAAO,QAAQ,CAAC,CAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,EAAQ,KAAA,GAAQ,GAAG,GAAG,CAAA;AACjD,EAAA,OAAO,QAAA,CAAS,MAAM,KAAK,CAAA;AAC7B;;;AC9HO,IAAM,qBAAA,GAAwB;AACrC,IAAM,gBAAA,GAAmB,gBAAA;AACzB,IAAMA,cAAAA,GAAgB,EAAA;AACtB,IAAM,kBAAA,mBAAqB,IAAI,GAAA,CAAY,CAAC,qBAAqB,CAAC,CAAA;AAQ3D,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,IAAA;AAAA,EACT,WAAA,CAAY,MAAiC,OAAA,EAAkB;AAC7D,IAAA,KAAA,CAAM,UAAU,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,OAAO,KAAK,IAAI,CAAA;AAC5C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAiBO,SAAS,iBAAiB,IAAA,EAAwC;AACvE,EAAA,IAAI,EAAE,IAAA,CAAK,IAAA,YAAgB,eAAe,IAAA,CAAK,IAAA,CAAK,WAAWA,cAAAA,EAAe;AAC5E,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA,6BAA6BA,cAAa,CAAA,CAAA;AAAA,KAC5C;AAAA,EACF;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,aAA2B,EAAC;AAClC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AAC3C,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA;AAC1B,IAAA,IAAI,EAAE,IAAA,YAAgB,UAAA,CAAA,IAAe,IAAA,CAAK,WAAWA,cAAAA,EAAe;AAClE,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,gCAAA;AAAA,QACA,CAAA,OAAA,EAAU,CAAC,CAAA,uBAAA,EAA0BA,cAAa,CAAA,CAAA;AAAA,OACpD;AAAA,IACF;AACA,IAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EACtB;AACA,EAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAa,OAAO,IAAA,CAAK,YAAY,QAAA,EAAU;AAClE,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,MAAA,EAAQ,qBAAA;AAAA,IACR,QAAA,EAAU,gBAAA;AAAA,IACV,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,MAAA,EAAQ,UAAA;AAAA,IACR,YAAY,UAAA,CAAW;AAAA,GACzB;AACA,EAAA,IAAI,IAAA,CAAK,YAAY,MAAA,EAAW;AAC9B,IAAA,GAAA,CAAI,UAAU,IAAI,IAAA,CAAK,OAAA;AAAA,EACzB;AACA,EAAA,OAAO,oBAAoB,GAAY,CAAA;AACzC;AAEO,SAAS,iBAAiB,KAAA,EAAsC;AACrE,EAAA,MAAM,OAAA,GAAU,oBAAoB,KAAK,CAAA;AACzC,EAAA,IAAI,OAAO,YAAY,QAAA,IAAY,OAAA,KAAY,QAAQ,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC7E,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,CAAA,GAAI,OAAA;AAEV,EAAA,MAAM,MAAA,GAAS,EAAE,QAAQ,CAAA;AACzB,EAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,yCAAA;AAAA,MACA,WAAW,MAAM,CAAA,8BAAA;AAAA,KACnB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,EAAE,UAAU,CAAA;AAC5B,EAAA,IAAI,YAAY,gBAAA,EAAkB;AAChC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA,CAAA,UAAA,EAAa,MAAA,CAAO,OAAO,CAAC,aAAa,gBAAgB,CAAA,CAAA;AAAA,KAC3D;AAAA,EACF;AAEA,EAAA,MAAM,IAAA,GAAO,EAAE,MAAM,CAAA;AACrB,EAAA,IAAI,EAAE,IAAA,YAAgB,UAAA,CAAA,IAAe,IAAA,CAAK,WAAWA,cAAAA,EAAe;AAClE,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA,kBAAkBA,cAAa,CAAA,iBAAA;AAAA,KACjC;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,QAAQ,CAAA;AAC5B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA,IAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AACrD,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,SAAA,CAAU,QAAQ,CAAA,EAAA,EAAK;AACzC,IAAA,MAAM,IAAA,GAAO,UAAU,CAAC,CAAA;AACxB,IAAA,IAAI,EAAE,IAAA,YAAgB,UAAA,CAAA,IAAe,IAAA,CAAK,WAAWA,cAAAA,EAAe;AAClE,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,gCAAA;AAAA,QACA,CAAA,OAAA,EAAU,CAAC,CAAA,YAAA,EAAeA,cAAa,CAAA,iBAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAA,CAAO,KAAK,IAAI,CAAA;AAAA,EAClB;AAEA,EAAA,MAAM,YAAA,GAAe,EAAE,YAAY,CAAA;AACnC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAO,iBAAiB,QAAA,IAAY,MAAA,CAAO,UAAU,YAAY,CAAA,IAAK,gBAAgB,CAAA,EAAG;AAC3F,IAAA,SAAA,GAAY,YAAA;AAAA,EACd,CAAA,MAAA,IAAW,OAAO,YAAA,KAAiB,QAAA,IAAY,gBAAgB,EAAA,EAAI;AACjE,IAAA,IAAI,YAAA,GAAe,MAAA,CAAO,MAAA,CAAO,gBAAgB,CAAA,EAAG;AAClD,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,gCAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,SAAA,GAAY,OAAO,YAAY,CAAA;AAAA,EACjC,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,gCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAA;AAAA,KAC9D;AAAA,EACF;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAA,CAAE,UAAU,CAAA,KAAM,MAAA,EAAW;AAC/B,IAAA,IAAI,OAAO,CAAA,CAAE,UAAU,CAAA,KAAM,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,gCAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAA,GAAU,EAAE,UAAU,CAAA;AAAA,EACxB;AAEA,EAAA,MAAM,UAAA,GAAa,kBAAkB,MAAM,CAAA;AAC3C,EAAA,IAAI,CAAC,SAAA,CAAU,UAAA,EAAY,IAAI,CAAA,EAAG;AAChC,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,qBAAA;AAAA,IACR,OAAA,EAAS,gBAAA;AAAA,IACT,IAAA;AAAA,IACA,MAAA;AAAA,IACA,SAAA;AAAA,IACA,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC7C;AACA,EAAA,OAAO,GAAA;AACT","file":"merkle.js","sourcesContent":["// Every canonical-CBOR decode violation collapses to the single public CIP-309\n// taxonomy code MALFORMED_CBOR: indefinite-length (streaming) items, duplicate\n// keys, unsorted keys, non-minimal integer encodings, and invalid UTF-8 in text\n// strings. The taxonomy intentionally has one code for all of these; the\n// specific cause survives in the human-readable error message, not as a\n// separate code.