@mnemom/agent-integrity-protocol 0.1.7 → 0.2.0

package/dist/index.cjs

@@ -1,6 +1,29 @@
 'use strict';
 
 var crypto = require('crypto');
+var ed = require('@noble/ed25519');
+var sha2_js = require('@noble/hashes/sha2.js');
+var utils_js = require('@noble/hashes/utils.js');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var ed__namespace = /*#__PURE__*/_interopNamespace(ed);
 
 // src/window/state.ts
 function createWindowState(sessionId) {
@@ -1550,6 +1573,99 @@ function constantTimeEqual(a, b) {
   }
   return result === 0;
 }
+function base64ToUint8(b64) {
+  const binary = atob(b64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+var encoder = new TextEncoder();
+function sha256Hex(input) {
+  const hash = sha2_js.sha256(encoder.encode(input));
+  return utils_js.bytesToHex(hash);
+}
+function computeNodeHash(left, right) {
+  return sha256Hex(left + right);
+}
+async function verifySignature2(certificate, publicKey) {
+  try {
+    const signatureBytes = base64ToUint8(certificate.proofs.signature.value);
+    const messageBytes = encoder.encode(certificate.proofs.signature.signed_payload);
+    const valid = await ed__namespace.verifyAsync(signatureBytes, messageBytes, publicKey);
+    return {
+      valid,
+      details: valid ? "Ed25519 signature verified successfully" : "Ed25519 signature verification failed"
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      details: `Signature verification error: ${err instanceof Error ? err.message : "unknown"}`
+    };
+  }
+}
+function verifyChain(certificate) {
+  try {
+    const chain = certificate.proofs.chain;
+    if (!chain || !chain.chain_hash) {
+      return { valid: false, details: "No chain proof data in certificate" };
+    }
+    const preimage = `${chain.prev_chain_hash || "genesis"}|${certificate.subject.checkpoint_id}|${certificate.claims.verdict}|${certificate.input_commitments.thinking_block_hash}|${certificate.input_commitments.combined_commitment}|${certificate.issued_at}`;
+    const recomputed = sha256Hex(preimage);
+    const valid = recomputed === chain.chain_hash;
+    return {
+      valid,
+      details: valid ? "Chain hash verified successfully" : "Recomputed chain hash does not match certificate"
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      details: `Chain verification error: ${err instanceof Error ? err.message : "unknown"}`
+    };
+  }
+}
+function verifyMerkle(certificate, expectedRoot) {
+  const merkle = certificate.proofs.merkle;
+  if (!merkle) {
+    return null;
+  }
+  try {
+    const root = expectedRoot ?? merkle.root;
+    let current = merkle.leaf_hash;
+    for (const sibling of merkle.inclusion_proof) {
+      if (sibling.position === "left") {
+        current = computeNodeHash(sibling.hash, current);
+      } else {
+        current = computeNodeHash(current, sibling.hash);
+      }
+    }
+    const valid = current === root;
+    return {
+      valid,
+      details: valid ? "Merkle inclusion proof verified successfully" : "Merkle inclusion proof verification failed \u2014 computed root does not match"
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      details: `Merkle verification error: ${err instanceof Error ? err.message : "unknown"}`
+    };
+  }
+}
+async function verifyCertificate(certificate, publicKey, merkleRoot) {
+  const signatureResult = await verifySignature2(certificate, publicKey);
+  const chainResult = verifyChain(certificate);
+  const merkleResult = verifyMerkle(certificate, merkleRoot);
+  const valid = signatureResult.valid && chainResult.valid && (merkleResult === null || merkleResult.valid);
+  return {
+    valid,
+    checks: {
+      signature: signatureResult,
+      chain: chainResult,
+      merkle: merkleResult
+    }
+  };
+}
 
 exports.AIP_CONTENT_TYPE = AIP_CONTENT_TYPE;
 exports.AIP_SIGNATURE_HEADER = AIP_SIGNATURE_HEADER;
@@ -1598,6 +1714,7 @@ exports.mapVerdictToProceed = mapVerdictToProceed;
 exports.signPayload = signPayload;
 exports.summarizeCard = summarizeCard;
 exports.validateAgreement = validateAgreement;
+exports.verifyCertificate = verifyCertificate;
 exports.verifySignature = verifySignature;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map