@cedulon/cose 0.1.0

package/LICENSE

@@ -0,0 +1,192 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the
+      purposes of this License, Derivative Works shall not include works
+      that remain separable from, or merely link (or bind by name) to
+      the interfaces of, the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of,
+      the Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as
+      a result of this License or out of the use or inability to use
+      the Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      Copyright 2026 Emekcan Dogru
+
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.

package/README.md

@@ -0,0 +1,13 @@
+# `@cedulon/cose`
+
+Deterministic CBOR and COSE_Sign1 (Ed25519). Cedulon receipts, manifests,
+checkpoints, and decision tokens share this encoder.
+
+```ts
+import { signCoseSign1, verifyCoseSign1, CTY_RECEIPT } from "@cedulon/cose";
+
+const cose = signCoseSign1(payload, privateKeyPem, CTY_RECEIPT);
+verifyCoseSign1(cose, publicKeyPem, CTY_RECEIPT);
+```
+
+Repository: https://github.com/dogrucanemek-alt/cedulon

package/dist/cbor.d.ts

@@ -0,0 +1,17 @@
+/** Deterministic CBOR (RFC 8949 §4.2.1) for Cedulon claim types. Zero deps. */
+export type CborVal = null | boolean | number | string | Uint8Array | CborVal[] | CborMap;
+export type CborMap = {
+    readonly $map: Array<[CborVal, CborVal]>;
+};
+export declare function cborMap(entries: Array<[CborVal, CborVal]>): CborMap;
+export declare function isCborMap(value: CborVal): value is CborMap;
+export declare function encodeCbor(value: CborVal): Uint8Array;
+/** RFC 8949 §4.2.1: bytewise lexicographic order of encoded keys. */
+export declare function compareEncodedKeys(a: Buffer, b: Buffer): number;
+export declare function decodeCbor(bytes: Uint8Array): CborVal;
+export declare function mapGet(map: CborMap, key: number | string): CborVal | undefined;
+export declare function asMap(value: CborVal): CborMap;
+export declare function asArray(value: CborVal): CborVal[];
+export declare function bytesToHex(bytes: Uint8Array): string;
+export declare function hexToBytes(hex: string): Uint8Array;
+//# sourceMappingURL=cbor.d.ts.map

package/dist/cbor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor.d.ts","sourceRoot":"","sources":["../src/cbor.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,MAAM,MAAM,OAAO,GACf,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,UAAU,GACV,OAAO,EAAE,GACT,OAAO,CAAC;AAEZ,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEnE,wBAAgB,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAEnE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAE1D;AASD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAErD;AA2CD,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAmCD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAOrD;AAuED,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAK9E;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAK7C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,CAKjD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQlD"}

