@longarc/mdash 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (55) hide show
  1. package/README.md +278 -0
  2. package/dist/checkpoint/engine.d.ts +208 -0
  3. package/dist/checkpoint/engine.d.ts.map +1 -0
  4. package/dist/checkpoint/engine.js +369 -0
  5. package/dist/checkpoint/engine.js.map +1 -0
  6. package/dist/context/engine.d.ts +197 -0
  7. package/dist/context/engine.d.ts.map +1 -0
  8. package/dist/context/engine.js +392 -0
  9. package/dist/context/engine.js.map +1 -0
  10. package/dist/core/commitment.d.ts +154 -0
  11. package/dist/core/commitment.d.ts.map +1 -0
  12. package/dist/core/commitment.js +305 -0
  13. package/dist/core/commitment.js.map +1 -0
  14. package/dist/core/crypto.d.ts +100 -0
  15. package/dist/core/crypto.d.ts.map +1 -0
  16. package/dist/core/crypto.js +243 -0
  17. package/dist/core/crypto.js.map +1 -0
  18. package/dist/index.d.ts +121 -0
  19. package/dist/index.d.ts.map +1 -0
  20. package/dist/index.js +234 -0
  21. package/dist/index.js.map +1 -0
  22. package/dist/mcca/engine.d.ts +260 -0
  23. package/dist/mcca/engine.d.ts.map +1 -0
  24. package/dist/mcca/engine.js +518 -0
  25. package/dist/mcca/engine.js.map +1 -0
  26. package/dist/physics/engine.d.ts +165 -0
  27. package/dist/physics/engine.d.ts.map +1 -0
  28. package/dist/physics/engine.js +371 -0
  29. package/dist/physics/engine.js.map +1 -0
  30. package/dist/tee/engine.d.ts +285 -0
  31. package/dist/tee/engine.d.ts.map +1 -0
  32. package/dist/tee/engine.js +505 -0
  33. package/dist/tee/engine.js.map +1 -0
  34. package/dist/warrant/engine.d.ts +195 -0
  35. package/dist/warrant/engine.d.ts.map +1 -0
  36. package/dist/warrant/engine.js +409 -0
  37. package/dist/warrant/engine.js.map +1 -0
  38. package/dist/zk/engine.d.ts +243 -0
  39. package/dist/zk/engine.d.ts.map +1 -0
  40. package/dist/zk/engine.js +489 -0
  41. package/dist/zk/engine.js.map +1 -0
  42. package/package.json +25 -0
  43. package/src/__tests__/phase1.test.ts +1120 -0
  44. package/src/__tests__/phase2-4.test.ts +898 -0
  45. package/src/checkpoint/engine.ts +532 -0
  46. package/src/context/engine.ts +598 -0
  47. package/src/core/commitment.ts +438 -0
  48. package/src/core/crypto.ts +304 -0
  49. package/src/index.ts +320 -0
  50. package/src/mcca/engine.ts +778 -0
  51. package/src/physics/engine.ts +563 -0
  52. package/src/tee/engine.ts +810 -0
  53. package/src/warrant/engine.ts +625 -0
  54. package/src/zk/engine.ts +730 -0
  55. package/tsconfig.json +21 -0
@@ -0,0 +1,305 @@
1
+ /**
2
+ * mdash v3.0 - Commitment Layer (L1)
3
+ *
4
+ * Sub-millisecond cryptographic commitments.
5
+ * "The seal races the attack."
