@degenerate/generic 0.4.0 → 0.7.0

package/dist/_settings/cryptography-settings.d.ts

@@ -30,7 +30,11 @@ export declare enum EllipticalCurvesEncryption {
     P521 = "p521"
 }
 /**
- * This contains the values for the elliptical curvers for signing
+ * This contains the values for the elliptical curves for signing.
+ *
+ * `Curve25519 = 'ed25519'` selects the Edwards25519 curve, signed with true
+ * EdDSA (RFC 8032) via `@noble/ed25519`. `P521` is retained as a recorded curve
+ * label for persistence forward-compatibility; no shipped factory uses it.
  */
 export declare enum EllipticalCurvesSigning {
     Curve25519 = "ed25519",

package/dist/_settings/cryptography-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cryptography-settings.d.ts","sourceRoot":"","sources":["../../src/_settings/cryptography-settings.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC;;GAEG;AACH,eAAO,MAAM,cAAc;;;;gBAIF,MAAM,CAAC,oBAAoB;;;;;;kBAMxB,MAAM,CAAC,QAAQ;CAC1C,CAAC;AAGF,eAAO,MAAM,cAAc,EAAe,cAAc,CAAC;AACzD,eAAO,MAAM,WAAW,EAAY,cAAc,CAAC;AAGnD,eAAO,MAAM,iBAAiB,SAAS,CAAC;AACxC,eAAO,MAAM,iBAAiB,SAAS,CAAC;AACxC,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC;;GAEG;AACH,oBAAY,0BAA0B;IAClC,UAAU,eAAe;IACzB,IAAI,SAAS;CAChB;AAED;;GAEG;AACH,oBAAY,uBAAuB;IAC/B,UAAU,YAAY;IACtB,IAAI,SAAS;CAChB"}
+{"version":3,"file":"cryptography-settings.d.ts","sourceRoot":"","sources":["../../src/_settings/cryptography-settings.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC;;GAEG;AACH,eAAO,MAAM,cAAc;;;;gBAIF,MAAM,CAAC,oBAAoB;;;;;;kBAMxB,MAAM,CAAC,QAAQ;CAC1C,CAAC;AAGF,eAAO,MAAM,cAAc,EAAe,cAAc,CAAC;AACzD,eAAO,MAAM,WAAW,EAAY,cAAc,CAAC;AAGnD,eAAO,MAAM,iBAAiB,SAAS,CAAC;AACxC,eAAO,MAAM,iBAAiB,SAAS,CAAC;AACxC,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC;;GAEG;AACH,oBAAY,0BAA0B;IAClC,UAAU,eAAe;IACzB,IAAI,SAAS;CAChB;AAED;;;;;;GAMG;AACH,oBAAY,uBAAuB;IAC/B,UAAU,YAAY;IACtB,IAAI,SAAS;CAChB"}

package/dist/_settings/cryptography-settings.js

@@ -32,7 +32,11 @@ var EllipticalCurvesEncryption;
     EllipticalCurvesEncryption["P521"] = "p521";
 })(EllipticalCurvesEncryption || (exports.EllipticalCurvesEncryption = EllipticalCurvesEncryption = {}));
 /**
- * This contains the values for the elliptical curvers for signing
+ * This contains the values for the elliptical curves for signing.
+ *
+ * `Curve25519 = 'ed25519'` selects the Edwards25519 curve, signed with true
+ * EdDSA (RFC 8032) via `@noble/ed25519`. `P521` is retained as a recorded curve
+ * label for persistence forward-compatibility; no shipped factory uses it.
  */
 var EllipticalCurvesSigning;
 (function (EllipticalCurvesSigning) {

