@ghostspeak/sdk 2.0.6 → 2.0.7

package/dist/chunk-BQDGRTVP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/signature-verification.ts"],"names":["authorization","buffer","data"],"mappings":";;;;;AAAA,IAAA,8BAAA,GAAA;AAAA,QAAA,CAAA,8BAAA,EAAA;AAAA,EAAA,0BAAA,EAAA,MAAA,0BAAA;AAAA,EAAA,yBAAA,EAAA,MAAA,yBAAA;AAAA,EAAA,wBAAA,EAAA,MAAA,wBAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,wBAAA,EAAA,MAAA,wBAAA;AAAA,EAAA,sBAAA,EAAA,MAAA,sBAAA;AAAA,EAAA,sBAAA,EAAA,MAAA,sBAAA;AAAA,EAAA,wBAAA,EAAA,MAAA,wBAAA;AAAA,EAAA,4BAAA,EAAA,MAAA,4BAAA;AAAA,EAAA,4BAAA,EAAA,MAAA;AAAA,CAAA,CAAA;AAmCA,IAAM,gBAAA,GAAmB,qCAAA;AAiBlB,SAAS,2BAA2B,OAAA,EAAuC;AAChF,EAAA,MAAM,aAAuB,EAAC;AAG9B,EAAA,UAAA,CAAW,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,gBAAA,EAAkB,MAAM,CAAC,CAAA;AAGrD,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA;AACnD,EAAA,UAAA,CAAW,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAGvC,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA;AACxD,EAAA,UAAA,CAAW,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,WAAW,CAAC,CAAA;AAGxC,EAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,WAAA,CAAY,CAAC,CAAA;AAC7C,EAAA,gBAAA,CAAiB,gBAAA,CAAiB,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAC,CAAA;AAC5D,EAAA,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAGhC,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,WAAA,CAAY,CAAC,CAAA;AAC5C,EAAA,eAAA,CAAgB,gBAAA,CAAiB,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAC,CAAA;AAC1D,EAAA,UAAA,CAAW,KAAK,eAAe,CAAA;AAG/B,EAAA,UAAA,CAAW,KAAK,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,OAAA,EAAS,MAAM,CAAC,CAAA;AAGpD,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,UAAA,CAAW,KAAK,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,EACpD;AAEA,EAAA,OAAO,MAAA,CAAO,OAAO,UAAU,CAAA;AACjC;AASA,eAAsB,wBAAA,CACpB,SACA,YAAA,EACqB;AAErB,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,SAAA,CAAU,QAAA,EAAS;AACvD,EAAA,IAAI,cAAA,KAAmB,QAAQ,YAAA,EAAc;AAC3C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,cAAc,CAAA,8BAAA,EAAiC,OAAA,CAAQ,YAAY,CAAA;AAAA,KAC3F;AAAA,EACF;AAGA,EAAA,MAAM,aAAA,GAAgB,2BAA2B,OAAO,CAAA;AAGxD,EAAA,MAAM,IAAA,GAAO,MAAM,OAAO,yBAAW,CAAA;AACrC,EAAA,MAAM,YAAY,IAAA,CAAK,IAAA,CAAK,QAAA,CAAS,aAAA,EAAe,aAAa,SAAS,CAAA;AAE1E,EAAA,OAAO,SAAA;AACT;AAQA,eAAsB,6BACpBA,cAAAA,EACkB;AAClB,EAAA,IAAI;AAEF,IAAA,MAAM,OAAA,GAAgC;AAAA,MACpC,cAAcA,cAAAA,CAAc,YAAA;AAAA,MAC5B,kBAAkBA,cAAAA,CAAc,gBAAA;AAAA,MAChC,YAAYA,cAAAA,CAAc,UAAA;AAAA,MAC1B,WAAWA,cAAAA,CAAc,SAAA;AAAA,MACzB,SAASA,cAAAA,CAAc,OAAA;AAAA,MACvB,OAAOA,cAAAA,CAAc;AAAA,KACvB;AAEA,IAAA,MAAM,aAAA,GAAgB,2BAA2B,OAAO,CAAA;AAGxD,IAAA,MAAM,IAAA,GAAO,MAAM,OAAO,yBAAW,CAAA;AACrC,IAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,MAAA,CAAOA,cAAAA,CAAc,YAAY,CAAA;AAC/D,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,QAAA,CAAS,MAAA;AAAA,MACjC,aAAA;AAAA,MACAA,cAAAA,CAAc,SAAA;AAAA,MACd;AAAA,KACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,yCAAyC,KAAK,CAAA;AAC5D,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AASA,eAAsB,yBAAA,CACpB,QACA,YAAA,EACkC;AAElC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,YAAA,CAAa,SAAA,CAAU,UAAU,CAAA;AAG9D,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA,IAAO,OAAO,SAAA,IAAa,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA,CAAA;AAGhF,EAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,GAAA;AAGxC,EAAA,MAAM,OAAA,GAAyB,OAAO,OAAA,IAAW,QAAA;AAIjD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,KAAA,KAAU,MAAA,GAAY,OAAO,KAAA,GAAQ,SAAA;AAG1D,EAAA,MAAM,OAAA,GAAgC;AAAA,IACpC,YAAA;AAAA,IACA,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,UAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,wBAAA,CAAyB,OAAA,EAAS,YAAY,CAAA;AAGtE,EAAA,MAAMA,cAAAA,GAAyC;AAAA,IAC7C,YAAA;AAAA,IACA,kBAAkB,MAAA,CAAO,gBAAA;AAAA,IACzB,UAAA;AAAA,IACA,SAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,KAAA;AAAA,IACA,UAAU,MAAA,CAAO;AAAA,GACnB;AAEA,EAAA,OAAOA,cAAAA;AACT;AAOO,SAAS,aAAA,GAAwB;AAEtC,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,MAAMC,OAAAA,GAAS,IAAI,UAAA,CAAW,EAAE,CAAA;AAChC,IAAA,UAAA,CAAW,MAAA,CAAO,gBAAgBA,OAAM,CAAA;AACxC,IAAA,OAAO,MAAA,CAAO,IAAA,CAAKA,OAAM,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,EAC3C;AAIA,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAS,CAAA,CAAE,QAAQ,CAAA;AAC3C,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW,EAAE,CAAA;AAChC,EAAA,UAAA,CAAW,SAAA,CAAU,gBAAgB,MAAM,CAAA;AAC3C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,KAAK,CAAA;AAC3C;AAQO,SAAS,uBAAuBD,cAAAA,EASrC;AACA,EAAA,OAAO;AAAA,IACL,cAAcA,cAAAA,CAAc,YAAA;AAAA,IAC5B,kBAAkBA,cAAAA,CAAc,gBAAA;AAAA,IAChC,YAAYA,cAAAA,CAAc,UAAA;AAAA,IAC1B,WAAWA,cAAAA,CAAc,SAAA;AAAA,IACzB,SAASA,cAAAA,CAAc,OAAA;AAAA,IACvB,SAAA,EAAW,IAAA,CAAK,MAAA,CAAOA,cAAAA,CAAc,SAAS,CAAA;AAAA,IAC9C,OAAOA,cAAAA,CAAc,KAAA;AAAA,IACrB,UAAUA,cAAAA,CAAc;AAAA,GAC1B;AACF;AAQO,SAAS,yBAAyBE,KAAAA,EASb;AAC1B,EAAA,OAAO;AAAA,IACL,cAAcA,KAAAA,CAAK,YAAA;AAAA,IACnB,kBAAkBA,KAAAA,CAAK,gBAAA;AAAA,IACvB,YAAYA,KAAAA,CAAK,UAAA;AAAA,IACjB,WAAWA,KAAAA,CAAK,SAAA;AAAA,IAChB,SAASA,KAAAA,CAAK,OAAA;AAAA,IACd,SAAA,EAAW,IAAA,CAAK,MAAA,CAAOA,KAAAA,CAAK,SAAS,CAAA;AAAA,IACrC,OAAOA,KAAAA,CAAK,KAAA;AAAA,IACZ,UAAUA,KAAAA,CAAK;AAAA,GACjB;AACF;AAQA,eAAsB,mBAAmB,aAAA,EAAyD;AAChG,EAAA,MAAM,UAAA,GAAa,uBAAuB,aAAa,CAAA;AACvD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,UAAU,CAAA;AACtC,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAGhC,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,MAAA,GAAS,UAAA,CAAW,MAAA;AAAA,EACtB,CAAA,MAAO;AAEL,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAS,CAAA,CAAE,QAAQ,CAAA;AAC3C,IAAA,MAAA,GAAS,UAAA,CAAW,SAAA;AAAA,EACtB;AAGA,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAC7D,EAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,UAAU,CAAA;AAE3C,EAAA,OAAO,IAAA,CAAK,OAAO,SAAS,CAAA;AAC9B;AASO,SAAS,sBAAA,CACdF,gBACA,WAAA,EACS;AACT,EAAA,MAAM,MAAM,WAAA,IAAe,IAAA,CAAK,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACvD,EAAA,OAAO,OAAOA,cAAAA,CAAc,SAAA;AAC9B;AASO,SAAS,wBAAA,CACdA,gBACA,YAAA,EACS;AACT,EAAA,OAAO,gBAAgBA,cAAAA,CAAc,UAAA;AACvC;AASO,SAAS,4BAAA,CACdA,gBACA,eAAA,EACS;AACT,EAAA,OAAOA,eAAc,OAAA,KAAY,eAAA;AACnC","file":"chunk-BQDGRTVP.js","sourcesContent":["/**\n * Agent Authorization Signature Verification\n *\n * Ed25519 signature creation and verification for GhostSpeak's\n * trustless agent pre-authorization system.\n *\n * Enables verifiable delegation of reputation update authority.