@motebit/crypto 1.0.0 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/artifacts.d.ts +4 -4
- package/dist/artifacts.js +1 -1
- package/dist/credential-anchor.d.ts.map +1 -1
- package/dist/credential-anchor.js +3 -49
- package/dist/credential-anchor.js.map +1 -1
- package/dist/credentials.d.ts +25 -0
- package/dist/credentials.d.ts.map +1 -1
- package/dist/credentials.js +3 -0
- package/dist/credentials.js.map +1 -1
- package/dist/deletion-certificate.d.ts +256 -0
- package/dist/deletion-certificate.d.ts.map +1 -0
- package/dist/deletion-certificate.js +562 -0
- package/dist/deletion-certificate.js.map +1 -0
- package/dist/hardware-attestation.d.ts +30 -0
- package/dist/hardware-attestation.d.ts.map +1 -1
- package/dist/hardware-attestation.js +55 -0
- package/dist/hardware-attestation.js.map +1 -1
- package/dist/index.d.ts +121 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1077 -5459
- package/dist/index.js.map +1 -1
- package/dist/merkle.d.ts +34 -0
- package/dist/merkle.d.ts.map +1 -0
- package/dist/merkle.js +84 -0
- package/dist/merkle.js.map +1 -0
- package/dist/skills.d.ts +95 -0
- package/dist/skills.d.ts.map +1 -0
- package/dist/skills.js +228 -0
- package/dist/skills.js.map +1 -0
- package/dist/suite-dispatch.js +189 -3223
- package/dist/witness-omission-dispute.d.ts +98 -0
- package/dist/witness-omission-dispute.d.ts.map +1 -0
- package/dist/witness-omission-dispute.js +237 -0
- package/dist/witness-omission-dispute.js.map +1 -0
- package/package.json +2 -2
package/dist/artifacts.d.ts
CHANGED
|
@@ -98,9 +98,9 @@ export declare function verifyExecutionReceiptDetailed(receipt: SignableReceipt,
|
|
|
98
98
|
* Structurally compatible with `@motebit/protocol` ToolInvocationReceipt.
|
|
99
99
|
*
|
|
100
100
|
* A per-tool-call signed artifact: one receipt per invocation of a tool
|
|
101
|
-
* during an agent turn. The
|
|
102
|
-
*
|
|
103
|
-
*
|
|
101
|
+
* during an agent turn. The slab emits these live as tool calls
|
|
102
|
+
* complete. Binding to the enclosing task is by `task_id`; a verifier
|
|
103
|
+
* can gather all invocations for a task by matching it.
|
|
104
104
|
*
|
|
105
105
|
* Commits to structural facts only — tool name, canonical-JSON SHA-256
|
|
106
106
|
* hashes of args and result, timestamps, identities. The raw args and
|
|
@@ -480,7 +480,7 @@ export declare const SETTLEMENT_RECORD_SUITE: "motebit-jcs-ed25519-b64-v1";
|
|
|
480
480
|
* Callers pass the record without `signature` or `suite`; the signer
|
|
481
481
|
* owns both.
|
|
482
482
|
*
|
|
483
|
-
* Foundation Law (services/
|
|
483
|
+
* Foundation Law (services/relay/CLAUDE.md rule 6): every truth the
|
|
484
484
|
* relay asserts is independently verifiable. Per-agent settlements
|
|
485
485
|
* deliver this through the signature; federation settlements
|
|
486
486
|
* additionally get Merkle-batched and onchain-anchored.
|
package/dist/artifacts.js
CHANGED
|
@@ -725,7 +725,7 @@ export const SETTLEMENT_RECORD_SUITE = "motebit-jcs-ed25519-b64-v1";
|
|
|
725
725
|
* Callers pass the record without `signature` or `suite`; the signer
|
|
726
726
|
* owns both.
|
|
727
727
|
*
|
|
728
|
-
* Foundation Law (services/
|
|
728
|
+
* Foundation Law (services/relay/CLAUDE.md rule 6): every truth the
|
|
729
729
|
* relay asserts is independently verifiable. Per-agent settlements
|
|
730
730
|
* deliver this through the signature; federation settlements
|
|
731
731
|
* additionally get Merkle-batched and onchain-anchored.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-anchor.d.ts","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;
|
|
1
|
+
{"version":3,"file":"credential-anchor.d.ts","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,EAAG,4BAAqC,CAAC;AAI7E;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhG;AAID,qDAAqD;AACrD,MAAM,WAAW,4BAA4B;IAC3C,wCAAwC;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,wDAAwD;QACxD,UAAU,EAAE,OAAO,CAAC;QACpB,6DAA6D;QAC7D,YAAY,EAAE,OAAO,CAAC;QACtB,yEAAyE;QACzE,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,WAAW,EAAE,2BAA2B,EACxC,aAAa,CAAC,EAAE,mBAAmB,GAClC,OAAO,CAAC,4BAA4B,CAAC,CA8FvC;AAID,wDAAwD;AACxD,MAAM,WAAW,4BAA4B;IAC3C,8CAA8C;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,KAAK,EAAE;QACL,yEAAyE;QACzE,UAAU,EAAE,OAAO,CAAC;QACpB,8EAA8E;QAC9E,qBAAqB,EAAE,OAAO,CAAC;QAC/B,6DAA6D;QAC7D,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAG,+BAAwC,CAAC;AAEhF,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,OAAO,uBAAuB,CAAC;IACtC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,qBAAqB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC,OAAO,CAAC,GACrB,OAAO,CAAC,4BAA4B,CAAC,CAoEvC"}
|
|
@@ -7,28 +7,10 @@
|
|
|
7
7
|
*
|
|
8
8
|
* motebit/credential-anchor@1.0 §3 (leaf hash) and §5.2 (verification).