package/dist/crypto/index.d.ts

@@ -1,15 +1,11 @@
 export * from './calculate-hash';
 export * from './calculate-combined-hash';
 export * from './private-public-keys/generation/create-256-private-key-from-mnemonic';
-export * from './private-public-keys/generation/create-entropy-for-elliptical-curve';
 export * from './private-public-keys/generation/create-random-256-private-key';
 export * from './private-public-keys/generation/create-random-512-key-pair';
-export * from './private-public-keys/generation/generate-key-pair';
-export * from './private-public-keys/generation/get-private-public-key-from-keypair';
-export * from './private-public-keys/create-key-pair-from-private-key';
-export * from './private-public-keys/create-key-pair-from-mnemonic';
-export * from './private-public-keys/create-key-pair-from-public-key';
-export * from './signature/create-crypto-signature';
-export * from './signature/verify-crypto-signature-by-data';
-export * from './signature/verify-crypto-signature-by-hash';
+export * from './private-public-keys/create-ed25519-keys-from-mnemonic';
+export * from './private-public-keys/get-ed25519-public-key-from-private-key';
+export * from './signature/ed25519-primitives';
+export * from './signature/create-ed25519-signature';
+export * from './signature/verify-ed25519-signature';
 //# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAK1C,cAAc,uEAAuE,CAAC;AACtF,cAAc,sEAAsE,CAAC;AACrF,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,oDAAoD,CAAC;AACnE,cAAc,sEAAsE,CAAC;AAGrF,cAAc,wDAAwD,CAAC;AACvE,cAAc,qDAAqD,CAAC;AACpE,cAAc,uDAAuD,CAAC;AAMtE,cAAc,qCAAqC,CAAC;AACpD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAK1C,cAAc,uEAAuE,CAAC;AACtF,cAAc,gEAAgE,CAAC;AAC/E,cAAc,6DAA6D,CAAC;AAI5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,+DAA+D,CAAC;AAO9E,cAAc,gCAAgC,CAAC;AAC/C,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC"}

package/dist/crypto/index.js

@@ -19,18 +19,16 @@ __exportStar(require("./calculate-combined-hash"), exports);
 //#region folder private-public-keys
 //#region folder generation
 __exportStar(require("./private-public-keys/generation/create-256-private-key-from-mnemonic"), exports);
-__exportStar(require("./private-public-keys/generation/create-entropy-for-elliptical-curve"), exports);
 __exportStar(require("./private-public-keys/generation/create-random-256-private-key"), exports);
 __exportStar(require("./private-public-keys/generation/create-random-512-key-pair"), exports);
-__exportStar(require("./private-public-keys/generation/generate-key-pair"), exports);
-__exportStar(require("./private-public-keys/generation/get-private-public-key-from-keypair"), exports);
 //#endregion folder generation
-__exportStar(require("./private-public-keys/create-key-pair-from-private-key"), exports);
-__exportStar(require("./private-public-keys/create-key-pair-from-mnemonic"), exports);
-__exportStar(require("./private-public-keys/create-key-pair-from-public-key"), exports);
+// EdDSA (true Ed25519) key derivation — the sole signing-key path.
+__exportStar(require("./private-public-keys/create-ed25519-keys-from-mnemonic"), exports);
+__exportStar(require("./private-public-keys/get-ed25519-public-key-from-private-key"), exports);
 //#endregion folder private-public-keys
 //#region folder signature
-__exportStar(require("./signature/create-crypto-signature"), exports);
-__exportStar(require("./signature/verify-crypto-signature-by-data"), exports);
-__exportStar(require("./signature/verify-crypto-signature-by-hash"), exports);
+// EdDSA (true Ed25519) signing primitives — the sole signature path.
+__exportStar(require("./signature/ed25519-primitives"), exports);
+__exportStar(require("./signature/create-ed25519-signature"), exports);
+__exportStar(require("./signature/verify-ed25519-signature"), exports);
 //#endregion folder signature

package/dist/crypto/private-public-keys/create-ed25519-keys-from-mnemonic.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Derives a true Ed25519 (EdDSA) keypair from a mnemonic.
+ *
+ * Derivation (pinned, RFC 8032): the 32-byte Ed25519 secret SEED is
+ * `SHA-256(mnemonic)` — the same 32 bytes the legacy `elliptic` path fed into
+ * `keyFromPrivate`, but here interpreted as an Ed25519 seed rather than an ECDSA
+ * private scalar. The public key is `ed25519.getPublicKey(seed)`.
+ *
+ * Because EdDSA hashes-and-clamps the seed to form its scalar, the PUBLIC KEY for
+ * a given mnemonic differs from the legacy ECDSA-over-ed25519 public key derived
+ * from the same mnemonic. The mnemonic still works, but the identity it maps to
+ * changes — the "same mnemonic → different identity" break in the migration plan
+ * (§3c). Any record of "this mnemonic owns public key X" must be re-derived.
+ *
+ * @param mnemonic the BIP39 mnemonic phrase.
+ * @returns hex-encoded `{ privateKey (32-byte seed), publicKey (32-byte) }`.
+ */
+export declare const createEd25519KeysFromMnemonic: (mnemonic: string) => {
+    privateKey: string;
+    publicKey: string;
+};
+//# sourceMappingURL=create-ed25519-keys-from-mnemonic.d.ts.map

