@onsignet/core 0.1.0

package/dist/attestation.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Owner attestation verification: verify that an owner signed an attestation for an agent nodeId.
+ */
+/**
+ * Verify owner attestation signature. The attestation is sign("Signet owner attestation: agent <nodeId>").
+ */
+export declare function verifyOwnerAttestation(agentNodeId: string, attestationBase64: string, ownerEd25519PublicKey: Uint8Array): boolean;
+//# sourceMappingURL=attestation.d.ts.map

package/dist/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,qBAAqB,EAAE,UAAU,GAChC,OAAO,CAST"}

package/dist/attestation.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * Owner attestation verification: verify that an owner signed an attestation for an agent nodeId.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyOwnerAttestation = verifyOwnerAttestation;
+const crypto_js_1 = require("./crypto.js");
+const ATTESTATION_PREFIX = "Signet owner attestation: agent ";
+/**
+ * Verify owner attestation signature. The attestation is sign("Signet owner attestation: agent <nodeId>").
+ */
+function verifyOwnerAttestation(agentNodeId, attestationBase64, ownerEd25519PublicKey) {
+    try {
+        const statement = ATTESTATION_PREFIX + agentNodeId;
+        const msg = new TextEncoder().encode(statement);
+        const sig = (0, crypto_js_1.decodeBase64)(attestationBase64);
+        return (0, crypto_js_1.verify)(msg, sig, ownerEd25519PublicKey);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=attestation.js.map

package/dist/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":";AAAA;;GAEG;;AASH,wDAaC;AApBD,2CAAmD;AAEnD,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAE9D;;GAEG;AACH,SAAgB,sBAAsB,CACpC,WAAmB,EACnB,iBAAyB,EACzB,qBAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,kBAAkB,GAAG,WAAW,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,iBAAiB,CAAC,CAAC;QAC5C,OAAO,IAAA,kBAAM,EAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/capability.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Minimal capability helper: build capability blob and sign. Full policy in daemon.
+ */
+import type { MessageCapability } from "./types.js";
+export declare function createCapabilityToken(scope: string, constraints: Record<string, unknown>, ownerEd25519SecretKey: Uint8Array): MessageCapability;
+export declare function verifyCapabilitySignature(capability: MessageCapability, ownerEd25519PublicKey: Uint8Array): boolean;
+//# sourceMappingURL=capability.d.ts.map

package/dist/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,qBAAqB,EAAE,UAAU,GAChC,iBAAiB,CASnB;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,iBAAiB,EAC7B,qBAAqB,EAAE,UAAU,GAChC,OAAO,CAKT"}

package/dist/capability.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Minimal capability helper: build capability blob and sign. Full policy in daemon.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCapabilityToken = createCapabilityToken;
+exports.verifyCapabilitySignature = verifyCapabilitySignature;
+const crypto_js_1 = require("./crypto.js");
+function createCapabilityToken(scope, constraints, ownerEd25519SecretKey) {
+    const payload = JSON.stringify({ scope, constraints });
+    const payloadBytes = new TextEncoder().encode(payload);
+    const ownerSignature = (0, crypto_js_1.sign)(payloadBytes, ownerEd25519SecretKey);
+    return {
+        scope,
+        constraints,
+        ownerSignature: (0, crypto_js_1.encodeBase64)(ownerSignature),
+    };
+}
+function verifyCapabilitySignature(capability, ownerEd25519PublicKey) {
+    const payload = JSON.stringify({ scope: capability.scope, constraints: capability.constraints });
+    const payloadBytes = new TextEncoder().encode(payload);
+    const sig = (0, crypto_js_1.decodeBase64)(capability.ownerSignature);
+    return (0, crypto_js_1.verify)(payloadBytes, sig, ownerEd25519PublicKey);
+}
+//# sourceMappingURL=capability.js.map