|
|
9
9
|
*/
|
|
10
|
-
import { canonicalJson, sha256, hexToBytes, verifyBySuite } from "./signing.js";
|
|
10
|
+
import { canonicalJson, sha256, hexToBytes, bytesToHex, verifyBySuite } from "./signing.js";
|
|
11
|
+
import { verifyMerkleInclusion } from "./merkle.js";
|
|
11
12
|
/** The one suite CredentialAnchorBatch records sign under today. */
|
|
12
13
|
export const CREDENTIAL_ANCHOR_SUITE = "motebit-jcs-ed25519-hex-v1";
|
|
13
|
-
// === Helpers (inlined — zero monorepo deps) ===
|
|
14
|
-
function toHex(bytes) {
|
|
15
|
-
return Array.from(bytes)
|
|
16
|
-
.map((b) => b.toString(16).padStart(2, "0"))
|
|
17
|
-
.join("");
|
|
18
|
-
}
|
|
19
|
-
function fromHex(hex) {
|
|
20
|
-
const bytes = new Uint8Array(hex.length / 2);
|
|
21
|
-
for (let i = 0; i < hex.length; i += 2) {
|
|
22
|
-
bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
|
|
23
|
-
}
|
|
24
|
-
return bytes;
|
|
25
|
-
}
|
|
26
|
-
function concat(a, b) {
|
|
27
|
-
const out = new Uint8Array(a.length + b.length);
|
|
28
|
-
out.set(a);
|
|
29
|
-
out.set(b, a.length);
|
|
30
|
-
return out;
|
|
31
|
-
}
|
|
32
14
|
// === Leaf Hash ===
|
|
33
15
|
/**
|
|
34
16
|
* Compute a credential leaf hash for Merkle anchoring.
|
|
@@ -43,35 +25,7 @@ function concat(a, b) {
|
|
|
43
25
|
export async function computeCredentialLeaf(credential) {
|
|
44
26
|
const canonical = canonicalJson(credential);
|
|
45
27
|
const hash = await sha256(new TextEncoder().encode(canonical));
|
|
46
|
-
return
|
|
47
|
-
}
|
|
48
|
-
// === Merkle Proof Verification ===
|
|
49
|
-
/**
|
|
50
|
-
* Verify a Merkle inclusion proof against an expected root.
|
|
51
|
-
*
|
|
52
|
-
* Binary tree with odd-leaf promotion (no duplication).
|
|
53
|
-
* Same algorithm as @motebit/encryption/merkle.ts — inlined here
|
|
54
|
-
* so the crypto package remains zero-monorepo-deps.
|
|
55
|
-
*/
|
|
56
|
-
async function verifyMerkleInclusion(leaf, index, siblings, layerSizes, expectedRoot) {
|
|
57
|
-
let current = fromHex(leaf);
|
|
58
|
-
let idx = index;
|
|
59
|
-
let sibIdx = 0;
|
|
60
|
-
for (const layerSize of layerSizes) {
|
|
61
|
-
const siblingPos = idx % 2 === 0 ? idx + 1 : idx - 1;
|
|
62
|
-
const hasSibling = siblingPos >= 0 && siblingPos < layerSize;
|
|
63
|
-
if (hasSibling) {
|
|
64
|
-
if (sibIdx >= siblings.length)
|
|
65
|
-
return false;
|
|
66
|
-
const siblingBytes = fromHex(siblings[sibIdx]);
|
|
67
|
-
const combined = idx % 2 === 0 ? concat(current, siblingBytes) : concat(siblingBytes, current);
|
|
68
|
-
current = await sha256(combined);
|
|
69
|
-
sibIdx++;
|
|
70
|
-
}
|
|
71
|
-
// Odd promotion: current passes through unchanged
|
|
72
|
-
idx = Math.floor(idx / 2);
|
|
73
|
-
}
|
|
74
|
-
return toHex(current) === expectedRoot;
|
|
28
|
+
return bytesToHex(hash);
|
|
75
29
|
}
|
|
76
30
|
/**
|
|
77
31
|
* Verify a credential anchor proof — the 4-step self-verification algorithm.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-anchor.js","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"credential-anchor.js","sourceRoot":"","sources":["../src/credential-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAAqC,CAAC;AAE7E,oBAAoB;AAEpB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAmC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAqED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAmC,EACnC,WAAwC,EACxC,aAAmC;IAEnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kEAAkE;IAClE,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,YAAY,KAAK,WAAW,CAAC,eAAe,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,2BAA2B,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CACnH,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAC7C,WAAW,CAAC,eAAe,EAC3B,WAAW,CAAC,UAAU,EACtB,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,WAAW,CACxB,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IAED,6DAA6D;IAC7D,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,WAAW;IACX,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAChC,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,wDAAwD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