@kya-os/cli 2.0.0 → 2.0.2

package/dist/sidecar/sidecar/src/ops/resolve-identity.js

@@ -0,0 +1,233 @@
+/**
+ * Verify the registry's did:webvh history with the same SDK as Hobbsidian.
+ * Registry possession, a DID document, and a valid history are distinct facts:
+ * this operation establishes history integrity, never recipient authorization.
+ */
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { isIP } from "node:net";
+import { z } from "zod";
+import { multibaseDecode, resolveDIDFromLog, } from "didwebvh-ts";
+export const IDENTITY_MAX_BYTES = 1024 * 1024;
+export const IDENTITY_MAX_ENTRIES = 256;
+export const IDENTITY_TIMEOUT_MS = 10000;
+const paramsSchema = z.object({ did: z.string().min(1).max(2048) }).strict();
+/** Only public IPv4 or native globally routed IPv6; reject mapped/tunnel space. */
+export function publicAddress(address) {
+    if (isIP(address) === 4) {
+        const [a, b, c] = address.split(".").map(Number);
+        return !(a === 0 || a === 10 || a === 127 || a >= 224 ||
+            (a === 100 && b >= 64 && b <= 127) ||
+            (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) ||
+            (a === 192 && (b === 168 || b === 0 || (b === 88 && c === 99))) ||
+            (a === 198 && (b === 18 || b === 19 || (b === 51 && c === 100))) ||
+            (a === 203 && b === 0 && c === 113));
+    }
+    if (isIP(address) !== 6)
+        return false;
+    const expanded = new URL(`http://[${address}]/`).hostname.slice(1, -1);
+    const first = parseInt(expanded.split(":")[0], 16);
+    // Native global unicast 2000::/3 only. Conservatively omit 2001::/23
+    // special-purpose assignments, documentation and 6to4 translation space.
+    return first >= 0x2000 && first <= 0x3fff &&
+        !/^2001:(?:[01]?[0-9a-f]{1,2}:|:|db8:)/i.test(expanded) &&
+        first !== 0x2002 && !expanded.startsWith("3fff:");
+}
+function configuredHosts() {
+    return (process.env.KYA_OS_REGISTRY_HOSTS ?? "knowthat.ai")
+        .split(",").map((host) => host.trim().toLowerCase()).filter(Boolean);
+}
+export function identityLogUrl(did, allowedHosts = configuredHosts()) {
+    const parts = did.split(":");
+    if (parts.length < 4 || parts[0] !== "did" || parts[1] !== "webvh")
+        return null;
+    const [, , scid, host, ...path] = parts;
+    // No percent encoding, port, credentials, DID URL query/fragment, traversal,
+    // Unicode host ambiguity, or IP literals. This intentionally supports the
+    // registry profile; more permissive DID syntax needs explicit qualification.
+    if (!/^[1-9A-HJ-NP-Za-km-z]{16,128}$/.test(scid) ||
+        !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(host) ||
+        isIP(host) !== 0 || !allowedHosts.includes(host) ||
+        path.some((part) => !/^[A-Za-z0-9_-]{1,128}$/.test(part)))
+        return null;
+    return new URL(path.length ? `https://${host}/${path.join("/")}/did.jsonl` :
+        `https://${host}/.well-known/did.jsonl`);
+}
+class ResolutionError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/** DNS lookup is pinned into TLS connect, closing the check/connect rebind gap. */
+export async function readIdentityLog(url, signal) {
+    const addresses = await Promise.race([
+        lookup(url.hostname, { all: true, verbatim: true }),
+        new Promise((_, reject) => {
+            signal.addEventListener("abort", () => reject(new ResolutionError("unavailable", "resolution_timeout")), { once: true });
+            if (signal.aborted)
+                reject(new ResolutionError("unavailable", "resolution_timeout"));
+        }),
+    ]);
+    if (!addresses.length || addresses.some(({ address }) => !publicAddress(address))) {
+        throw new ResolutionError("unsupported", "unsafe_registry_address");
+    }
+    signal.throwIfAborted();
+    const pinned = addresses[0];
+    return new Promise((resolve, reject) => {
+        const req = request(url, {
+            method: "GET", signal, agent: false,
+            headers: { accept: "application/jsonl, text/jsonl", "accept-encoding": "identity" },
+            // Keep hostname and SNI, but never resolve the target a second time.
+            lookup: (_hostname, options, callback) => {
+                if (typeof options === "object" && options.all)
+                    callback(null, [pinned]);
+                else
+                    callback(null, pinned.address, pinned.family);
+            },
+        }, (response) => {
+            if (response.statusCode !== 200) {
+                response.destroy();
+                reject(new ResolutionError("unavailable", response.statusCode && response.statusCode >= 300 && response.statusCode < 400 ? "redirect_refused" : `registry_http_${response.statusCode ?? "error"}`));
+                return;
+            }
+            if (response.headers["content-encoding"] && response.headers["content-encoding"] !== "identity") {
+                response.destroy();
+                reject(new ResolutionError("unsupported", "encoded_log_refused"));
+                return;
+            }
+            const declared = response.headers["content-length"];
+            if (declared && Number(declared) > IDENTITY_MAX_BYTES) {
+                response.destroy();
+                reject(new ResolutionError("unsupported", "log_size_limit"));
+                return;
+            }
+            const chunks = [];
+            let bytes = 0;
+            response.on("data", (chunk) => {
+                bytes += chunk.length;
+                if (bytes > IDENTITY_MAX_BYTES) {
+                    response.destroy();
+                    reject(new ResolutionError("unsupported", "log_size_limit"));
+                }
+                else
+                    chunks.push(chunk);
+            });
+            response.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+            response.on("error", () => reject(new ResolutionError("unavailable", "registry_read_failed")));
+        });
+        req.on("error", () => reject(new ResolutionError("unavailable", signal.aborted ? "resolution_timeout" : "registry_unavailable")));
+        req.end();
+    });
+}
+/** Standard Node Ed25519 primitive; didwebvh-ts owns all log/proof semantics. */
+export const identityVerifier = {
+    async verify(signature, message, publicKey) {
+        try {