\nexport type CanonicalCborErrorCode = 'MALFORMED_CBOR';\n\nexport class CanonicalCborError extends Error {\n  readonly code: CanonicalCborErrorCode;\n\n  constructor(code: CanonicalCborErrorCode, message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = 'CanonicalCborError';\n    this.code = code;\n  }\n}\n","import { cdeDecodeOptions, decode, encode } from 'cbor2';\nimport { sortCoreDeterministic } from 'cbor2/sorts';\n\nimport { CanonicalCborError } from './errors';\n\nexport type CanonicalCborValue =\n  | null\n  | boolean\n  | number\n  | bigint\n  | string\n  | Uint8Array\n  | readonly CanonicalCborValue[]\n  | { readonly [key: string]: CanonicalCborValue }\n  | ReadonlyMap<string | number, CanonicalCborValue>;\n\nexport function encodeCanonicalCbor(value: CanonicalCborValue): Uint8Array {\n  return encode(value, {\n    cde: true,\n    collapseBigInts: true,\n    rejectDuplicateKeys: true,\n    sortKeys: sortCoreDeterministic,\n  });\n}\n\nexport function decodeCanonicalCbor(bytes: Uint8Array): unknown {\n  try {\n    return decode(bytes, {\n      ...cdeDecodeOptions,\n      rejectStreaming: true,\n      rejectDuplicateKeys: true,\n      // A CIP-309 record carries integers, byte/text strings, arrays, maps and\n      // `null` — and nothing else. Without these rejections the major-type-7\n      // surface leaks into the decoder: a float16/32/64 that happens to hold an\n      // integral value (e.g. 1.0) silently decodes to the integer 1 and passes\n      // a `z.literal(1)` / Number.isInteger schema check, so two byte strings\n      // that are NOT byte-identical canonicalise to the same record. That\n      // breaks the cross-implementation parity invariant (the Python twin\n      // already rejects non-integer `v` / `enc.scheme` outright). Reject the\n      // whole non-record surface — floats, negative zero, undefined, and\n      // non-{true,false,null} simple values — so any such input surfaces as\n      // MALFORMED_CBOR via mapDecodeError rather than decoding to a look-alike.\n      rejectFloats: true,\n      rejectNegativeZero: true,\n      rejectUndefined: true,\n      rejectSimple: true,\n    });\n  } catch (cause) {\n    throw mapDecodeError(cause);\n  }\n}\n\nfunction mapDecodeError(cause: unknown): CanonicalCborError {\n  const message = cause instanceof Error ? cause.message : String(cause);\n  const lower = message.toLowerCase();\n  // Every canonical-decode violation collapses to the single public taxonomy\n  // code MALFORMED_CBOR: indefinite-length (streaming) items, duplicate keys,\n  // non-canonical (unsorted) key ordering, non-minimal integer encodings, and\n  // invalid UTF-8 in text strings. cbor2 raises the SAME \"Duplicate or out of\n  // order key\" message for both true duplicates AND distinct-but-unsorted keys,\n  // so the two are indistinguishable by message — and per the CIP-309 taxonomy\n  // both belong under MALFORMED_CBOR anyway. The specific cause survives in the\n  // human-readable message below; for indefinite-length we state it explicitly\n  // so the diagnostic is not lost when the code is collapsed.\n  const isIndefinite = lower.includes('streaming') || lower.includes('indefinite');\n  const detail = isIndefinite\n    ? `indefinite-length items are not permitted in canonical CBOR: ${message}`\n    : message;\n  return new CanonicalCborError('MALFORMED_CBOR', `cbor decode failed: ${detail}`, { cause });\n}\n","// Isomorphic constant-time byte-equality. crypto-core is browser-safe by\n// design, so we cannot import `node:crypto.timingSafeEqual` — webpack rejects\n// the `node:` scheme in the browser bundle. A pure-JS XOR loop is constant-time\n// for equal-length inputs; length mismatch is a deliberate early-return (the\n// API surface itself leaks length, same as node's timingSafeEqual which throws).\nexport function compareCt(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  // Lengths are equal and `i` stays in-bounds, so both indexes are always\n  // defined — no nullish guard is needed (and one would read as a guard for\n  // an impossible case).\n  for (let i = 0; i < a.length; i++) diff |= (a[i] as number) ^ (b[i] as number);\n  return diff === 0;\n}\n","// RFC 9162 §2.1.1 binary Merkle tree under SHA-256.\n// This implements the algorithm tier identified on the wire as the\n// `rfc9162-sha256` OPT-INFO; the record's `merkle[]` field carries the proof.\n//\n// Construction (RFC 9162 §2.1.1):\n//   - Single leaf:   MTH({d_0})     = SHA-256(0x00 || d_0)\n//   - Internal node: MTH(L)         = SHA-256(0x01 || MTH(L[0:k]) || MTH(L[k:n]))\n//     where k = largest power of 2 strictly less than n.\n//   - Empty trees (n == 0) are FORBIDDEN.\n//   - The 0x00 leaf / 0x01 internal prefixes prevent the CVE-2012-2459\n//     leaf-vs-internal collision family.\n\nimport { sha256 } from '@noble/hashes/sha2.js';\n\nimport { compareCt } from '../util/compare-ct';\n\nexport const MERKLE_ALG_ID = 'rfc9162-sha256' as const;\n\nconst LEAF_PREFIX = 0x00;\nconst NODE_PREFIX = 0x01;\nconst DIGEST_LENGTH = 32;\n\nfunction validateLeaves(leaves: ReadonlyArray<Uint8Array>, fnName: string): void {\n  if (leaves.length === 0) {\n    throw new Error(`${fnName}: empty leaf list (n == 0 is forbidden by RFC 9162 §2.1.1)`);\n  }\n  for (let i = 0; i < leaves.length; i++) {\n    const leaf = leaves[i];\n    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH) {\n      throw new Error(\n        `${fnName}: leaf[${i}] must be a Uint8Array(${DIGEST_LENGTH}); got length ${\n          leaf instanceof Uint8Array ? leaf.length : 'non-Uint8Array'\n        }`,\n      );\n    }\n  }\n}\n\nexport function merkleSha2256Root(leaves: ReadonlyArray<Uint8Array>): Uint8Array {\n  validateLeaves(leaves, 'merkleSha2256Root');\n  return mthRecursive(leaves, 0, leaves.length);\n}\n\nexport function merkleSha2256InclusionProof(\n  leaves: ReadonlyArray<Uint8Array>,\n  index: number,\n): Uint8Array[] {\n  validateLeaves(leaves, 'merkleSha2256InclusionProof');\n  if (!Number.isInteger(index) || index < 0 || index >= leaves.length) {\n    throw new Error(\n      `merkleSha2256InclusionProof: index ${index} out of range [0, ${leaves.length})`,\n    );\n  }\n  return auditPath(leaves, index, 0, leaves.length);\n}\n\n/**\n * Verify an inclusion proof per RFC 9162 §2.1.3.2 (iterative form).