,aAAa,CAAC;YACjC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,KAAK;SACN,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,mBAAmB,GAAG,MAAM,aAAa,CACvC,KAAK,EACL,YAAY,EACZ,cAAc,EACd,cAAc,CACf,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,aAAa,GAAmB,IAAI,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,aAAa,CAAC;gBAClC,GAAG,WAAW,CAAC,MAAM;gBACrB,aAAa,EAAE,WAAW,CAAC,WAAW;aACvC,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GACT,SAAS,IAAI,WAAW,IAAI,mBAAmB,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC;IAE/F,OAAO;QACL,KAAK;QACL,KAAK,EAAE;YACL,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,WAAW;YACzB,qBAAqB,EAAE,mBAAmB;YAC1C,cAAc,EAAE,aAAa;SAC9B;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAqBD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,+BAAwC,CAAC;AA0BhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA4B,EAC5B,iBAAyB,EACzB,aAKsB;IAEtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,8EAA8E;IAC9E,MAAM,YAAY,GAAG,yBAAyB,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;IAC5F,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,+CAA+C,KAAK,CAAC,kBAAkB,CAAC,MAAM,6BAA6B,KAAK,CAAC,SAAS,EAAE,CAC7H,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,6DAA6D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CACpF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACjE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,mBAAmB,GAAG,MAAM,aAAa,CACvC,KAAK,CAAC,KAAK,EACX,YAAY,EACZ,cAAc,EACd,cAAc,CACf,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,aAAa,GAAmB,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,aAAa,CAAC;gBAClC,GAAG,KAAK,CAAC,MAAM;gBACf,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,0CAA0C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,IAAI,mBAAmB,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC;IAE5F,OAAO;QACL,KAAK;QACL,KAAK,EAAE;YACL,UAAU,EAAE,SAAS;YACrB,qBAAqB,EAAE,mBAAmB;YAC1C,cAAc,EAAE,aAAa;SAC9B;QACD,MAAM;KACP,CAAC;AACJ,CAAC"}
|
package/dist/credentials.d.ts
CHANGED
|
@@ -67,6 +67,21 @@ export interface TrustCredentialSubject {
|
|
|
67
67
|
failed_tasks: number;
|
|
68
68
|
first_seen_at: number;
|
|
69
69
|
last_seen_at: number;
|
|
70
|
+
/**
|
|
71
|
+
* Optional hardware-attestation claim. Mirror of the same-named
|
|
72
|
+
* field on `TrustCredentialSubject` in `@motebit/protocol`. Set when
|
|
73
|
+
* a peer issuer has verified the subject's self-published
|
|
74
|
+
* hardware-attestation credential and is folding the verified claim
|
|
75
|
+
* into a peer credential about the subject. See
|
|
76
|
+
* `spec/credential-v1.md` §3.4.
|
|
77
|
+
*/
|
|
78
|
+
hardware_attestation?: HardwareAttestationClaim;
|
|
79
|
+
}
|
|
80
|
+
/** Mirror of `HardwareAttestationClaim` in `@motebit/protocol`. */
|
|
81
|
+
export interface HardwareAttestationClaim {
|
|
82
|
+
platform: "secure_enclave" | "tpm" | "play_integrity" | "android_keystore" | "device_check" | "webauthn" | "software";
|
|
83
|
+
key_exported?: boolean;
|
|
84
|
+
attestation_receipt?: string;
|
|
70
85
|
}
|
|
71
86
|
export declare function signVerifiableCredential<T = Record<string, unknown>>(unsignedVC: Omit<VerifiableCredential<T>, "proof">, privateKey: Uint8Array, publicKey: Uint8Array): Promise<VerifiableCredential<T>>;
|
|
72
87
|
export declare function verifyVerifiableCredential<T = Record<string, unknown>>(vc: VerifiableCredential<T>): Promise<boolean>;
|
|
@@ -102,6 +117,16 @@ export declare function issueTrustCredential(trustRecord: {
|
|
|
102
117
|
failed_tasks?: number;
|
|
103
118
|
first_seen_at: number;
|
|
104
119
|
last_seen_at: number;
|
|
120
|
+
/**
|
|
121
|
+
* Optional verified `HardwareAttestationClaim` to embed in the
|
|
122
|
+
* subject. Phase 1 of the hardware-attestation peer flow: the
|
|
123
|
+
* issuer (delegator that consumed the worker's receipt) verifies
|
|
124
|
+
* the worker's self-published claim via
|
|
125
|
+
* `verifyHardwareAttestationClaim` and includes the verified claim
|
|
126
|
+
* here. Routing aggregation reads this via
|
|
127
|
+
* `aggregateHardwareAttestation`. Spec credential-v1 §3.4.
