@openvtc/pnm-core 0.1.0

package/dist/provision/adopt.js

@@ -0,0 +1,114 @@
+// Adapt a `MinimalAdminReply` from `runProvisionIntegration` into the
+// shape `installVtaMintedHolder` consumes. Decodes the multibase-encoded
+// private keys, runs a defence-in-depth sanity check that the X25519
+// keyAgreement secret derives correctly from the Ed25519 seed via
+// Montgomery clamping (the canonical did:key derivation the VTA uses
+// on its side), and returns just the seed + DIDs the wallet persists.
+//
+// Kept separate from `run.ts` so the round-trip + the persistence
+// adapter can be unit-tested independently — the round-trip needs a
+// mediator + a live VTA, the adapter is a pure byte-level transform.
+import { ed25519, x25519 } from "@noble/curves/ed25519.js";
+import { multibase } from "@openvtc/vti-didcomm-js";
+const ED25519_PRIV_CODEC = new Uint8Array([0x80, 0x26]); // 0x1300 varint
+const X25519_PRIV_CODEC = new Uint8Array([0x82, 0x26]); // 0x1302 varint
+/** Pull the wallet-persistable shape out of a `MinimalAdminReply`.
+ *
+ *  Decodes the multibase private keys, verifies the multicodec prefix,
+ *  and cross-checks that:
+ *    - the X25519 secret the VTA shipped equals `toMontgomerySecret(edSeed)`
+ *      — defence against a buggy or hostile VTA that ships an X25519
+ *      secret independent of the Ed25519 seed; the wallet's loader will
+ *      *always* recompute X25519 from the seed, so the two MUST agree
+ *      or any DIDComm authcrypt the wallet attempts later will fail in
+ *      a deeply confusing way at AEAD-open time.
+ *    - the Ed25519 public key the seed expands to matches the multibase
+ *      identifier inside the `did:key` — confirms the wallet receives a
+ *      legitimate did:key (not a forged DID claiming a key it doesn't
+ *      control). */
+export function holderInputsFromAdminReply(reply) {
+    const signingPriv = decodePrivateKey(reply.adminSigningPrivateMultibase, ED25519_PRIV_CODEC, "signing (Ed25519)");
+    const kaPriv = decodePrivateKey(reply.adminKaPrivateMultibase, X25519_PRIV_CODEC, "keyAgreement (X25519)");
+    // Cross-check 1: X25519 secret must equal Montgomery(seed). If the VTA
+    // ever changes its derivation, we want to know NOW (at install time)
+    // rather than silently storing the seed and then having every
+    // DIDComm authcrypt fail under this DID.
+    const derivedX25519 = ed25519.utils.toMontgomerySecret(signingPriv);
+    if (!constantTimeEqual(derivedX25519, kaPriv)) {
+        throw new Error("provision-integration: VTA's ka_key.private_key_multibase does not equal " +
+            "toMontgomerySecret(signing seed). The wallet stores the seed and " +
+            "re-derives X25519 on demand; a mismatch would break DIDComm.");
+    }
+    // Cross-check 2: Ed25519 public must match the did:key identifier. The
+    // adminDid is `did:key:z<multibase-of-ed25519-pub>`; we extract the
+    // multibase, decode it, and assert equality with edPub from the seed.
+    const edPub = ed25519.getPublicKey(signingPriv);
+    const didMb = extractDidKeyMultibase(reply.adminDid);
+    const decodedDidKey = multibase.decodeMultikey(didMb);
+    if (!constantTimeEqual(decodedDidKey.codec, multibase.MULTICODEC.ED25519_PUB)) {
+        throw new Error(`provision-integration: adminDid '${reply.adminDid}' is not an Ed25519 did:key`);
+    }
+    if (!constantTimeEqual(decodedDidKey.key, edPub)) {
+        throw new Error("provision-integration: adminDid's multibase identifier does not encode the " +
+            "Ed25519 public key that the shipped seed expands to. The wallet would " +
+            "publish a DID it does not actually control.");
+    }
+    // The keyAgreement VM id convention for did:key Ed25519 (mirrored by
+    // the VTA at mint.rs:124-132) is `<did>#<x25519-multibase-pub>`. The
+    // wallet derives the X25519 pubkey from the seed and emits the same
+    // shape so every signer-side check the wallet later runs against this
+    // identity matches the verifier-side view.
+    const xPub = x25519.getPublicKey(derivedX25519);
+    const xMb = multibase.encodeMultikey(multibase.MULTICODEC.X25519_PUB, xPub);
+    const keyAgreementKid = `${reply.adminDid}#${xMb}`;
+    // signingKid: the VTA ships this in the bundle as
+    // `admin.signing_key.key_id`; we trust the bundle's value. The
+    // canonical shape is `<did>#<signing-multibase>`, which is the did:key
+    // identifier itself (the fragment equals the multibase tag).
+    const signingKid = `${reply.adminDid}#${didMb}`;
+    return {
+        did: reply.adminDid,
+        signingKid,
+        keyAgreementKid,
+        edSeed: signingPriv,
+        vtaDid: reply.vtaDid,
+        ...(reply.vtaUrl ? { vtaUrl: reply.vtaUrl } : {}),
+    };
+}
+function decodePrivateKey(multikey, expectedCodec, label) {
+    const { codec, key } = multibase.decodeMultikey(multikey);
+    if (!constantTimeEqual(codec, expectedCodec)) {
+        throw new Error(`provision-integration: ${label} multicodec mismatch — expected ` +
+            `${hex(expectedCodec)}, got ${hex(codec)}`);
+    }
+    if (key.length !== 32) {
+        throw new Error(`provision-integration: ${label} key length ${key.length} != 32 bytes`);
+    }
+    return key;
+}
+function extractDidKeyMultibase(did) {
+    if (!did.startsWith("did:key:")) {
+        throw new Error(`provision-integration: '${did}' is not a did:key`);
+    }
+    const mb = did.slice("did:key:".length);
+    if (!mb.startsWith("z")) {
+        throw new Error(`provision-integration: did:key identifier '${mb}' is not base58btc multibase`);
+    }
+    return mb;
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let acc = 0;
+    for (let i = 0; i < a.length; i++)
+        acc |= a[i] ^ b[i];
+    return acc === 0;
+}
+function hex(bytes) {
+    let s = "";
+    for (let i = 0; i < bytes.length; i++) {
+        s += bytes[i].toString(16).padStart(2, "0");
+    }
+    return s;
+}
+//# sourceMappingURL=adopt.js.map