\n */\n\nimport { address } from '@solana/addresses'\nimport type { Address } from '@solana/addresses'\nimport type {\n  ReputationAuthorization,\n  AuthorizationMessage,\n  CreateAuthorizationParams,\n  SolanaNetwork,\n} from '../types/authorization/authorization-types'\nimport bs58 from 'bs58'\n\n/**\n * Keypair interface for Ed25519 signing operations\n * Compatible with both legacy and modern Solana key formats\n */\nexport interface SigningKeypair {\n  publicKey: {\n    toBase58(): string\n    toBytes(): Uint8Array\n  }\n  secretKey: Uint8Array\n}\n\n/**\n * Authorization message domain separator\n * Prevents signature reuse across different protocols\n */\nconst DOMAIN_SEPARATOR = 'GhostSpeak Reputation Authorization'\n\n/**\n * Create authorization message for signing\n *\n * Message format:\n * - Domain separator (prevents cross-protocol replay)\n * - Agent address (32 bytes)\n * - Authorized source (32 bytes)\n * - Index limit (8 bytes, u64 big-endian)\n * - Expiration timestamp (8 bytes, u64 big-endian)\n * - Network string (variable length)\n * - Nonce (optional, 32 bytes if present)\n *\n * @param message - Authorization message parameters\n * @returns Buffer ready for signing\n */\nexport function createAuthorizationMessage(message: AuthorizationMessage): Buffer {\n  const components: Buffer[] = []\n\n  // 1. Domain separator\n  components.push(Buffer.from(DOMAIN_SEPARATOR, 'utf8'))\n\n  // 2. Agent address (32 bytes)\n  const agentBytes = bs58.decode(message.agentAddress)\n  components.push(Buffer.from(agentBytes))\n\n  // 3. Authorized source (32 bytes)\n  const sourceBytes = bs58.decode(message.authorizedSource)\n  components.push(Buffer.from(sourceBytes))\n\n  // 4. Index limit (8 bytes, u64 big-endian)\n  const indexLimitBuffer = Buffer.allocUnsafe(8)\n  indexLimitBuffer.writeBigUInt64BE(BigInt(message.indexLimit))\n  components.push(indexLimitBuffer)\n\n  // 5. Expiration timestamp (8 bytes, u64 big-endian)\n  const expiresAtBuffer = Buffer.allocUnsafe(8)\n  expiresAtBuffer.writeBigUInt64BE(BigInt(message.expiresAt))\n  components.push(expiresAtBuffer)\n\n  // 6. Network string\n  components.push(Buffer.from(message.network, 'utf8'))\n\n  // 7. Nonce (optional, 32 bytes)\n  if (message.nonce) {\n    components.push(Buffer.from(message.nonce, 'utf8'))\n  }\n\n  return Buffer.concat(components)\n}\n\n/**\n * Sign authorization message with agent's private key\n *\n * @param message - Authorization message to sign\n * @param agentKeypair - Agent's keypair (must match message.agentAddress)\n * @returns Ed25519 signature (64 bytes)\n */\nexport async function signAuthorizationMessage(\n  message: AuthorizationMessage,\n  agentKeypair: SigningKeypair\n): Promise<Uint8Array> {\n  // Verify keypair matches agent address\n  const keypairAddress = agentKeypair.publicKey.toBase58()\n  if (keypairAddress !== message.agentAddress) {\n    throw new Error(\n      `Keypair public key ${keypairAddress} does not match agent address ${message.agentAddress}`\n    )\n  }\n\n  // Create message buffer\n  const messageBuffer = createAuthorizationMessage(message)\n\n  // Sign with Ed25519\n  const nacl = await import('tweetnacl')\n  const signature = nacl.sign.detached(messageBuffer, agentKeypair.secretKey)\n\n  return signature\n}\n\n/**\n * Verify authorization signature\n *\n * @param authorization - Authorization to verify\n * @returns True if signature is valid\n */\nexport async function verifyAuthorizationSignature(\n  authorization: ReputationAuthorization\n): Promise<boolean> {\n  try {\n    // Reconstruct message\n    const message: AuthorizationMessage = {\n      agentAddress: authorization.agentAddress,\n      authorizedSource: authorization.authorizedSource,\n      indexLimit: authorization.indexLimit,\n      expiresAt: authorization.expiresAt,\n      network: authorization.network,\n      nonce: authorization.nonce,\n    }\n\n    const messageBuffer = createAuthorizationMessage(message)\n\n    // Verify signature\n    const nacl = await import('tweetnacl')\n    const agentPubkeyBytes = bs58.decode(authorization.agentAddress)\n    const isValid = nacl.sign.detached.verify(\n      messageBuffer,\n      authorization.signature,\n      agentPubkeyBytes\n    )\n\n    return isValid\n  } catch (error) {\n    console.error('[Auth Signature] Verification failed:', error)\n    return false\n  }\n}\n\n/**\n * Create a complete authorization with signature\n *\n * @param params - Authorization parameters\n * @param agentKeypair - Agent's keypair for signing\n * @returns Complete signed authorization\n */\nexport async function createSignedAuthorization(\n  params: CreateAuthorizationParams,\n  agentKeypair: SigningKeypair\n): Promise<ReputationAuthorization> {\n  // Get agent address from keypair\n  const agentAddress = address(agentKeypair.publicKey.toBase58())\n\n  // Calculate expiration\n  const now = Math.floor(Date.now() / 1000)\n  const expiresAt = params.expiresAt || now + (params.expiresIn || 30 * 24 * 60 * 60) // Default 30 days\n\n  // Default index limit\n  const indexLimit = params.indexLimit || 1000\n\n  // Default network (would need to be passed or detected from cluster)\n  const network: SolanaNetwork = params.network || 'devnet'\n\n  // Use \"default\" nonce if not provided to avoid PDA seed length issues (64-char hex exceeds 32-byte limit)\n  // Note: This matches Rust's unwrap_or(&String::from(\"default\")) behavior\n  const nonce = params.nonce !== undefined ? params.nonce : \"default\"\n\n  // Create message\n  const message: AuthorizationMessage = {\n    agentAddress,\n    authorizedSource: params.authorizedSource,\n    indexLimit,\n    expiresAt,\n    network,\n    nonce,\n  }\n\n  // Sign message\n  const signature = await signAuthorizationMessage(message, agentKeypair)\n\n  // Return complete authorization\n  const authorization: ReputationAuthorization = {\n    agentAddress,\n    authorizedSource: params.authorizedSource,\n    indexLimit,\n    expiresAt,\n    network,\n    signature,\n    nonce,\n    metadata: params.metadata,\n  }\n\n  return authorization\n}\n\n/**\n * Generate a random nonce for replay protection\n *\n * @returns 32-byte random nonce as hex string\n */\nexport function generateNonce(): string {\n  // Use global crypto if available (browser/modern Node.js)\n  if (globalThis.crypto) {\n    const buffer = new Uint8Array(32)\n    globalThis.crypto.getRandomValues(buffer)\n    return Buffer.from(buffer).toString('hex')\n  }\n\n  // Fallback for Node.js < 19 (though we require Node 24+)\n  // This branch should rarely execute but provides compatibility\n  const nodeCrypto = eval('require')('crypto')\n  const buffer = new Uint8Array(32)\n  nodeCrypto.webcrypto.getRandomValues(buffer)\n  return Buffer.from(buffer).toString('hex')\n}\n\n/**\n * Serialize authorization to JSON-safe format\n *\n * @param authorization - Authorization to serialize\n * @returns JSON-safe object (signature as base58)\n */\nexport function serializeAuthorization(authorization: ReputationAuthorization): {\n  