|
|
128
|
+
*/
|
|
129
|
+
hardware_attestation?: HardwareAttestationClaim;
|
|
105
130
|
}, privateKey: Uint8Array, publicKey: Uint8Array, subjectDid: string, validForMs?: number, statusEndpoint?: string): Promise<VerifiableCredential<TrustCredentialSubject>>;
|
|
106
131
|
export declare function createPresentation(credentials: VerifiableCredential[], privateKey: Uint8Array, publicKey: Uint8Array): Promise<VerifiablePresentation>;
|
|
107
132
|
//# sourceMappingURL=credentials.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAKD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,CAAC,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAKD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CACjD;AAED,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EACJ,gBAAgB,GAChB,KAAK,GACL,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,UAAU,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAgGD,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxE,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAClD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAQlC;AAED,wBAAsB,0BAA0B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,OAAO,CAAC,CAMlB;AAID,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,EACjD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAQjC;AAED,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,sBAAsB,GACzB,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoB/C;AAUD,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE;IACR,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC,CA8B1D;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE;IACR,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,CA2B5D;AAED,wBAAsB,oBAAoB,CACxC,WAAW,EAAE;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CACjD,EACD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,SAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CA6BvD;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,oBAAoB,EAAE,EACnC,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAUjC"}
|
package/dist/credentials.js
CHANGED
|
@@ -181,6 +181,9 @@ export async function issueTrustCredential(trustRecord, privateKey, publicKey, s
|
|
|
181
181
|
failed_tasks: trustRecord.failed_tasks ?? 0,
|
|
182
182
|
first_seen_at: trustRecord.first_seen_at,
|
|
183
183
|
last_seen_at: trustRecord.last_seen_at,
|
|
184
|
+
...(trustRecord.hardware_attestation != null
|
|
185
|
+
? { hardware_attestation: trustRecord.hardware_attestation }
|
|
186
|
+
: {}),
|
|
184
187
|
};
|
|
185
188
|
const now = new Date();
|
|
186
189
|
const unsignedVC = {
|
package/dist/credentials.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,GACP,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,GACP,MAAM,cAAc,CAAC;AA6FtB,2BAA2B;AAE3B,SAAS,uBAAuB,CAAC,SAAqB;IACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,iCAAiC;AAEjC;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAC9B,QAAiC,EACjC,UAAsB,EACtB,SAAqB,EACrB,YAAkD;IAElD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzC,MAAM,YAAY,GAAG;QACnB,IAAI,EAAE,oBAA6B;QACnC,WAAW,EAAE,gBAAyB;QACtC,OAAO;QACP,kBAAkB;QAClB,YAAY;KACb,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,GAAG,QAAQ,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAEpD,OAAO,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,0BAA0B,CACvC,QAAiC,EACjC,KAAyB;IAEzB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACpD,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC;IAE9C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,GAAG,QAAQ,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,4CAA4C;AAE5C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAkD,EAClD,UAAsB,EACtB,SAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACnC,UAAgD,EAChD,UAAU,EACV,SAAS,EACT,iBAAiB,CAClB,CAAC;IACF,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAA2B;IAE3B,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,0BAA0B,CAAC,EAAwC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,8CAA8C;AAE9C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAiD,EACjD,UAAsB,EACtB,SAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACnC,UAAgD,EAChD,UAAU,EACV,SAAS,EACT,gBAAgB,CACjB,CAAC;IACF,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAA4B,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAA0B;IAE1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,EAAwC,EACxC,EAAE,CAAC,KAAK,CACT,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,yCAAyC;AAEzC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AACvD,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAWC,EACD,UAAsB,EACtB,SAAqB,EACrB,UAAmB,EACnB,UAAU,GAAG,WAAW,EACxB,cAAuB;IAEvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,OAAO,GAA8B;QACzC,EAAE,EAAE,UAAU,IAAI,SAAS;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;QACvD,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,WAAW,EAAE,QAAQ,CAAC,SAAS;KAChC,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAmE;QACjF,UAAU,EAAE,CAAC,sCAAsC,CAAC;QACpD,IAAI,EAAE,CAAC,sBAAsB,EAAE,gBAAgB,CAAC;QAChD,MAAM,EAAE,SAAS;QACjB,iBAAiB,EAAE,OAAO;QAC1B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;QAC9D,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO,wBAAwB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAOC,EACD,UAAsB,EACtB,SAAqB,EACrB,UAAkB,EAClB,UAAU,GAAG,WAAW,EACxB,cAAuB;IAEvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAgC;QAC3C,EAAE,EAAE,UAAU;QACd,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,WAAW,EAAE,QAAQ,CAAC,UAAU;QAChC,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAqE;QACnF,UAAU,EAAE,CAAC,sCAAsC,CAAC;QACpD,IAAI,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;QAClD,MAAM,EAAE,SAAS;QACjB,iBAAiB,EAAE,OAAO;QAC1B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;QAC9D,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO,wBAAwB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAiBC,EACD,UAAsB,EACtB,SAAqB,EACrB,UAAkB,EAClB,UAAU,GAAG,WAAW,EACxB,cAAuB;IAEvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,OAAO,GAA2B;QACtC,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;QAChD,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,IAAI,CAAC;QACnD,YAAY,EAAE,WAAW,CAAC,YAAY,IAAI,CAAC;QAC3C,aAAa,EAAE,WAAW,CAAC,aAAa;QACxC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,GAAG,CAAC,WAAW,CAAC,oBAAoB,IAAI,IAAI;YAC1C,CAAC,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAAgE;QAC9E,UAAU,EAAE,CAAC,sCAAsC,CAAC;QACpD,IAAI,EAAE,CAAC,sBAAsB,EAAE,aAAa,CAAC;QAC7C,MAAM,EAAE,SAAS;QACjB,iBAAiB,EAAE,OAAO;QAC1B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;QAC9D,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE;YAC1E,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,OAAO,wBAAwB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmC,EACnC,UAAsB,EACtB,SAAqB;IAErB,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,UAAU,GAA0C;QACxD,UAAU,EAAE,CAAC,sCAAsC,CAAC;QACpD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,MAAM,EAAE,SAAS;QACjB,oBAAoB,EAAE,WAAW;KAClC,CAAC;IAEF,OAAO,0BAA0B,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC"}
|
|
@@ -0,0 +1,256 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Deletion certificate — sign + verify for the three retention shapes.
|
|
3
|
+
*
|
|
4
|
+
* Permissive floor (Apache-2.0). Zero monorepo dependencies — types
|
|
5
|
+
* mirror `@motebit/protocol`'s discriminated union; primitives route
|
|
6
|
+
* through `@motebit/crypto/suite-dispatch`.