package/dist/provision/adopt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/provision/adopt.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,EAAE;AACF,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AAErE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAIpD,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB;AACzE,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB;AAiBxE;;;;;;;;;;;;;oBAaoB;AACpB,MAAM,UAAU,0BAA0B,CACxC,KAAwB;IAExB,MAAM,WAAW,GAAG,gBAAgB,CAClC,KAAK,CAAC,4BAA4B,EAClC,kBAAkB,EAClB,mBAAmB,CACpB,CAAC;IACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,KAAK,CAAC,uBAAuB,EAC7B,iBAAiB,EACjB,uBAAuB,CACxB,CAAC;IAEF,uEAAuE;IACvE,qEAAqE;IACrE,8DAA8D;IAC9D,yCAAyC;IACzC,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,mEAAmE;YACnE,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,CAAC,QAAQ,6BAA6B,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,6EAA6E;YAC3E,wEAAwE;YACxE,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;IACnD,kDAAkD;IAClD,+DAA+D;IAC/D,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC;IAEhD,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,UAAU;QACV,eAAe;QACf,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,aAAyB,EACzB,KAAa;IAEb,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,kCAAkC;YAC/D,GAAG,GAAG,CAAC,aAAa,CAAC,SAAS,GAAG,CAAC,KAAK,CAAC,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,eAAe,GAAG,CAAC,MAAM,cAAc,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,oBAAoB,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE,8BAA8B,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAK,CAAC,CAAC,CAAC,CAAY,GAAI,CAAC,CAAC,CAAC,CAAY,CAAC;IAC9E,OAAO,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/provision/armor.d.ts

@@ -0,0 +1,19 @@
+import type { SealedBundle } from "./types.js";
+/** Decode armored input into one or more SealedBundles, grouped by Bundle-Id. */
+export declare function decodeArmor(input: string): SealedBundle[];
+/** Build the AAD bytes for one chunk's HPKE seal. Mirrors
+ *  `ChunkPlaintext::aad` in `chunk.rs`:
+ *
+ *      version || bundle_id || chunk_index_be || total_chunks_be ||
+ *        digest_algo_len(u8) || digest_algo
+ *
+ *  `digest_algo_len` is capped at 255 (the Rust side uses `u8::MAX`); for
+ *  `sha256`/`sha512`/`blake3` this never trips. */
+export declare function buildChunkAad(args: {
+    version: number;
+    bundleId: Uint8Array;
+    chunkIndex: number;
+    totalChunks: number;
+    digestAlgo: string;
+}): Uint8Array;
+//# sourceMappingURL=armor.d.ts.map