6
+ *
7
+ * Target Latency:
8
+ * - Commitment seal: <0.5ms P50, <1ms P99
9
+ * - Merkle proof: <0.1ms
10
+ */
11
+ import { sha256, sha256Object, rollingHash, hmacSeal, hmacVerify, deriveKey, generateTimestamp, constantTimeEqual, } from './crypto';
12
+ // ============================================================================
13
+ // MERKLE TREE - Incremental for streaming support
14
+ // ============================================================================
15
+ export class IncrementalMerkleTree {
16
+ leaves = [];
17
+ levels = [];
18
+ maxDepth;
19
+ constructor(maxDepth = 20) {
20
+ this.maxDepth = maxDepth;
21
+ }
22
+ /**
23
+ * Add a leaf to the tree
24
+ * O(log n) operation
25
+ */
26
+ async addLeaf(hash) {
27
+ const index = this.leaves.length;
28
+ if (index >= Math.pow(2, this.maxDepth)) {
29
+ throw new Error(`Tree capacity exceeded: max ${Math.pow(2, this.maxDepth)} leaves`);
30
+ }
31
+ this.leaves.push(hash);
32
+ await this.updatePath(index);
33
+ return index;
34
+ }
35
+ /**
36
+ * Update the Merkle path for a new leaf
37
+ * Incrementally updates only affected nodes
38
+ */
39
+ async updatePath(leafIndex) {
40
+ const leafHash = this.leaves[leafIndex];
41
+ if (!leafHash) {
42
+ throw new Error(`Leaf not found at index ${leafIndex}`);
43
+ }
44
+ let currentHash = leafHash;
45
+ let currentIndex = leafIndex;
46
+ for (let level = 0; level < this.maxDepth; level++) {
47
+ const levelArray = this.levels[level] ?? (this.levels[level] = []);
48
+ const siblingIndex = currentIndex ^ 1; // XOR to get sibling
49
+ const parentIndex = currentIndex >> 1; // Divide by 2
50
+ // Get sibling hash (empty hash if doesn't exist)
51
+ const siblingHash = levelArray[siblingIndex] ?? await sha256('');
52
+ // Store current hash at this level
53
+ levelArray[currentIndex] = currentHash;
54
+ // Compute parent hash
55
+ if (currentIndex % 2 === 0) {
56
+ currentHash = await rollingHash([currentHash, siblingHash]);
57
+ }
58
+ else {
59
+ currentHash = await rollingHash([siblingHash, currentHash]);
60
+ }
61
+ currentIndex = parentIndex;
62
+ }
63
+ }
64
+ /**
65
+ * Get the current root hash
66
+ */
67
+ async getRoot() {
68
+ if (this.leaves.length === 0) {
69
+ return sha256('empty');
70
+ }
71
+ // Root is at the top level
72
+ const topLevel = this.levels[this.maxDepth - 1];
73
+ return topLevel?.[0] || await sha256('');
74
+ }
75
+ /**
76
+ * Generate Merkle proof for a leaf
77
+ * O(log n) operation
78
+ */
79
+ async getProof(leafIndex) {
80
+ if (leafIndex < 0 || leafIndex >= this.leaves.length) {
81
+ throw new Error(`Invalid leaf index: ${leafIndex}`);
82
+ }
83
+ const path = [];
84
+ let currentIndex = leafIndex;
85
+ for (let level = 0; level < this.maxDepth; level++) {
86
+ const siblingIndex = currentIndex ^ 1;
87
+ const levelArray = this.levels[level];
88
+ const siblingHash = levelArray?.[siblingIndex] ?? await sha256('');
89
+ path.push({
90
+ hash: siblingHash,
91
+ position: currentIndex % 2 === 0 ? 'right' : 'left',
92
+ });
93
+ currentIndex = currentIndex >> 1;
94
+ }
95
+ return path;
96
+ }
97
+ /**
98
+ * Verify a Merkle proof
99
+ * O(log n) operation
100
+ */
101
+ static async verifyProof(leafHash, proof, expectedRoot) {
102
+ let currentHash = leafHash;
103
+ for (const node of proof) {
104
+ if (node.position === 'left') {
105
+ currentHash = await rollingHash([node.hash, currentHash]);
106
+ }
107
+ else {
108
+ currentHash = await rollingHash([currentHash, node.hash]);
109
+ }
110
+ }
111
+ return constantTimeEqual(currentHash, expectedRoot);
112
+ }
113
+ /**
114
+ * Get tree statistics
115
+ */
116
+ getStats() {
117
+ return {
118
+ leaves: this.leaves.length,
119
+ depth: Math.ceil(Math.log2(this.leaves.length + 1)),
120
+ capacity: Math.pow(2, this.maxDepth),
121
+ };
122
+ }
123
+ }
124
+ // ============================================================================
125
+ // COMMITMENT ENGINE
126
+ // ============================================================================
127
+ export class CommitmentEngine {
128
+ key = null;
129
+ tree;
130
+ commitments = new Map();
131
+ constructor(maxTreeDepth = 20) {
132
+ this.tree = new IncrementalMerkleTree(maxTreeDepth);