|
|
7
|
+
*
|
|
8
|
+
* Three arms in one union (`@motebit/protocol :: DeletionCertificate`):
|
|
9
|
+
*
|
|
10
|
+
* - `mutable_pruning` and `consolidation_flush` — multi-signature
|
|
11
|
+
* certs (subject / operator / delegate / guardian, at-least-one
|
|
12
|
+
* required by the reason-table). Each present signature covers the
|
|
13
|
+
* same canonical bytes: `canonicalJson(cert minus all *_signature
|
|
14
|
+
* fields)`. Pattern matches identity-v1 §3.8.1 dual-signature
|
|
15
|
+
* succession (one canonical payload, multiple verifiable signers).
|
|
16
|
+
*
|
|
17
|
+
* - `append_only_horizon` — single-issuer signature plus witness
|
|
18
|
+
* signatures. Both the issuer and every witness sign the same
|
|
19
|
+
* `canonicalJson(cert minus signature)`. Witness array is part of
|
|
20
|
+
* the signed body — a forged witness fails verification.
|
|
21
|
+
*
|
|
22
|
+
* Verification dispatches by `kind`. Reason × signer × mode table
|
|
23
|
+
* (decision 5) gates which signer compositions are admissible. Each
|
|
24
|
+
* admissible signature is then cryptographically verified through
|
|
25
|
+
* `verifyBySuite`.
|
|
26
|
+
*/
|
|
27
|
+
import type { DeletionCertificate, HorizonWitness, HorizonWitnessRequestBody, SuiteId } from "@motebit/protocol";
|
|
28
|
+
/** The cryptosuite every deletion certificate signs under today. */
|
|
29
|
+
export declare const DELETION_CERTIFICATE_SUITE: SuiteId;
|
|
30
|
+
/**
|
|
31
|
+
* Filing window for `WitnessOmissionDispute` (retention phase 4b-3).
|
|
32
|
+
* A dispute MUST be filed within 24h of the cert's `issued_at`;
|
|
33
|
+
* `verifyWitnessOmissionDispute` rejects beyond this window. Mirrors
|
|
34
|
+
* the 24h cadence of `spec/dispute-v1.md` §7.5 (filing / withdrawal /
|
|
35
|
+
* appeal windows).
|
|
36
|
+
*/
|
|
37
|
+
export declare const WITNESS_OMISSION_DISPUTE_WINDOW_MS: number;
|
|
38
|
+
type DeploymentMode = "sovereign" | "mediated" | "enterprise";
|
|
39
|
+
/** Result of verifying a deletion certificate. Fail-closed: any failure → `valid: false`. */
|
|
40
|
+
export interface DeletionCertificateVerifyResult {
|
|
41
|
+
readonly valid: boolean;
|
|
42
|
+
readonly errors: string[];
|
|
43
|
+
/** Per-step breakdown — useful for debugging and audit display. */
|
|
44
|
+
readonly steps: {
|
|
45
|
+
readonly reason_table_satisfied: boolean;
|
|
46
|
+
readonly subject_signature_valid: boolean | null;
|
|
47
|
+
readonly operator_signature_valid: boolean | null;
|
|
48
|
+
readonly delegate_signature_valid: boolean | null;
|
|
49
|
+
readonly guardian_signature_valid: boolean | null;
|
|
50
|
+
/** Horizon-arm only: issuer signature on the cert body. */
|
|
51
|
+
readonly horizon_issuer_signature_valid: boolean | null;
|
|
52
|
+
/** Horizon-arm only: count of witness signatures that verified. */
|
|
53
|
+
readonly horizon_witnesses_valid_count: number | null;
|
|
54
|
+
/** Horizon-arm only: count of witness signatures present. */
|
|
55
|
+
readonly horizon_witnesses_present_count: number | null;
|
|
56
|
+
};
|
|
57
|
+
}
|
|
58
|
+
/**
|
|
59
|
+
* Resolver context for the verifier. Callers supply the public-key
|
|
60
|
+
* resolution paths the cert's signers reference. Resolvers return
|
|
61
|
+
* `null` when the key cannot be resolved (unknown id, registry miss);
|
|
62
|
+
* the verifier rejects fail-closed in that case.
|
|
63
|
+
*
|
|
64
|
+
* The guardian signature embeds its own public key (`guardian_public_key`),
|
|
65
|
+
* so no guardian resolver is needed — the verifier does cross-check that
|
|
66
|
+
* the embedded key matches the motebit's declared guardian via the
|
|
67
|
+
* `validateGuardianBinding` callback when supplied.
|
|
68
|
+
*/
|
|
69
|
+
export interface DeletionCertificateVerifyContext {
|
|
70
|
+
/** Resolve a motebit's identity Ed25519 public key (32 bytes). */
|
|
71
|
+
readonly resolveMotebitPublicKey: (motebitId: string) => Promise<Uint8Array | null>;
|
|
72
|
+
/** Resolve an operator's Ed25519 public key (32 bytes). */
|
|
73
|
+
readonly resolveOperatorPublicKey: (operatorId: string) => Promise<Uint8Array | null>;
|
|
74
|
+
/**
|
|
75
|
+
* Optional cross-check that an embedded `guardian_public_key` actually
|
|
76
|
+
* is the declared guardian for the cert's subject motebit. When
|
|
77
|
+
* absent, the verifier verifies the signature against the embedded
|
|
78
|
+
* key without checking the binding.