package/dist/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAKH,sDAaC;AAED,8DAQC;AA1BD,2CAAuE;AAGvE,SAAgB,qBAAqB,CACnC,KAAa,EACb,WAAoC,EACpC,qBAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,IAAA,gBAAI,EAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;IACjE,OAAO;QACL,KAAK;QACL,WAAW;QACX,cAAc,EAAE,IAAA,wBAAY,EAAC,cAAc,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAgB,yBAAyB,CACvC,UAA6B,EAC7B,qBAAiC;IAEjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IACpD,OAAO,IAAA,kBAAM,EAAC,YAAY,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAC1D,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Cryptographic operations: Ed25519 signing, X25519+XSalsa20-Poly1305 box.
+ * Product plan Section 8.2: Ed25519, X25519, XSalsa20-Poly1305.
+ */
+export interface Ed25519KeyPair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+export interface X25519KeyPair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+export declare function generateEd25519KeyPair(): Ed25519KeyPair;
+export declare function generateX25519KeyPair(): X25519KeyPair;
+export declare function sign(payload: Uint8Array, secretKey: Uint8Array): Uint8Array;
+export declare function verify(payload: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
+/**
+ * NodeId = "am_" + base58(Ed25519 public key). Product plan Section 6.4.
+ */
+export declare function nodeIdFromPublicKey(ed25519PublicKey: Uint8Array): string;
+/**
+ * Parse nodeId to Ed25519 public key bytes. Returns null if invalid.
+ */
+export declare function parseNodeId(nodeId: string): Uint8Array | null;
+/**
+ * Encrypt payload for recipient using ephemeral sender key (X25519 box).
+ * Returns ciphertext, nonce, and ephemeral public key for the envelope.
+ */
+export declare function encrypt(payload: Uint8Array, recipientX25519PublicKey: Uint8Array): {
+    ciphertext: Uint8Array;
+    nonce: Uint8Array;
+    senderPublicKey: Uint8Array;
+};
+/**
+ * Decrypt payload from sender's ephemeral key using recipient's X25519 secret key.
+ */
+export declare function decrypt(ciphertext: Uint8Array, nonce: Uint8Array, senderEphemeralPublicKey: Uint8Array, recipientX25519SecretKey: Uint8Array): Uint8Array | null;
+export declare function encodeBase64(bytes: Uint8Array): string;
+export declare function decodeBase64(s: string): Uint8Array;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,wBAAgB,sBAAsB,IAAI,cAAc,CAGvD;AAED,wBAAgB,qBAAqB,IAAI,aAAa,CAGrD;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAE3E;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAEjG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,UAAU,GAAG,MAAM,CAExE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAU7D;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACrB,OAAO,EAAE,UAAU,EACnB,wBAAwB,EAAE,UAAU,GACnC;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,UAAU,CAAA;CAAE,CAS5E;AAED;;GAEG;AACH,wBAAgB,OAAO,CACrB,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,UAAU,EACjB,wBAAwB,EAAE,UAAU,EACpC,wBAAwB,EAAE,UAAU,GACnC,UAAU,GAAG,IAAI,CAEnB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEtD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAElD"}