package/dist/provision/armor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"armor.d.ts","sourceRoot":"","sources":["../../src/provision/armor.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAgB,YAAY,EAAE,MAAM,YAAY,CAAC;AAoB7D,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE,CA+CzD;AA6GD;;;;;;;mDAOmD;AACnD,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CAkBb"}

package/dist/provision/armor.js

@@ -0,0 +1,243 @@
+// OpenPGP-style ASCII armor decoder for VTA sealed bundles.
+//
+// Port of `vta-sdk/src/sealed_transfer/armor.rs`. The wire shape is one or
+// more BEGIN/END blocks; blocks sharing a `Bundle-Id:` header belong to the
+// same bundle. The armor headers themselves are not signed — they reach the
+// AEAD layer as AAD (built by the per-chunk caller), so a tampered header
+// makes HPKE open fail rather than the armor parser.
+//
+// Frame:
+//   -----BEGIN VTA SEALED BUNDLE-----
+//   Version: 1
+//   Bundle-Id: <32 hex chars>
+//   Chunk: 1/N
+//   Digest-Algo: sha256
+//                                            <-- blank line
+//   <STANDARD base64, 64 chars/line>
+//   =<base64 of 3-byte CRC24 (big-endian)>
+//   -----END VTA SEALED BUNDLE-----
+//
+// STANDARD base64 (not URL-safe) — the armor format predates anything
+// URL-aware and matches PGP precedent.
+import { base64 } from "@scure/base";
+import { crc24 } from "./crc24.js";
+const BEGIN = "-----BEGIN VTA SEALED BUNDLE-----";
+const END = "-----END VTA SEALED BUNDLE-----";
+const SUPPORTED_VERSION = 1;
+/** Recognised armor headers. Unknown headers are rejected at parse time so a
+ *  future header that would participate in AAD cannot be silently dropped by
+ *  this parser — bumping the `Version:` line is the path for adding new ones. */
+const KNOWN_HEADERS = new Set(["Version", "Bundle-Id", "Chunk", "Digest-Algo"]);
+/** Decode armored input into one or more SealedBundles, grouped by Bundle-Id. */
+export function decodeArmor(input) {
+    const lines = input.split(/\r?\n/);
+    const bundles = [];
+    let i = 0;
+    while (i < lines.length) {
+        if ((lines[i] ?? "").trim() !== BEGIN) {
+            i++;
+            continue;
+        }
+        const bodyStart = i + 1;
+        let j = bodyStart;
+        while (j < lines.length && (lines[j] ?? "").trim() !== END)
+            j++;
+        if (j >= lines.length) {
+            throw new Error("armor: unterminated BEGIN block");
+        }
+        const block = parseBlock(lines.slice(bodyStart, j));
+        const existing = bundles.find((b) => bytesEqual(b.bundleId, block.bundleId));
+        if (existing) {
+            if (existing.digestAlgo !== block.digestAlgo) {
+                throw new Error("armor: digest_algo differs across chunks of the same bundle");
+            }
+            existing.chunks.push({
+                chunkIndex: block.chunkIndex,
+                totalChunks: block.totalChunks,
+                sealedBytes: block.sealedBytes,
+            });
+        }
+        else {
+            bundles.push({
+                bundleId: block.bundleId,
+                digestAlgo: block.digestAlgo,
+                chunks: [
+                    {
+                        chunkIndex: block.chunkIndex,
+                        totalChunks: block.totalChunks,
+                        sealedBytes: block.sealedBytes,
+                    },
+                ],
+            });
+        }
+        i = j + 1;
+    }
+    if (bundles.length === 0) {
+        throw new Error("armor: no BEGIN blocks found");
+    }
+    return bundles;
+}
+function parseBlock(lines) {
+    let idx = 0;
+    let version;
+    let bundleId;
+    let chunk;
+    let digestAlgo;
+    // Header lines, terminated by a blank line.
+    while (idx < lines.length) {
+        const raw = lines[idx] ?? "";
+        const trimmed = raw.replace(/\s+$/, "");
+        idx++;
+        if (trimmed.length === 0)
+            break;
+        const colon = trimmed.indexOf(":");
+        if (colon < 0) {
+            throw new Error(`armor: bad header: '${trimmed}'`);
+        }
+        const key = trimmed.slice(0, colon).trim();
+        const value = trimmed.slice(colon + 1).trim();
+        if (!KNOWN_HEADERS.has(key)) {
+            throw new Error(`armor: unknown header '${key}' (rejecting forward-compat hazard)`);
+        }
+        switch (key) {
+            case "Version": {
+                const n = Number.parseInt(value, 10);
+                if (!Number.isFinite(n))
+                    throw new Error(`armor: bad Version: ${value}`);
+                version = n;
+                break;
+            }
+            case "Bundle-Id": {
+                bundleId = hexDecode(value);