|
|
79
|
+
*/
|
|
80
|
+
readonly validateGuardianBinding?: (targetMotebitId: string | undefined, guardianPublicKeyHex: string) => Promise<boolean>;
|
|
81
|
+
/**
|
|
82
|
+
* Optional declared deployment mode. When supplied, the verifier
|
|
83
|
+
* additionally checks the cert's reason against
|
|
84
|
+
* `REASON_TABLE[reason].modes`. When absent, mode-checking is skipped
|
|
85
|
+
* (the reason × signer table still applies).
|
|
86
|
+
*/
|
|
87
|
+
readonly deploymentMode?: DeploymentMode;
|
|
88
|
+
}
|
|
89
|
+
/**
|
|
90
|
+
* Compute the canonical signing bytes for a `mutable_pruning` or
|
|
91
|
+
* `consolidation_flush` cert. Strips every `*_signature` field so all
|
|
92
|
+
* present signers sign identical bytes — matches identity-v1 §3.8.1's
|
|
93
|
+
* dual-signature canonical payload.
|
|
94
|
+
*/
|
|
95
|
+
export declare function canonicalizeMultiSignatureCert(cert: Extract<DeletionCertificate, {
|
|
96
|
+
kind: "mutable_pruning" | "consolidation_flush";
|
|
97
|
+
}>): Uint8Array;
|
|
98
|
+
/**
|
|
99
|
+
* Compute the canonical signing bytes for an `append_only_horizon`
|
|
100
|
+
* cert's ISSUER signature. Strips only `signature`. The issuer commits
|
|
101
|
+
* to the full body — including every witness's signature in
|
|
102
|
+
* `witnessed_by` — so a forged witness fails verification at the
|
|
103
|
+
* issuer signature step (the body the issuer signed no longer matches
|
|
104
|
+
* the post-tampering body).
|
|
105
|
+
*/
|
|
106
|
+
export declare function canonicalizeHorizonCert(cert: Extract<DeletionCertificate, {
|
|
107
|
+
kind: "append_only_horizon";
|
|
108
|
+
}>): Uint8Array;
|
|
109
|
+
/**
|
|
110
|
+
* Compute the canonical signing bytes for a WITNESS signature on an
|
|
111
|
+
* `append_only_horizon` cert. Strips both `signature` and
|
|
112
|
+
* `witnessed_by` so witnesses can co-sign asynchronously without
|
|
113
|
+
* needing to know each other's signatures.
|
|
114
|
+
*
|
|
115
|
+
* Witness's identity is bound to the signature via the public key
|
|
116
|
+
* used at verification (resolved from `witnessed_by[i].motebit_id`).
|
|
117
|
+
* The cert body's other fields (subject, store_id, horizon_ts,
|
|
118
|
+
* issued_at, federation_graph_anchor) make two distinct horizon
|
|
119
|
+
* advances produce distinct signing bytes, so a witness signature
|
|
120
|
+
* cannot be relayed to a different cert.
|
|
121
|
+
*
|
|
122
|
+
* The issuer's separate signature commits to the assembled witness
|
|
123
|
+
* array — that's the binding that makes a forged or substituted
|
|
124
|
+
* witness detectable.
|
|
125
|
+
*/
|
|
126
|
+
export declare function canonicalizeHorizonCertForWitness(cert: Extract<DeletionCertificate, {
|
|
127
|
+
kind: "append_only_horizon";
|
|
128
|
+
}>): Uint8Array;
|
|
129
|
+
/**
|
|
130
|
+
* Sign a `mutable_pruning` or `consolidation_flush` cert as the
|
|
131
|
+
* subject (motebit identity key). Adds the `subject_signature` block.
|
|
132
|
+
*
|
|
133
|
+
* Callers compose: sign as subject → optionally sign as operator → emit.
|
|
134
|
+
* Each signing step appends a signature block; the canonical bytes are
|
|
135
|
+
* recomputed from the body each time, so signatures are commutative
|
|
136
|
+
* (any signing order produces identical bytes for every signer).
|
|
137
|
+
*/
|
|
138
|
+
export declare function signCertAsSubject<T extends Extract<DeletionCertificate, {
|
|
139
|
+
kind: "mutable_pruning" | "consolidation_flush";
|
|
140
|
+
}>>(cert: T, motebitId: string, privateKey: Uint8Array): Promise<T>;
|
|
141
|
+
/** Sign a multi-signature cert as the operator. */
|
|
142
|
+
export declare function signCertAsOperator<T extends Extract<DeletionCertificate, {
|
|
143
|
+
kind: "mutable_pruning" | "consolidation_flush";
|
|
144
|
+
}>>(cert: T, operatorId: string, privateKey: Uint8Array): Promise<T>;
|
|
145
|
+
/** Sign a multi-signature cert as a delegate (multi-hop authorization). */
|
|
146
|
+
export declare function signCertAsDelegate<T extends Extract<DeletionCertificate, {
|
|
147
|
+
kind: "mutable_pruning" | "consolidation_flush";
|
|
148
|
+
}>>(cert: T, delegateMotebitId: string, delegationReceiptId: string, privateKey: Uint8Array): Promise<T>;
|
|
149
|
+
/** Sign a multi-signature cert as the guardian (enterprise custody). */
|
|
150
|
+
export declare function signCertAsGuardian<T extends Extract<DeletionCertificate, {
|
|
151
|
+
kind: "mutable_pruning" | "consolidation_flush";
|
|
152
|
+
}>>(cert: T, guardianPublicKey: Uint8Array, privateKey: Uint8Array): Promise<T>;
|
|
153
|
+
/**
|
|
154
|
+
* Sign an `append_only_horizon` cert as the issuer. The issuer is the
|
|
155
|
+
* subject named by the discriminator — motebit identity key for
|
|
156
|
+
* per-motebit horizons, operator key for operator-wide horizons.
