@oxy.so/core 1.16.0 → 1.18.0

package/src/crypto/__tests__/identityMove.test.ts

@@ -1,146 +0,0 @@
-/**
- * Giving a root to Commons (ADR 0024 D6): both sides derive the same key and code;
- * the responder receives exactly the declared identity; the initiator's key is
- * committed before the responder's is chosen, so a relay cannot steer both codes
- * together; and the receipt binds the move, root, both keys and the relayed
- * ciphertext.
- */
-
-import { generateSecp256k1KeyPair } from '@oxy.so/protocol/secp256k1';
-import { signMessage } from '@oxy.so/protocol';
-import {
-  buildMoveQrPayload,
-  createMoveCommitment,
-  deriveMoveKey,
-  deriveMoveSas,
-  digestMoveCiphertext,
-  generateMoveEphemeralKeyPair,
-  openMovedIdentity,
-  parseMoveQrPayload,
-  sealIdentityForMove,
-  signMoveReceipt,
-  verifyMoveCommitment,
-  verifyMoveReceipt,
-} from '../identityMove';
-import { deriveIdentityFromMnemonic, generateWebIdentity } from '../webIdentityCarrier';
-
-const MOVE_ID = '0123456789abcdef0123456789abcdef';
-const MNEMONIC_24 =
-  'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon art';
-
-function code(initiator: string, responder: string, commitment: string, moveId = MOVE_ID): string {
-  return deriveMoveSas({ moveId, initiatorEphemeralPublicKey: initiator, responderEphemeralPublicKey: responder, initiatorCommitment: commitment });
-}
-
-describe('a move between two honest sides', () => {
-  it('delivers the declared identity — 12 or 24 words — and both screens show the same code', () => {
-    for (const identity of [generateWebIdentity(), deriveIdentityFromMnemonic(MNEMONIC_24)]) {
-      const web = generateMoveEphemeralKeyPair();
-      const commons = generateMoveEphemeralKeyPair();
-      const { commitment, nonce } = createMoveCommitment(web.publicKey);
-      expect(verifyMoveCommitment(web.publicKey, nonce, commitment)).toBe(true);
-
-      const webKey = deriveMoveKey(web.privateKey, commons.publicKey, MOVE_ID);
-      const commonsKey = deriveMoveKey(commons.privateKey, web.publicKey, MOVE_ID);
-      expect(Buffer.from(webKey).equals(Buffer.from(commonsKey))).toBe(true);
-      expect(code(web.publicKey, commons.publicKey, commitment)).toMatch(/^\d{6}$/);
-      expect(code(web.publicKey, commons.publicKey, commitment, MOVE_ID.toUpperCase())).toBe(code(web.publicKey, commons.publicKey, commitment));
-
-      const sealed = sealIdentityForMove(identity, webKey, MOVE_ID);
-      expect(JSON.stringify(sealed)).not.toContain(identity.privateKey);
-      expect(openMovedIdentity(sealed, commonsKey, MOVE_ID, identity.publicKey)).toEqual(identity);
-    }
-  });
-});
-
-describe('a relay that substitutes keys', () => {
-  it('cannot reveal a key the commitment does not open', () => {
-    const web = generateSecp256k1KeyPair();
-    const { commitment, nonce } = createMoveCommitment(web.publicKey);
-    expect(verifyMoveCommitment(generateSecp256k1KeyPair().publicKey, nonce, commitment)).toBe(false);
-    expect(verifyMoveCommitment(web.publicKey, 'ab'.repeat(32), commitment)).toBe(false);
-  });
-
-  it('shows a different code on each screen and cannot open the identity', () => {
-    const identity = generateWebIdentity();
-    const web = generateMoveEphemeralKeyPair();
-    const commons = generateMoveEphemeralKeyPair();
-    const attacker = generateMoveEphemeralKeyPair();
-    const { commitment } = createMoveCommitment(web.publicKey);
-    const attackerCommitment = createMoveCommitment(attacker.publicKey).commitment;
-
-    expect(code(web.publicKey, attacker.publicKey, commitment)).not.toBe(code(attacker.publicKey, commons.publicKey, attackerCommitment));
-
-    const sealedToAttacker = sealIdentityForMove(identity, deriveMoveKey(web.privateKey, attacker.publicKey, MOVE_ID), MOVE_ID);
-    expect(() =>
-      openMovedIdentity(sealedToAttacker, deriveMoveKey(commons.privateKey, web.publicKey, MOVE_ID), MOVE_ID, identity.publicKey),