133
+ }
134
+ /**
135
+ * Initialize the engine with a seal key
136
+ */
137
+ async initialize(sealKey) {
138
+ this.key = await deriveKey(sealKey);
139
+ }
140
+ /**
141
+ * Create a commitment for content
142
+ * Target: <0.5ms P50, <1ms P99
143
+ */
144
+ async commit(content, id) {
145
+ if (!this.key) {
146
+ throw new Error('Engine not initialized. Call initialize() first.');
147
+ }
148
+ const startTime = performance.now();
149
+ // Hash the content
150
+ const contentHash = await sha256Object(content);
151
+ const timestamp = generateTimestamp();
152
+ // Create the commitment record
153
+ const commitmentData = {
154
+ _v: 1, // Protocol version for upgrade path
155
+ id,
156
+ content_hash: contentHash,
157
+ committed_at: timestamp,
158
+ };
159
+ // Seal the commitment
160
+ const seal = await hmacSeal(commitmentData, this.key);
161
+ const commitment = {
162
+ id,
163
+ content_hash: contentHash,
164
+ committed_at: timestamp,
165
+ seal,
166
+ version: 'v3.0',
167
+ };
168
+ // Add to Merkle tree
169
+ await this.tree.addLeaf(contentHash);
170
+ // Store commitment
171
+ this.commitments.set(id, commitment);
172
+ const elapsed = performance.now() - startTime;
173
+ if (elapsed > 1) {
174
+ console.warn(`Commitment latency exceeded P99: ${elapsed.toFixed(2)}ms`);
175
+ }
176
+ return commitment;
177
+ }
178
+ /**
179
+ * Get a commitment by ID
180
+ */
181
+ getCommitment(id) {
182
+ return this.commitments.get(id);
183
+ }
184
+ /**
185
+ * Verify a commitment
186
+ */
187
+ async verify(commitment) {
188
+ if (!this.key) {
189
+ throw new Error('Engine not initialized. Call initialize() first.');
190
+ }
191
+ const commitmentData = {
192
+ _v: 1,
193
+ id: commitment.id,
194
+ content_hash: commitment.content_hash,
195
+ committed_at: commitment.committed_at,
196
+ };
197
+ return hmacVerify(commitmentData, commitment.seal, this.key);
198
+ }
199
+ /**
200
+ * Generate a proof for a commitment
201
+ */
202
+ async generateProof(id) {
203
+ const commitment = this.commitments.get(id);
204
+ if (!commitment) {
205
+ throw new Error(`Commitment not found: ${id}`);
206
+ }
207
+ // Find leaf index
208
+ const leafIndex = Array.from(this.commitments.keys()).indexOf(id);
209
+ const merkle_path = await this.tree.getProof(leafIndex);
210
+ const root_hash = await this.tree.getRoot();
211
+ return {
212
+ commitment,
213
+ merkle_path,
214
+ root_hash,
215
+ leaf_index: leafIndex,
216
+ };
217
+ }
218
+ /**
219
+ * Verify a proof
220
+ */
221
+ async verifyProof(proof) {
222
+ // First verify the commitment seal
223
+ const commitmentValid = await this.verify(proof.commitment);
224
+ if (!commitmentValid) {
225
+ return false;
226
+ }
227
+ // Then verify the Merkle path
228
+ return IncrementalMerkleTree.verifyProof(proof.commitment.content_hash, proof.merkle_path, proof.root_hash);
229
+ }
230
+ /**
231
+ * Get the current Merkle root
232
+ */
233
+ async getRoot() {
234
+ return this.tree.getRoot();
235
+ }
236
+ /**
237
+ * Get statistics
238
+ */
239
+ getStats() {
240
+ return {
241
+ commitments: this.commitments.size,
242
+ treeStats: this.tree.getStats(),
243
+ };
244
+ }
245
+ }
246
+ export class LatencyMonitor {
247
+ metrics = new Map();
248
+ thresholds = new Map();
249
+ constructor() {
250
+ // Default thresholds from v3.0 spec
251
+ this.thresholds.set('commitment_seal', { p50: 0.5, p99: 1 });
252
+ this.thresholds.set('merkle_proof', { p50: 0.05, p99: 0.1 });
253
+ this.thresholds.set('context_chunk_seal', { p50: 2, p99: 5 });
254
+ this.thresholds.set('checkpoint_create', { p50: 0.5, p99: 1 });
255
+ }
256
+ /**
257
+ * Record a latency sample
258
+ */
259
+ record(operation, latencyMs) {
260
+ if (!this.metrics.has(operation)) {
261
+ this.metrics.set(operation, []);
262
+ }
263
+ this.metrics.get(operation).push(latencyMs);
264
+ }
265
+ /**
266
+ * Get metrics for an operation
267
+ */
268
+ getMetrics(operation) {
269
+ const samples = this.metrics.get(operation);
270
+ if (!samples || samples.length === 0) {
271
+ return null;
272
+ }
273
+ const sorted = [...samples].sort((a, b) => a - b);
274
+ const p50Index = Math.floor(sorted.length * 0.5);
275
+ const p99Index = Math.floor(sorted.length * 0.99);