agentAddress: string\n  authorizedSource: string\n  indexLimit: number\n  expiresAt: number\n  network: SolanaNetwork\n  signature: string\n  nonce?: string\n  metadata?: any\n} {\n  return {\n    agentAddress: authorization.agentAddress,\n    authorizedSource: authorization.authorizedSource,\n    indexLimit: authorization.indexLimit,\n    expiresAt: authorization.expiresAt,\n    network: authorization.network,\n    signature: bs58.encode(authorization.signature),\n    nonce: authorization.nonce,\n    metadata: authorization.metadata,\n  }\n}\n\n/**\n * Deserialize authorization from JSON format\n *\n * @param data - Serialized authorization data\n * @returns ReputationAuthorization with Uint8Array signature\n */\nexport function deserializeAuthorization(data: {\n  agentAddress: string\n  authorizedSource: string\n  indexLimit: number\n  expiresAt: number\n  network: SolanaNetwork\n  signature: string\n  nonce?: string\n  metadata?: any\n}): ReputationAuthorization {\n  return {\n    agentAddress: data.agentAddress as Address,\n    authorizedSource: data.authorizedSource as Address,\n    indexLimit: data.indexLimit,\n    expiresAt: data.expiresAt,\n    network: data.network,\n    signature: bs58.decode(data.signature),\n    nonce: data.nonce,\n    metadata: data.metadata,\n  }\n}\n\n/**\n * Get authorization ID (deterministic hash)\n *\n * @param authorization - Authorization to hash\n * @returns Base58-encoded SHA-256 hash\n */\nexport async function getAuthorizationId(authorization: ReputationAuthorization): Promise<string> {\n  const serialized = serializeAuthorization(authorization)\n  const json = JSON.stringify(serialized)\n  const encoder = new TextEncoder()\n  const data = encoder.encode(json)\n\n  // Use global crypto if available\n  let crypto: Crypto\n  if (globalThis.crypto) {\n    crypto = globalThis.crypto\n  } else {\n    // Fallback for Node.js < 19\n    const nodeCrypto = eval('require')('crypto')\n    crypto = nodeCrypto.webcrypto as Crypto\n  }\n\n  // SHA-256 hash\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data)\n  const hashArray = new Uint8Array(hashBuffer)\n\n  return bs58.encode(hashArray)\n}\n\n/**\n * Check if authorization is expired\n *\n * @param authorization - Authorization to check\n * @param currentTime - Current Unix timestamp (defaults to now)\n * @returns True if expired\n */\nexport function isAuthorizationExpired(\n  authorization: ReputationAuthorization,\n  currentTime?: number\n): boolean {\n  const now = currentTime || Math.floor(Date.now() / 1000)\n  return now >= authorization.expiresAt\n}\n\n/**\n * Check if authorization has exceeded index limit\n *\n * @param authorization - Authorization to check\n * @param currentIndex - Current usage count\n * @returns True if exhausted\n */\nexport function isAuthorizationExhausted(\n  authorization: ReputationAuthorization,\n  currentIndex: number\n): boolean {\n  return currentIndex >= authorization.indexLimit\n}\n\n/**\n * Validate authorization network matches expected\n *\n * @param authorization - Authorization to check\n * @param expectedNetwork - Expected network\n * @returns True if networks match\n */\nexport function validateAuthorizationNetwork(\n  authorization: ReputationAuthorization,\n  expectedNetwork: SolanaNetwork\n): boolean {\n  return authorization.network === expectedNetwork\n}\n"]}