\n *\n * `proof` is ordered leaf-to-root: `proof[0]` is the sibling at the leaf\n * level, `proof[m-1]` is the top-level sibling. The fold uses the\n * `sn`/`fn` tracking from RFC 9162: `sn` is the leaf index within the\n * current subtree, `fn` is (subtree_size - 1). At each step, `sn` odd\n * OR `sn == fn` means the current node is a right child (sibling on\n * the left); otherwise it is a left child (sibling on the right).\n * Both shift right by one each iteration. This handles non-power-of-2\n * sizes including the \"promote a lone right subtree\" cases.\n */\nexport function merkleSha2256VerifyInclusion(\n  leaf: Uint8Array,\n  index: number,\n  treeSize: number,\n  proof: ReadonlyArray<Uint8Array>,\n  root: Uint8Array,\n): boolean {\n  if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH) return false;\n  if (!(root instanceof Uint8Array) || root.length !== DIGEST_LENGTH) return false;\n  if (\n    !Number.isInteger(index) ||\n    !Number.isInteger(treeSize) ||\n    treeSize < 1 ||\n    index < 0 ||\n    index >= treeSize\n  ) {\n    return false;\n  }\n  for (let i = 0; i < proof.length; i++) {\n    const sibling = proof[i];\n    if (!(sibling instanceof Uint8Array) || sibling.length !== DIGEST_LENGTH) {\n      return false;\n    }\n  }\n\n  if (treeSize === 1) {\n    if (proof.length !== 0 || index !== 0) return false;\n    return compareCt(hashLeaf(leaf), root);\n  }\n\n  let h = hashLeaf(leaf);\n  let sn = index;\n  let fn = treeSize - 1;\n  for (let i = 0; i < proof.length; i++) {\n    if (fn === 0) return false;\n    const sibling = proof[i] as Uint8Array;\n    if ((sn & 1) === 1 || sn === fn) {\n      h = hashNode(sibling, h);\n      while ((sn & 1) === 0 && sn !== 0) {\n        sn >>>= 1;\n        fn >>>= 1;\n      }\n    } else {\n      h = hashNode(h, sibling);\n    }\n    sn >>>= 1;\n    fn >>>= 1;\n  }\n  if (fn !== 0) return false;\n  return compareCt(h, root);\n}\n\nfunction largestPow2Lt(n: number): number {\n  let k = 1;\n  while (k * 2 < n) k *= 2;\n  return k;\n}\n\nfunction hashLeaf(d: Uint8Array): Uint8Array {\n  const buf = new Uint8Array(1 + d.length);\n  buf[0] = LEAF_PREFIX;\n  buf.set(d, 1);\n  return sha256(buf);\n}\n\nfunction hashNode(left: Uint8Array, right: Uint8Array): Uint8Array {\n  const buf = new Uint8Array(1 + left.length + right.length);\n  buf[0] = NODE_PREFIX;\n  buf.set(left, 1);\n  buf.set(right, 1 + left.length);\n  return sha256(buf);\n}\n\nfunction mthRecursive(leaves: ReadonlyArray<Uint8Array>, start: number, end: number): Uint8Array {\n  const n = end - start;\n  if (n === 1) {\n    return hashLeaf(leaves[start] as Uint8Array);\n  }\n  const k = largestPow2Lt(n);\n  const left = mthRecursive(leaves, start, start + k);\n  const right = mthRecursive(leaves, start + k, end);\n  return hashNode(left, right);\n}\n\nfunction auditPath(\n  leaves: ReadonlyArray<Uint8Array>,\n  i: number,\n  start: number,\n  end: number,\n): Uint8Array[] {\n  const n = end - start;\n  if (n === 1) return [];\n  const k = largestPow2Lt(n);\n  if (i < k) {\n    const subPath = auditPath(leaves, i, start, start + k);\n    subPath.push(mthRecursive(leaves, start + k, end));\n    return subPath;\n  }\n  const subPath = auditPath(leaves, i - k, start + k, end);\n  subPath.push(mthRecursive(leaves, start, start + k));\n  return subPath;\n}\n","// Canonical-CBOR codec for the off-chain Merkle leaves-list artefact.\n// The on-chain `merkle[]` field binds to this file via `uris[]` / `leaf_count`;\n// the file itself carries the full leaf set. Canonical CBOR is RFC 8949 §4.2.1.\n//\n// CDDL:\n//\n//   leaves-list = {\n//     \"format\":     \"cardano-poe-merkle-leaves-v1\",\n//     \"tree_alg\":   \"rfc9162-sha256\",\n//     \"root\":       bytes .size 32,\n//     \"leaves\":     [ + bytes .size 32 ],\n//     \"leaf_count\": uint,\n//     ? \"leaf_alg\": tstr,\n//   }\n//\n// Canonical ordering is bytewise-lexicographic on encoded map keys (RFC 8949\n// §4.2.1) so the wire-key order is fixed by `cde:true` regardless of insertion\n// order: root (4B) < format (6B) < leaves (6B) < leaf_alg (8B) < tree_alg (8B)\n// < leaf_count (10B).\n\nimport { decodeCanonicalCbor, encodeCanonicalCbor } from '../cbor/canonical';\nimport { compareCt } from '../util/compare-ct';\nimport { merkleSha2256Root } from '../hash/merkle-sha2-256';\n\nexport const LEAVES_LIST_FORMAT_V1 = 'cardano-poe-merkle-leaves-v1' as const;\nconst TREE_ALG_RFC9162 = 'rfc9162-sha256' as const;\nconst DIGEST_LENGTH = 32;\nconst REGISTERED_FORMATS = new Set<string>([LEAVES_LIST_FORMAT_V1]);\n\nexport type MerkleLeavesListErrorCode =\n  | 'SCHEMA_MERKLE_LEAVES_FORMAT_UNSUPPORTED'\n  | 'SCHEMA_MERKLE_LEAVES_MALFORMED'\n  | 'SCHEMA_MERKLE_LEAF_COUNT_MISMATCH'\n  | 'MERKLE_ROOT_MISMATCH';\n\nexport class MerkleLeavesListError extends Error {\n  readonly code: MerkleLeavesListErrorCode;\n  constructor(code: MerkleLeavesListErrorCode, message?: string) {\n    super(message ? `${code}: ${message}` : code);\n    this.code = code;\n    this.name = 'MerkleLeavesListError';\n  }\n}\n\nexport interface EncodeLeavesListArgs {\n  readonly leaves: ReadonlyArray<Uint8Array>;\n  readonly root: Uint8Array;\n  readonly leafAlg?: string;\n}\n\nexport interface DecodedLeavesList {\n  readonly format: typeof LEAVES_LIST_FORMAT_V1;\n  readonly treeAlg: typeof TREE_ALG_RFC9162;\n  readonly root: Uint8Array;\n  readonly leaves: Uint8Array[];\n  readonly leafCount: number;\n  readonly leafAlg?: string;\n}\n\nexport function encodeLeavesList(args: EncodeLeavesListArgs): Uint8Array {\n  if (!