+                if (bundleId.length !== 16) {
+                    throw new Error(`armor: Bundle-Id must be 16 bytes (got ${bundleId.length})`);
+                }
+                break;
+            }
+            case "Chunk": {
+                const slash = value.indexOf("/");
+                if (slash < 0)
+                    throw new Error(`armor: bad Chunk header: ${value}`);
+                const oneBased = Number.parseInt(value.slice(0, slash), 10);
+                const total = Number.parseInt(value.slice(slash + 1), 10);
+                if (!Number.isFinite(oneBased) ||
+                    !Number.isFinite(total) ||
+                    oneBased === 0 ||
+                    oneBased > total) {
+                    throw new Error(`armor: chunk ${oneBased}/${total} out of range`);
+                }
+                chunk = { index: oneBased - 1, total };
+                break;
+            }
+            case "Digest-Algo": {
+                digestAlgo = value;
+                break;
+            }
+        }
+    }
+    if (version === undefined)
+        throw new Error("armor: missing Version");
+    if (version !== SUPPORTED_VERSION) {
+        throw new Error(`armor: unsupported version ${version}`);
+    }
+    if (!bundleId)
+        throw new Error("armor: missing Bundle-Id");
+    if (!chunk)
+        throw new Error("armor: missing Chunk header");
+    if (!digestAlgo)
+        throw new Error("armor: missing Digest-Algo");
+    // Body: base64 lines until the `=<base64>` CRC line.
+    let b64 = "";
+    let crcB64;
+    while (idx < lines.length) {
+        const raw = lines[idx] ?? "";
+        const trimmed = raw.replace(/\s+$/, "");
+        idx++;
+        if (trimmed.length === 0)
+            continue;
+        if (trimmed.startsWith("=")) {
+            crcB64 = trimmed.slice(1);
+            break;
+        }
+        b64 += trimmed;
+    }
+    if (crcB64 === undefined)
+        throw new Error("armor: missing CRC line");
+    const sealedBytes = base64.decode(b64);
+    const crcBytes = base64.decode(crcB64);
+    if (crcBytes.length !== 3) {
+        throw new Error(`armor: CRC payload must be 3 bytes (got ${crcBytes.length})`);
+    }
+    const expected = (crcBytes[0] << 16) | (crcBytes[1] << 8) | crcBytes[2];
+    const got = crc24(sealedBytes);
+    if (got !== expected) {
+        throw new Error(`armor: CRC24 mismatch (expected 0x${expected.toString(16)}, got 0x${got.toString(16)})`);
+    }
+    return {
+        bundleId,
+        digestAlgo,
+        chunkIndex: chunk.index,
+        totalChunks: chunk.total,
+        sealedBytes,
+    };
+}
+/** Build the AAD bytes for one chunk's HPKE seal. Mirrors
+ *  `ChunkPlaintext::aad` in `chunk.rs`:
+ *
+ *      version || bundle_id || chunk_index_be || total_chunks_be ||
+ *        digest_algo_len(u8) || digest_algo
+ *
+ *  `digest_algo_len` is capped at 255 (the Rust side uses `u8::MAX`); for
+ *  `sha256`/`sha512`/`blake3` this never trips. */
+export function buildChunkAad(args) {
+    if (args.bundleId.length !== 16) {
+        throw new Error(`buildChunkAad: bundleId must be 16 bytes (got ${args.bundleId.length})`);
+    }
+    const algoBytes = new TextEncoder().encode(args.digestAlgo);
+    const algoLen = Math.min(algoBytes.length, 255);
+    const buf = new Uint8Array(1 + 16 + 2 + 2 + 1 + algoLen);
+    let p = 0;
+    buf[p++] = args.version;
+    buf.set(args.bundleId, p);
+    p += 16;
+    buf[p++] = (args.chunkIndex >> 8) & 0xff;
+    buf[p++] = args.chunkIndex & 0xff;
+    buf[p++] = (args.totalChunks >> 8) & 0xff;
+    buf[p++] = args.totalChunks & 0xff;
+    buf[p++] = algoLen;
+    buf.set(algoBytes.subarray(0, algoLen), p);
+    return buf;
+}
+/** Decode a (lowercase or mixed-case) hex string into bytes. The armor format
+ *  emits lowercase only, but accepting both costs nothing and matches the
+ *  Rust parser's behaviour. */
+function hexDecode(s) {
+    if (s.length % 2 !== 0)
+        throw new Error(`hex: odd length: ${s.length}`);
+    const out = new Uint8Array(s.length / 2);
+    for (let i = 0; i < s.length; i += 2) {
+        const hi = hexNibble(s.charCodeAt(i));
+        const lo = hexNibble(s.charCodeAt(i + 1));
+        out[i / 2] = (hi << 4) | lo;
+    }
+    return out;
+}
+function hexNibble(c) {
+    if (c >= 0x30 && c <= 0x39)
+        return c - 0x30;
+    if (c >= 0x61 && c <= 0x66)
+        return c - 0x61 + 10;
+    if (c >= 0x41 && c <= 0x46)
+        return c - 0x41 + 10;
+    throw new Error(`hex: non-hex byte 0x${c.toString(16)}`);
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        if (a[i] !== b[i])
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=armor.js.map