+            if (publicKey.length !== 32 || signature.length !== 64)
+                return false;
+            const key = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: Buffer.from(publicKey).toString("base64url") }, format: "jwk" });
+            return verify(null, message, key, signature);
+        }
+        catch {
+            return false;
+        }
+    },
+};
+const entryEnvelope = z.object({
+    versionId: z.string().min(1).max(256), versionTime: z.string().min(1).max(64),
+    parameters: z.record(z.unknown()), state: z.object({ id: z.string().optional() }).passthrough(),
+    proof: z.array(z.object({
+        type: z.literal("DataIntegrityProof"), cryptosuite: z.literal("eddsa-jcs-2022"),
+        verificationMethod: z.string().max(2048), created: z.string().max(64),
+        proofValue: z.string().max(512),
+        proofPurpose: z.enum(["authentication", "assertionMethod", "keyAgreement", "capabilityInvocation", "capabilityDelegation"]),
+    }).passthrough()).min(1).max(32),
+}).passthrough();
+export function createIdentityResolver(deps) {
+    return async (params) => {
+        const parsed = paramsSchema.safeParse(params);
+        if (!parsed.success)
+            throw new Error("resolveIdentity requires only a bounded DID string");
+        const { did } = parsed.data;
+        const base = { version: 1, did, method: did.startsWith("did:webvh:") ? "webvh" : "unsupported", verification: "none" };
+        if (base.method === "unsupported")
+            return { ...base, status: "unsupported", reason: "did_method_not_supported" };
+        const url = identityLogUrl(did, deps.allowedHosts);
+        if (!url)
+            return { ...base, status: "unsupported", reason: "unsupported_or_unsafe_registry_did" };
+        const signal = AbortSignal.timeout(IDENTITY_TIMEOUT_MS);
+        try {
+            let body;
+            try {
+                body = await deps.readLog(url, signal);
+            }
+            catch (error) {
+                if (error instanceof ResolutionError)
+                    throw error;
+                throw new ResolutionError("unavailable", signal.aborted ? "resolution_timeout" : "registry_unavailable");
+            }
+            if (Buffer.byteLength(body) > IDENTITY_MAX_BYTES)
+                throw new ResolutionError("unsupported", "log_size_limit");
+            const lines = body.split("\n").filter((line) => line.trim());
+            if (lines.length > IDENTITY_MAX_ENTRIES)
+                throw new ResolutionError("unsupported", "log_entry_limit");
+            if (!lines.length)
+                throw new ResolutionError("invalid", "empty_identity_history");
+            const entries = lines.map((line) => entryEnvelope.parse(JSON.parse(line)));
+            if (entries[0].parameters.method !== "did:webvh:1.0") {
+                return { ...base, status: "unsupported", reason: "history_method_version_not_supported" };
+            }
+            // Witness resources are not supported by this bounded registry profile.
+            // Explicit [] prevents the SDK from performing its own unbounded fetch.
+            if (entries.some((entry) => {
+                const witness = entry.parameters.witness;
+                return entry.parameters.witnesses != null || (witness != null &&
+                    typeof witness === "object" && (Object.keys(witness).length > 0));
+            })) {
+                return { ...base, status: "unsupported", reason: "witness_history_not_supported" };
+            }
+            // Envelope validated above; SDK validates the normative member types,
+            // SCID, every proof, sequence, method version, and history hash chain.
+            const resolved = await resolveDIDFromLog(entries, {
+                verifier: identityVerifier, requestedDid: did, witnessProofs: [],
+            });
+            if (resolved.meta.deactivated)
+                throw new ResolutionError("invalid", "identity_deactivated");
+            if (resolved.meta.error || resolved.did !== did || resolved.doc.id !== did ||
+                resolved.meta.versionId !== entries.at(-1)?.versionId) {
+                throw new ResolutionError("invalid", "identity_history_mismatch");
+            }
+            const document = { ...resolved.doc };
+            // Public-only output and compatibility with existing JWK consumers.
+            document.verificationMethod = document.verificationMethod?.map((method) => {
+                if (method.secretKeyMultibase || method.publicKeyJwk?.d)
+                    throw new ResolutionError("invalid", "private_key_in_identity_document");
+                const normalized = { ...method, id: method.id?.startsWith("#") ? `${did}${method.id}` : method.id };
+                if (!normalized.publicKeyJwk && normalized.publicKeyMultibase) {
+                    const { bytes } = multibaseDecode(normalized.publicKeyMultibase);
+                    if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {
+                        normalized.publicKeyJwk = { kty: "OKP", crv: "Ed25519", x: Buffer.from(bytes.slice(2)).toString("base64url") };
+                    }
+                }
+                return normalized;
+            });
+            return { ...base, status: "verified", verification: "verified_history", document,
+                history: { entries: entries.length, versionId: resolved.meta.versionId,
+                    versionIds: entries.map((entry) => entry.versionId),
+                    updated: resolved.meta.updated, logDigest: createHash("sha256").update(body).digest("hex"),
+                    sourceUrl: url.href, verifiedAt: (deps.now?.() ?? new Date()).toISOString() } };
+        }
+        catch (error) {
+            if (error instanceof ResolutionError)
+                return { ...base, status: error.status, reason: error.message };
+            // Network exceptions must not become assertions that an identity is invalid.
+            if (signal.aborted)
+                return { ...base, status: "unavailable", reason: "resolution_timeout" };
+            return { ...base, status: "invalid", reason: "identity_history_verification_failed" };
+        }
+    };
+}
+export const resolveIdentity = createIdentityResolver({ readLog: readIdentityLog });
+//# sourceMappingURL=resolve-identity.js.map