package/dist/cbor.js

@@ -0,0 +1,210 @@
+/** Deterministic CBOR (RFC 8949 §4.2.1) for Cedulon claim types. Zero deps. */
+export function cborMap(entries) {
+    return { $map: entries };
+}
+export function isCborMap(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) && !ArrayBuffer.isView(value) && "$map" in value;
+}
+const MT_UINT = 0;
+const MT_NINT = 1;
+const MT_BSTR = 2;
+const MT_TSTR = 3;
+const MT_ARRAY = 4;
+const MT_MAP = 5;
+export function encodeCbor(value) {
+    return Buffer.concat(encodeParts(value));
+}
+function encodeParts(value) {
+    if (value === null) {
+        return [Buffer.from([0xf6])];
+    }
+    if (typeof value === "boolean") {
+        return [Buffer.from([value ? 0xf5 : 0xf4])];
+    }
+    if (typeof value === "number") {
+        if (!Number.isInteger(value) || !Number.isSafeInteger(value)) {
+            throw new Error("cbor-non-integer");
+        }
+        return [encodeInt(value)];
+    }
+    if (typeof value === "string") {
+        const utf8 = Buffer.from(value, "utf8");
+        return [head(MT_TSTR, utf8.length), utf8];
+    }
+    if (value instanceof Uint8Array) {
+        const bytes = Buffer.from(value);
+        return [head(MT_BSTR, bytes.length), bytes];
+    }
+    if (isCborMap(value)) {
+        const entries = value.$map.map(([k, v]) => {
+            const key = Buffer.concat(encodeParts(k));
+            const val = Buffer.concat(encodeParts(v));
+            return { key, val };
+        });
+        entries.sort((a, b) => compareEncodedKeys(a.key, b.key));
+        const parts = [head(MT_MAP, entries.length)];
+        for (const e of entries) {
+            parts.push(e.key, e.val);
+        }
+        return parts;
+    }
+    const parts = [head(MT_ARRAY, value.length)];
+    for (const item of value) {
+        parts.push(...encodeParts(item));
+    }
+    return parts;
+}
+/** RFC 8949 §4.2.1: bytewise lexicographic order of encoded keys. */
+export function compareEncodedKeys(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i += 1) {
+        if (a[i] !== b[i]) {
+            return a[i] - b[i];
+        }
+    }
+    return a.length - b.length;
+}
+function encodeInt(n) {
+    if (n >= 0) {
+        return head(MT_UINT, n);
+    }
+    return head(MT_NINT, -1 - n);
+}
+function head(major, n) {
+    const hi = major << 5;
+    if (n < 24) {
+        return Buffer.from([hi | n]);
+    }
+    if (n < 256) {
+        return Buffer.from([hi | 24, n]);
+    }
+    if (n < 65536) {
+        const b = Buffer.alloc(3);
+        b[0] = hi | 25;
+        b.writeUInt16BE(n, 1);
+        return b;
+    }
+    if (n <= 0xffffffff) {
+        const b = Buffer.alloc(5);
+        b[0] = hi | 26;
+        b.writeUInt32BE(n, 1);
+        return b;
+    }
+    const b = Buffer.alloc(9);
+    b[0] = hi | 27;
+    b.writeBigUInt64BE(BigInt(n), 1);
+    return b;
+}
+export function decodeCbor(bytes) {
+    const r = { bytes: Buffer.from(bytes), offset: 0 };
+    const value = readVal(r);
+    if (r.offset !== r.bytes.length) {
+        throw new Error("cbor-trailing");
+    }
+    return value;
+}
+function readVal(r) {
+    const ib = r.bytes[r.offset];
+    if (ib === undefined) {
+        throw new Error("cbor-eof");
+    }
+    r.offset += 1;
+    const major = ib >> 5;
+    const ai = ib & 31;
+    if (ib === 0xf4)
+        return false;
+    if (ib === 0xf5)
+        return true;
+    if (ib === 0xf6)
+        return null;
+    const n = readLength(r, ai);
+    if (major === MT_UINT)
+        return n;
+    if (major === MT_NINT)
+        return -1 - n;
+    if (major === MT_BSTR) {
+        const slice = r.bytes.subarray(r.offset, r.offset + n);
+        r.offset += n;
+        return new Uint8Array(slice);
+    }
+    if (major === MT_TSTR) {
+        const slice = r.bytes.subarray(r.offset, r.offset + n);
+        r.offset += n;
+        return slice.toString("utf8");
+    }
+    if (major === MT_ARRAY) {
+        const arr = [];
+        for (let i = 0; i < n; i += 1) {
+            arr.push(readVal(r));
+        }
+        return arr;
+    }
+    if (major === MT_MAP) {
+        const entries = [];
+        for (let i = 0; i < n; i += 1) {
+            entries.push([readVal(r), readVal(r)]);
+        }
+        return cborMap(entries);
+    }
+    throw new Error("cbor-unsupported");
+}
+function readLength(r, ai) {
+    if (ai < 24)
+        return ai;
+    if (ai === 24) {
+        const v = r.bytes[r.offset];
+        r.offset += 1;
+        return v;
+    }
+    if (ai === 25) {
+        const v = r.bytes.readUInt16BE(r.offset);
+        r.offset += 2;
+        return v;
+    }
+    if (ai === 26) {
+        const v = r.bytes.readUInt32BE(r.offset);
+        r.offset += 4;
+        return v;
+    }
+    if (ai === 27) {
+        const v = r.bytes.readBigUInt64BE(r.offset);
+        r.offset += 8;
+        if (v > BigInt(Number.MAX_SAFE_INTEGER)) {
+            throw new Error("cbor-too-large");
+        }
+        return Number(v);
+    }
+    throw new Error("cbor-indefinite");
+}
+export function mapGet(map, key) {
+    for (const [k, v] of map.$map) {
+        if (k === key)
+            return v;
+    }
+    return undefined;
+}
+export function asMap(value) {
+    if (!isCborMap(value)) {
+        throw new Error("cbor-not-map");
+    }
+    return value;
+}
+export function asArray(value) {
+    if (!Array.isArray(value)) {
+        throw new Error("cbor-not-array");
+    }
+    return value;
+}
+export function bytesToHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+export function hexToBytes(hex) {
+    if (hex.length % 2 !== 0) {
+        throw new Error("hex-odd");
+    }
+    if (hex !== hex.toLowerCase()) {
+        throw new Error("hex-not-lowercase");
+    }
+    return Uint8Array.from(Buffer.from(hex, "hex"));
+}
+//# sourceMappingURL=cbor.js.map

