@certrev/cert-block 1.3.0 → 2.0.0

package/dist/verify/key-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-set.d.ts","sourceRoot":"","sources":["../../src/verify/key-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGN,KAAK,qBAAqB,EAE1B,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAA;AAI9B,6CAA6C;AAC7C,eAAO,MAAM,YAAY,sBAAsB,CAAA;AAE/C,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;IACb,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACnG;AAED,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;CACzD;AA4BD;;;GAGG;AACH,wBAAsB,YAAY,CACjC,IAAI,EAAE,OAAO,EACb,eAAe,EAAE,qBAAqB,EACtC,QAAQ,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA2ChC;AAED,MAAM,WAAW,qBAAqB;IACrC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,qDAAqD;IACrD,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAA;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AA+DD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,qBAAqB,CASjF;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C"}

package/dist/verify/key-set.js

@@ -0,0 +1,190 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The issuer key SET a card trusts (2.0.0): baked keys first, then CertREV's signed published set
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * Through 1.3.x the Builder card trusted exactly one baked key (`cert-issuer-1`), so a key rotation would have needed
+ * every brand to install a new package. 2.0 trusts a SET without adding a trust root:
+ *
+ *  1. A kid the package bakes resolves to the baked key, always (a published set never overrides a baked key).
+ *  2. Any other kid makes ONE read of the delivery origin's published key set, `GET <origin>/api/cert/v1/keys`
+ *     (`credentials: 'omit'`, the card's deadline): a browser reads it at most once per page and origin, a server at
+ *     most once per origin per hour (single-flight, a failure remembered for ten minutes).
+ *  3. The set is accepted only when it is signed by a BAKED kid, over the RFC 8785 bytes of exactly this object:
+ *
+ *       { kind: 'certrev.keyset', v: 1, issuedAt, keys: [{ kid, crv: 'Ed25519', x }] }     (x: base64url, 32 bytes)
+ *
+ *     answered as `{ keyset, signature: { alg: 'ed25519', kid, sig, signedAt? } }`. Refused: another `kind` or `v`
+ *     (an envelope, a tombstone or a release record can never verify as a key set: their signed bytes are other
+ *     objects), a set whose `issuedAt` is older than the one already accepted from that origin (no rollback), a set
+ *     whose keys do not hold its signer's kid with the same key (it may not drop or replace the key that vouches for
+ *     it), a malformed key, a signature that does not verify.
+ *  4. Anything else (no route, a network error, a refused set) leaves the kid unknown: the kernel suppresses the
+ *     envelope with `unknown_key`, so the card renders nothing and reports, exactly as for an unknown kid in 1.3.x.
+ *
+ * The route is the portal's (ADR 0001 section 3 addendum). Today every envelope is signed by the baked
+ * `cert-issuer-1`, so step 2 never runs and nothing is fetched.
+ */
+import { base64urlDecode, canonicalBytes, importEd25519PublicKey, } from '../contract/kernel.js';
+import { TtlCache } from './cache.js';
+import { DEFAULT_FETCH_TIMEOUT_MS, fetchWithDeadline } from './fetch-with-deadline.js';
+/** Where an origin publishes its key set. */
+export const KEY_SET_PATH = '/api/cert/v1/keys';
+const ED25519 = { name: 'Ed25519' };
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const isString = (v) => typeof v === 'string';
+function rawKey(x) {
+    if (!isString(x) || !/^[A-Za-z0-9_-]+$/.test(x))
+        return null;
+    try {
+        const bytes = base64urlDecode(x);
+        return bytes.length === 32 ? bytes : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Ed25519 verify under a declared key or an imported one; any failure (a bad key, no WebCrypto Ed25519) is false. */
+async function verifies(key, sig, bytes) {
+    try {
+        const imported = 'format' in key ? await importEd25519PublicKey(key) : key;
+        // Fresh ArrayBuffer-backed copies: WebCrypto's BufferSource excludes a SharedArrayBuffer view.
+        return await crypto.subtle.verify(ED25519, imported, new Uint8Array(sig), new Uint8Array(bytes));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Judge one key-set response body against the baked keys (and the set already accepted from the same origin, for
+ * the no-rollback rule). Returns the accepted set, or null. Never throws.
+ */
+export async function verifyKeySet(body, bakedResolveKid, previous) {
+    if (!isRecord(body) || !isRecord(body.keyset) || !isRecord(body.signature))
+        return null;
+    const { keyset, signature } = body;
+    if (keyset.kind !== 'certrev.keyset' || keyset.v !== 1)
+        return null;
+    if (!isString(keyset.issuedAt))
+        return null;
+    const issuedAt = Date.parse(keyset.issuedAt);
+    if (!Number.isFinite(issuedAt))
+        return null;
+    if (previous && issuedAt < previous.issuedAt)
+        return null;
+    if (!Array.isArray(keyset.keys) || keyset.keys.length === 0)
+        return null;
+    if (signature.alg !== 'ed25519' || !isString(signature.kid) || !isString(signature.sig))
+        return null;
+    // The signer must be a kid this package bakes.