package/dist/crypto/private-public-keys/create-ed25519-keys-from-mnemonic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-ed25519-keys-from-mnemonic.d.ts","sourceRoot":"","sources":["../../../src/crypto/private-public-keys/create-ed25519-keys-from-mnemonic.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GACtC,UAAU,MAAM,KACjB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAOzC,CAAC"}

package/dist/crypto/private-public-keys/create-ed25519-keys-from-mnemonic.js

@@ -0,0 +1,65 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEd25519KeysFromMnemonic = void 0;
+const crypto = __importStar(require("crypto"));
+const ed25519_primitives_1 = require("../signature/ed25519-primitives");
+const cryptography_settings_1 = require("../../_settings/cryptography-settings");
+/**
+ * Derives a true Ed25519 (EdDSA) keypair from a mnemonic.
+ *
+ * Derivation (pinned, RFC 8032): the 32-byte Ed25519 secret SEED is
+ * `SHA-256(mnemonic)` — the same 32 bytes the legacy `elliptic` path fed into
+ * `keyFromPrivate`, but here interpreted as an Ed25519 seed rather than an ECDSA
+ * private scalar. The public key is `ed25519.getPublicKey(seed)`.
+ *
+ * Because EdDSA hashes-and-clamps the seed to form its scalar, the PUBLIC KEY for
+ * a given mnemonic differs from the legacy ECDSA-over-ed25519 public key derived
+ * from the same mnemonic. The mnemonic still works, but the identity it maps to
+ * changes — the "same mnemonic → different identity" break in the migration plan
+ * (§3c). Any record of "this mnemonic owns public key X" must be re-derived.
+ *
+ * @param mnemonic the BIP39 mnemonic phrase.
+ * @returns hex-encoded `{ privateKey (32-byte seed), publicKey (32-byte) }`.
+ */
+const createEd25519KeysFromMnemonic = (mnemonic) => {
+    const seedHex = crypto
+        .createHash(cryptography_settings_1.CryptoSettings.Hash.Algorithm)
+        .update(mnemonic, cryptography_settings_1.CryptoSettings.TextEncoding)
+        .digest(cryptography_settings_1.CryptoSettings.Hash.Digest);
+    const publicKey = ed25519_primitives_1.ed.etc.bytesToHex(ed25519_primitives_1.ed.getPublicKey(ed25519_primitives_1.ed.etc.hexToBytes(seedHex)));
+    return { privateKey: seedHex, publicKey };
+};
+exports.createEd25519KeysFromMnemonic = createEd25519KeysFromMnemonic;

package/dist/crypto/private-public-keys/get-ed25519-public-key-from-private-key.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Derives the 32-byte Ed25519 public key (hex) from a 32-byte Ed25519 secret
+ * seed (hex). The EdDSA counterpart to `getPublicKeyFromKeyPair` for the legacy
+ * path — useful when only the private seed is on hand (e.g. recovered from a
+ * mnemonic) and the matching public identity is needed.
+ *
+ * @param privateKey 32-byte Ed25519 secret seed as hex.
+ * @returns the 32-byte Ed25519 public key as hex (64 chars).
+ */
+export declare const getEd25519PublicKeyFromPrivateKey: (privateKey: string) => string;
+//# sourceMappingURL=get-ed25519-public-key-from-private-key.d.ts.map

package/dist/crypto/private-public-keys/get-ed25519-public-key-from-private-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-ed25519-public-key-from-private-key.d.ts","sourceRoot":"","sources":["../../../src/crypto/private-public-keys/get-ed25519-public-key-from-private-key.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,eAAO,MAAM,iCAAiC,GAAI,YAAY,MAAM,KAAG,MACF,CAAC"}