|
|
157
|
+
*/
|
|
158
|
+
export declare function signHorizonCertAsIssuer(cert: Omit<Extract<DeletionCertificate, {
|
|
159
|
+
kind: "append_only_horizon";
|
|
160
|
+
}>, "suite" | "signature">, privateKey: Uint8Array): Promise<Extract<DeletionCertificate, {
|
|
161
|
+
kind: "append_only_horizon";
|
|
162
|
+
}>>;
|
|
163
|
+
/**
|
|
164
|
+
* Add a witness signature to an `append_only_horizon` cert. Witness
|
|
165
|
+
* signs the same canonical body as the issuer; the witness array is
|
|
166
|
+
* part of the signed body, so once the issuer has signed, the witness
|
|
167
|
+
* additions are appended without re-signing the issuer side.
|
|
168
|
+
*
|
|
169
|
+
* Note: the issuer's signature is over the body INCLUDING the
|
|
170
|
+
* witness array as it stood when the issuer signed. Witnesses added
|
|
171
|
+
* after issuer-signing invalidate the issuer signature. Production
|
|
172
|
+
* flow: build the witness array first → issuer signs last. This
|
|
173
|
+
* function is here for tests and offline witness aggregation.
|
|
174
|
+
*/
|
|
175
|
+
export declare function signHorizonWitness(cert: Extract<DeletionCertificate, {
|
|
176
|
+
kind: "append_only_horizon";
|
|
177
|
+
}>, witnessMotebitId: string, privateKey: Uint8Array, inclusionProof?: HorizonWitness["inclusion_proof"]): Promise<HorizonWitness>;
|
|
178
|
+
/**
|
|
179
|
+
* Compute the canonical signing bytes for a `HorizonWitnessRequestBody`.
|
|
180
|
+
* Byte-equal to `canonicalizeHorizonCertForWitness` over the
|
|
181
|
+
* corresponding full cert (since the function strips
|
|
182
|
+
* `witnessed_by[]` + `signature`); exposed as a separate helper so
|
|
183
|
+
* call sites pass the wire-shaped request body directly without
|
|
184
|
+
* synthesizing a full cert.
|
|
185
|
+
*/
|
|
186
|
+
export declare function canonicalizeHorizonWitnessRequestBody(body: HorizonWitnessRequestBody): Uint8Array;
|
|
187
|
+
/**
|
|
188
|
+
* Sign a `HorizonWitnessRequestBody` — produces a base64url-encoded
|
|
189
|
+
* Ed25519 signature over the canonical bytes. Used by BOTH:
|
|
190
|
+
*
|
|
191
|
+
* - the issuer, for `WitnessSolicitationRequest.issuer_signature`
|
|
192
|
+
* (attests authenticity of the solicitation request before any
|
|
193
|
+
* peer signs as witness),
|
|
194
|
+
* - each peer witness, for `WitnessSolicitationResponse.signature`
|
|
195
|
+
* (the per-witness signature copied verbatim into
|
|
196
|
+
* `cert.witnessed_by[].signature`).
|
|
197
|
+
*
|
|
198
|
+
* Both roles sign byte-equal canonical bytes by design (session-3
|
|
199
|
+
* sub-decision: issuer-signature payload IS witness-signature payload).
|
|
200
|
+
* The peer's verify-issuer + sign-as-witness paths share canonical-bytes
|
|
201
|
+
* derivation through this primitive — drift-impossible.
|
|
202
|
+
*/
|
|
203
|
+
export declare function signHorizonWitnessRequestBody(body: HorizonWitnessRequestBody, privateKey: Uint8Array): Promise<string>;
|
|
204
|
+
/**
|
|
205
|
+
* Verify the issuer's `issuer_signature` on a
|
|
206
|
+
* `WitnessSolicitationRequest`. Peer-side fail-closed gate before the
|
|
207
|
+
* peer signs as a witness over the same bytes. Returns `false` on any
|
|
208
|
+
* malformed signature, suite mismatch, or hash failure — never throws.
|
|
209
|
+
*/
|
|
210
|
+
export declare function verifyHorizonWitnessRequestSignature(body: HorizonWitnessRequestBody, signatureBase64Url: string, issuerPublicKey: Uint8Array): Promise<boolean>;
|
|
211
|
+
/**
|
|
212
|
+
* Verify a deletion certificate. Single entry point — dispatches by
|
|
213
|
+
* `kind` to the per-arm verifier. Fail-closed throughout: any
|
|
214
|
+
* verification step that errors or returns false → `valid: false`.
|
|
215
|
+
*
|
|
216
|
+
* The verifier checks, in order:
|
|
217
|
+
* 1. Reason × signer × mode table is satisfied (decision 5).
|
|
218
|
+
* 2. Each present signature is cryptographically valid against the
|
|
219
|
+
* cert's canonical signing bytes.
|
|
220
|
+
* 3. (Horizon arm only) the issuer signature and each witness
|
|
221
|
+
* signature verify.
|
|
222
|
+
* 4. (Optional, when `validateGuardianBinding` supplied) the
|
|
223
|
+
* embedded guardian public key matches the subject motebit's
|
|
224
|
+
* declared guardian.