package/dist/sidecar/sidecar/src/ops/resolve-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-identity.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/resolve-identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,eAAe,EACf,iBAAiB,GAGlB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAuB7E,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG;YACnD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;YAClC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7D,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,qEAAqE;IACrE,yEAAyE;IACzE,OAAO,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM;QACvC,CAAC,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvD,KAAK,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,aAAa,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,YAAY,GAAG,eAAe,EAAE;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,CAAC,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IACvC,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5C,CAAC,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1E,WAAW,IAAI,wBAAwB,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,eAAgB,SAAQ,KAAK;IACjC,YAAqB,MAAiD,EAAE,OAAe;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,WAAM,GAAN,MAAM,CAA2C;IAEtE,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAQ,EAAE,MAAmB;IACjE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzH,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,UAAU,EAAE;YACnF,qEAAqE;YACrE,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG;oBAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;;oBACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;SACF,EAAE,CAAC,QAAQ,EAAE,EAAE;YACd,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAChC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,QAAQ,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpM,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,UAAU,EAAE,CAAC;gBAChG,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,kBAAkB,EAAE,CAAC;gBACtD,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;oBAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC/D,CAAC;;oBAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAClI,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS;QACxC,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,KAAK,CAAC;YACrE,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrI,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;IAC/F,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/E,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;KAC5H,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC,WAAW,EAAE,CAAC;AAQjB,MAAM,UAAU,sBAAsB,CAAC,IAAkC;IACvE,OAAO,KAAK,EAAE,MAAe,EAA+B,EAAE;QAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAgB,CAAC,CAAC,CAAC,aAAsB,EAAE,YAAY,EAAE,MAAe,EAAE,CAAC;QAC3J,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QACjH,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QAClG,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAC/C,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,eAAe;oBAAE,MAAM,KAAK,CAAC;gBAClD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAC3G,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB;gBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;YAC7G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB;gBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YACrG,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;YAClF,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3E,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACrD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;YAC5F,CAAC;YACD,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBACzC,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI;oBAC3D,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC,CAAC,EAAE,CAAC;gBACH,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;YACrF,CAAC;YACD,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAwB,EAAE;gBACjE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE;aACjE,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;YAC5F,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG;gBACtE,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBAC1D,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;YACrC,oEAAoE;YACpE,QAAQ,CAAC,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxE,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;gBAClI,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACpG,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;oBAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;oBACjE,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;wBAClE,UAAU,CAAC,YAAY,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBACjH,CAAC;gBACH,CAAC;gBACD,OAAO,UAAU,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ;gBAC9E,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;oBACpE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;oBACnD,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC1F,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACtG,6EAA6E;YAC7E,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC5F,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QACxF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC"}