(args.root instanceof Uint8Array) || args.root.length !== DIGEST_LENGTH) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      `root must be a Uint8Array(${DIGEST_LENGTH})`,\n    );\n  }\n  if (args.leaves.length < 1) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      'leaves array must be non-empty',\n    );\n  }\n  const leavesCopy: Uint8Array[] = [];\n  for (let i = 0; i < args.leaves.length; i++) {\n    const leaf = args.leaves[i];\n    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH) {\n      throw new MerkleLeavesListError(\n        'SCHEMA_MERKLE_LEAVES_MALFORMED',\n        `leaves[${i}] must be a Uint8Array(${DIGEST_LENGTH})`,\n      );\n    }\n    leavesCopy.push(leaf);\n  }\n  if (args.leafAlg !== undefined && typeof args.leafAlg !== 'string') {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      'leaf_alg must be a string when present',\n    );\n  }\n  const map: Record<string, unknown> = {\n    format: LEAVES_LIST_FORMAT_V1,\n    tree_alg: TREE_ALG_RFC9162,\n    root: args.root,\n    leaves: leavesCopy,\n    leaf_count: leavesCopy.length,\n  };\n  if (args.leafAlg !== undefined) {\n    map['leaf_alg'] = args.leafAlg;\n  }\n  return encodeCanonicalCbor(map as never);\n}\n\nexport function decodeLeavesList(bytes: Uint8Array): DecodedLeavesList {\n  const decoded = decodeCanonicalCbor(bytes);\n  if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      'leaves-list MUST be a CBOR map',\n    );\n  }\n  const m = decoded as Record<string, unknown>;\n\n  const format = m['format'];\n  if (typeof format !== 'string') {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      'format must be a text string',\n    );\n  }\n  if (!REGISTERED_FORMATS.has(format)) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_FORMAT_UNSUPPORTED',\n      `format '${format}' is not in the registered set`,\n    );\n  }\n\n  const treeAlg = m['tree_alg'];\n  if (treeAlg !== TREE_ALG_RFC9162) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      `tree_alg '${String(treeAlg)}' is not '${TREE_ALG_RFC9162}'`,\n    );\n  }\n\n  const root = m['root'];\n  if (!(root instanceof Uint8Array) || root.length !== DIGEST_LENGTH) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      `root must be a ${DIGEST_LENGTH}-byte byte string`,\n    );\n  }\n\n  const leavesRaw = m['leaves'];\n  if (!Array.isArray(leavesRaw) || leavesRaw.length < 1) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      'leaves must be a non-empty array',\n    );\n  }\n  const leaves: Uint8Array[] = [];\n  for (let i = 0; i < leavesRaw.length; i++) {\n    const leaf = leavesRaw[i];\n    if (!(leaf instanceof Uint8Array) || leaf.length !== DIGEST_LENGTH) {\n      throw new MerkleLeavesListError(\n        'SCHEMA_MERKLE_LEAVES_MALFORMED',\n        `leaves[${i}] must be a ${DIGEST_LENGTH}-byte byte string`,\n      );\n    }\n    leaves.push(leaf);\n  }\n\n  const leafCountRaw = m['leaf_count'];\n  let leafCount: number;\n  if (typeof leafCountRaw === 'number' && Number.isInteger(leafCountRaw) && leafCountRaw >= 0) {\n    leafCount = leafCountRaw;\n  } else if (typeof leafCountRaw === 'bigint' && leafCountRaw >= 0n) {\n    if (leafCountRaw > BigInt(Number.MAX_SAFE_INTEGER)) {\n      throw new MerkleLeavesListError(\n        'SCHEMA_MERKLE_LEAVES_MALFORMED',\n        'leaf_count exceeds Number.MAX_SAFE_INTEGER',\n      );\n    }\n    leafCount = Number(leafCountRaw);\n  } else {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAVES_MALFORMED',\n      'leaf_count must be a non-negative CBOR uint',\n    );\n  }\n  if (leaves.length !== leafCount) {\n    throw new MerkleLeavesListError(\n      'SCHEMA_MERKLE_LEAF_COUNT_MISMATCH',\n      `leaves.length (${leaves.length}) != leaf_count (${leafCount})`,\n    );\n  }\n\n  let leafAlg: string | undefined;\n  if (m['leaf_alg'] !== undefined) {\n    if (typeof m['leaf_alg'] !== 'string') {\n      throw new MerkleLeavesListError(\n        'SCHEMA_MERKLE_LEAVES_MALFORMED',\n        'leaf_alg must be a text string when present',\n      );\n    }\n    leafAlg = m['leaf_alg'];\n  }\n\n  const recomputed = merkleSha2256Root(leaves);\n  if (!compareCt(recomputed, root)) {\n    throw new MerkleLeavesListError(\n      'MERKLE_ROOT_MISMATCH',\n      'leaves recompute does not match declared root',\n    );\n  }\n\n  const out: DecodedLeavesList = {\n    format: LEAVES_LIST_FORMAT_V1,\n    treeAlg: TREE_ALG_RFC9162,\n    root,\n    leaves,\n    leafCount,\n    ...(leafAlg !== undefined ? { leafAlg } : {}),\n  };\n  return out;\n}\n"]}

package/dist/recipient.cjs

@@ -0,0 +1,141 @@
+'use strict';
+
+// src/recipient/bech32.ts
+var BECH32_ALPHABET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+var POLYMOD_GENERATORS = [996825010, 642813549, 513874426, 1027748829, 705979059];