+    let baked;
+    try {
+        baked = await bakedResolveKid(signature.kid);
+    }
+    catch {
+        return null;
+    }
+    if (!baked)
+        return null;
+    const keys = new Map();
+    for (const entry of keyset.keys) {
+        if (!isRecord(entry) || !isString(entry.kid) || entry.kid === '' || entry.crv !== 'Ed25519')
+            return null;
+        const bytes = rawKey(entry.x);
+        if (!bytes || keys.has(entry.kid))
+            return null;
+        keys.set(entry.kid, { format: 'raw', bytes });
+    }
+    // The set must keep the key that signed it.
+    const signerEntry = keys.get(signature.kid);
+    if (!signerEntry)
+        return null;
+    let sig;
+    let bytes;
+    try {
+        sig = base64urlDecode(signature.sig);
+        bytes = canonicalBytes(keyset);
+    }
+    catch {
+        return null;
+    }
+    if (!(await verifies(baked, sig, bytes)))
+        return null;
+    // ... and publish it as the same key: the signature must verify under the published entry too.
+    if (!(await verifies(signerEntry, sig, bytes)))
+        return null;
+    return { issuedAt, keys };
+}
+/** Server: one read per origin per hour, a failure remembered for ten minutes (single-flight across renders). */
+const serverSets = new TtlCache({ ttlMs: 3_600_000, negativeTtlMs: 600_000, maxEntries: 50 });
+/** Browser: one read per origin for the page's lifetime, whatever it settled to. */
+const pageSets = new Map();
+/** The newest set accepted per origin (both runtimes), for the no-rollback rule. */
+const acceptedSets = new Map();
+function originOf(baseUrl) {
+    try {
+        return new URL(baseUrl).origin;
+    }
+    catch {
+        return null;
+    }
+}
+async function loadKeySet(origin, opts) {
+    let res;
+    try {
+        res = await fetchWithDeadline(opts.fetchImpl, `${origin}${KEY_SET_PATH}`, { headers: { accept: 'application/json' }, credentials: 'omit' }, opts.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS);
+    }
+    catch {
+        return acceptedSets.get(origin) ?? null;
+    }
+    if (!res.ok)
+        return acceptedSets.get(origin) ?? null;
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        return acceptedSets.get(origin) ?? null;
+    }
+    const previous = acceptedSets.get(origin);
+    const accepted = await verifyKeySet(body, opts.bakedResolveKid, previous);
+    // A refused set (older, unsigned, malformed) never replaces one this origin already proved.
+    if (!accepted)
+        return previous ?? null;
+    acceptedSets.set(origin, accepted);
+    return accepted;
+}
+function publishedSet(origin, opts) {
+    if (typeof document !== 'undefined') {
+        let pending = pageSets.get(origin);
+        if (!pending) {
+            pending = loadKeySet(origin, opts);
+            pageSets.set(origin, pending);
+        }
+        return pending;
+    }
+    return serverSets.getOrLoad(origin, () => loadKeySet(origin, opts), (v) => v === null);
+}
+/**
+ * The resolver a card verifies with: the baked kids, then (for any other kid) the origin's published, signed set.
+ * Never throws; an unresolved kid is null (`unknown_key`).