|
|
225
|
+
*/
|
|
226
|
+
export declare function verifyDeletionCertificate(cert: DeletionCertificate, ctx: DeletionCertificateVerifyContext): Promise<DeletionCertificateVerifyResult>;
|
|
227
|
+
import type { RetentionManifest } from "@motebit/protocol";
|
|
228
|
+
/** Result of verifying a retention manifest. Fail-closed: any failure → `valid: false`. */
|
|
229
|
+
export interface RetentionManifestVerifyResult {
|
|
230
|
+
readonly valid: boolean;
|
|
231
|
+
readonly errors: string[];
|
|
232
|
+
/** The parsed manifest if signature verified, else `null`. */
|
|
233
|
+
readonly manifest: RetentionManifest | null;
|
|
234
|
+
}
|
|
235
|
+
/**
|
|
236
|
+
* Verify a retention manifest published at
|
|
237
|
+
* `/.well-known/motebit-retention.json`. The manifest's signature
|
|
238
|
+
* covers `canonicalJson(manifest minus signature)`, signed by the
|
|
239
|
+
* operator's identity key under `motebit-jcs-ed25519-hex-v1` —
|
|
240
|
+
* sibling to the operator-transparency manifest's signing flow.
|
|
241
|
+
*
|
|
242
|
+
* Browser-side re-verifier per docs/doctrine/retention-policy.md
|
|
243
|
+
* §"Self-attesting transparency". Composes existing primitives —
|
|
244
|
+
* `canonicalJson` from signing.ts, `verifyBySuite` from
|
|
245
|
+
* suite-dispatch.ts. Same shape as the `verifySkillBundle`
|
|
246
|
+
* (87e2f174) browser primitive.
|
|
247
|
+
*
|
|
248
|
+
* The verifier accepts the operator's public key directly — callers
|
|
249
|
+
* resolve it from the operator-transparency manifest at
|
|
250
|
+
* `/.well-known/motebit-transparency.json` (its `relay_public_key`
|
|
251
|
+
* field), so a single manifest fetch + verify pair gives users a
|
|
252
|
+
* full retention claim audit.
|
|
253
|
+
*/
|
|
254
|
+
export declare function verifyRetentionManifest(manifest: RetentionManifest, operatorPublicKey: Uint8Array): Promise<RetentionManifestVerifyResult>;
|
|
255
|
+
export {};
|
|
256
|
+
//# sourceMappingURL=deletion-certificate.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"deletion-certificate.d.ts","sourceRoot":"","sources":["../src/deletion-certificate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EACV,mBAAmB,EAEnB,cAAc,EACd,yBAAyB,EACzB,OAAO,EACR,MAAM,mBAAmB,CAAC;AAO3B,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,EAAE,OAAsC,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,QAAsB,CAAC;AAgBtE,KAAK,cAAc,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAgE9D,6FAA6F;AAC7F,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;QACzC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,GAAG,IAAI,CAAC;QACjD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,GAAG,IAAI,CAAC;QAClD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,GAAG,IAAI,CAAC;QAClD,QAAQ,CAAC,wBAAwB,EAAE,OAAO,GAAG,IAAI,CAAC;QAClD,2DAA2D;QAC3D,QAAQ,CAAC,8BAA8B,EAAE,OAAO,GAAG,IAAI,CAAC;QACxD,mEAAmE;QACnE,QAAQ,CAAC,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;QACtD,6DAA6D;QAC7D,QAAQ,CAAC,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAC;KACzD,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gCAAgC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,uBAAuB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACpF,2DAA2D;IAC3D,QAAQ,CAAC,wBAAwB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACtF;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CACjC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,oBAAoB,EAAE,MAAM,KACzB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAID;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,GACtF,UAAU,CASZ;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,GAClE,UAAU,CAIZ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,GAClE,UAAU,CAKZ;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAC3F,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAWhE;AAED,mDAAmD;AACnD,wBAAsB,kBAAkB,CACtC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAC3F,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAWjE;AAED,2EAA2E;AAC3E,wBAAsB,kBAAkB,CACtC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAE3F,IAAI,EAAE,CAAC,EACP,iBAAiB,EAAE,MAAM,EACzB,mBAAmB,EAAE,MAAM,EAC3B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CACtC,CAAC,SAAS,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAAA;CAAE,CAAC,EAC3F,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAW5E;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,EAChG,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC,CAKxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,qBAAqB,CAAA;CAAE,CAAC,EACnE,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,UAAU,EACtB,cAAc,CAAC,EAAE,cAAc,CAAC,iBAAiB,CAAC,GACjD,OAAO,CAAC,cAAc,CAAC,CASzB;AAmBD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,yBAAyB,GAAG,UAAU,CAMjG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,yBAAyB,EAC/B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,IAAI,EAAE,yBAAyB,EAC/B,kBAAkB,EAAE,MAAM,EAC1B,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,OAAO,CAAC,CAUlB;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,gCAAgC,GACpC,OAAO,CAAC,+BAA+B,CAAC,CAQ1C;AAiND,OAAO,KAAK,EAAE,iBAAiB,EAAa,MAAM,mBAAmB,CAAC;AAEtE,2FAA2F;AAC3F,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,iBAAiB,EAC3B,iBAAiB,EAAE,UAAU,GAC5B,OAAO,CAAC,6BAA6B,CAAC,CAiDxC"}
|