+var ENCODING_CONST = 1;
+function polymodStep(pre) {
+  const b = pre >> 25;
+  let chk = (pre & 33554431) << 5;
+  for (let i = 0; i < POLYMOD_GENERATORS.length; i++) {
+    if ((b >> i & 1) === 1) chk ^= POLYMOD_GENERATORS[i];
+  }
+  return chk;
+}
+function bytesToWords(bytes) {
+  const words = [];
+  let carry = 0;
+  let pos = 0;
+  const mask = (1 << 5) - 1;
+  for (const n of bytes) {
+    carry = carry << 8 | n;
+    pos += 8;
+    for (; pos >= 5; pos -= 5) words.push(carry >> pos - 5 & mask);
+    carry &= (1 << pos) - 1;
+  }
+  if (pos > 0) words.push(carry << 5 - pos & mask);
+  return words;
+}
+function checksum(prefix, words) {
+  let chk = 1;
+  for (let i = 0; i < prefix.length; i++) {
+    const c = prefix.charCodeAt(i);
+    if (c < 33 || c > 126) throw new Error(`bech32: invalid prefix (${prefix})`);
+    chk = polymodStep(chk) ^ c >> 5;
+  }
+  chk = polymodStep(chk);
+  for (let i = 0; i < prefix.length; i++) chk = polymodStep(chk) ^ prefix.charCodeAt(i) & 31;
+  for (const v of words) chk = polymodStep(chk) ^ v;
+  for (let i = 0; i < 6; i++) chk = polymodStep(chk);
+  chk ^= ENCODING_CONST;
+  let out = "";
+  for (let i = 0; i < 6; i++) out += BECH32_ALPHABET[chk >> 5 * (5 - i) & 31];
+  return out;
+}
+function bech32EncodeNoLimit(prefix, bytes) {
+  if (prefix.length === 0) throw new Error("bech32: empty prefix");
+  const words = bytesToWords(bytes);
+  let payload = "";
+  for (const w of words) payload += BECH32_ALPHABET[w];
+  const lowered = prefix.toLowerCase();
+  return `${lowered}1${payload}${checksum(lowered, words)}`;
+}
+function checksumValid(prefix, words) {
+  let chk = 1;
+  for (let i = 0; i < prefix.length; i++) chk = polymodStep(chk) ^ prefix.charCodeAt(i) >> 5;
+  chk = polymodStep(chk);
+  for (let i = 0; i < prefix.length; i++) chk = polymodStep(chk) ^ prefix.charCodeAt(i) & 31;
+  for (const v of words) chk = polymodStep(chk) ^ v;
+  return chk === ENCODING_CONST;
+}
+function wordsToBytes(words) {
+  const out = [];
+  let carry = 0;
+  let pos = 0;
+  for (const w of words) {
+    carry = carry << 5 | w;
+    pos += 5;
+    for (; pos >= 8; pos -= 8) out.push(carry >> pos - 8 & 255);
+    carry &= (1 << pos) - 1;
+  }
+  if (pos >= 5 || carry !== 0) throw new Error("bech32: non-canonical padding");
+  return Uint8Array.from(out);
+}
+function bech32DecodeNoLimit(input) {
+  if (input.length === 0) throw new Error("bech32: empty string");
+  const hasLower = input !== input.toUpperCase();
+  const hasUpper = input !== input.toLowerCase();
+  if (hasLower && hasUpper) throw new Error("bech32: mixed-case string");
+  const s = input.toLowerCase();
+  const sep = s.lastIndexOf("1");
+  if (sep < 1) throw new Error("bech32: missing human-readable prefix");
+  if (s.length - sep - 1 < 6) throw new Error("bech32: data too short for checksum");
+  const hrp = s.slice(0, sep);
+  for (let i = 0; i < hrp.length; i++) {
+    const c = hrp.charCodeAt(i);
+    if (c < 33 || c > 126) throw new Error("bech32: invalid prefix character");
+  }
+  const words = [];
+  for (let i = sep + 1; i < s.length; i++) {
+    const v = BECH32_ALPHABET.indexOf(s[i]);
+    if (v === -1) throw new Error("bech32: invalid data character");
+    words.push(v);
+  }
+  if (!checksumValid(hrp, words)) throw new Error("bech32: bad checksum");
+  return { hrp, bytes: wordsToBytes(words.slice(0, words.length - 6)) };
+}
+
+// src/recipient/age-recipient.ts
+var X25519_HRP = "age";
+var XWING_HRP = "age1pqc";
+var X25519_PUBLIC_KEY_BYTES = 32;
+var XWING_PUBLIC_KEY_BYTES = 1216;
+function encodeAgeX25519Recipient(publicKey) {
+  if (publicKey.length !== X25519_PUBLIC_KEY_BYTES) {
+    throw new Error("encodeAgeX25519Recipient: publicKey must be exactly 32 bytes");
+  }
+  return bech32EncodeNoLimit(X25519_HRP, publicKey);
+}
+function encodeAgeXWingRecipient(publicKey) {
+  if (publicKey.length !== XWING_PUBLIC_KEY_BYTES) {
+    throw new Error("encodeAgeXWingRecipient: publicKey must be exactly 1216 bytes");
+  }
+  return bech32EncodeNoLimit(XWING_HRP, publicKey);
+}
+function parseAgeRecipient(recipient) {
+  if (typeof recipient !== "string") {
+    throw new Error("parseAgeRecipient: recipient must be a string");
+  }
+  const { hrp, bytes } = bech32DecodeNoLimit(recipient.trim());
+  if (hrp === X25519_HRP) {
+    if (bytes.length !== X25519_PUBLIC_KEY_BYTES) {
+      throw new Error("parseAgeRecipient: age recipient must carry a 32-byte X25519 key");
+    }
+    return { kem: "x25519", publicKey: bytes };
+  }
+  if (hrp === XWING_HRP) {
+    if (bytes.length !== XWING_PUBLIC_KEY_BYTES) {
+      throw new Error("parseAgeRecipient: age1pqc recipient must carry a 1216-byte X-Wing key");
+    }
+    return { kem: "mlkem768x25519", publicKey: bytes };
+  }
+  throw new Error(`parseAgeRecipient: unrecognized recipient prefix "${hrp}"`);
+}
+
+exports.bech32DecodeNoLimit = bech32DecodeNoLimit;
+exports.bech32EncodeNoLimit = bech32EncodeNoLimit;
+exports.encodeAgeX25519Recipient = encodeAgeX25519Recipient;
+exports.encodeAgeXWingRecipient = encodeAgeXWingRecipient;
+exports.parseAgeRecipient = parseAgeRecipient;
+//# sourceMappingURL=recipient.cjs.map
+//# sourceMappingURL=recipient.cjs.map