+ */
+export function keySetResolver(opts) {
+    return async (kid) => {
+        const baked = await opts.bakedResolveKid(kid);
+        if (baked)
+            return baked;
+        const origin = originOf(opts.baseUrl);
+        if (!origin)
+            return null;
+        const set = await publishedSet(origin, opts);
+        return set?.keys.get(kid) ?? null;
+    };
+}
+/** Test seam: forget every published set (a new page and process). */
+export function forgetKeySetsForTests() {
+    serverSets.clear();
+    pageSets.clear();
+    acceptedSets.clear();
+}
+//# sourceMappingURL=key-set.js.map

package/dist/verify/key-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-set.js","sourceRoot":"","sources":["../../src/verify/key-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACN,eAAe,EACf,cAAc,EAEd,sBAAsB,GAEtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAEtF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAA;AAgB/C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAA;AAE5C,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACvH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAA;AAEnE,SAAS,MAAM,CAAC,CAAU;IACzB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5D,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;QAChC,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,sHAAsH;AACtH,KAAK,UAAU,QAAQ,CAAC,GAAsC,EAAE,GAAe,EAAE,KAAiB;IACjG,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,QAAQ,IAAK,GAAc,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAA4B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QAC/G,+FAA+F;QAC/F,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAqB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9G,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,IAAa,EACb,eAAsC,EACtC,QAAyB;IAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACvF,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,IAAI,QAAQ,IAAI,QAAQ,GAAG,QAAQ,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEpG,+CAA+C;IAC/C,IAAI,KAA2D,CAAA;IAC/D,IAAI,CAAC;QACJ,KAAK,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiC,CAAA;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACxG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,4CAA4C;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAE7B,IAAI,GAAe,CAAA;IACnB,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACJ,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACpC,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,+FAA+F;IAC/F,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAcD,iHAAiH;AACjH,MAAM,UAAU,GAAG,IAAI,QAAQ,CAAS,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;AACrG,oFAAoF;AACpF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAA;AACnD,oFAAoF;AACpF,MAAM,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAA;AAEtD,SAAS,QAAQ,CAAC,OAAe;IAChC,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAA2B;IACpE,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,iBAAiB,CAC5B,IAAI,CAAC,SAAS,EACd,GAAG,MAAM,GAAG,YAAY,EAAE,EAC1B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAChE,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAC1C,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IACxC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IACpD,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;IACzE,4FAA4F;IAC5F,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,IAAI,IAAI,CAAA;IACtC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAClC,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAA2B;IAChE,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAClC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9B,CAAC;QACD,OAAO,OAAO,CAAA;IACf,CAAC;IACD,OAAO,UAAU,CAAC,SAAS,CAC1B,MAAM,EACN,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CACjB,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAA2B;IACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;QACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,OAAO,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;IAClC,CAAC,CAAA;AACF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB;IACpC,UAAU,CAAC,KAAK,EAAE,CAAA;IAClB,QAAQ,CAAC,KAAK,EAAE,CAAA;IAChB,YAAY,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC"}

package/package.json

@@ -1,113 +1,116 @@
 {
-	"name": "@certrev/cert-block",
-	"version": "1.3.0",
-	"description": "Headless render edge for the CertREV CertDeliveryEnvelope: SSR-safe React cert components, a framework-agnostic <certrev-badge> Web Component, a schema.org JSON-LD projector, and a fail-closed verify layer over the shared VerdictKernel.",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/CertREV/cert-kit.git",
-		"directory": "packages/cert-block"
-	},
-	"homepage": "https://github.com/CertREV/cert-kit/tree/HEAD/packages/cert-block#readme",
-	"bugs": {
-		"url": "https://github.com/CertREV/cert-kit/issues"
-	},
-	"type": "module",
-	"main": "./dist/index.js",
-	"types": "./dist/index.d.ts",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"default": "./dist/index.js"
-		},
-		"./builder": {
-			"types": "./dist/builder/index.d.ts",
-			"default": "./dist/builder/index.js"
-		},
-		"./builder/face": {
-			"types": "./dist/builder/envelope-face.d.ts",
-			"default": "./dist/builder/envelope-face.js"
-		},
-		"./reader": {
-			"types": "./dist/reader/index.d.ts",
-			"default": "./dist/reader/index.js"
-		},
-		"./reader.css": "./src/reader/reader.css",
-		"./webcomponent": {
-			"types": "./dist/webcomponent/certrev-badge.d.ts",