package/dist/provision/armor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"armor.js","sourceRoot":"","sources":["../../src/provision/armor.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,qDAAqD;AACrD,EAAE;AACF,SAAS;AACT,sCAAsC;AACtC,eAAe;AACf,8BAA8B;AAC9B,eAAe;AACf,wBAAwB;AACxB,4DAA4D;AAC5D,qCAAqC;AACrC,2CAA2C;AAC3C,oCAAoC;AACpC,EAAE;AACF,sEAAsE;AACtE,uCAAuC;AAEvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,KAAK,GAAG,mCAAmC,CAAC;AAClD,MAAM,GAAG,GAAG,iCAAiC,CAAC;AAC9C,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;iFAEiF;AACjF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;AAUhF,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACtC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,SAAS,CAAC;QAClB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;gBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE;oBACN;wBACE,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QACD,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAe;IACjC,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,IAAI,OAA2B,CAAC;IAChC,IAAI,QAAgC,CAAC;IACrC,IAAI,KAAmD,CAAC;IACxD,IAAI,UAA8B,CAAC;IAEnC,4CAA4C;IAC5C,OAAO,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,GAAG,EAAE,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,qCAAqC,CAAC,CAAC;QACtF,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;gBACzE,OAAO,GAAG,CAAC,CAAC;gBACZ,MAAM;YACR,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBAChF,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,KAAK,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;gBACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1D,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC1B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACvB,QAAQ,KAAK,CAAC;oBACd,QAAQ,GAAG,KAAK,EAChB,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,IAAI,KAAK,eAAe,CAAC,CAAC;gBACpE,CAAC;gBACD,KAAK,GAAG,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;gBACvC,MAAM;YACR,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,UAAU,GAAG,KAAK,CAAC;gBACnB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAE/D,qDAAqD;IACrD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAA0B,CAAC;IAC/B,OAAO,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,GAAG,EAAE,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM;QACR,CAAC;QACD,GAAG,IAAI,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAErE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GACZ,CAAE,QAAQ,CAAC,CAAC,CAAY,IAAI,EAAE,CAAC,GAAG,CAAE,QAAQ,CAAC,CAAC,CAAY,IAAI,CAAC,CAAC,GAAI,QAAQ,CAAC,CAAC,CAAY,CAAC;IAC7F,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CACzF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,UAAU;QACV,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,WAAW,EAAE,KAAK,CAAC,KAAK;QACxB,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;mDAOmD;AACnD,MAAM,UAAU,aAAa,CAAC,IAM7B;IACC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC,IAAI,EAAE,CAAC;IACR,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IAClC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC1C,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACnC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC;IACnB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;+BAE+B;AAC/B,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IACjD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;IACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/provision/crc24.d.ts