package/dist/sidecar/sidecar/src/ops/rotate-identity.js

@@ -0,0 +1,37 @@
+// A thin wrapper around @kya-os/mcp-i's own IdentityManager.rotateDevIdentity
+// -- mirrors ops/ensure-identity.ts's own precedent of reusing existing
+// crypto/identity logic rather than reimplementing it, and its own doc
+// comment's reasoning for importing @kya-os/mcp-i as a normal package
+// specifier.
+import { IdentityManager } from "@kya-os/mcp-i";
+/**
+ * Force-generate a fresh Ed25519 keypair and persist it to `identityPath`,
+ * unconditionally overwriting whatever identity (if any) is already there.
+ * Unlike `ensureIdentity`, which loads an existing valid identity rather
+ * than replacing it, this always mints a new one -- the primitive
+ * `mcpi keys rotate` needs.
+ *
+ * `preserveDid`, when given, is reused as the rotated identity's DID
+ * instead of minting a fresh one -- the caller decides whether to keep the
+ * agent's DID stable across a rotation (the default) or mint a new one
+ * (`--new-did`); this op has no opinion of its own.
+ */
+export async function rotateIdentity(params) {
+    const { identityPath, preserveDid } = params;
+    if (typeof identityPath !== "string" || identityPath.length === 0) {
+        throw new Error("rotateIdentity: identityPath is required");
+    }
+    const manager = new IdentityManager({ environment: "development", devIdentityPath: identityPath });
+    const identity = await manager.rotateDevIdentity(typeof preserveDid === "string" && preserveDid.length > 0 ? preserveDid : undefined);
+    return {
+        did: identity.did,
+        kid: identity.kid,
+        privateKeyBase64: identity.privateKey,
+        publicKeyBase64: identity.publicKey,
+        createdAt: identity.createdAt,
+        // rotateDevIdentity() always sets lastRotated to the new identity's own
+        // createdAt -- see identity.ts's own doc comment.
+        lastRotated: identity.lastRotated,
+    };
+}
+//# sourceMappingURL=rotate-identity.js.map

package/dist/sidecar/sidecar/src/ops/rotate-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-identity.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/rotate-identity.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAgBhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAe;IAClD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAA8B,CAAC;IACrE,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAC9C,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CACpF,CAAC;IACF,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,gBAAgB,EAAE,QAAQ,CAAC,UAAU;QACrC,eAAe,EAAE,QAAQ,CAAC,SAAS;QACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,wEAAwE;QACxE,kDAAkD;QAClD,WAAW,EAAE,QAAQ,CAAC,WAAqB;KAC5C,CAAC;AACJ,CAAC"}