package/dist/cbor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor.js","sourceRoot":"","sources":["../src/cbor.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAa/E,MAAM,UAAU,OAAO,CAAC,OAAkC;IACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,IAAI,KAAK,CAAC;AAC/H,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,MAAM,GAAG,CAAC,CAAC;AAEjB,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,CAAS;IACrD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,CAAS;IACpC,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IACf,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,CAAoC;IACnD,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IACD,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACnB,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,CAAoC,EAAE,EAAU;IAClE,IAAI,EAAE,GAAG,EAAE;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAY,EAAE,GAAoB;IACvD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAc;IAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/cose.d.ts

@@ -0,0 +1,44 @@
+/** RFC 9052 EdDSA. Deprecated for this profile; use Ed25519 (-19). */
+export declare const COSE_ALG_EDDSA = -8;
+/** Ed25519, RFC 9864. */
+export declare const COSE_ALG_ED25519 = -19;
+/** COSE header label alg. */
+export declare const COSE_HDR_ALG = 1;
+/** COSE header label content type. */
+export declare const COSE_HDR_CONTENT_TYPE = 3;
+/** COSE header label kid. */
+export declare const COSE_HDR_KID = 4;
+export declare const CTY_RECEIPT = "application/cedulon-receipt+cbor";
+export declare const CTY_CHECKPOINT = "application/cedulon-checkpoint+cbor";
+export declare const CTY_MANIFEST = "application/cedulon-manifest+cbor";
+export declare const CTY_INCLUSION = "application/cedulon-inclusion+cbor";
+export declare const CTY_DECISION = "application/cedulon-decision+cbor";
+export declare const CTY_COUNTERSIGN = "application/cedulon-countersign+cbor";
+export type CoseSign1 = {
+    protectedHeader: Uint8Array;
+    unprotected: Record<string, never>;
+    payload: Uint8Array;
+    signature: Uint8Array;
+};
+export type ProtectedHeader = {
+    alg: number;
+    kid: Uint8Array;
+    contentType: string;
+};
+export declare function kidFromPublicKeyPem(publicKeyPem: string): Uint8Array;
+export declare function publicKeyPemFromPrivate(privateKeyPem: string): string;
+export declare function encodeProtectedHeader(header: ProtectedHeader): Uint8Array;
+export declare function decodeProtectedHeader(bytes: Uint8Array): ProtectedHeader;
+export declare function sigStructure(protectedHeader: Uint8Array, payload: Uint8Array): Uint8Array;
+export declare function signCoseSign1(payload: Uint8Array, privateKeyPem: string, contentType: string): Uint8Array;
+export declare function encodeCoseSign1(msg: CoseSign1): Uint8Array;
+export declare function decodeCoseSign1(bytes: Uint8Array): CoseSign1;
+export declare function verifyCoseSign1(bytes: Uint8Array, publicKeyPem: string, expectedContentType?: string): boolean;
+export { bytesToHex as coseToHex, hexToBytes as coseFromHex } from "./cbor.ts";
+/** RFC 8032 Ed25519 secret #1 — fixture only, never a production key. */
+export declare const FIXTURE_ED25519_SEED_HEX = "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60";
+export declare function fixtureEd25519Pems(): {
+    publicKeyPem: string;
+    privateKeyPem: string;
+};
+//# sourceMappingURL=cose.d.ts.map