package/dist/crypto/private-public-keys/get-ed25519-public-key-from-private-key.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEd25519PublicKeyFromPrivateKey = void 0;
+const ed25519_primitives_1 = require("../signature/ed25519-primitives");
+/**
+ * Derives the 32-byte Ed25519 public key (hex) from a 32-byte Ed25519 secret
+ * seed (hex). The EdDSA counterpart to `getPublicKeyFromKeyPair` for the legacy
+ * path — useful when only the private seed is on hand (e.g. recovered from a
+ * mnemonic) and the matching public identity is needed.
+ *
+ * @param privateKey 32-byte Ed25519 secret seed as hex.
+ * @returns the 32-byte Ed25519 public key as hex (64 chars).
+ */
+const getEd25519PublicKeyFromPrivateKey = (privateKey) => ed25519_primitives_1.ed.etc.bytesToHex(ed25519_primitives_1.ed.getPublicKey(ed25519_primitives_1.ed.etc.hexToBytes(privateKey)));
+exports.getEd25519PublicKeyFromPrivateKey = getEd25519PublicKeyFromPrivateKey;

package/dist/crypto/signature/create-ed25519-signature.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Signs a message with a true Ed25519 (EdDSA) secret seed.
+ *
+ * Unlike `createEllipticalCurveSignature`, this does NOT pre-hash the message.
+ * Ed25519 hashes the full message with SHA-512 internally (RFC 8032) and has no
+ * input-length truncation, so the SHA-256 pre-hash the ECDSA path needs to
+ * defend its 3-bit truncation would only discard information here. The UTF-8
+ * bytes of `message` are signed directly; `verifyEd25519Signature` mirrors this
+ * exactly.
+ *
+ * @param privateKey 32-byte Ed25519 secret seed as hex (e.g. SHA-256(mnemonic)).
+ * @param message the message string to sign.
+ * @returns the 64-byte EdDSA signature as hex (128 chars).
+ */
+export declare const createEd25519Signature: (privateKey: string, message: string) => string;
+//# sourceMappingURL=create-ed25519-signature.d.ts.map

package/dist/crypto/signature/create-ed25519-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-ed25519-signature.d.ts","sourceRoot":"","sources":["../../../src/crypto/signature/create-ed25519-signature.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAAI,YAAY,MAAM,EAAE,SAAS,MAAM,KAAG,MAK5E,CAAC"}

package/dist/crypto/signature/create-ed25519-signature.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEd25519Signature = void 0;
+const ed25519_primitives_1 = require("./ed25519-primitives");
+const cryptography_settings_1 = require("../../_settings/cryptography-settings");
+/**
+ * Signs a message with a true Ed25519 (EdDSA) secret seed.
+ *
+ * Unlike `createEllipticalCurveSignature`, this does NOT pre-hash the message.
+ * Ed25519 hashes the full message with SHA-512 internally (RFC 8032) and has no
+ * input-length truncation, so the SHA-256 pre-hash the ECDSA path needs to
+ * defend its 3-bit truncation would only discard information here. The UTF-8
+ * bytes of `message` are signed directly; `verifyEd25519Signature` mirrors this
+ * exactly.
+ *
+ * @param privateKey 32-byte Ed25519 secret seed as hex (e.g. SHA-256(mnemonic)).
+ * @param message the message string to sign.
+ * @returns the 64-byte EdDSA signature as hex (128 chars).
+ */
+const createEd25519Signature = (privateKey, message) => {
+    const seed = ed25519_primitives_1.ed.etc.hexToBytes(privateKey);
+    const messageBytes = Buffer.from(message, cryptography_settings_1.CryptoSettings.TextEncoding);
+    const signature = ed25519_primitives_1.ed.sign(messageBytes, seed);
+    return ed25519_primitives_1.ed.etc.bytesToHex(signature);
+};
+exports.createEd25519Signature = createEd25519Signature;

package/dist/crypto/signature/ed25519-primitives.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared access point to the configured `@noble/ed25519` module.
+ *
+ * `@noble/ed25519` v3 ships ESM-only (`"type": "module"`, no CommonJS build).
+ * Our packages emit CommonJS (`module: "node16"`), where a static
+ * `import * as ed from '@noble/ed25519'` makes `tsc` emit a `require()` of an
+ * ESM module and reject it at compile time (TS1479). Node ≥22.12 can `require()`
+ * a synchronous ESM graph, and noble has no top-level await, so a runtime
+ * `require` resolves fine. `typeof import(...)` is a type-only query — fully
+ * erased, emits no import — so it gives full typings without re-triggering
+ * TS1479. Jest loads the same specifier via its `@noble/ed25519` → source-`.ts`
+ * moduleNameMapper + transformIgnorePatterns exception.
+ *
+ * v3's synchronous API (`getPublicKey` / `sign` / `verify`) refuses to run until
+ * a synchronous SHA-512 is wired into `ed.hashes.sha512`. We back it with Node's
+ * `crypto` so the rest of the codebase keeps its synchronous signing/verification
+ * call shape — the structural-proof verifier (`verifyShareDataProposalProof`) is
+ * synchronous on purpose and we don't want to cascade-async every caller.
+ *
+ * The hook receives the already-concatenated message bytes and must return a
+ * 64-byte digest. Guarded so re-importing this module does not re-assign it.
+ */
+declare const ed: typeof import('@noble/ed25519', { with: { 'resolution-mode': 'import' } });
+export { ed };
+//# sourceMappingURL=ed25519-primitives.d.ts.map