@@ -0,0 +1,5 @@
+export declare function crc24(data: Uint8Array): number;
+/** Encode a 24-bit CRC value as the 3 big-endian bytes the armor body line
+ *  base64-encodes after the `=` prefix. */
+export declare function crc24ToBytes(crc: number): Uint8Array;
+//# sourceMappingURL=crc24.d.ts.map

package/dist/provision/crc24.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crc24.d.ts","sourceRoot":"","sources":["../../src/provision/crc24.ts"],"names":[],"mappings":"AAcA,wBAAgB,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAU9C;AAED;2CAC2C;AAC3C,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAEpD"}

package/dist/provision/crc24.js

@@ -0,0 +1,30 @@
+// PGP-style CRC24 over raw bytes. Used by the armor parser to detect
+// pasted-text corruption before the AEAD layer has a chance to.
+//
+// Mirrors `crc24` in `vta-sdk/src/sealed_transfer/armor.rs`:
+//   init  = 0x00B704CE
+//   poly  = 0x01864CFB
+//   width = 24 bits, output big-endian, no reflection.
+//
+// Reference vector at the bottom of this file; the armor parser must
+// reject a corrupted body via `Crc24Mismatch` before HPKE sees it.
+const INIT = 0x00b704ce;
+const POLY = 0x01864cfb;
+export function crc24(data) {
+    let crc = INIT;
+    for (let i = 0; i < data.length; i++) {
+        crc ^= data[i] << 16;
+        for (let bit = 0; bit < 8; bit++) {
+            crc <<= 1;
+            if ((crc & 0x01000000) !== 0)
+                crc ^= POLY;
+        }
+    }
+    return crc & 0x00ffffff;
+}
+/** Encode a 24-bit CRC value as the 3 big-endian bytes the armor body line
+ *  base64-encodes after the `=` prefix. */
+export function crc24ToBytes(crc) {
+    return new Uint8Array([(crc >> 16) & 0xff, (crc >> 8) & 0xff, crc & 0xff]);
+}
+//# sourceMappingURL=crc24.js.map

package/dist/provision/crc24.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crc24.js","sourceRoot":"","sources":["../../src/provision/crc24.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,6DAA6D;AAC7D,uBAAuB;AACvB,uBAAuB;AACvB,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AAEnE,MAAM,IAAI,GAAG,UAAU,CAAC;AACxB,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,MAAM,UAAU,KAAK,CAAC,IAAgB;IACpC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,GAAG,IAAK,IAAI,CAAC,CAAC,CAAY,IAAI,EAAE,CAAC;QACjC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;YACjC,GAAG,KAAK,CAAC,CAAC;YACV,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,UAAU,CAAC;AAC1B,CAAC;AAED;2CAC2C;AAC3C,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/provision/hpke.d.ts

@@ -0,0 +1,17 @@
+export interface HpkeOpenInput {
+    /** 32-byte X25519 secret. Derived from the wallet's Ed25519 seed via
+     *  Montgomery conversion + clamping (see `bundle-secret.ts`). */
+    recipientSecret: Uint8Array;
+    /** 32-byte KEM encapsulation (the sender's ephemeral X25519 pubkey). */
+    kemEncap: Uint8Array;
+    /** AEAD ciphertext (ciphertext || tag). */
+    ciphertext: Uint8Array;
+    /** Additional authenticated data — built from the chunk header via
+     *  `buildChunkAad`. Must byte-match the AAD used at seal time. */
+    aad: Uint8Array;
+}
+/** Open one HPKE-sealed chunk. Returns the plaintext bytes (CBOR-encoded
+ *  ChunkPlaintext, decoded by the caller). Throws on AEAD failure — wrong
+ *  recipient secret, tampered AAD, or replayed ciphertext. */
+export declare function hpkeOpen(input: HpkeOpenInput): Promise<Uint8Array>;
+//# sourceMappingURL=hpke.d.ts.map

package/dist/provision/hpke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.d.ts","sourceRoot":"","sources":["../../src/provision/hpke.ts"],"names":[],"mappings":"AAqCA,MAAM,WAAW,aAAa;IAC5B;qEACiE;IACjE,eAAe,EAAE,UAAU,CAAC;IAC5B,wEAAwE;IACxE,QAAQ,EAAE,UAAU,CAAC;IACrB,2CAA2C;IAC3C,UAAU,EAAE,UAAU,CAAC;IACvB;sEACkE;IAClE,GAAG,EAAE,UAAU,CAAC;CACjB;AAED;;8DAE8D;AAC9D,wBAAsB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBxE"}