276
+ const threshold = this.thresholds.get(operation);
277
+ const p50 = sorted[p50Index] ?? 0;
278
+ const p99 = sorted[p99Index] ?? 0;
279
+ return {
280
+ operation,
281
+ p50_ms: p50,
282
+ p99_ms: p99,
283
+ count: samples.length,
284
+ breaches: threshold ? samples.filter(s => s > threshold.p99).length : 0,
285
+ };
286
+ }
287
+ /**
288
+ * Check if operation is within SLA
289
+ */
290
+ isWithinSLA(operation) {
291
+ const metrics = this.getMetrics(operation);
292
+ const threshold = this.thresholds.get(operation);
293
+ if (!metrics || !threshold) {
294
+ return true;
295
+ }
296
+ return metrics.p99_ms <= threshold.p99;
297
+ }
298
+ /**
299
+ * Clear metrics
300
+ */
301
+ clear() {
302
+ this.metrics.clear();
303
+ }
304
+ }
305
+ //# sourceMappingURL=commitment.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"commitment.js","sourceRoot":"","sources":["../../src/core/commitment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAIL,MAAM,EACN,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAuClB,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAE/E,MAAM,OAAO,qBAAqB;IACxB,MAAM,GAAW,EAAE,CAAC;IACpB,MAAM,GAAa,EAAE,CAAC;IACb,QAAQ,CAAS;IAElC,YAAY,WAAmB,EAAE;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAEjC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,SAAiB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,WAAW,GAAS,QAAQ,CAAC;QACjC,IAAI,YAAY,GAAG,SAAS,CAAC;QAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAEnE,MAAM,YAAY,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,qBAAqB;YAC5D,MAAM,WAAW,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,cAAc;YAErD,iDAAiD;YACjD,MAAM,WAAW,GAAS,UAAU,CAAC,YAAY,CAAC,IAAI,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC;YAEvE,mCAAmC;YACnC,UAAU,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;YAEvC,sBAAsB;YACtB,IAAI,YAAY,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,WAAW,GAAG,MAAM,WAAW,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,MAAM,WAAW,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC9D,CAAC;YAED,YAAY,GAAG,WAAW,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,IAAI,GAAqB,EAAE,CAAC;QAClC,IAAI,YAAY,GAAG,SAAS,CAAC;QAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,YAAY,GAAG,YAAY,GAAG,CAAC,CAAC;YACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,WAAW,GAAS,UAAU,EAAE,CAAC,YAAY,CAAC,IAAI,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC;YAEzE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;aACpD,CAAC,CAAC;YAEH,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,QAAc,EACd,KAAuB,EACvB,YAAkB;QAElB,IAAI,WAAW,GAAG,QAAQ,CAAC;QAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC7B,WAAW,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,MAAM,WAAW,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,iBAAiB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC;SACrC,CAAC;IACJ,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,OAAO,gBAAgB;IACnB,GAAG,GAAqB,IAAI,CAAC;IAC7B,IAAI,CAAwB;IAC5B,WAAW,GAA4B,IAAI,GAAG,EAAE,CAAC;IAEzD,YAAY,eAAuB,EAAE;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,IAAI,CAAC,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAI,OAAU,EAAE,EAAU;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,mBAAmB;QACnB,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAEtC,+BAA+B;QAC/B,MAAM,cAAc,GAAG;YACrB,EAAE,EAAE,CAAC,EAAE,oCAAoC;YAC3C,EAAE;YACF,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,SAAS;SACxB,CAAC;QAEF,sBAAsB;QACtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAe;YAC7B,EAAE;YACF,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,SAAS;YACvB,IAAI;YACJ,OAAO,EAAE,MAAM;SAChB,CAAC;QAEF,qBAAqB;QACrB,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAErC,mBAAmB;QACnB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC9C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,UAAsB;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,cAAc,GAAG;YACrB,EAAE,EAAE,CAAC;YACL,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAC;QAEF,OAAO,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,kBAAkB;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAE5C,OAAO;YACL,UAAU;YACV,WAAW;YACX,SAAS;YACT,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAsB;QACtC,mCAAmC;QACnC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,8BAA8B;QAC9B,OAAO,qBAAqB,CAAC,WAAW,CACtC,KAAK,CAAC,UAAU,CAAC,YAAY,EAC7B,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ;QAIN,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAClC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;SAChC,CAAC;IACJ,CAAC;CACF;AAcD,MAAM,OAAO,cAAc;IACjB,OAAO,GAA0B,IAAI,GAAG,EAAE,CAAC;IAC3C,UAAU,GAA8C,IAAI,GAAG,EAAE,CAAC;IAE1E;QACE,oCAAoC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAiB,EAAE,SAAiB;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAElC,OAAO;YACL,SAAS;YACT,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACxE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAiB;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}
@@ -0,0 +1,100 @@
1
+ /**
2
+ * mdash v3.0 - Cryptographic Core
3
+ *
4
+ * "LLM at the edges, cryptography at the core."
5
+ *
6
+ * All cryptographic operations use Web Crypto API for:
7
+ * - Hardware acceleration where available
8
+ * - Constant-time operations (timing attack resistance)
9
+ * - Non-extractable key material
10
+ */
11
+ export type Hash = string & {
12
+ readonly __brand: 'Hash';
13
+ };
14
+ export type Seal = string & {
15
+ readonly __brand: 'Seal';
16
+ };
17
+ export type Timestamp = string & {
18
+ readonly __brand: 'Timestamp';
19
+ };
20
+ export type FragmentId = string & {
21
+ readonly __brand: 'FragmentId';
22
+ };
23
+ export type WarrantId = string & {
24
+ readonly __brand: 'WarrantId';
25
+ };
26
+ export type CheckpointId = string & {
27
+ readonly __brand: 'CheckpointId';
28
+ };
29
+ export declare function isHash(value: unknown): value is Hash;
30
+ export declare function isSeal(value: unknown): value is Seal;
31
+ export declare function isTimestamp(value: unknown): value is Timestamp;
32
+ export declare function isFragmentId(value: unknown): value is FragmentId;
33
+ export declare function isWarrantId(value: unknown): value is WarrantId;
34
+ export declare function isCheckpointId(value: unknown): value is CheckpointId;
35
+ /**
36
+ * SHA-256 hash of a string
37
+ * Returns lowercase hex (64 characters)
38
+ */
39
+ export declare function sha256(input: string): Promise<Hash>;
40
+ /**
41
+ * SHA-256 hash of an object using deterministic serialization
42
+ * Keys are sorted at all nesting levels
43
+ */
44
+ export declare function sha256Object(obj: unknown): Promise<Hash>;
45
+ /**
46
+ * SHA-256 hash of binary data
47
+ */
48
+ export declare function sha256Binary(data: ArrayBuffer): Promise<Hash>;
49
+ /**
50
+ * Rolling hash of multiple hashes (for Merkle tree nodes)
51
+ * Order matters: H(a, b) ≠ H(b, a)
52
+ */
53
+ export declare function rollingHash(hashes: Hash[]): Promise<Hash>;
54
+ /**
55
+ * JSON.stringify with sorted keys at all nesting levels
56
+ * Ensures {a:1, b:2} and {b:2, a:1} produce identical output
57
+ */
58
+ export declare function deterministicStringify(obj: unknown): string;
59
+ /**
60
+ * Derive an HMAC key from a master key using HKDF
61
+ * The derived key is non-extractable
62
+ */
63
+ export declare function deriveKey(masterKey: string): Promise<CryptoKey>;
64
+ /**
65
+ * Create HMAC seal of content
66
+ */
67
+ export declare function hmacSeal(content: unknown, key: CryptoKey): Promise<Seal>;
68
+ /**
69
+ * Verify HMAC seal
70
+ */
71
+ export declare function hmacVerify(content: unknown, seal: Seal, key: CryptoKey): Promise<boolean>;
72
+ /**
73
+ * Compare two strings in constant time
74
+ * Prevents timing attacks on seal/hash comparison
75
+ */
76
+ export declare function constantTimeEqual(a: string, b: string): boolean;
77
+ /**
78
+ * Generate a new fragment ID (UUID v4)
79
+ */
80
+ export declare function generateFragmentId(): FragmentId;
81
+ /**
82
+ * Generate a new warrant ID
83
+ * Format: w-{8 hex chars}
84
+ */
85
+ export declare function generateWarrantId(): WarrantId;
86
+ /**
87
+ * Generate a new checkpoint ID
88
+ * Format: cp-{8 hex chars}
89
+ */
90
+ export declare function generateCheckpointId(): CheckpointId;
91
+ /**
92
+ * Generate current timestamp in ISO format
93
+ */
94
+ export declare function generateTimestamp(): Timestamp;
95
+ /**
96