package/dist/sidecar/sidecar/src/ops/run-conformance.js

@@ -0,0 +1,78 @@
+/** Execute the pinned suite against installed public reference primitives.
+ * No supplied adapters, paths, URLs, executable code, clocks or keys are loaded. */
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { z } from "zod";
+import { SUITE, HARNESS } from "../conformance/pins.js";
+import { runConformance } from "../conformance/reference/runner.js";
+import { ReferenceConformanceAdapter } from "../conformance/reference/reference-adapter.js";
+const categories = ["signed-proof", "delegation-chain", "status-list", "did-key-resolution", "did-web-resolution", "card-proof", "entity-card", "audit-integrity", "negotiation"];
+const requestSchema = z.object({
+    files: z.array(z.object({ name: z.string().max(128), contents: z.string().max(262144) }).strict()).length(SUITE.files.length),
+    category: z.enum(categories).optional(),
+}).strict();
+const vectorSchema = z.object({
+    id: z.string().min(1).max(256),
+    category: z.enum(categories).optional(),
+    description: z.string().min(1),
+    expected: z.enum(["pass", "fail"]),
+    reason: z.string().min(1),
+    input: z.unknown(),
+}).passthrough();
+const vectorFileSchema = z.object({ version: z.string(), category: z.enum(categories), vectors: z.array(vectorSchema) }).passthrough();
+const sha256 = (value) => createHash("sha256").update(value, "utf8").digest("hex");
+export function pinnedVectors(params) {
+    const parsed = requestSchema.parse(params);
+    if (Buffer.byteLength(JSON.stringify(parsed), "utf8") > 1024 * 1024)
+        throw new Error("Conformance request exceeds bound");
+    const files = new Map(parsed.files.map((file) => [file.name, file.contents]));
+    if (files.size !== SUITE.files.length)
+        throw new Error("Duplicate conformance file");
+    if (`sha256:${sha256(JSON.stringify(SUITE.files))}` !== SUITE.vectorSetHash)
+        throw new Error("Pinned conformance manifest is inconsistent");
+    const vectors = [];
+    const ids = new Set();
+    for (const [name, expectedDigest] of SUITE.files) {
+        const raw = files.get(name);
+        if (raw === undefined || sha256(raw) !== expectedDigest)
+            throw new Error(`Conformance integrity mismatch: ${name}`);
+        const file = vectorFileSchema.parse(JSON.parse(raw));
+        for (const vector of file.vectors) {
+            if (ids.has(vector.id) || (vector.category !== undefined && vector.category !== file.category) || !("input" in vector))
+                throw new Error("Conflicting conformance vector identity or category");
+            ids.add(vector.id);
+            vectors.push({ ...vector, category: file.category });
+        }
+    }
+    if (vectors.length !== SUITE.vectorCount)
+        throw new Error("Conformance vector count differs from its pin");
+    return { vectors: parsed.category ? vectors.filter((v) => v.category === parsed.category) : vectors, category: parsed.category };
+}
+export async function runConformanceSuite(params) {
+    const { vectors, category } = pinnedVectors(params);
+    const report = await runConformance(new ReferenceConformanceAdapter(), vectors);
+    const implementation = createRequire(import.meta.url)("@kya-os/mcp/package.json");
+    const results = report.results.map((result) => ({
+        id: result.id, category: result.category, description: result.description,
+        expected: result.expected, actual: result.actual,
+        status: result.actual === "error" ? "indeterminate" : result.ok ? "passed" : "failed",
+        ...(result.detail ? { detail: result.detail } : {}),
+    }));
+    const passed = results.filter((r) => r.status === "passed").length;
+    const failed = results.filter((r) => r.status === "failed").length;
+    const indeterminate = results.length - passed - failed;
+    return {
+        version: 1,
+        status: failed ? "failed" : indeterminate ? "indeterminate" : "passed",
+        suiteVersion: SUITE.suiteVersion,
+        vectorSetHash: SUITE.vectorSetHash,
+        pinnedPackageVersion: SUITE.pinnedAt.packageVersion,
+        harnessCommit: HARNESS.commit,
+        harnessSourceDigest: HARNESS.sourceDigest,
+        implementationName: implementation.name,
+        implementationVersion: implementation.version,
+        ...(category ? { category } : {}),
+        total: results.length, passed, failed, indeterminate, results,
+    };
+}
+//# sourceMappingURL=run-conformance.js.map

package/dist/sidecar/sidecar/src/ops/run-conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-conformance.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/run-conformance.ts"],"names":[],"mappings":"AAAA;oFACoF;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAG5F,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAU,CAAC;AAC3L,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IAC9H,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC,WAAW,EAAE,CAAC;AACjB,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACvI,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3F,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACrF,IAAI,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5I,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QACpH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC/L,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAuB,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC3G,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACnI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAe;IACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,2BAA2B,EAAE,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,0BAA0B,CAAsC,CAAC;IACvH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;QACzE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QAChD,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACrF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;QACtE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QACnD,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,mBAAmB,EAAE,OAAO,CAAC,YAAY;QACzC,kBAAkB,EAAE,cAAc,CAAC,IAAI;QACvC,qBAAqB,EAAE,cAAc,CAAC,OAAO;QAC7C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO;KAC9D,CAAC;AACJ,CAAC"}