package/dist/provision/hpke.js

@@ -0,0 +1,60 @@
+// HPKE (RFC 9180) base-mode open for VTA sealed bundles.
+//
+// Suite (pinned, matches `vta-sdk/src/sealed_transfer/hpke.rs`):
+//   KEM:  DHKEM(X25519, HKDF-SHA256)
+//   KDF:  HKDF-SHA256
+//   AEAD: ChaCha20-Poly1305
+//
+// Single-shot, base mode (no PSK, no auth-mode KEM). The chunk header is
+// bound as AEAD AAD by the caller (`buildChunkAad` in `armor.ts`); the info
+// string `vta-sealed-transfer/v1` domain-separates this suite from any
+// future use of the same primitives.
+//
+// We feed the X25519 secret as raw 32-byte material via the suite's KEM
+// `importKey("raw", secret, false)` — the Rust side derives the X25519
+// secret from an Ed25519 seed via SHA-512 + clamping; the wallet does the
+// same conversion in `bundle-secret.ts` before calling `hpkeOpen` here.
+import { CipherSuite, DhkemX25519HkdfSha256, HkdfSha256 } from "@hpke/core";
+import { Chacha20Poly1305 } from "@hpke/chacha20poly1305";
+/** Domain-binding info string. Hardcoded — a different envelope format means
+ *  a different info string, not a parameter the caller picks. */
+const HPKE_INFO = new TextEncoder().encode("vta-sealed-transfer/v1");
+let _suite = null;
+function suite() {
+    if (!_suite) {
+        _suite = new CipherSuite({
+            kem: new DhkemX25519HkdfSha256(),
+            kdf: new HkdfSha256(),
+            aead: new Chacha20Poly1305(),
+        });
+    }
+    return _suite;
+}
+/** Open one HPKE-sealed chunk. Returns the plaintext bytes (CBOR-encoded
+ *  ChunkPlaintext, decoded by the caller). Throws on AEAD failure — wrong
+ *  recipient secret, tampered AAD, or replayed ciphertext. */
+export async function hpkeOpen(input) {
+    if (input.recipientSecret.length !== 32) {
+        throw new Error(`hpke: recipientSecret must be 32 bytes (got ${input.recipientSecret.length})`);
+    }
+    if (input.kemEncap.length !== 32) {
+        throw new Error(`hpke: kemEncap must be 32 bytes (got ${input.kemEncap.length})`);
+    }
+    const cs = suite();
+    const recipientKey = await cs.kem.importKey("raw", asArrayBuffer(input.recipientSecret), false);
+    const pt = await cs.open({
+        recipientKey,
+        enc: asArrayBuffer(input.kemEncap),
+        info: HPKE_INFO,
+    }, asArrayBuffer(input.ciphertext), asArrayBuffer(input.aad));
+    return new Uint8Array(pt);
+}
+/** Force-detached ArrayBuffer copy. `@hpke/core` rejects typed-array views
+ *  whose underlying buffer is a SharedArrayBuffer or has unusual byteOffset
+ *  semantics; a fresh copy normalises everything. */
+function asArrayBuffer(u8) {
+    const out = new ArrayBuffer(u8.byteLength);
+    new Uint8Array(out).set(u8);
+    return out;
+}
+//# sourceMappingURL=hpke.js.map

package/dist/provision/hpke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.js","sourceRoot":"","sources":["../../src/provision/hpke.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,iEAAiE;AACjE,qCAAqC;AACrC,sBAAsB;AACtB,4BAA4B;AAC5B,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,wEAAwE;AAExE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;iEACiE;AACjE,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAErE,IAAI,MAAM,GAAuB,IAAI,CAAC;AAEtC,SAAS,KAAK;IACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,WAAW,CAAC;YACvB,GAAG,EAAE,IAAI,qBAAqB,EAAE;YAChC,GAAG,EAAE,IAAI,UAAU,EAAE;YACrB,IAAI,EAAE,IAAI,gBAAgB,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD;;8DAE8D;AAC9D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAoB;IACjD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAChG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CACtB;QACE,YAAY;QACZ,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,IAAI,EAAE,SAAS;KAChB,EACD,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAC/B,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CACzB,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;;qDAEqD;AACrD,SAAS,aAAa,CAAC,EAAc;IACnC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/provision/index.d.ts