package/dist/crypto.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Cryptographic operations: Ed25519 signing, X25519+XSalsa20-Poly1305 box.
+ * Product plan Section 8.2: Ed25519, X25519, XSalsa20-Poly1305.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateEd25519KeyPair = generateEd25519KeyPair;
+exports.generateX25519KeyPair = generateX25519KeyPair;
+exports.sign = sign;
+exports.verify = verify;
+exports.nodeIdFromPublicKey = nodeIdFromPublicKey;
+exports.parseNodeId = parseNodeId;
+exports.encrypt = encrypt;
+exports.decrypt = decrypt;
+exports.encodeBase64 = encodeBase64;
+exports.decodeBase64 = decodeBase64;
+const nacl = __importStar(require("tweetnacl"));
+const util = __importStar(require("tweetnacl-util"));
+const bs58_1 = __importDefault(require("bs58"));
+const NODE_ID_PREFIX = "am_";
+const BOX_NONCE_LENGTH = 24;
+function generateEd25519KeyPair() {
+    const kp = nacl.sign.keyPair();
+    return { publicKey: kp.publicKey, secretKey: kp.secretKey };
+}
+function generateX25519KeyPair() {
+    const kp = nacl.box.keyPair();
+    return { publicKey: kp.publicKey, secretKey: kp.secretKey };
+}
+function sign(payload, secretKey) {
+    return nacl.sign.detached(payload, secretKey);
+}
+function verify(payload, signature, publicKey) {
+    return nacl.sign.detached.verify(payload, signature, publicKey);
+}
+/**
+ * NodeId = "am_" + base58(Ed25519 public key). Product plan Section 6.4.
+ */
+function nodeIdFromPublicKey(ed25519PublicKey) {
+    return NODE_ID_PREFIX + bs58_1.default.encode(ed25519PublicKey);
+}
+/**
+ * Parse nodeId to Ed25519 public key bytes. Returns null if invalid.
+ */
+function parseNodeId(nodeId) {
+    if (!nodeId.startsWith(NODE_ID_PREFIX))
+        return null;
+    const b58 = nodeId.slice(NODE_ID_PREFIX.length);
+    if (!b58)
+        return null;
+    try {
+        const bytes = bs58_1.default.decode(b58);
+        return bytes.length > 0 ? new Uint8Array(bytes) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Encrypt payload for recipient using ephemeral sender key (X25519 box).
+ * Returns ciphertext, nonce, and ephemeral public key for the envelope.
+ */
+function encrypt(payload, recipientX25519PublicKey) {
+    const ephemeral = nacl.box.keyPair();
+    const nonce = nacl.randomBytes(BOX_NONCE_LENGTH);
+    const ciphertext = nacl.box(payload, nonce, recipientX25519PublicKey, ephemeral.secretKey);
+    return {
+        ciphertext,
+        nonce,
+        senderPublicKey: ephemeral.publicKey,
+    };
+}
+/**
+ * Decrypt payload from sender's ephemeral key using recipient's X25519 secret key.
+ */
+function decrypt(ciphertext, nonce, senderEphemeralPublicKey, recipientX25519SecretKey) {
+    return nacl.box.open(ciphertext, nonce, senderEphemeralPublicKey, recipientX25519SecretKey);
+}
+function encodeBase64(bytes) {
+    return util.encodeBase64(bytes);
+}
+function decodeBase64(s) {
+    return util.decodeBase64(s);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBH,wDAGC;AAED,sDAGC;AAED,oBAEC;AAED,wBAEC;AAKD,kDAEC;AAKD,kCAUC;AAMD,0BAYC;AAKD,0BAOC;AAED,oCAEC;AAED,oCAEC;AA7FD,gDAAkC;AAClC,qDAAuC;AACvC,gDAAwB;AAExB,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAY5B,SAAgB,sBAAsB;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,qBAAqB;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,IAAI,CAAC,OAAmB,EAAE,SAAqB;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,SAAgB,MAAM,CAAC,OAAmB,EAAE,SAAqB,EAAE,SAAqB;IACtF,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,gBAA4B;IAC9D,OAAO,cAAc,GAAG,cAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CACrB,OAAmB,EACnB,wBAAoC;IAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3F,OAAO;QACL,UAAU;QACV,KAAK;QACL,eAAe,EAAE,SAAS,CAAC,SAAS;KACrC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,OAAO,CACrB,UAAsB,EACtB,KAAiB,EACjB,wBAAoC,EACpC,wBAAoC;IAEpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;AAC9F,CAAC;AAED,SAAgB,YAAY,CAAC,KAAiB;IAC5C,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Minimal identity helper: keypair + nodeId. Full identity logic lives in daemon.
+ */
+import { type Ed25519KeyPair, type X25519KeyPair } from "./crypto.js";
+export interface AgentIdentityKeys {
+    ed25519: Ed25519KeyPair;
+    x25519: X25519KeyPair;
+    nodeId: string;
+}
+export declare function createAgentIdentity(): AgentIdentityKeys;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,IAAI,iBAAiB,CAKvD"}

package/dist/identity.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * Minimal identity helper: keypair + nodeId. Full identity logic lives in daemon.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentIdentity = createAgentIdentity;
+const crypto_js_1 = require("./crypto.js");
+function createAgentIdentity() {
+    const ed25519 = (0, crypto_js_1.generateEd25519KeyPair)();
+    const x25519 = (0, crypto_js_1.generateX25519KeyPair)();
+    const nodeId = (0, crypto_js_1.nodeIdFromPublicKey)(ed25519.publicKey);
+    return { ed25519, x25519, nodeId };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAgBH,kDAKC;AAnBD,2CAMqB;AAQrB,SAAgB,mBAAmB;IACjC,MAAM,OAAO,GAAG,IAAA,kCAAsB,GAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,iCAAqB,GAAE,CAAC;IACvC,MAAM,MAAM,GAAG,IAAA,+BAAmB,EAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./crypto.js";
+export * from "./message.js";
+export * from "./identity.js";
+export * from "./capability.js";
+export * from "./types.js";
+export * from "./revocation.js";
+export * from "./attestation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./crypto.js"), exports);
+__exportStar(require("./message.js"), exports);
+__exportStar(require("./identity.js"), exports);
+__exportStar(require("./capability.js"), exports);
+__exportStar(require("./types.js"), exports);
+__exportStar(require("./revocation.js"), exports);
+__exportStar(require("./attestation.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,+CAA6B;AAC7B,gDAA8B;AAC9B,kDAAgC;AAChC,6CAA2B;AAC3B,kDAAgC;AAChC,mDAAiC"}