package/dist/crypto/signature/ed25519-primitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-primitives.d.ts","sourceRoot":"","sources":["../../../src/crypto/signature/ed25519-primitives.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,QAAA,MAAM,EAAE,EAAE,cAAc,gBAAgB,EAAU,UAAE,iBAAiB,EAAE,QAAQ,IAAE,CACpD,CAAC;AAM9B,OAAO,EAAE,EAAE,EAAE,CAAC"}

package/dist/crypto/signature/ed25519-primitives.js

@@ -0,0 +1,65 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ed = void 0;
+const crypto = __importStar(require("crypto"));
+/**
+ * Shared access point to the configured `@noble/ed25519` module.
+ *
+ * `@noble/ed25519` v3 ships ESM-only (`"type": "module"`, no CommonJS build).
+ * Our packages emit CommonJS (`module: "node16"`), where a static
+ * `import * as ed from '@noble/ed25519'` makes `tsc` emit a `require()` of an
+ * ESM module and reject it at compile time (TS1479). Node ≥22.12 can `require()`
+ * a synchronous ESM graph, and noble has no top-level await, so a runtime
+ * `require` resolves fine. `typeof import(...)` is a type-only query — fully
+ * erased, emits no import — so it gives full typings without re-triggering
+ * TS1479. Jest loads the same specifier via its `@noble/ed25519` → source-`.ts`
+ * moduleNameMapper + transformIgnorePatterns exception.
+ *
+ * v3's synchronous API (`getPublicKey` / `sign` / `verify`) refuses to run until
+ * a synchronous SHA-512 is wired into `ed.hashes.sha512`. We back it with Node's
+ * `crypto` so the rest of the codebase keeps its synchronous signing/verification
+ * call shape — the structural-proof verifier (`verifyShareDataProposalProof`) is
+ * synchronous on purpose and we don't want to cascade-async every caller.
+ *
+ * The hook receives the already-concatenated message bytes and must return a
+ * 64-byte digest. Guarded so re-importing this module does not re-assign it.
+ */
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const ed = require('@noble/ed25519');
+exports.ed = ed;
+if (!ed.hashes.sha512) {
+    ed.hashes.sha512 = (message) => Uint8Array.from(crypto.createHash('sha512').update(message).digest());
+}

package/dist/crypto/signature/verify-ed25519-signature.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Verifies a true Ed25519 (EdDSA) signature over `message` for `publicKey`.
+ *
+ * Mirrors `createEd25519Signature`: the raw UTF-8 bytes of `message` are
+ * verified directly, with no SHA-256 pre-hash (Ed25519 hashes internally).
+ *
+ * @param publicKey 32-byte Ed25519 public key as hex (64 chars).
+ * @param message the message string that was signed.
+ * @param signature the 64-byte EdDSA signature as hex.
+ * @returns `true` when the signature is valid, `false` otherwise.
+ */
+export declare const verifyEd25519Signature: (publicKey: string, message: string, signature: string) => boolean;
+//# sourceMappingURL=verify-ed25519-signature.d.ts.map

package/dist/crypto/signature/verify-ed25519-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-ed25519-signature.d.ts","sourceRoot":"","sources":["../../../src/crypto/signature/verify-ed25519-signature.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAC/B,WAAW,MAAM,EACjB,SAAS,MAAM,EACf,WAAW,MAAM,KAClB,OAYF,CAAC"}