package/dist/recipient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/recipient/bech32.ts","../src/recipient/age-recipient.ts"],"names":[],"mappings":";;;AAUA,IAAM,eAAA,GAAkB,kCAAA;AACxB,IAAM,qBAAqB,CAAC,SAAA,EAAY,SAAA,EAAY,SAAA,EAAY,YAAY,SAAU,CAAA;AACtF,IAAM,cAAA,GAAiB,CAAA;AAEvB,SAAS,YAAY,GAAA,EAAqB;AACxC,EAAA,MAAM,IAAI,GAAA,IAAO,EAAA;AACjB,EAAA,IAAI,GAAA,GAAA,CAAO,MAAM,QAAA,KAAc,CAAA;AAC/B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,kBAAA,CAAmB,QAAQ,CAAA,EAAA,EAAK;AAClD,IAAA,IAAA,CAAM,KAAK,CAAA,GAAK,CAAA,MAAO,CAAA,EAAG,GAAA,IAAO,mBAAmB,CAAC,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,GAAA;AACT;AAGA,SAAS,aAAa,KAAA,EAA6B;AACjD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,MAAM,IAAA,GAAA,CAAQ,KAAK,CAAA,IAAK,CAAA;AACxB,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,KAAA,GAAS,SAAS,CAAA,GAAK,CAAA;AACvB,IAAA,GAAA,IAAO,CAAA;AACP,IAAA,OAAO,GAAA,IAAO,GAAG,GAAA,IAAO,CAAA,QAAS,IAAA,CAAM,KAAA,IAAU,GAAA,GAAM,CAAA,GAAM,IAAI,CAAA;AACjE,IAAA,KAAA,IAAA,CAAU,KAAK,GAAA,IAAO,CAAA;AAAA,EACxB;AACA,EAAA,IAAI,MAAM,CAAA,EAAG,KAAA,CAAM,KAAM,KAAA,IAAU,CAAA,GAAI,MAAQ,IAAI,CAAA;AACnD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,QAAA,CAAS,QAAgB,KAAA,EAAyB;AACzD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,MAAM,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAC7B,IAAA,IAAI,CAAA,GAAI,MAAM,CAAA,GAAI,GAAA,QAAW,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,MAAM,CAAA,CAAA,CAAG,CAAA;AAC3E,IAAA,GAAA,GAAM,WAAA,CAAY,GAAG,CAAA,GAAK,CAAA,IAAK,CAAA;AAAA,EACjC;AACA,EAAA,GAAA,GAAM,YAAY,GAAG,CAAA;AACrB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,GAAM,WAAA,CAAY,GAAG,CAAA,GAAK,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA;AACzF,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,GAAM,WAAA,CAAY,GAAG,CAAA,GAAI,CAAA;AAChD,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAG,CAAA,EAAA,EAAK,GAAA,GAAM,YAAY,GAAG,CAAA;AACjD,EAAA,GAAA,IAAO,cAAA;AACP,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK,GAAA,IAAO,eAAA,CAAiB,GAAA,IAAQ,CAAA,IAAK,CAAA,GAAI,CAAA,CAAA,GAAO,EAAE,CAAA;AAC9E,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,mBAAA,CAAoB,QAAgB,KAAA,EAA2B;AAC7E,EAAA,IAAI,OAAO,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAC/D,EAAA,MAAM,KAAA,GAAQ,aAAa,KAAK,CAAA;AAChC,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,OAAA,IAAW,eAAA,CAAgB,CAAC,CAAA;AACnD,EAAA,MAAM,OAAA,GAAU,OAAO,WAAA,EAAY;AACnC,EAAA,OAAO,CAAA,EAAG,OAAO,CAAA,CAAA,EAAI,OAAO,GAAG,QAAA,CAAS,OAAA,EAAS,KAAK,CAAC,CAAA,CAAA;AACzD;AAKA,SAAS,aAAA,CAAc,QAAgB,KAAA,EAA0B;AAC/D,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,GAAM,WAAA,CAAY,GAAG,CAAA,GAAK,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA,IAAK,CAAA;AAC1F,EAAA,GAAA,GAAM,YAAY,GAAG,CAAA;AACrB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,GAAM,WAAA,CAAY,GAAG,CAAA,GAAK,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA;AACzF,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,GAAM,WAAA,CAAY,GAAG,CAAA,GAAI,CAAA;AAChD,EAAA,OAAO,GAAA,KAAQ,cAAA;AACjB;AAKA,SAAS,aAAa,KAAA,EAA6B;AACjD,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,KAAA,GAAS,SAAS,CAAA,GAAK,CAAA;AACvB,IAAA,GAAA,IAAO,CAAA;AACP,IAAA,OAAO,GAAA,IAAO,GAAG,GAAA,IAAO,CAAA,MAAO,IAAA,CAAM,KAAA,IAAU,GAAA,GAAM,CAAA,GAAM,GAAI,CAAA;AAC/D,IAAA,KAAA,IAAA,CAAU,KAAK,GAAA,IAAO,CAAA;AAAA,EACxB;AACA,EAAA,IAAI,OAAO,CAAA,IAAK,KAAA,KAAU,GAAG,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAC5E,EAAA,OAAO,UAAA,CAAW,KAAK,GAAG,CAAA;AAC5B;AAOO,SAAS,oBAAoB,KAAA,EAAmD;AACrF,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAC9D,EAAA,MAAM,QAAA,GAAW,KAAA,KAAU,KAAA,CAAM,WAAA,EAAY;AAC7C,EAAA,MAAM,QAAA,GAAW,KAAA,KAAU,KAAA,CAAM,WAAA,EAAY;AAC7C,EAAA,IAAI,QAAA,IAAY,QAAA,EAAU,MAAM,IAAI,MAAM,2BAA2B,CAAA;AACrE,EAAA,MAAM,CAAA,GAAI,MAAM,WAAA,EAAY;AAC5B,EAAA,MAAM,GAAA,GAAM,CAAA,CAAE,WAAA,CAAY,GAAG,CAAA;AAC7B,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAM,IAAI,MAAM,uCAAuC,CAAA;AACpE,EAAA,IAAI,CAAA,CAAE,SAAS,GAAA,GAAM,CAAA,GAAI,GAAG,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACjF,EAAA,MAAM,GAAA,GAAM,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC1B,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC1B,IAAA,IAAI,IAAI,EAAA,IAAM,CAAA,GAAI,KAAK,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,IAAI,GAAA,GAAM,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,MAAM,CAAA,GAAI,eAAA,CAAgB,OAAA,CAAQ,CAAA,CAAE,CAAC,CAAE,CAAA;AACvC,IAAA,IAAI,CAAA,KAAM,EAAA,EAAI,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAC9D,IAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,EACd;AACA,EAAA,IAAI,CAAC,cAAc,GAAA,EAAK,KAAK,GAAG,MAAM,IAAI,MAAM,sBAAsB,CAAA;AACtE,EAAA,OAAO,EAAE,GAAA,EAAK,KAAA,EAAO,YAAA,CAAa,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,KAAA,CAAM,MAAA,GAAS,CAAC,CAAC,CAAA,EAAE;AACtE;;;ACxGA,IAAM,UAAA,GAAa,KAAA;AACnB,IAAM,SAAA,GAAY,SAAA;AAClB,IAAM,uBAAA,GAA0B,EAAA;AAChC,IAAM,sBAAA,GAAyB,IAAA;AAUxB,SAAS,yBAAyB,SAAA,EAA+B;AACtE,EAAA,IAAI,SAAA,CAAU,WAAW,uBAAA,EAAyB;AAChD,IAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAAA,EAChF;AACA,EAAA,OAAO,mBAAA,CAAoB,YAAY,SAAS,CAAA;AAClD;AAEO,SAAS,wBAAwB,SAAA,EAA+B;AACrE,EAAA,IAAI,SAAA,CAAU,WAAW,sBAAA,EAAwB;AAC/C,IAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,EACjF;AACA,EAAA,OAAO,mBAAA,CAAoB,WAAW,SAAS,CAAA;AACjD;AASO,SAAS,kBAAkB,SAAA,EAAuC;AACvE,EAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EACjE;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,KAAA,KAAU,mBAAA,CAAoB,SAAA,CAAU,MAAM,CAAA;AAC3D,EAAA,IAAI,QAAQ,UAAA,EAAY;AACtB,IAAA,IAAI,KAAA,CAAM,WAAW,uBAAA,EAAyB;AAC5C,MAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAAA,IACpF;AACA,IAAA,OAAO,EAAE,GAAA,EAAK,QAAA,EAAU,SAAA,EAAW,KAAA,EAAM;AAAA,EAC3C;AACA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,IAAI,KAAA,CAAM,WAAW,sBAAA,EAAwB;AAC3C,MAAA,MAAM,IAAI,MAAM,wEAAwE,CAAA;AAAA,IAC1F;AACA,IAAA,OAAO,EAAE,GAAA,EAAK,gBAAA,EAAkB,SAAA,EAAW,KAAA,EAAM;AAAA,EACnD;AACA,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kDAAA,EAAqD,GAAG,CAAA,CAAA,CAAG,CAAA;AAC7E","file":"recipient.cjs","sourcesContent":["// Minimal BIP-173 bech32 encoder used to format age-style recipient strings.