+ * Sanitize an object by removing dangerous prototype keys
97
+ * Recursively processes nested objects and arrays
98
+ */
99
+ export declare function sanitizeObject<T>(obj: T): T;
100
+ //# sourceMappingURL=crypto.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/core/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AACzD,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AACzD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AACrE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAUzE,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEpD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEpD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAwBD;;;GAGG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzD;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9D;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAMnE;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/D;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAY3D;AASD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA0BrE;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9E;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/F;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAU/D;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,CAK7C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,YAAY,CAKnD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,CAE7C;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAgB3C"}
@@ -0,0 +1,243 @@
1
+ /**
2
+ * mdash v3.0 - Cryptographic Core
3
+ *
4
+ * "LLM at the edges, cryptography at the core."
5
+ *
6
+ * All cryptographic operations use Web Crypto API for:
7
+ * - Hardware acceleration where available
8
+ * - Constant-time operations (timing attack resistance)
9
+ * - Non-extractable key material
10
+ */
11
+ // ============================================================================
12
+ // TYPE GUARDS
13
+ // ============================================================================
14
+ const HASH_REGEX = /^[a-f0-9]{64}$/;
15
+ const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
16
+ const ISO_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z$/;
17
+ export function isHash(value) {
18
+ return typeof value === 'string' && HASH_REGEX.test(value);
19
+ }
20
+ export function isSeal(value) {
21
+ return typeof value === 'string' && HASH_REGEX.test(value);
22
+ }
23
+ export function isTimestamp(value) {
24
+ return typeof value === 'string' && ISO_REGEX.test(value);
25
+ }
26
+ export function isFragmentId(value) {
27
+ return typeof value === 'string' && UUID_REGEX.test(value);
28
+ }
29
+ export function isWarrantId(value) {
30
+ return typeof value === 'string' && value.startsWith('w-') && value.length === 10;
31
+ }
32
+ export function isCheckpointId(value) {
33
+ return typeof value === 'string' && value.startsWith('cp-') && value.length === 11;
34
+ }
35
+ // ============================================================================
36
+ // CRYPTO CONTEXT - Web Crypto API access
37
+ // ============================================================================
38
+ function getSubtleCrypto() {
39
+ if (typeof globalThis.crypto?.subtle !== 'undefined') {
40
+ return globalThis.crypto.subtle;
41
+ }
42
+ throw new Error('Web Crypto API not available');
43
+ }
44
+ function getRandomUUID() {
45
+ if (typeof globalThis.crypto?.randomUUID === 'function') {
46
+ return globalThis.crypto.randomUUID();
47
+ }
48
+ throw new Error('crypto.randomUUID not available');
49
+ }
50
+ // ============================================================================
51
+ // HASHING - SHA-256
52
+ // ============================================================================
53
+ /**
54
+ * SHA-256 hash of a string
55
+ * Returns lowercase hex (64 characters)
56
+ */
57
+ export async function sha256(input) {
58
+ const subtle = getSubtleCrypto();
59
+ const encoder = new TextEncoder();
60
+ const data = encoder.encode(input);
61
+ const hashBuffer = await subtle.digest('SHA-256', data);
62
+ const hashArray = Array.from(new Uint8Array(hashBuffer));
63
+ const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
64
+ return hashHex;
65
+ }
66
+ /**
67