-			"default": "./dist/webcomponent/certrev-badge.js"
-		},
-		"./fixtures": {
-			"types": "./dist/contract/fixtures.d.ts",
-			"default": "./dist/contract/fixtures.js"
-		},
-		"./modal": {
-			"types": "./dist/modal/index.d.ts",
-			"default": "./dist/modal/index.js"
-		},
-		"./modal/placement": {
-			"types": "./dist/modal/placement.d.ts",
-			"default": "./dist/modal/placement.js"
-		},
-		"./modal/certrev-cert.js": "./dist/modal/certrev-cert.js"
-	},
-	"files": [
-		"dist",
-		"src",
-		"!src/**/__tests__",
-		"!src/**/*.test.ts",
-		"!src/**/*.test.tsx",
-		"README.md",
-		"CHANGELOG.md"
-	],
-	"publishConfig": {
-		"registry": "https://registry.npmjs.org",
-		"access": "public"
-	},
-	"publishTargets": [
-		"npmjs",
-		"github-packages"
-	],
-	"scripts": {
-		"build": "tsc && pnpm build:modal-bundle",
-		"build:modal-bundle": "pnpm dlx esbuild@0.27.7 src/modal/certrev-cert.entry.ts --bundle --minify --target=es2020 --format=iife --legal-comments=none --tsconfig-raw='{\"compilerOptions\":{\"target\":\"ES2017\",\"module\":\"esnext\",\"strict\":true}}' --banner:js='/* biome-ignore-all format: generated cert-badge bundle, see @certrev/cert-block src/modal/ */ /* biome-ignore-all lint: generated cert-badge bundle, see @certrev/cert-block src/modal/ */' --outfile=dist/modal/certrev-cert.js",
-		"refresh:reader": "node scripts/refresh-reader.mjs",
-		"typecheck": "tsc --noEmit",
-		"test": "vitest run"
-	},
-	"dependencies": {
-		"@certrev/cert-contract": "^0.6.0"
-	},
-	"peerDependencies": {
-		"react": ">=18.0.0"
-	},
-	"peerDependenciesMeta": {
-		"react": {
-			"optional": false
-		}
-	},
-	"devDependencies": {
-		"@testing-library/react": "^16.1.0",
-		"@types/node": "^20.0.0",
-		"@types/react": "^18.3.0",
-		"@types/react-dom": "^18.3.0",
-		"jsdom": "^25.0.0",
-		"react": "^18.3.1",
-		"react-dom": "^18.3.1",
-		"typescript": "^6.0.3",
-		"vitest": "^4.1.5"
-	},
-	"keywords": [
-		"certrev",
-		"certification",
-		"react",
-		"server-components",
-		"hydrogen",
-		"shopify",
-		"json-ld",
-		"schema-org",
-		"web-component",
-		"ed25519",
-		"ssr"
-	],
-	"license": "MIT"
-}
+  "name": "@certrev/cert-block",
+  "version": "2.0.0",
+  "description": "Headless render edge for the CertREV CertDeliveryEnvelope: SSR-safe React cert components, a framework-agnostic <certrev-badge> Web Component, a schema.org JSON-LD projector, and a fail-closed verify layer over the shared VerdictKernel.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CertREV/cert-kit.git",
+    "directory": "packages/cert-block"
+  },
+  "homepage": "https://github.com/CertREV/cert-kit/tree/HEAD/packages/cert-block#readme",
+  "bugs": {
+    "url": "https://github.com/CertREV/cert-kit/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./builder": {
+      "types": "./dist/builder/index.d.ts",
+      "default": "./dist/builder/index.js"
+    },
+    "./builder/face": {
+      "types": "./dist/builder/envelope-face.d.ts",
+      "default": "./dist/builder/envelope-face.js"
+    },
+    "./reader": {
+      "types": "./dist/reader/index.d.ts",
+      "default": "./dist/reader/index.js"
+    },
+    "./reader.css": "./src/reader/reader.css",
+    "./webcomponent": {
+      "types": "./dist/webcomponent/certrev-badge.d.ts",
+      "default": "./dist/webcomponent/certrev-badge.js"
+    },
+    "./fixtures": {
+      "types": "./dist/contract/fixtures.d.ts",
+      "default": "./dist/contract/fixtures.js"
+    },
+    "./modal": {
+      "types": "./dist/modal/index.d.ts",
+      "default": "./dist/modal/index.js"
+    },
+    "./modal/placement": {
+      "types": "./dist/modal/placement.d.ts",
+      "default": "./dist/modal/placement.js"
+    },
+    "./modal/certrev-cert.js": "./dist/modal/certrev-cert.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/__tests__",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "publishTargets": [
+    "npmjs",
+    "github-packages"
+  ],
+  "dependencies": {
+    "@certrev/cert-contract": "^0.6.0"
+  },
+  "peerDependencies": {
+    "react": ">=18.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": false
+    }
+  },
+  "devDependencies": {
+    "@testing-library/react": "^16.1.0",
+    "@types/node": "^20.0.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "esbuild": "0.27.7",
+    "jsdom": "^25.0.0",
+    "playwright-core": "1.59.1",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.5"
+  },
+  "keywords": [
+    "certrev",
+    "certification",
+    "react",
+    "server-components",
+    "hydrogen",
+    "shopify",
+    "json-ld",
+    "schema-org",
+    "web-component",
+    "ed25519",
+    "ssr"
+  ],
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc && pnpm build:modal-bundle",
+    "build:modal-bundle": "pnpm dlx esbuild@0.27.7 src/modal/certrev-cert.entry.ts --bundle --minify --target=es2020 --format=iife --legal-comments=none --tsconfig-raw='{\"compilerOptions\":{\"target\":\"ES2017\",\"module\":\"esnext\",\"strict\":true}}' --banner:js='/* biome-ignore-all format: generated cert-badge bundle, see @certrev/cert-block src/modal/ */ /* biome-ignore-all lint: generated cert-badge bundle, see @certrev/cert-block src/modal/ */' --outfile=dist/modal/certrev-cert.js",
+    "refresh:reader": "node scripts/refresh-reader.mjs",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.e2e.json",
+    "test": "vitest run",
+    "test:replica": "vitest run --config vitest.e2e.config.ts"
+  }
+}