package/dist/cose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../src/cose.ts"],"names":[],"mappings":"AAGA,sEAAsE;AACtE,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,yBAAyB;AACzB,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,6BAA6B;AAC7B,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,sCAAsC;AACtC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,6BAA6B;AAC7B,eAAO,MAAM,YAAY,IAAI,CAAC;AAE9B,eAAO,MAAM,WAAW,qCAAqC,CAAC;AAC9D,eAAO,MAAM,cAAc,wCAAwC,CAAC;AACpE,eAAO,MAAM,YAAY,sCAAsC,CAAC;AAChE,eAAO,MAAM,aAAa,uCAAuC,CAAC;AAClE,eAAO,MAAM,YAAY,sCAAsC,CAAC;AAChE,eAAO,MAAM,eAAe,yCAAyC,CAAC;AAEtE,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CAGpE;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAIrE;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,UAAU,CAQzE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,eAAe,CASxE;AAED,wBAAgB,YAAY,CAAC,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CAEzF;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAezG;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAc5D;AAaD,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,YAAY,EAAE,MAAM,EACpB,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAkBT;AAED,OAAO,EAAE,UAAU,IAAI,SAAS,EAAE,UAAU,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,qEAC+B,CAAC;AAErE,wBAAgB,kBAAkB,IAAI;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CASpF"}