-    ).toThrow('could not be opened');
-  });
-
-  it('changes the code when any input changes, including the commitment', () => {
-    const web = generateSecp256k1KeyPair();
-    const commons = generateSecp256k1KeyPair();
-    const { commitment } = createMoveCommitment(web.publicKey);
-    const base = code(web.publicKey, commons.publicKey, commitment);
-    expect(code(web.publicKey, commons.publicKey, createMoveCommitment(web.publicKey).commitment)).not.toBe(base);
-    expect(code(web.publicKey, generateSecp256k1KeyPair().publicKey, commitment)).not.toBe(base);
-    expect(code(commons.publicKey, web.publicKey, commitment)).not.toBe(base);
-  });
-
-  it('refuses a sealed identity that is not the one the move declared, or another move’s ciphertext', () => {
-    const declared = generateWebIdentity();
-    const web = generateMoveEphemeralKeyPair();
-    const commons = generateMoveEphemeralKeyPair();
-    const key = deriveMoveKey(web.privateKey, commons.publicKey, MOVE_ID);
-    expect(() => openMovedIdentity(sealIdentityForMove(generateWebIdentity(), key, MOVE_ID), key, MOVE_ID, declared.publicKey)).toThrow();
-    expect(() => openMovedIdentity(sealIdentityForMove(declared, key, MOVE_ID), key, 'ffffffffffffffffffffffffffffffff', declared.publicKey)).toThrow();
-  });
-});
-
-describe('receipts', () => {
-  function transfer() {
-    const identity = generateWebIdentity();
-    const web = generateMoveEphemeralKeyPair();
-    const commons = generateMoveEphemeralKeyPair();
-    const sealed = sealIdentityForMove(identity, deriveMoveKey(web.privateKey, commons.publicKey, MOVE_ID), MOVE_ID);
-    const claims = {
-      moveId: MOVE_ID,
-      rootPublicKey: identity.publicKey,
-      initiatorEphemeralPublicKey: web.publicKey,
-      responderEphemeralPublicKey: commons.publicKey,
-      ciphertextDigest: digestMoveCiphertext(sealed),
-    };
-    return { identity, sealed, claims };
-  }
-
-  it('verify for exactly the move, root, keys and ciphertext they were made over', async () => {
-    const { identity, sealed, claims } = transfer();
-    const receipt = await signMoveReceipt((message) => signMessage(message, identity.privateKey), claims);
-    expect(await verifyMoveReceipt(claims, receipt.signature)).toBe(true);
-
-    const other = { ...sealed, ciphertext: `${sealed.ciphertext.slice(0, -2)}00` };
-    for (const changed of [
-      { ...claims, moveId: 'ffffffffffffffffffffffffffffffff' },
-      { ...claims, responderEphemeralPublicKey: generateSecp256k1KeyPair().publicKey },
-      { ...claims, initiatorEphemeralPublicKey: generateSecp256k1KeyPair().publicKey },
-      { ...claims, ciphertextDigest: digestMoveCiphertext(other) },
-    ]) {
-      expect(await verifyMoveReceipt(changed, receipt.signature)).toBe(false);
-    }
-  });
-
-  it('are not the root’s if another key signed them', async () => {
-    const { claims } = transfer();
-    const forged = await signMoveReceipt((message) => signMessage(message, generateWebIdentity().privateKey), claims);
-    expect(await verifyMoveReceipt(claims, forged.signature)).toBe(false);
-  });
-});
-
-describe('QR payload', () => {
-  it('round-trips and rejects anything else', () => {
-    expect(parseMoveQrPayload(buildMoveQrPayload(MOVE_ID))).toBe(MOVE_ID);
-    expect(parseMoveQrPayload(`  ${buildMoveQrPayload(MOVE_ID).toUpperCase()} `)).toBe(MOVE_ID);
-    expect(parseMoveQrPayload('oxycommons://approve?code=abc')).toBeNull();
-    expect(parseMoveQrPayload('oxycommons://move?id=123')).toBeNull();
-  });
-});

package/src/crypto/__tests__/webIdentityCarrier.test.ts

@@ -1,169 +0,0 @@
-/**
- * Web identity carrier — the envelope must carry EXACTLY the Commons identity,
- * open only with a registered passkey's PRF output, and refuse (with a reason a
- * UI can act on) anything else.