package/dist/message.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Message envelope: build, serialize, parse, verify. Product plan Section 6.4.
+ */
+import { type Ed25519KeyPair, type X25519KeyPair } from "./crypto.js";
+import type { SignetEnvelopeWire, SignetEnvelope, MessagePayload, MessageCapability } from "./types.js";
+export interface CreateEnvelopeOptions {
+    recipientX25519PublicKey: Uint8Array;
+    ownerAttestation?: string;
+    ownerPublicKey?: string;
+    replyTo?: string;
+}
+/**
+ * Build a wire envelope: encrypt payload for recipient, sign with from keypair.
+ */
+export declare function createEnvelope(fromEd25519: Ed25519KeyPair, _fromX25519: X25519KeyPair, toNodeId: string, payload: MessagePayload, capability: MessageCapability, options: CreateEnvelopeOptions): SignetEnvelopeWire;
+export declare function serializeEnvelope(envelope: SignetEnvelopeWire): string;
+export declare function parseEnvelope(json: string): SignetEnvelopeWire;
+/**
+ * Verify envelope signature. Sender's Ed25519 public key must be provided (e.g. from registry).
+ */
+export declare function verifyEnvelope(envelope: SignetEnvelopeWire, senderEd25519PublicKey: Uint8Array): boolean;
+/**
+ * Decrypt payload and return in-memory envelope. Caller must have verified signature first.
+ */
+export declare function decryptEnvelope(wire: SignetEnvelopeWire, recipientX25519SecretKey: Uint8Array): SignetEnvelope;
+//# sourceMappingURL=message.d.ts.map

package/dist/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../src/message.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAQL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EAEd,cAAc,EACd,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAkBpB,MAAM,WAAW,qBAAqB;IACpC,wBAAwB,EAAE,UAAU,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,cAAc,EAC3B,WAAW,EAAE,aAAa,EAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,iBAAiB,EAC7B,OAAO,EAAE,qBAAqB,GAC7B,kBAAkB,CAoCpB;AAkBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAEtE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAa9D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,UAAU,GAAG,OAAO,CAQxG;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,kBAAkB,EACxB,wBAAwB,EAAE,UAAU,GACnC,cAAc,CAQhB"}