+ * SHA-256 hash of an object using deterministic serialization
68
+ * Keys are sorted at all nesting levels
69
+ */
70
+ export async function sha256Object(obj) {
71
+ const serialized = deterministicStringify(obj);
72
+ return sha256(serialized);
73
+ }
74
+ /**
75
+ * SHA-256 hash of binary data
76
+ */
77
+ export async function sha256Binary(data) {
78
+ const subtle = getSubtleCrypto();
79
+ const hashBuffer = await subtle.digest('SHA-256', data);
80
+ const hashArray = Array.from(new Uint8Array(hashBuffer));
81
+ const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
82
+ return hashHex;
83
+ }
84
+ /**
85
+ * Rolling hash of multiple hashes (for Merkle tree nodes)
86
+ * Order matters: H(a, b) ≠ H(b, a)
87
+ */
88
+ export async function rollingHash(hashes) {
89
+ if (hashes.length === 0) {
90
+ return sha256('');
91
+ }
92
+ if (hashes.length === 1) {
93
+ const first = hashes[0];
94
+ if (!first) {
95
+ return sha256('');
96
+ }
97
+ return first;
98
+ }
99
+ const combined = hashes.join('|');
100
+ return sha256(combined);
101
+ }
102
+ // ============================================================================
103
+ // DETERMINISTIC SERIALIZATION
104
+ // ============================================================================
105
+ /**
106
+ * JSON.stringify with sorted keys at all nesting levels
107
+ * Ensures {a:1, b:2} and {b:2, a:1} produce identical output
108
+ */
109
+ export function deterministicStringify(obj) {
110
+ return JSON.stringify(obj, (_, value) => {
111
+ if (value && typeof value === 'object' && !Array.isArray(value)) {
112
+ return Object.keys(value)
113
+ .sort()
114
+ .reduce((sorted, key) => {
115
+ sorted[key] = value[key];
116
+ return sorted;
117
+ }, {});
118
+ }
119
+ return value;
120
+ });
121
+ }
122
+ // ============================================================================
123
+ // HMAC SEALING - HMAC-SHA256
124
+ // ============================================================================
125
+ const HKDF_SALT = 'caret-context-primitive-engine';
126
+ const HKDF_INFO = 'mdash-seal-v3';
127
+ /**
128
+ * Derive an HMAC key from a master key using HKDF
129
+ * The derived key is non-extractable
130
+ */
131
+ export async function deriveKey(masterKey) {
132
+ const subtle = getSubtleCrypto();
133
+ const encoder = new TextEncoder();
134
+ // Import master key as raw key material
135
+ const keyMaterial = await subtle.importKey('raw', encoder.encode(masterKey), 'HKDF', false, ['deriveKey']);
136
+ // Derive HMAC key using HKDF
137
+ return subtle.deriveKey({
138
+ name: 'HKDF',
139
+ salt: encoder.encode(HKDF_SALT),
140
+ info: encoder.encode(HKDF_INFO),
141
+ hash: 'SHA-256',
142
+ }, keyMaterial, { name: 'HMAC', hash: 'SHA-256' }, false, // non-extractable
143
+ ['sign', 'verify']);
144
+ }
145
+ /**
146
+ * Create HMAC seal of content
147
+ */
148
+ export async function hmacSeal(content, key) {
149
+ const subtle = getSubtleCrypto();
150
+ const encoder = new TextEncoder();
151
+ const data = encoder.encode(deterministicStringify(content));
152
+ const signature = await subtle.sign('HMAC', key, data);
153
+ const sigArray = Array.from(new Uint8Array(signature));
154
+ const sigHex = sigArray.map(b => b.toString(16).padStart(2, '0')).join('');
155
+ return sigHex;
156
+ }
157
+ /**
158
+ * Verify HMAC seal
159
+ */
160
+ export async function hmacVerify(content, seal, key) {
161
+ const subtle = getSubtleCrypto();
162
+ const encoder = new TextEncoder();
163
+ const data = encoder.encode(deterministicStringify(content));
164
+ // Convert seal hex to ArrayBuffer
165
+ const sealBytes = new Uint8Array(seal.match(/.{2}/g).map(byte => parseInt(byte, 16)));
166
+ return subtle.verify('HMAC', key, sealBytes, data);
167
+ }
168
+ // ============================================================================
169
+ // CONSTANT-TIME COMPARISON
170
+ // ============================================================================
171
+ /**
172
+ * Compare two strings in constant time
173
+ * Prevents timing attacks on seal/hash comparison
174
+ */
175
+ export function constantTimeEqual(a, b) {
176
+ if (a.length !== b.length) {
177
+ return false;
178
+ }
179
+ let result = 0;
180