package/dist/sidecar/sidecar/src/ops/sign-with-ed25519-seed.js

@@ -0,0 +1,12 @@
+import { signWithEd25519Seed as signRaw } from "../ssh-key.js";
+export async function signWithEd25519Seed(params) {
+    const { seedBase64, payloadBase64 } = params;
+    if (typeof seedBase64 !== "string" || typeof payloadBase64 !== "string") {
+        throw new Error("signWithEd25519Seed: seedBase64 and payloadBase64 are required");
+    }
+    const seed = Buffer.from(seedBase64, "base64");
+    const payload = Buffer.from(payloadBase64, "base64");
+    const signature = signRaw(seed, payload);
+    return { signatureBase64: signature.toString("base64") };
+}
+//# sourceMappingURL=sign-with-ed25519-seed.js.map

package/dist/sidecar/sidecar/src/ops/sign-with-ed25519-seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-with-ed25519-seed.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/sign-with-ed25519-seed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,IAAI,OAAO,EAAE,MAAM,eAAe,CAAC;AAW/D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAe;IACvD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAmC,CAAC;IAC1E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/dist/sidecar/sidecar/src/ops/sign.js

@@ -0,0 +1,24 @@
+import { createPrivateKey, sign as edSign } from "node:crypto";
+import { loadCurrentIdentity } from "../identity-manager.js";
+export async function sign(params) {
+    const { cwd, payloadBase64 } = params;
+    if (typeof cwd !== "string" || typeof payloadBase64 !== "string") {
+        throw new Error("sign: cwd and payloadBase64 are required");
+    }
+    const identity = loadCurrentIdentity(cwd);
+    if (!identity) {
+        throw new Error("sign: no agent identity configured (run `kya-os register`)");
+    }
+    const privateKey = createPrivateKey({
+        key: Buffer.from(identity.privateKey, "base64"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const signature = edSign(null, Buffer.from(payloadBase64, "base64"), privateKey);
+    return {
+        signatureBase64: signature.toString("base64"),
+        kid: identity.kid,
+        did: identity.did,
+    };
+}
+//# sourceMappingURL=sign.js.map

package/dist/sidecar/sidecar/src/ops/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAa7D,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAe;IACxC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,MAAoB,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC/C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;IAEjF,OAAO;QACL,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;KAClB,CAAC;AACJ,CAAC"}