@@ -0,0 +1,10 @@
+export { decodeArmor, buildChunkAad } from "./armor.js";
+export { crc24, crc24ToBytes } from "./crc24.js";
+export { hpkeOpen, type HpkeOpenInput } from "./hpke.js";
+export { openSealedBundle, openBundle, openAdminRotationBundle, type OpenedBundle } from "./open.js";
+export { buildBootstrapRequest, type BootstrapAsk, type BootstrapRequestVp, type BuildBootstrapRequestOptions, type DidTemplateRef, } from "./request.js";
+export { sendProvisionIntegration, ProvisionProblemReportError, type ProblemReportPayload, type ProvisionIntegrationRequestBody, type ProvisionIntegrationResponseBody, type ProvisionSummary, type SendProvisionIntegrationOptions, } from "./send.js";
+export { runProvisionIntegration, type MinimalAdminReply, type RunProvisionIntegrationOptions, } from "./run.js";
+export { holderInputsFromAdminReply, type HolderInputsFromAdminReply, } from "./adopt.js";
+export type { AdminRotationPayload, ArmoredChunk, AssertionProof, ChunkPlaintext, DidKeyMaterial, HpkeSealed, KeyPair, ProducerAssertion, SealedBundle, SealedPayloadV1, TemplateBootstrapPayload, VtaTrustBundle, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/provision/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/provision/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,uBAAuB,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,KAAK,oBAAoB,EACzB,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,gBAAgB,EACrB,KAAK,+BAA+B,GACrC,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,uBAAuB,EACvB,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,GACpC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,KAAK,0BAA0B,GAChC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,cAAc,EACd,cAAc,EACd,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/provision/index.js

@@ -0,0 +1,16 @@
+// Public surface for the wallet's sealed-bundle openers.
+//
+// The wallet calls `openAdminRotationBundle` on the armored response from a
+// VTA's `provision-integration/1.0/provision-integration-result` reply,
+// using the same Ed25519 seed it signed the request with. Returns the
+// freshly-minted long-term admin DID + private keys the wallet adopts as
+// its holder identity.
+export { decodeArmor, buildChunkAad } from "./armor.js";
+export { crc24, crc24ToBytes } from "./crc24.js";
+export { hpkeOpen } from "./hpke.js";
+export { openSealedBundle, openBundle, openAdminRotationBundle } from "./open.js";
+export { buildBootstrapRequest, } from "./request.js";
+export { sendProvisionIntegration, ProvisionProblemReportError, } from "./send.js";
+export { runProvisionIntegration, } from "./run.js";
+export { holderInputsFromAdminReply, } from "./adopt.js";
+//# sourceMappingURL=index.js.map

package/dist/provision/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/provision/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,uBAAuB;AAEvB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAsB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,uBAAuB,EAAqB,MAAM,WAAW,CAAC;AACrG,OAAO,EACL,qBAAqB,GAKtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAM5B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,uBAAuB,GAGxB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,GAE3B,MAAM,YAAY,CAAC"}

package/dist/provision/open.d.ts

@@ -0,0 +1,28 @@
+import type { AdminRotationPayload, SealedBundle, SealedPayloadV1 } from "./types.js";
+export interface OpenedBundle {
+    bundleId: Uint8Array;
+    digestAlgo: string;
+    payload: SealedPayloadV1;
+}
+/** Open the first bundle in `armored` using the recipient's Ed25519 seed.
+ *
+ *  The seed is converted to its X25519 secret via Montgomery clamping
+ *  (same derivation the Rust side uses; see
+ *  `affinidi_crypto::ed25519::ed25519_private_to_x25519`). The wallet's
+ *  ephemeral Ed25519 seed produced at onboarding is what gets passed here.
+ *
+ *  If the armored input contains multiple bundles (different Bundle-Ids),
+ *  this opens only the first. The provision-integration reply has exactly
+ *  one bundle today; multi-bundle armored payloads are reserved for future
+ *  flows.
+ */
+export declare function openSealedBundle(armored: string, edSeed: Uint8Array): Promise<OpenedBundle>;
+/** Lower-level: open a pre-parsed SealedBundle with an X25519 secret. */
+export declare function openBundle(bundle: SealedBundle, x25519Secret: Uint8Array): Promise<OpenedBundle>;
+/** Convenience: open the bundle and assert it carries an `AdminRotation`
+ *  variant, returning the typed payload. Throws if any other variant. */
+export declare function openAdminRotationBundle(armored: string, edSeed: Uint8Array): Promise<{
+    bundleId: Uint8Array;
+    payload: AdminRotationPayload;
+}>;
+//# sourceMappingURL=open.d.ts.map

package/dist/provision/open.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../src/provision/open.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,oBAAoB,EAGpB,YAAY,EACZ,eAAe,EAEhB,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,UAAU,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,yEAAyE;AACzE,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,YAAY,CAAC,CAkEvB;AAED;yEACyE;AACzE,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,QAAQ,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAUlE"}