package/dist/cose.js

@@ -0,0 +1,130 @@
+import { createHash, createPrivateKey, createPublicKey, sign, verify } from "node:crypto";
+import { asArray, asMap, cborMap, decodeCbor, encodeCbor, mapGet } from "./cbor.js";
+/** RFC 9052 EdDSA. Deprecated for this profile; use Ed25519 (-19). */
+export const COSE_ALG_EDDSA = -8;
+/** Ed25519, RFC 9864. */
+export const COSE_ALG_ED25519 = -19;
+/** COSE header label alg. */
+export const COSE_HDR_ALG = 1;
+/** COSE header label content type. */
+export const COSE_HDR_CONTENT_TYPE = 3;
+/** COSE header label kid. */
+export const COSE_HDR_KID = 4;
+export const CTY_RECEIPT = "application/cedulon-receipt+cbor";
+export const CTY_CHECKPOINT = "application/cedulon-checkpoint+cbor";
+export const CTY_MANIFEST = "application/cedulon-manifest+cbor";
+export const CTY_INCLUSION = "application/cedulon-inclusion+cbor";
+export const CTY_DECISION = "application/cedulon-decision+cbor";
+export const CTY_COUNTERSIGN = "application/cedulon-countersign+cbor";
+export function kidFromPublicKeyPem(publicKeyPem) {
+    const der = createPublicKey(publicKeyPem).export({ type: "spki", format: "der" });
+    return new Uint8Array(createHash("sha256").update(der).digest().subarray(0, 8));
+}
+export function publicKeyPemFromPrivate(privateKeyPem) {
+    return createPublicKey(createPrivateKey(privateKeyPem))
+        .export({ type: "spki", format: "pem" })
+        .toString();
+}
+export function encodeProtectedHeader(header) {
+    return encodeCbor(cborMap([
+        [COSE_HDR_ALG, header.alg],
+        [COSE_HDR_CONTENT_TYPE, header.contentType],
+        [COSE_HDR_KID, header.kid],
+    ]));
+}
+export function decodeProtectedHeader(bytes) {
+    const map = asMap(decodeCbor(bytes));
+    const alg = mapGet(map, COSE_HDR_ALG);
+    const contentType = mapGet(map, COSE_HDR_CONTENT_TYPE);
+    const kid = mapGet(map, COSE_HDR_KID);
+    if (typeof alg !== "number" || typeof contentType !== "string" || !(kid instanceof Uint8Array)) {
+        throw new Error("cose-protected-header");
+    }
+    return { alg, contentType, kid };
+}
+export function sigStructure(protectedHeader, payload) {
+    return encodeCbor(["Signature1", protectedHeader, new Uint8Array(0), payload]);
+}
+export function signCoseSign1(payload, privateKeyPem, contentType) {
+    const publicKeyPem = publicKeyPemFromPrivate(privateKeyPem);
+    const protectedHeader = encodeProtectedHeader({
+        alg: COSE_ALG_ED25519,
+        kid: kidFromPublicKeyPem(publicKeyPem),
+        contentType,
+    });
+    const toBeSigned = sigStructure(protectedHeader, payload);
+    const signature = sign(null, Buffer.from(toBeSigned), privateKeyPem);
+    return encodeCoseSign1({
+        protectedHeader,
+        unprotected: {},
+        payload,
+        signature: new Uint8Array(signature),
+    });
+}
+export function encodeCoseSign1(msg) {
+    return encodeCbor([
+        msg.protectedHeader,
+        cborMap([]),
+        msg.payload,
+        msg.signature,
+    ]);
+}
+export function decodeCoseSign1(bytes) {
+    const arr = asArray(decodeCbor(bytes));
+    if (arr.length !== 4) {
+        throw new Error("cose-sign1-length");
+    }
+    if (!(arr[0] instanceof Uint8Array) || !(arr[2] instanceof Uint8Array) || !(arr[3] instanceof Uint8Array)) {
+        throw new Error("cose-sign1-types");
+    }
+    return {
+        protectedHeader: arr[0],
+        unprotected: {},
+        payload: arr[2],
+        signature: arr[3],
+    };
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let d = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        d |= a[i] ^ b[i];
+    }
+    return d === 0;
+}
+export function verifyCoseSign1(bytes, publicKeyPem, expectedContentType) {
+    try {
+        const msg = decodeCoseSign1(bytes);
+        const header = decodeProtectedHeader(msg.protectedHeader);
+        if (header.alg !== COSE_ALG_ED25519) {
+            return false;
+        }
+        if (!bytesEqual(header.kid, kidFromPublicKeyPem(publicKeyPem))) {
+            return false;
+        }
+        if (expectedContentType && header.contentType !== expectedContentType) {
+            return false;
+        }
+        const toBeSigned = sigStructure(msg.protectedHeader, msg.payload);
+        return verify(null, Buffer.from(toBeSigned), publicKeyPem, Buffer.from(msg.signature));
+    }
+    catch {
+        return false;
+    }
+}
+export { bytesToHex as coseToHex, hexToBytes as coseFromHex } from "./cbor.js";
+/** RFC 8032 Ed25519 secret #1 — fixture only, never a production key. */
+export const FIXTURE_ED25519_SEED_HEX = "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60";
+export function fixtureEd25519Pems() {
+    const seed = Buffer.from(FIXTURE_ED25519_SEED_HEX, "hex");
+    const pkcs8 = Buffer.concat([Buffer.from("302e020100300506032b657004220420", "hex"), seed]);
+    const privateKey = createPrivateKey({ key: pkcs8, format: "der", type: "pkcs8" });
+    const publicKey = createPublicKey(privateKey);
+    return {
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    };
+}
+//# sourceMappingURL=cose.js.map