\n//\n// This package's dependency policy keeps the runtime import graph to a small,\n// audited set of cryptographic libraries, so we inline the exact bech32\n// algorithm here rather than pull in a general-purpose base-encoding library.\n// Output is byte-identical to the no-length-limit form of a standard bech32\n// encoder (`encode(hrp, toWords(bytes))` with the 90-char BIP-173 cap\n// disabled): age recipients exceed that cap — an X-Wing recipient is ~1960\n// characters — so the limit must be off.\n\nconst BECH32_ALPHABET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';\nconst POLYMOD_GENERATORS = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3];\nconst ENCODING_CONST = 1; // BIP-173 bech32 (not bech32m).\n\nfunction polymodStep(pre: number): number {\n  const b = pre >> 25;\n  let chk = (pre & 0x1ffffff) << 5;\n  for (let i = 0; i < POLYMOD_GENERATORS.length; i++) {\n    if (((b >> i) & 1) === 1) chk ^= POLYMOD_GENERATORS[i]!;\n  }\n  return chk;\n}\n\n// 8-bit bytes → 5-bit words, padding the final partial group with zero bits.\nfunction bytesToWords(bytes: Uint8Array): number[] {\n  const words: number[] = [];\n  let carry = 0;\n  let pos = 0;\n  const mask = (1 << 5) - 1;\n  for (const n of bytes) {\n    carry = (carry << 8) | n;\n    pos += 8;\n    for (; pos >= 5; pos -= 5) words.push((carry >> (pos - 5)) & mask);\n    carry &= (1 << pos) - 1;\n  }\n  if (pos > 0) words.push((carry << (5 - pos)) & mask);\n  return words;\n}\n\nfunction checksum(prefix: string, words: number[]): string {\n  let chk = 1;\n  for (let i = 0; i < prefix.length; i++) {\n    const c = prefix.charCodeAt(i);\n    if (c < 33 || c > 126) throw new Error(`bech32: invalid prefix (${prefix})`);\n    chk = polymodStep(chk) ^ (c >> 5);\n  }\n  chk = polymodStep(chk);\n  for (let i = 0; i < prefix.length; i++) chk = polymodStep(chk) ^ (prefix.charCodeAt(i) & 0x1f);\n  for (const v of words) chk = polymodStep(chk) ^ v;\n  for (let i = 0; i < 6; i++) chk = polymodStep(chk);\n  chk ^= ENCODING_CONST;\n  let out = '';\n  for (let i = 0; i < 6; i++) out += BECH32_ALPHABET[(chk >> (5 * (5 - i))) & 31];\n  return out;\n}\n\n// Encode raw bytes to a bech32 string with NO length limit. `prefix` is the HRP.\nexport function bech32EncodeNoLimit(prefix: string, bytes: Uint8Array): string {\n  if (prefix.length === 0) throw new Error('bech32: empty prefix');\n  const words = bytesToWords(bytes);\n  let payload = '';\n  for (const w of words) payload += BECH32_ALPHABET[w];\n  const lowered = prefix.toLowerCase();\n  return `${lowered}1${payload}${checksum(lowered, words)}`;\n}\n\n// Recompute the polymod over the HRP + every data word (the trailing six being\n// the checksum) and test it against the encoding constant. True iff the string\n// carries a valid bech32 checksum.\nfunction checksumValid(prefix: string, words: number[]): boolean {\n  let chk = 1;\n  for (let i = 0; i < prefix.length; i++) chk = polymodStep(chk) ^ (prefix.charCodeAt(i) >> 5);\n  chk = polymodStep(chk);\n  for (let i = 0; i < prefix.length; i++) chk = polymodStep(chk) ^ (prefix.charCodeAt(i) & 0x1f);\n  for (const v of words) chk = polymodStep(chk) ^ v;\n  return chk === ENCODING_CONST;\n}\n\n// 5-bit words → 8-bit bytes (the inverse of `bytesToWords`). Rejects\n// non-canonical padding: any leftover must be fewer than 5 bits and all zero,\n// matching the zero-fill `bytesToWords` applies to a final partial group.\nfunction wordsToBytes(words: number[]): Uint8Array {\n  const out: number[] = [];\n  let carry = 0;\n  let pos = 0;\n  for (const w of words) {\n    carry = (carry << 5) | w;\n    pos += 5;\n    for (; pos >= 8; pos -= 8) out.push((carry >> (pos - 8)) & 0xff);\n    carry &= (1 << pos) - 1;\n  }\n  if (pos >= 5 || carry !== 0) throw new Error('bech32: non-canonical padding');\n  return Uint8Array.from(out);\n}\n\n// Decode a bech32 string with NO length limit, verifying the checksum. Returns\n// the lower-cased HRP and the decoded data bytes. The inverse of\n// `bech32EncodeNoLimit`. The separator is the last `1` in the string, so HRPs\n// that themselves contain a `1` (e.g. the `age1pqc` recipient prefix) round-trip\n// correctly.\nexport function bech32DecodeNoLimit(input: string): { hrp: string; bytes: Uint8Array } {\n  if (input.length === 0) throw new Error('bech32: empty string');\n  const hasLower = input !== input.toUpperCase();\n  const hasUpper = input !