package/dist/message.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Message envelope: build, serialize, parse, verify. Product plan Section 6.4.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEnvelope = createEnvelope;
+exports.serializeEnvelope = serializeEnvelope;
+exports.parseEnvelope = parseEnvelope;
+exports.verifyEnvelope = verifyEnvelope;
+exports.decryptEnvelope = decryptEnvelope;
+const crypto_js_1 = require("./crypto.js");
+const types_js_1 = require("./types.js");
+const ENCRYPTION_ALGORITHM = "x25519-xsalsa20-poly1305";
+function randomId() {
+    const bytes = new Uint8Array(16);
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+        crypto.getRandomValues(bytes);
+    }
+    else {
+        for (let i = 0; i < 16; i++)
+            bytes[i] = Math.floor(Math.random() * 256);
+    }
+    const hex = Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+    return "msg_" + hex;
+}
+/**
+ * Build a wire envelope: encrypt payload for recipient, sign with from keypair.
+ */
+function createEnvelope(fromEd25519, _fromX25519, toNodeId, payload, capability, options) {
+    const id = randomId();
+    const timestamp = new Date().toISOString();
+    const from = {
+        nodeId: (0, crypto_js_1.nodeIdFromPublicKey)(fromEd25519.publicKey),
+        ...(options.ownerAttestation !== undefined && { ownerAttestation: options.ownerAttestation }),
+        ...(options.ownerPublicKey !== undefined && { ownerPublicKey: options.ownerPublicKey }),
+    };
+    const payloadBytes = new TextEncoder().encode(JSON.stringify(payload));
+    const { ciphertext, nonce, senderPublicKey } = (0, crypto_js_1.encrypt)(payloadBytes, options.recipientX25519PublicKey);
+    const encryption = {
+        algorithm: ENCRYPTION_ALGORITHM,
+        nonce: (0, crypto_js_1.encodeBase64)(nonce),
+        senderPublicKey: (0, crypto_js_1.encodeBase64)(senderPublicKey),
+    };
+    const envelopeWithoutSig = {
+        protocol: types_js_1.PROTOCOL_VERSION,
+        id,
+        timestamp,
+        from,
+        to: toNodeId,
+        ...(options.replyTo !== undefined && { replyTo: options.replyTo }),
+        capability,
+        payload: (0, crypto_js_1.encodeBase64)(ciphertext),
+        encryption,
+        signature: "",
+    };
+    const canonical = canonicalEnvelopeBytes(envelopeWithoutSig);
+    const sig = (0, crypto_js_1.sign)(canonical, fromEd25519.secretKey);
+    return {
+        ...envelopeWithoutSig,
+        signature: (0, crypto_js_1.encodeBase64)(sig),
+    };
+}
+function canonicalEnvelopeBytes(envelope) {
+    const obj = {
+        protocol: envelope.protocol,
+        id: envelope.id,
+        timestamp: envelope.timestamp,
+        from: envelope.from,
+        to: envelope.to,
+        replyTo: envelope.replyTo,
+        capability: envelope.capability,
+        payload: envelope.payload,
+        encryption: envelope.encryption,
+        signature: envelope.signature,
+    };
+    return new TextEncoder().encode(JSON.stringify(obj));
+}
+function serializeEnvelope(envelope) {
+    return JSON.stringify(envelope);
+}
+function parseEnvelope(json) {
+    const raw = JSON.parse(json);
+    if (typeof raw !== "object" || raw === null)
+        throw new Error("Invalid envelope: not an object");
+    const e = raw;
+    for (const key of ["protocol", "id", "timestamp", "from", "to", "capability", "payload", "encryption", "signature"]) {
+        if (!(key in e))
+            throw new Error(`Invalid envelope: missing ${key}`);
+    }
+    const from = e.from;
+    if (!from.nodeId || typeof from.nodeId !== "string")
+        throw new Error("Invalid envelope: from.nodeId");
+    if (typeof e.to !== "string")
+        throw new Error("Invalid envelope: to");
+    if (typeof e.payload !== "string")
+        throw new Error("Invalid envelope: payload");
+    if (typeof e.signature !== "string")
+        throw new Error("Invalid envelope: signature");
+    return raw;
+}
+/**
+ * Verify envelope signature. Sender's Ed25519 public key must be provided (e.g. from registry).
+ */
+function verifyEnvelope(envelope, senderEd25519PublicKey) {
+    const envelopeWithoutSig = {
+        ...envelope,
+        signature: "",
+    };
+    const canonical = canonicalEnvelopeBytes(envelopeWithoutSig);
+    const sig = (0, crypto_js_1.decodeBase64)(envelope.signature);
+    return (0, crypto_js_1.verify)(canonical, sig, senderEd25519PublicKey);
+}
+/**
+ * Decrypt payload and return in-memory envelope. Caller must have verified signature first.
+ */
+function decryptEnvelope(wire, recipientX25519SecretKey) {
+    const ciphertext = (0, crypto_js_1.decodeBase64)(wire.payload);
+    const nonce = (0, crypto_js_1.decodeBase64)(wire.encryption.nonce);
+    const senderPublicKey = (0, crypto_js_1.decodeBase64)(wire.encryption.senderPublicKey);
+    const plain = (0, crypto_js_1.decrypt)(ciphertext, nonce, senderPublicKey, recipientX25519SecretKey);
+    if (!plain)
+        throw new Error("Decryption failed");
+    const payload = JSON.parse(new TextDecoder().decode(plain));
+    return { ...wire, payload };
+}
+//# sourceMappingURL=message.js.map