- */
-
-import { webIdentityEnvelopeSchema } from '@oxy.so/contracts';
-import { RecoveryPhraseService } from '../recoveryPhrase';
-import {
-  addWrap,
-  deriveIdentityFromMnemonic,
-  generateWebIdentity,
-  openWebIdentity,
-  removeWrap,
-  sealWebIdentity,
-  unlockWebIdentity,
-  unwrapDataKey,
-  WEB_IDENTITY_PRF_INPUT,
-  WebIdentityUnlockError,
-  wipeBytes,
-} from '../webIdentityCarrier';
-
-/** The BIP-39 reference mnemonic (all-zero entropy). */
-const MNEMONIC = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
-
-const prf = (fill: number): Uint8Array => new Uint8Array(32).fill(fill);
-const CREDENTIAL_A = 'credential-aaaaaaaaaaaaaaaa';
-const CREDENTIAL_B = 'credential-bbbbbbbbbbbbbbbb';
-
-const failureOf = (fn: () => unknown): string | undefined => {
-  try {
-    fn();
-  } catch (error) {
-    return error instanceof WebIdentityUnlockError ? error.failure : 'other';
-  }
-  return undefined;
-};
-
-describe('the identity itself', () => {
-  it('derives the SAME key Commons derives from a phrase — one identity, not a second kind', async () => {
-    const identity = deriveIdentityFromMnemonic(MNEMONIC);
-
-    expect(identity.privateKey).toBe(await RecoveryPhraseService.derivePrivateKeyFromPhrase(MNEMONIC));
-    expect(identity.publicKey).toBe(await RecoveryPhraseService.derivePublicKeyFromPhrase(MNEMONIC));
-  });
-
-  it('normalizes case and spacing the way a person types a phrase', () => {
-    const typed = `  ${MNEMONIC.toUpperCase().split(' ').join('   ')} `;
-    expect(deriveIdentityFromMnemonic(typed).publicKey).toBe(deriveIdentityFromMnemonic(MNEMONIC).publicKey);
-  });
-
-  it('rejects an invalid phrase', () => {
-    expect(() => deriveIdentityFromMnemonic('abandon abandon abandon')).toThrow('Invalid recovery phrase');
-  });
-
-  it('generates a fresh 12-word identity in canonical public-key form', () => {
-    const identity = generateWebIdentity();
-    expect(identity.mnemonic.split(' ')).toHaveLength(12);
-    expect(identity.publicKey).toMatch(/^04[0-9a-f]{128}$/);
-    expect(generateWebIdentity().publicKey).not.toBe(identity.publicKey);
-  });
-
-  it('uses a fixed 32-byte PRF input', () => {
-    expect(WEB_IDENTITY_PRF_INPUT).toHaveLength(32);
-  });
-});
-
-describe('sealing and unlocking', () => {
-  it('round-trips: the passkey that sealed it opens it into the same identity', () => {
-    const identity = deriveIdentityFromMnemonic(MNEMONIC);
-    const { envelope, dataKey } = sealWebIdentity(identity, { prfOutput: prf(7), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    wipeBytes(dataKey);
-
-    // The stored shape is exactly the published contract.