== input.toLowerCase();\n  if (hasLower && hasUpper) throw new Error('bech32: mixed-case string');\n  const s = input.toLowerCase();\n  const sep = s.lastIndexOf('1');\n  if (sep < 1) throw new Error('bech32: missing human-readable prefix');\n  if (s.length - sep - 1 < 6) throw new Error('bech32: data too short for checksum');\n  const hrp = s.slice(0, sep);\n  for (let i = 0; i < hrp.length; i++) {\n    const c = hrp.charCodeAt(i);\n    if (c < 33 || c > 126) throw new Error('bech32: invalid prefix character');\n  }\n  const words: number[] = [];\n  for (let i = sep + 1; i < s.length; i++) {\n    const v = BECH32_ALPHABET.indexOf(s[i]!);\n    if (v === -1) throw new Error('bech32: invalid data character');\n    words.push(v);\n  }\n  if (!checksumValid(hrp, words)) throw new Error('bech32: bad checksum');\n  return { hrp, bytes: wordsToBytes(words.slice(0, words.length - 6)) };\n}\n","// Encodes a raw KEM public key to a bech32 age-style recipient string — the\n// form a sender uses to address a sealed PoE record.\n//\n//   • X25519 (32 bytes)                         → \"age1…\"\n//   • X-Wing / ML-KEM-768 + X25519 (1216 bytes) → \"age1pqc…\"\n//\n// The two HRPs make a recipient self-describing: a parser routes to the right\n// KEM purely from the bech32 prefix. We use the `age1pqc` HRP for the hybrid\n// key (upstream age v1.3.0 claims the shorter `age1pq` HRP for the same X-Wing\n// primitive; `age1pqc` avoids colliding with that wire identifier).\n//\n// The X-Wing public key derives for free from the same identity seed via\n// `deriveMlKem768X25519KeypairFromSeed`, so every identity always has one and\n// can RECEIVE hybrid sealed records even when it publishes via the classical\n// X25519 path.\n\nimport { bech32DecodeNoLimit, bech32EncodeNoLimit } from './bech32';\n\nconst X25519_HRP = 'age';\nconst XWING_HRP = 'age1pqc';\nconst X25519_PUBLIC_KEY_BYTES = 32;\nconst XWING_PUBLIC_KEY_BYTES = 1216;\n\n// The KEM a recipient string addresses, inferred from its bech32 HRP.\nexport type RecipientKem = 'x25519' | 'mlkem768x25519';\n\nexport interface ParsedAgeRecipient {\n  readonly kem: RecipientKem;\n  readonly publicKey: Uint8Array;\n}\n\nexport function encodeAgeX25519Recipient(publicKey: Uint8Array): string {\n  if (publicKey.length !== X25519_PUBLIC_KEY_BYTES) {\n    throw new Error('encodeAgeX25519Recipient: publicKey must be exactly 32 bytes');\n  }\n  return bech32EncodeNoLimit(X25519_HRP, publicKey);\n}\n\nexport function encodeAgeXWingRecipient(publicKey: Uint8Array): string {\n  if (publicKey.length !== XWING_PUBLIC_KEY_BYTES) {\n    throw new Error('encodeAgeXWingRecipient: publicKey must be exactly 1216 bytes');\n  }\n  return bech32EncodeNoLimit(XWING_HRP, publicKey);\n}\n\n// Decode an age-style recipient string back to its raw KEM public key, routing\n// on the bech32 HRP. The inverse of `encodeAgeX25519Recipient` /\n// `encodeAgeXWingRecipient`: a sender can take a recipient string a peer shared\n// and recover the exact public key (and which KEM it belongs to) needed to seal\n// a record to them. Surrounding whitespace is tolerated so pasted strings parse.\n// Throws on an unknown HRP, a bad checksum, or a key length that does not match\n// the HRP's KEM.\nexport function parseAgeRecipient(recipient: string): ParsedAgeRecipient {\n  if (typeof recipient !== 'string') {\n    throw new Error('parseAgeRecipient: recipient must be a string');\n  }\n  const { hrp, bytes } = bech32DecodeNoLimit(recipient.trim());\n  if (hrp === X25519_HRP) {\n    if (bytes.length !== X25519_PUBLIC_KEY_BYTES) {\n      throw new Error('parseAgeRecipient: age recipient must carry a 32-byte X25519 key');\n    }\n    return { kem: 'x25519', publicKey: bytes };\n  }\n  if (hrp === XWING_HRP) {\n    if (bytes.length !== XWING_PUBLIC_KEY_BYTES) {\n      throw new Error('parseAgeRecipient: age1pqc recipient must carry a 1216-byte X-Wing key');\n    }\n    return { kem: 'mlkem768x25519', publicKey: bytes };\n  }\n  throw new Error(`parseAgeRecipient: unrecognized recipient prefix \"${hrp}\"`);\n}\n"]}

package/dist/recipient.d.cts

@@ -0,0 +1,16 @@
+declare function bech32EncodeNoLimit(prefix: string, bytes: Uint8Array): string;
+declare function bech32DecodeNoLimit(input: string): {
+    hrp: string;
+    bytes: Uint8Array;
+};
+
+type RecipientKem = 'x25519' | 'mlkem768x25519';
+interface ParsedAgeRecipient {
+    readonly kem: RecipientKem;
+    readonly publicKey: Uint8Array;
+}
+declare function encodeAgeX25519Recipient(publicKey: Uint8Array): string;
+declare function encodeAgeXWingRecipient(publicKey: Uint8Array): string;
+declare function parseAgeRecipient(recipient: string): ParsedAgeRecipient;
+
+export { type ParsedAgeRecipient, type RecipientKem, bech32DecodeNoLimit, bech32EncodeNoLimit, encodeAgeX25519Recipient, encodeAgeXWingRecipient, parseAgeRecipient };

package/dist/recipient.d.ts

@@ -0,0 +1,16 @@
+declare function bech32EncodeNoLimit(prefix: string, bytes: Uint8Array): string;
+declare function bech32DecodeNoLimit(input: string): {
+    hrp: string;
+    bytes: Uint8Array;
+};
+
+type RecipientKem = 'x25519' | 'mlkem768x25519';
+interface ParsedAgeRecipient {
+    readonly kem: RecipientKem;
+    readonly publicKey: Uint8Array;
+}
+declare function encodeAgeX25519Recipient(publicKey: Uint8Array): string;
+declare function encodeAgeXWingRecipient(publicKey: Uint8Array): string;
+declare function parseAgeRecipient(recipient: string): ParsedAgeRecipient;
+
+export { type ParsedAgeRecipient, type RecipientKem, bech32DecodeNoLimit, bech32EncodeNoLimit, encodeAgeX25519Recipient, encodeAgeXWingRecipient, parseAgeRecipient };