package/dist/message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.js","sourceRoot":"","sources":["../src/message.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAgDH,wCA2CC;AAkBD,8CAEC;AAED,sCAaC;AAKD,wCAQC;AAKD,0CAWC;AAzJD,2CAUqB;AASrB,yCAA8C;AAE9C,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAExD,SAAS,QAAQ;IACf,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,MAAM,GAAG,GAAG,CAAC;AACtB,CAAC;AASD;;GAEG;AACH,SAAgB,cAAc,CAC5B,WAA2B,EAC3B,WAA0B,EAC1B,QAAgB,EAChB,OAAuB,EACvB,UAA6B,EAC7B,OAA8B;IAE9B,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,IAAA,+BAAmB,EAAC,WAAW,CAAC,SAAS,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7F,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;KACxF,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,IAAA,mBAAO,EACpD,YAAY,EACZ,OAAO,CAAC,wBAAwB,CACjC,CAAC;IACF,MAAM,UAAU,GAAsB;QACpC,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,IAAA,wBAAY,EAAC,KAAK,CAAC;QAC1B,eAAe,EAAE,IAAA,wBAAY,EAAC,eAAe,CAAC;KAC/C,CAAC;IACF,MAAM,kBAAkB,GAAkE;QACxF,QAAQ,EAAE,2BAAgB;QAC1B,EAAE;QACF,SAAS;QACT,IAAI;QACJ,EAAE,EAAE,QAAQ;QACZ,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAClE,UAAU;QACV,OAAO,EAAE,IAAA,wBAAY,EAAC,UAAU,CAAC;QACjC,UAAU;QACV,SAAS,EAAE,EAAE;KACd,CAAC;IACF,MAAM,SAAS,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO;QACL,GAAG,kBAAkB;QACrB,SAAS,EAAE,IAAA,wBAAY,EAAC,GAAG,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAuE;IACrG,MAAM,GAAG,GAAG;QACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;IACF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAA4B;IAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QACpH,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAmB,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACtG,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,OAAO,GAAyB,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,QAA4B,EAAE,sBAAkC;IAC7F,MAAM,kBAAkB,GAAkE;QACxF,GAAG,QAAQ;QACX,SAAS,EAAE,EAAE;KACd,CAAC;IACF,MAAM,SAAS,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO,IAAA,kBAAM,EAAC,SAAS,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,IAAwB,EACxB,wBAAoC;IAEpC,MAAM,UAAU,GAAG,IAAA,wBAAY,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAA,wBAAY,EAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,IAAA,wBAAY,EAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAmB,CAAC;IAC9E,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/revocation.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Key revocation: create, serialize, and verify revocation notices.
+ */
+import type { KeyRevocation } from "./types.js";
+export declare function createKeyRevocation(revokedNodeId: string, reason: KeyRevocation["reason"], ownerEd25519SecretKey: Uint8Array, ownerEd25519PublicKey: Uint8Array, replacementNodeId?: string): KeyRevocation;
+export declare function verifyKeyRevocation(revocation: KeyRevocation): boolean;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAOhD,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAC/B,qBAAqB,EAAE,UAAU,EACjC,qBAAqB,EAAE,UAAU,EACjC,iBAAiB,CAAC,EAAE,MAAM,GACzB,aAAa,CAYf;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CActE"}

package/dist/revocation.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Key revocation: create, serialize, and verify revocation notices.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createKeyRevocation = createKeyRevocation;
+exports.verifyKeyRevocation = verifyKeyRevocation;
+const crypto_js_1 = require("./crypto.js");
+function canonicalRevocationBytes(revokedNodeId, revokedAt, reason, replacementNodeId) {
+    const obj = { revokedNodeId, revokedAt, reason, ...(replacementNodeId && { replacementNodeId }) };
+    return new TextEncoder().encode(JSON.stringify(obj));
+}
+function createKeyRevocation(revokedNodeId, reason, ownerEd25519SecretKey, ownerEd25519PublicKey, replacementNodeId) {
+    const revokedAt = new Date().toISOString();
+    const canonical = canonicalRevocationBytes(revokedNodeId, revokedAt, reason, replacementNodeId);
+    const sig = (0, crypto_js_1.sign)(canonical, ownerEd25519SecretKey);
+    return {
+        revokedNodeId,
+        revokedAt,
+        reason,
+        ...(replacementNodeId && { replacementNodeId }),
+        ownerSignature: (0, crypto_js_1.encodeBase64)(sig),
+        ownerPublicKey: (0, crypto_js_1.encodeBase64)(ownerEd25519PublicKey),
+    };
+}
+function verifyKeyRevocation(revocation) {
+    try {
+        const canonical = canonicalRevocationBytes(revocation.revokedNodeId, revocation.revokedAt, revocation.reason, revocation.replacementNodeId);
+        const sig = (0, crypto_js_1.decodeBase64)(revocation.ownerSignature);
+        const pubKey = (0, crypto_js_1.decodeBase64)(revocation.ownerPublicKey);
+        return (0, crypto_js_1.verify)(canonical, sig, pubKey);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=revocation.js.map