package/dist/sidecar/sidecar/src/ops/verify-audit-bundle.js

@@ -0,0 +1,139 @@
+/** Offline audit verification. All trust comes from caller-supplied policy and
+ * public keys. Bundle-provided keys, URLs and reports never bootstrap trust. */
+import { z } from "zod";
+import { AUDIT_REASON_CODES, CompactJwsAuditSignatureVerifier, CryptoProviderAuditHasher, parseAuditVerificationPolicy, verifyAuditBundle as referenceVerifyAuditBundle, } from "@kya-os/mcp/audit";
+import { NodeCryptoProvider } from "@kya-os/mcp/providers";
+export const AUDIT_MAX_BUNDLE_BYTES = 8 * 1024 * 1024;
+export const AUDIT_MAX_TRUST_BYTES = 256 * 1024;
+const unavailableKey = "AUDIT_VERIFICATION_KEY_UNAVAILABLE";
+const dimensions = ["cryptographicIntegrity", "chainIntegrity", "checkpointIntegrity", "anchorIntegrity",
+    "scopeEvidenceCompleteness", "authorizedAsObserved", "currentAuthorization"];
+const commonKey = {
+    x: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    kid: z.string().min(1).max(2304).optional(),
+    use: z.literal("sig").optional(),
+    key_ops: z.array(z.literal("verify")).max(1).optional(),
+    ext: z.boolean().optional(),
+};
+// Private/symmetric key material and unknown JWK extensions are refused rather
+// than transported into the long-lived sidecar as verification collateral.
+const publicKey = z.discriminatedUnion("kty", [
+    z.object({ ...commonKey, kty: z.literal("OKP"), crv: z.literal("Ed25519"), alg: z.literal("EdDSA").optional() }).strict(),
+    z.object({ ...commonKey, kty: z.literal("EC"), crv: z.literal("P-256"), y: z.string().regex(/^[A-Za-z0-9_-]{43}$/), alg: z.literal("ES256").optional() }).strict(),
+]);
+const keyFileSchema = z.object({ keys: z.array(z.object({ kid: z.string().min(1).max(2304), jwk: publicKey }).strict()).max(256) }).strict().superRefine((file, context) => {
+    const ids = new Set();
+    file.keys.forEach((entry, index) => {
+        if (ids.has(entry.kid) || (entry.jwk.kid !== undefined && entry.jwk.kid !== entry.kid)) {
+            context.addIssue({ code: "custom", path: ["keys", index], message: "duplicate or mismatched key ID" });
+        }
+        ids.add(entry.kid);
+    });
+});
+const requestSchema = z.object({ bundle: z.unknown(), policy: z.unknown(), keys: z.unknown() }).strict();
+export function auditReportStatus(report) {
+    const outcomes = dimensions.map((name) => report[name].verdict);
+    return outcomes.includes("invalid") ? "invalid" : outcomes.includes("indeterminate") ? "indeterminate" : "valid";
+}
+function signatureReason(payload) {
+    const parsed = JSON.parse(new TextDecoder().decode(payload));
+    if (!parsed || typeof parsed !== "object" || !("schema" in parsed))
+        return undefined;
+    switch (parsed.schema) {
+        case "https://schema.kya-os.org/v1/protocol/audit/bundle-manifest/v1.0.0": return AUDIT_REASON_CODES.BUNDLE_SIGNATURE_INVALID;
+        case "https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0": return AUDIT_REASON_CODES.SIGNATURE_INVALID;
+        case "https://schema.kya-os.org/v1/protocol/audit/checkpoint/v1.0.0": return AUDIT_REASON_CODES.CHECKPOINT_SIGNATURE_INVALID;
+        case "https://schema.kya-os.org/v1/protocol/audit/observation/v1.0.0": return AUDIT_REASON_CODES.OBSERVATION_SIGNATURE_INVALID;
+        default: return undefined;
+    }
+}
+function normalizeMissingKeys(report, missingReasons, provenInvalidReasons) {
+    const normalized = { ...report };
+    for (const name of dimensions) {
+        const dimension = report[name];
+        const affected = dimension.reasonCodes.filter((reason) => missingReasons.has(reason));
+        if (!affected.length)
+            continue;
+        const retained = dimension.reasonCodes.filter((reason) => !missingReasons.has(reason) || provenInvalidReasons.has(reason));
+        // NOT_EVALUATED accompanies observer freshness or supporting anchors when
+        // this offline verifier lacks a clock/adapter. It is absence of evidence,
+        // not an independently proven failure. Treat only this SDK reason as
+        // unknown here; preserve every known-key signature/digest/scope failure and
+        // any unrecognized reason rather than broadly downgrading a refusal.
+        const onlyUnevaluated = retained.every((reason) => reason === AUDIT_REASON_CODES.NOT_EVALUATED);
+        const verdict = dimension.verdict === "invalid" && onlyUnevaluated ? "indeterminate" : dimension.verdict;
+        normalized[name] = { verdict, reasonCodes: [...new Set([...retained, unavailableKey])].sort() };
+    }
+    return normalized;
+}
+function exceeds(value, max) {
+    const encoded = JSON.stringify(value);
+    return encoded === undefined || Buffer.byteLength(encoded) > max;
+}
+export async function verifyAuditBundle(params) {
+    const parsed = requestSchema.safeParse(params);
+    if (!parsed.success)
+        return { version: 1, status: "invalid", missingKeyIds: [], reason: "audit_request_invalid" };
+    const { bundle, policy, keys: keyFile } = parsed.data;
+    if (exceeds(bundle, AUDIT_MAX_BUNDLE_BYTES) || exceeds(policy, AUDIT_MAX_TRUST_BYTES) || exceeds(keyFile, AUDIT_MAX_TRUST_BYTES)) {
+        return { version: 1, status: "indeterminate", missingKeyIds: [], reason: "audit_input_limit" };
+    }
+    let approvedPolicy;
+    try {
+        approvedPolicy = parseAuditVerificationPolicy(policy);
+    }
+    catch {
+        return { version: 1, status: "invalid", missingKeyIds: [], reason: "verification_policy_invalid" };
+    }
+    const parsedKeys = keyFileSchema.safeParse(keyFile);
+    if (!parsedKeys.success)
+        return { version: 1, status: "invalid", missingKeyIds: [], reason: "verification_keys_invalid" };
+    // Bound cryptographic work as well as bytes. Reference schema validation
+    // remains authoritative; this only refuses workloads beyond this CLI limit.
+    const components = typeof bundle === "object" && bundle !== null && "components" in bundle ? bundle.components : undefined;
+    if (Array.isArray(components) && (components.length > 256 || components.reduce((total, component) => {
+        const content = component && typeof component === "object" && "content" in component ? component.content : undefined;
+        return total + (Array.isArray(content) ? content.length : 1);
+    }, 0) > 10000)) {
+        return { version: 1, status: "indeterminate", missingKeyIds: [], reason: "audit_artifact_limit" };
+    }
+    const keys = new Map(parsedKeys.data.keys.map((entry) => [entry.kid, entry.jwk]));
+    const missingKeyIds = new Set();
+    const missingReasons = new Set();
+    const invalidReasons = new Set();
+    const signatures = {
+        async verify(payload, jws, signer) {
+            let keyMissing = false;
+            const verifier = new CompactJwsAuditSignatureVerifier({
+                async resolve(requested) {
+                    const key = keys.get(requested.kid);
+                    if (!key) {
+                        keyMissing = true;
+                        missingKeyIds.add(requested.kid);
+                    }
+                    return key ?? null;
+                },
+            });
+            const valid = await verifier.verify(payload, jws, signer);
+            if (!valid) {
+                const reason = signatureReason(payload);
+                if (reason)
+                    (keyMissing ? missingReasons : invalidReasons).add(reason);
+            }
+            return valid;
+        },
+    };
+    try {
+        const referenceReport = await referenceVerifyAuditBundle(bundle, approvedPolicy, {
+            hasher: new CryptoProviderAuditHasher(new NodeCryptoProvider()), signatures,
+        });
+        const report = normalizeMissingKeys(referenceReport, missingReasons, invalidReasons);
+        return { version: 1, status: auditReportStatus(report), report,
+            ...(missingKeyIds.size ? { referenceReport, reason: "verification_keys_unavailable" } : {}),
+            missingKeyIds: [...missingKeyIds].sort() };
+    }
+    catch {
+        return { version: 1, status: "indeterminate", missingKeyIds: [...missingKeyIds].sort(), reason: "reference_verifier_unavailable" };
+    }
+}
+//# sourceMappingURL=verify-audit-bundle.js.map