-    expect(webIdentityEnvelopeSchema.parse(envelope)).toEqual(envelope);
-    // Nothing identifying the secret is visible in the envelope.
-    expect(JSON.stringify(envelope)).not.toContain(identity.privateKey);
-
-    const opened = unlockWebIdentity(envelope, prf(7), CREDENTIAL_A);
-    expect(opened).toEqual(identity);
-  });
-
-  it('refuses to seal a phrase under a public key it does not belong to', () => {
-    const other = generateWebIdentity();
-    expect(() =>
-      sealWebIdentity({ ...deriveIdentityFromMnemonic(MNEMONIC), publicKey: other.publicKey }, { prfOutput: prf(1), credentialId: CREDENTIAL_A, rpId: 'oxy.so' }),
-    ).toThrow('does not belong');
-  });
-
-  it('reports an unregistered passkey as unknown-credential', () => {
-    const { envelope } = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), { prfOutput: prf(7), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    expect(failureOf(() => unlockWebIdentity(envelope, prf(7), CREDENTIAL_B))).toBe('unknown-credential');
-  });
-
-  it('reports a registered passkey returning a different PRF value as prf-mismatch (recoverable)', () => {
-    const { envelope } = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), { prfOutput: prf(7), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    expect(failureOf(() => unlockWebIdentity(envelope, prf(8), CREDENTIAL_A))).toBe('prf-mismatch');
-  });
-
-  it('refuses a wrap transplanted onto another credential id', () => {
-    const { envelope } = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), { prfOutput: prf(7), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    const transplanted = { ...envelope, wraps: [{ ...envelope.wraps[0], credentialId: CREDENTIAL_B }] };
-    // The associated data binds each wrap to its credential.
-    expect(failureOf(() => unlockWebIdentity(transplanted, prf(7), CREDENTIAL_B))).toBe('prf-mismatch');
-  });
-
-  it('refuses an envelope re-labelled with another identity public key', () => {
-    const { envelope, dataKey } = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), {
-      prfOutput: prf(7),
-      credentialId: CREDENTIAL_A,
-      rpId: 'oxy.so',
-    });
-    const relabelled = { ...envelope, publicKey: generateWebIdentity().publicKey };
-    expect(failureOf(() => openWebIdentity(relabelled, dataKey))).toBe('corrupt');
-  });
-
-  it('treats a tampered sealed secret as corrupt, never as a different identity', () => {
-    const { envelope, dataKey } = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), {
-      prfOutput: prf(7),
-      credentialId: CREDENTIAL_A,
-      rpId: 'oxy.so',
-    });
-    const flipped = envelope.sealedSecret.startsWith('0') ? `1${envelope.sealedSecret.slice(1)}` : `0${envelope.sealedSecret.slice(1)}`;
-    expect(failureOf(() => openWebIdentity({ ...envelope, sealedSecret: flipped }, dataKey))).toBe('corrupt');
-  });
-});
-
-describe('more than one passkey', () => {
-  it('opens with every registered passkey and keeps a single sealed identity', () => {
-    const identity = deriveIdentityFromMnemonic(MNEMONIC);
-    const sealed = sealWebIdentity(identity, { prfOutput: prf(1), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    const withTwo = addWrap(sealed.envelope, sealed.dataKey, { prfOutput: prf(2), credentialId: CREDENTIAL_B, rpId: 'oxy.so' });
-
-    expect(withTwo.wraps.map((wrap) => wrap.credentialId)).toEqual([CREDENTIAL_A, CREDENTIAL_B]);
-    expect(withTwo.sealedSecret).toBe(sealed.envelope.sealedSecret);
-    expect(unlockWebIdentity(withTwo, prf(1), CREDENTIAL_A).publicKey).toBe(identity.publicKey);
-    expect(unlockWebIdentity(withTwo, prf(2), CREDENTIAL_B).publicKey).toBe(identity.publicKey);