package/dist/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../src/revocation.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAUH,kDAkBC;AAED,kDAcC;AA1CD,2CAAuE;AAGvE,SAAS,wBAAwB,CAAC,aAAqB,EAAE,SAAiB,EAAE,MAAc,EAAE,iBAA0B;IACpH,MAAM,GAAG,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IAClG,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,mBAAmB,CACjC,aAAqB,EACrB,MAA+B,EAC/B,qBAAiC,EACjC,qBAAiC,EACjC,iBAA0B;IAE1B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,wBAAwB,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChG,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACnD,OAAO;QACL,aAAa;QACb,SAAS;QACT,MAAM;QACN,GAAG,CAAC,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC/C,cAAc,EAAE,IAAA,wBAAY,EAAC,GAAG,CAAC;QACjC,cAAc,EAAE,IAAA,wBAAY,EAAC,qBAAqB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CAAC,UAAyB;IAC3D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,wBAAwB,CACxC,UAAU,CAAC,aAAa,EACxB,UAAU,CAAC,SAAS,EACpB,UAAU,CAAC,MAAM,EACjB,UAAU,CAAC,iBAAiB,CAC7B,CAAC;QACF,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACvD,OAAO,IAAA,kBAAM,EAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Signet protocol types (aligned with product plan Section 6.4).
+ */
+export declare const PROTOCOL_VERSION = "Signet/1.0";
+export interface MessageFrom {
+    nodeId: string;
+    ownerAttestation?: string;
+    /** Base64-encoded Ed25519 public key of the agent's owner (for attestation/capability verification). */
+    ownerPublicKey?: string;
+}
+export interface KeyRevocation {
+    /** The nodeId whose key is being revoked. */
+    revokedNodeId: string;
+    /** ISO timestamp of the revocation. */
+    revokedAt: string;
+    /** Reason for revocation (compromise, rotation, decommission). */
+    reason: "compromise" | "rotation" | "decommission";
+    /** Optional replacement nodeId (when reason is "rotation"). */
+    replacementNodeId?: string;
+    /** Base64 Ed25519 signature of the canonical revocation payload, signed by the owner key. */
+    ownerSignature: string;
+    /** Base64 Ed25519 public key of the owner who signed the revocation. */
+    ownerPublicKey: string;
+}
+export interface MessageCapability {
+    scope: string;
+    constraints: Record<string, unknown>;
+    ownerSignature: string;
+}
+export interface MessagePayload {
+    type: string;
+    version: string;
+    content: Record<string, unknown>;
+}
+export interface MessageEncryption {
+    algorithm: string;
+    nonce: string;
+    senderPublicKey: string;
+}
+/** Wire envelope: payload is base64-encoded ciphertext. */
+export interface SignetEnvelopeWire {
+    protocol: string;
+    id: string;
+    timestamp: string;
+    from: MessageFrom;
+    to: string;
+    replyTo?: string;
+    capability: MessageCapability;
+    payload: string;
+    encryption: MessageEncryption;
+    signature: string;
+}
+/** In-memory envelope after decryption: payload is plain MessagePayload. */
+export interface SignetEnvelope extends Omit<SignetEnvelopeWire, "payload"> {
+    payload: MessagePayload;
+}
+/** Escrow type for payment flows. */
+export type EscrowType = "immediate" | "on_delivery" | "milestone" | "time_release";
+/** Payment status in the lifecycle. */
+export type PaymentStatus = "pending" | "initiated" | "confirmed" | "delivered" | "released" | "complete" | "cancelled" | "disputed" | "refund_requested" | "refund_complete";
+/** Terms for a payment (delivery, auto-release, cancellation). */
+export interface PaymentTerms {
+    delivery_deadline?: string;
+    auto_release_hours?: number;
+    cancellation_policy?: string;
+}
+/** Carried in payload.content for every payment.* message. */
+export interface PaymentContext {
+    payment_id: string;
+    stripe_payment_intent_id?: string;
+    amount: number;
+    currency: string;
+    description?: string;
+    escrow_type: EscrowType;
+    platform_fee_percent?: number;
+    buyer_agent_id: string;
+    seller_agent_id: string;
+    terms?: PaymentTerms;
+    status: PaymentStatus;
+}
+/** Payment message payload types (payload.type). */
+export declare const PAYMENT_MESSAGE_TYPES: readonly ["payment.service_request", "payment.service_offer", "payment.initiate", "payment.confirmed", "payment.service_delivered", "payment.release", "payment.complete", "payment.cancelled", "payment.disputed", "payment.refund_requested", "payment.refund_complete"];
+export type PaymentMessageType = (typeof PAYMENT_MESSAGE_TYPES)[number];
+/** Spending policy (capability token extension and daemon config). */
+export interface PaymentPolicy {
+    enabled: boolean;
+    max_single_payment_usd?: number;
+    max_daily_spend_usd?: number;
+    max_monthly_spend_usd?: number;
+    auto_approve_below_usd?: number;
+    require_human_approval_above_usd?: number;
+    allowed_categories?: string[];
+    blocked_agents?: string[];
+    require_signet_verified_sellers?: boolean;
+}
+/** Agent profile payment fields (directory API). */
+export interface AgentPaymentProfile {
+    accepts_payments: boolean;
+    payment_terms?: {
+        default_escrow?: EscrowType;
+        min_amount_usd?: number;
+        categories?: string[];
+        [key: string]: unknown;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,cAAc,CAAC;IACnD,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAe,SAAQ,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC;IACzE,OAAO,EAAE,cAAc,CAAC;CACzB;AAMD,qCAAqC;AACrC,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEpF,uCAAuC;AACvC,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,WAAW,GACX,WAAW,GACX,WAAW,GACX,UAAU,GACV,UAAU,GACV,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,iBAAiB,CAAC;AAEtB,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,UAAU,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,4QAYxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gCAAgC,CAAC,EAAE,MAAM,CAAC;IAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC3C;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE;QACd,cAAc,CAAC,EAAE,UAAU,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH"}