package/dist/sidecar/sidecar/src/ops/verify-audit-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-audit-bundle.js","sourceRoot":"","sources":["../../../../../sidecar/src/ops/verify-audit-bundle.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,iBAAiB,IAAI,0BAA0B,GAKhD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AAChD,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,UAAU,GAAG,CAAC,wBAAwB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB;IACtG,2BAA2B,EAAE,sBAAsB,EAAE,sBAAsB,CAAU,CAAC;AAExF,MAAM,SAAS,GAAG;IAChB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,SAAS,GAAG,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE;IAC5C,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACzH,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACnK,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IACzK,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAYzG,MAAM,UAAU,iBAAiB,CAAC,MAAiC;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;AACnH,CAAC;AAED,SAAS,eAAe,CAAC,OAAmB;IAC1C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,oEAAoE,CAAC,CAAC,OAAO,kBAAkB,CAAC,wBAAwB,CAAC;QAC9H,KAAK,4DAA4D,CAAC,CAAC,OAAO,kBAAkB,CAAC,iBAAiB,CAAC;QAC/G,KAAK,+DAA+D,CAAC,CAAC,OAAO,kBAAkB,CAAC,4BAA4B,CAAC;QAC7H,KAAK,gEAAgE,CAAC,CAAC,OAAO,kBAAkB,CAAC,6BAA6B,CAAC;QAC/H,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAiC,EACjC,cAA2B,EAC3B,oBAAiC;IAEjC,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,SAAS;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3H,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAChG,MAAM,OAAO,GAA0C,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QAChJ,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,GAAW;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAe;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,MAAM,EAAE,sBAAsB,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACjI,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,cAAc,CAAC;IACnB,IAAI,CAAC;QAAC,cAAc,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC9D,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAAC,CAAC;IAC7G,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC1H,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3H,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAClG,MAAM,OAAO,GAAG,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACrH,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,EAAE,CAAC,CAAC,GAAG,KAAM,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,UAAU,GAA2B;QACzC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAC/B,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,gCAAgC,CAAC;gBACpD,KAAK,CAAC,OAAO,CAAC,SAAS;oBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACpC,IAAI,CAAC,GAAG,EAAE,CAAC;wBAAC,UAAU,GAAG,IAAI,CAAC;wBAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAC,CAAC;oBAClE,OAAO,GAAG,IAAI,IAAI,CAAC;gBACrB,CAAC;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,MAAM;oBAAE,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE;YAC/E,MAAM,EAAE,IAAI,yBAAyB,CAAC,IAAI,kBAAkB,EAAE,CAAC,EAAE,UAAU;SAC5E,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM;YAC5D,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACrI,CAAC;AACH,CAAC"}