package/dist/crypto/signature/verify-ed25519-signature.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyEd25519Signature = void 0;
+const ed25519_primitives_1 = require("./ed25519-primitives");
+const cryptography_settings_1 = require("../../_settings/cryptography-settings");
+/**
+ * Verifies a true Ed25519 (EdDSA) signature over `message` for `publicKey`.
+ *
+ * Mirrors `createEd25519Signature`: the raw UTF-8 bytes of `message` are
+ * verified directly, with no SHA-256 pre-hash (Ed25519 hashes internally).
+ *
+ * @param publicKey 32-byte Ed25519 public key as hex (64 chars).
+ * @param message the message string that was signed.
+ * @param signature the 64-byte EdDSA signature as hex.
+ * @returns `true` when the signature is valid, `false` otherwise.
+ */
+const verifyEd25519Signature = (publicKey, message, signature) => {
+    try {
+        const publicKeyBytes = ed25519_primitives_1.ed.etc.hexToBytes(publicKey);
+        const signatureBytes = ed25519_primitives_1.ed.etc.hexToBytes(signature);
+        const messageBytes = Buffer.from(message, cryptography_settings_1.CryptoSettings.TextEncoding);
+        return ed25519_primitives_1.ed.verify(signatureBytes, messageBytes, publicKeyBytes);
+    }
+    catch {
+        // noble throws (TypeError/RangeError) on malformed hex or wrong byte
+        // lengths rather than returning false. Normalize to a single rejection
+        // mode so a tampered/garbage signature reads as "invalid", not an error.
+        return false;
+    }
+};
+exports.verifyEd25519Signature = verifyEd25519Signature;

package/dist/errors/index.d.ts

@@ -2,9 +2,11 @@ export * from './audit-log/audit-log-errors';
 export * from './authorization/authorization-errors';
 export * from './database/database-errors';
 export * from './generic/generic-errors';
+export * from './library/library-errors';
 export * from './request/request-errors';
 export * from './safe/safe-rules-errors';
 export * from './scheduler/scheduler-errors';
+export * from './settlement/settlement-errors';
 export * from './share-data/share-data-errors';
 export * from './shareblock/shareblock-errors';
 export * from './validation/crypto-validation-errors';

package/dist/errors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AAGtD,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AAGtD,cAAc,cAAc,CAAC"}

package/dist/errors/index.js

@@ -18,9 +18,11 @@ __exportStar(require("./audit-log/audit-log-errors"), exports);
 __exportStar(require("./authorization/authorization-errors"), exports);
 __exportStar(require("./database/database-errors"), exports);
 __exportStar(require("./generic/generic-errors"), exports);
+__exportStar(require("./library/library-errors"), exports);
 __exportStar(require("./request/request-errors"), exports);
 __exportStar(require("./safe/safe-rules-errors"), exports);
 __exportStar(require("./scheduler/scheduler-errors"), exports);
+__exportStar(require("./settlement/settlement-errors"), exports);
 __exportStar(require("./share-data/share-data-errors"), exports);
 __exportStar(require("./shareblock/shareblock-errors"), exports);
 __exportStar(require("./validation/crypto-validation-errors"), exports);