package/dist/cose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cose.js","sourceRoot":"","sources":["../src/cose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEpF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC;AACjC,yBAAyB;AACzB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAE,CAAC;AACpC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,sCAAsC;AACtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B,MAAM,CAAC,MAAM,WAAW,GAAG,kCAAkC,CAAC;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAG,qCAAqC,CAAC;AACpE,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAetE,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,OAAO,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;SACpD,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACvC,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,OAAO,UAAU,CACf,OAAO,CAAC;QACN,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC;QAC1B,CAAC,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC;QAC3C,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC;KAC3B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,eAA2B,EAAE,OAAmB;IAC3E,OAAO,UAAU,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAmB,EAAE,aAAqB,EAAE,WAAmB;IAC3F,MAAM,YAAY,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,qBAAqB,CAAC;QAC5C,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,mBAAmB,CAAC,YAAY,CAAC;QACtC,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,CAAC;IACrE,OAAO,eAAe,CAAC;QACrB,eAAe;QACf,WAAW,EAAE,EAAE;QACf,OAAO;QACP,SAAS,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,OAAO,UAAU,CAAC;QAChB,GAAG,CAAC,eAAe;QACnB,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,SAAS;KACd,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,OAAO;QACL,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACf,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAAiB,EACjB,YAAoB,EACpB,mBAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,mBAAmB,IAAI,MAAM,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,OAAO,EAAE,UAAU,IAAI,SAAS,EAAE,UAAU,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/E,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GACnC,kEAAkE,CAAC;AAErE,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7E,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3E,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { asArray, asMap, bytesToHex, cborMap, compareEncodedKeys, decodeCbor, encodeCbor, hexToBytes, isCborMap, mapGet, type CborMap, type CborVal, } from "./cbor.ts";
+export { COSE_ALG_ED25519, COSE_ALG_EDDSA, COSE_HDR_ALG, COSE_HDR_CONTENT_TYPE, COSE_HDR_KID, CTY_CHECKPOINT, CTY_COUNTERSIGN, CTY_DECISION, CTY_INCLUSION, CTY_MANIFEST, CTY_RECEIPT, coseFromHex, coseToHex, decodeCoseSign1, decodeProtectedHeader, encodeCoseSign1, encodeProtectedHeader, fixtureEd25519Pems, FIXTURE_ED25519_SEED_HEX, kidFromPublicKeyPem, publicKeyPemFromPrivate, sigStructure, signCoseSign1, verifyCoseSign1, type CoseSign1, type ProtectedHeader, } from "./cose.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,KAAK,EACL,UAAU,EACV,OAAO,EACP,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,MAAM,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,WAAW,EACX,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { asArray, asMap, bytesToHex, cborMap, compareEncodedKeys, decodeCbor, encodeCbor, hexToBytes, isCborMap, mapGet, } from "./cbor.js";
+export { COSE_ALG_ED25519, COSE_ALG_EDDSA, COSE_HDR_ALG, COSE_HDR_CONTENT_TYPE, COSE_HDR_KID, CTY_CHECKPOINT, CTY_COUNTERSIGN, CTY_DECISION, CTY_INCLUSION, CTY_MANIFEST, CTY_RECEIPT, coseFromHex, coseToHex, decodeCoseSign1, decodeProtectedHeader, encodeCoseSign1, encodeProtectedHeader, fixtureEd25519Pems, FIXTURE_ED25519_SEED_HEX, kidFromPublicKeyPem, publicKeyPemFromPrivate, sigStructure, signCoseSign1, verifyCoseSign1, } from "./cose.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,KAAK,EACL,UAAU,EACV,OAAO,EACP,kBAAkB,EAClB,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,MAAM,GAGP,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,WAAW,EACX,SAAS,EACT,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,eAAe,GAGhB,MAAM,WAAW,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@cedulon/cose",
+  "version": "0.1.0",
+  "description": "Deterministic CBOR and COSE_Sign1 (Ed25519) used by Cedulon.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dogrucanemek-alt/cedulon.git",
+    "directory": "packages/cose"
+  },
+  "homepage": "https://github.com/dogrucanemek-alt/cedulon/tree/master/packages/cose",
+  "bugs": {
+    "url": "https://github.com/dogrucanemek-alt/cedulon/issues"
+  },
+  "keywords": [
+    "cedulon",
+    "cose",
+    "cbor",
+    "ed25519"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}