package/dist/types.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * Signet protocol types (aligned with product plan Section 6.4).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PAYMENT_MESSAGE_TYPES = exports.PROTOCOL_VERSION = void 0;
+exports.PROTOCOL_VERSION = "Signet/1.0";
+/** Payment message payload types (payload.type). */
+exports.PAYMENT_MESSAGE_TYPES = [
+    "payment.service_request",
+    "payment.service_offer",
+    "payment.initiate",
+    "payment.confirmed",
+    "payment.service_delivered",
+    "payment.release",
+    "payment.complete",
+    "payment.cancelled",
+    "payment.disputed",
+    "payment.refund_requested",
+    "payment.refund_complete",
+];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEU,QAAA,gBAAgB,GAAG,YAAY,CAAC;AA2G7C,oDAAoD;AACvC,QAAA,qBAAqB,GAAG;IACnC,yBAAyB;IACzB,uBAAuB;IACvB,kBAAkB;IAClB,mBAAmB;IACnB,2BAA2B;IAC3B,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,0BAA0B;IAC1B,yBAAyB;CACjB,CAAC"}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@onsignet/core",
+  "version": "0.1.0",
+  "description": "Signet protocol core: crypto, message format, identity",
+  "license": "MIT",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "lint": "eslint src tests --ext .ts",
+    "typecheck": "tsc --noEmit",
+    "test": "npx vitest run"
+  },
+  "dependencies": {
+    "bs58": "^5.0.0",
+    "tweetnacl": "^1.0.3",
+    "tweetnacl-util": "^0.15.1"
+  },
+  "devDependencies": {
+    "tsx": "^4.6.0",
+    "vitest": "^1.0.0"
+  }
+}