package/dist/errors/library/library-errors.d.ts

@@ -0,0 +1,101 @@
+import { BaseError } from '../base-error';
+/**
+ * Thrown when a library version's recorded `currentHash` does not match the
+ * hash recomputed from its `source` + `previousHash`. The content of the
+ * version has been altered (or the hash was forged).
+ */
+export declare class LibraryVersionHashMismatchError extends BaseError {
+    readonly entityId: string;
+    readonly claimedHash: string;
+    readonly recomputedHash: string;
+    constructor(entityId: string, claimedHash: string, recomputedHash: string);
+}
+/**
+ * Thrown when a version's `previousHash` does not equal the `currentHash` of
+ * the version before it (the prior version's hash, or the empty seed for the
+ * first version). The append-only chain has been broken or reordered.
+ */
+export declare class LibraryChainBrokenError extends BaseError {
+    readonly entityId: string;
+    readonly expectedPreviousHash: string;
+    readonly actualPreviousHash: string;
+    constructor(entityId: string, expectedPreviousHash: string, actualPreviousHash: string);
+}
+/**
+ * Thrown when a version or head proof's Ed25519 signature does not verify
+ * against the canonical, purpose-bound payload reconstructed from the record.
+ * A signature was forged, or a signed field (including metadata such as
+ * `createdAt`, which is bound by the signature though not by the content hash)
+ * was tampered with.
+ */
+export declare class LibraryProofInvalidError extends BaseError {
+    readonly entityId: string;
+    readonly proofKind: 'version' | 'head' | 'delegation';
+    constructor(entityId: string, proofKind: 'version' | 'head' | 'delegation');
+}
+/**
+ * Thrown when a delegation is registered by a key that is not the entity owner.
+ * Only the owner (the key that signed the first version) may delegate, which
+ * also blocks transitive delegation — a delegate's key is never the owner key,
+ * so a delegate can never register further delegates.
+ */
+export declare class LibraryDelegationNotAuthorizedError extends BaseError {
+    readonly entityId: string;
+    readonly attemptedBy: string;
+    constructor(entityId: string, attemptedBy: string, reason?: string);
+}
+/**
+ * Thrown when a version's signer is neither the entity owner nor a verified
+ * delegate. Signature validity alone only proves *someone* signed the version;
+ * this proves the *authorized* someone did.
+ */
+export declare class LibraryVersionNotAuthorizedError extends BaseError {
+    readonly entityId: string;
+    readonly signerPublicKey: string;
+    constructor(entityId: string, signerPublicKey: string);
+}
+/**
+ * Thrown when a store `save` would violate the append-only ledger: the incoming
+ * entity truncates or diverges from the stored history rather than extending it.
+ * The ledger may only grow, and existing versions may never change.
+ */
+export declare class LibraryStoreConflictError extends BaseError {
+    readonly entityId: string;
+    readonly reason: string;
+    constructor(entityId: string, reason: string);
+}
+/**
+ * Thrown when an entity is evaluated as the wrong kind — e.g. evaluating a rule
+ * entity through the function path. The entity is valid; the call is not.
+ */
+export declare class LibraryKindMismatchError extends BaseError {
+    readonly entityId: string;
+    readonly expected: string;
+    readonly actual: string;
+    constructor(entityId: string, expected: string, actual: string);
+}
+/** Thrown when a reference resolves to an id the store does not hold. */
+export declare class LibraryEntityNotFoundError extends BaseError {
+    readonly entityId: string;
+    constructor(entityId: string);
+}
+/**
+ * Thrown when a reference pins a `currentHash` that is not present in the
+ * entity's version ledger (e.g. a stale or forged reference).
+ */
+export declare class LibraryVersionNotFoundError extends BaseError {
+    readonly entityId: string;
+    readonly currentHash: string;
+    constructor(entityId: string, currentHash: string);
+}
+/**
+ * Thrown when a library entity is structurally invalid: no versions, an `id`
+ * that is not the first version's `currentHash` (identity is content-addressed
+ * to the first version), a `head` that does not match the latest version, or an
+ * out-of-range `gasLimit`.
+ */
+export declare class LibraryEntityInvalidError extends BaseError {
+    readonly reason: string;
+    constructor(reason: string);
+}
+//# sourceMappingURL=library-errors.d.ts.map

package/dist/errors/library/library-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-errors.d.ts","sourceRoot":"","sources":["../../../src/errors/library/library-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C;;;;GAIG;AACH,qBAAa,+BAAgC,SAAQ,SAAS;IAC1D,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,cAAc,EAAE,MAAM,CAAC;gBAE3B,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;CAQ5E;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;IAClD,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,oBAAoB,EAAE,MAAM,CAAC;IAC7C,SAAgB,kBAAkB,EAAE,MAAM,CAAC;gBAE/B,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM;CAQzF;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,SAAS;IACnD,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC;gBAEjD,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,YAAY;CAK7E;AAED;;;;;GAKG;AACH,qBAAa,mCAAoC,SAAQ,SAAS;IAC9D,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;gBAExB,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAOrE;AAED;;;;GAIG;AACH,qBAAa,gCAAiC,SAAQ,SAAS;IAC3D,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,eAAe,EAAE,MAAM,CAAC;gBAE5B,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM;CAOxD;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;IACpD,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEnB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK/C;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,SAAS;IACnD,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEnB,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMjE;AAED,yEAAyE;AACzE,qBAAa,0BAA2B,SAAQ,SAAS;IACrD,SAAgB,QAAQ,EAAE,MAAM,CAAC;gBAErB,QAAQ,EAAE,MAAM;CAI/B;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,SAAS;IACtD,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;gBAExB,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAKpD;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;IACpD,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEnB,MAAM,EAAE,MAAM;CAI7B"}