+ for (let i = 0; i < a.length; i++) {
181
+ result |= a.charCodeAt(i) ^ b.charCodeAt(i);
182
+ }
183
+ return result === 0;
184
+ }
185
+ // ============================================================================
186
+ // ID GENERATION
187
+ // ============================================================================
188
+ /**
189
+ * Generate a new fragment ID (UUID v4)
190
+ */
191
+ export function generateFragmentId() {
192
+ return getRandomUUID();
193
+ }
194
+ /**
195
+ * Generate a new warrant ID
196
+ * Format: w-{8 hex chars}
197
+ */
198
+ export function generateWarrantId() {
199
+ const bytes = new Uint8Array(4);
200
+ globalThis.crypto.getRandomValues(bytes);
201
+ const hex = Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
202
+ return `w-${hex}`;
203
+ }
204
+ /**
205
+ * Generate a new checkpoint ID
206
+ * Format: cp-{8 hex chars}
207
+ */
208
+ export function generateCheckpointId() {
209
+ const bytes = new Uint8Array(4);
210
+ globalThis.crypto.getRandomValues(bytes);
211
+ const hex = Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
212
+ return `cp-${hex}`;
213
+ }
214
+ /**
215
+ * Generate current timestamp in ISO format
216
+ */
217
+ export function generateTimestamp() {
218
+ return new Date().toISOString();
219
+ }
220
+ // ============================================================================
221
+ // PROTOTYPE POLLUTION PREVENTION
222
+ // ============================================================================
223
+ const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'];
224
+ /**
225
+ * Sanitize an object by removing dangerous prototype keys
226
+ * Recursively processes nested objects and arrays
227
+ */
228
+ export function sanitizeObject(obj) {
229
+ if (obj === null || typeof obj !== 'object') {
230
+ return obj;
231
+ }
232
+ if (Array.isArray(obj)) {
233
+ return obj.map(sanitizeObject);
234
+ }
235
+ const result = {};
236
+ for (const key of Object.keys(obj)) {
237
+ if (!DANGEROUS_KEYS.includes(key)) {
238
+ result[key] = sanitizeObject(obj[key]);
239
+ }
240
+ }
241
+ return result;
242
+ }
243
+ //# sourceMappingURL=crypto.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/core/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,UAAU,GAAG,wEAAwE,CAAC;AAC5F,MAAM,SAAS,GAAG,kDAAkD,CAAC;AAErE,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC;AACrF,CAAC;AAED,+EAA+E;AAC/E,yCAAyC;AACzC,+EAA+E;AAE/E,SAAS,eAAe;IACtB,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa;IACxC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,OAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAY;IAC7C,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAiB;IAClD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,OAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QACtC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;iBACtB,IAAI,EAAE;iBACN,MAAM,CAAC,CAAC,MAA+B,EAAE,GAAG,EAAE,EAAE;gBAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,MAAM,CAAC;YAChB,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,SAAS,GAAG,eAAe,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAElC,wCAAwC;IACxC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EACzB,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,6BAA6B;IAC7B,OAAO,MAAM,CAAC,SAAS,CACrB;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EAAE,kBAAkB;IACzB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,GAAc;IAC7D,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,OAAO,MAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,IAAU,EAAE,GAAc;IAC3E,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7D,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEvF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,EAAgB,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,KAAK,GAAG,EAAe,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,GAAG,EAAkB,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAe,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAI,GAAM;IACtC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,cAAc,CAAM,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAa,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAE,GAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC"}