-  });
-
-  it('replaces a passkey’s wrap instead of duplicating it', () => {
-    const sealed = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), { prfOutput: prf(1), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    const rewrapped = addWrap(sealed.envelope, sealed.dataKey, { prfOutput: prf(9), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    expect(rewrapped.wraps).toHaveLength(1);
-    expect(failureOf(() => unlockWebIdentity(rewrapped, prf(1), CREDENTIAL_A))).toBe('prf-mismatch');
-    expect(unlockWebIdentity(rewrapped, prf(9), CREDENTIAL_A).mnemonic).toBe(MNEMONIC);
-  });
-
-  it('will not add a wrap with a data key from a different envelope', () => {
-    const first = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), { prfOutput: prf(1), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    const second = sealWebIdentity(generateWebIdentity(), { prfOutput: prf(1), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    expect(() => addWrap(first.envelope, second.dataKey, { prfOutput: prf(2), credentialId: CREDENTIAL_B, rpId: 'oxy.so' })).toThrow();
-  });
-
-  it('removes a passkey, but never the last one', () => {
-    const sealed = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), { prfOutput: prf(1), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    const withTwo = addWrap(sealed.envelope, sealed.dataKey, { prfOutput: prf(2), credentialId: CREDENTIAL_B, rpId: 'oxy.so' });
-    const withOne = removeWrap(withTwo, CREDENTIAL_A);
-
-    expect(withOne.wraps.map((wrap) => wrap.credentialId)).toEqual([CREDENTIAL_B]);
-    expect(() => removeWrap(withOne, CREDENTIAL_B)).toThrow('at least one passkey');
-  });
-
-  it('keeps the data key usable only until it is wiped', () => {
-    const sealed = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC), { prfOutput: prf(1), credentialId: CREDENTIAL_A, rpId: 'oxy.so' });
-    const recovered = unwrapDataKey(sealed.envelope, prf(1), CREDENTIAL_A);
-    wipeBytes(recovered);
-    expect(failureOf(() => openWebIdentity(sealed.envelope, recovered))).toBe('corrupt');
-  });
-});

package/src/crypto/__tests__/webIdentityRecoveryMaterial.test.ts

@@ -1,117 +0,0 @@
-/**
- * Envelopes (ADR 0024 D2, D5): one root, whatever material it came from — a 12-
- * or 24-word phrase, or a raw key that must never gain a phrase — and wraps bound
- * to the RP ID their passkey lives under.
- */
-
-import { webIdentityEnvelopeSchema } from '@oxy.so/contracts';
-import { mnemonicToSeedSync } from '@scure/bip39';
-import { bytesToHex } from '@noble/hashes/utils';
-import { deriveSecp256k1PublicKey } from '@oxy.so/protocol/secp256k1';
-import {
-  addWrap,
-  deriveIdentityFromMnemonic,
-  deriveIdentityFromPrivateKey,
-  deriveIdentityFromRecoveryMaterial,
-  isUsablePrfOutput,
-  markWrapVerified,
-  parseRecoveryMaterial,
-  sealWebIdentity,
-  unlockWebIdentity,
-  unwrapDataKey,
-  WebIdentityUnlockError,
-  wipeBytes,
-} from '../webIdentityCarrier';
-
-const MNEMONIC_12 = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
-/** BIP-39 reference vector: 32 bytes of zero entropy. */
-const MNEMONIC_24 =
-  'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon art';
-const RAW_KEY = '1f'.repeat(32);
-const prf = (fill: number): Uint8Array => new Uint8Array(32).fill(fill);
-const CREDENTIAL = 'credential-aaaaaaaaaaaaaaaa';
-
-const failureOf = (fn: () => unknown): string | undefined => {
-  try {
-    fn();
-  } catch (error) {
-    return error instanceof WebIdentityUnlockError ? error.failure : 'other';
-  }
-  return undefined;
-};
-
-describe('recovery material', () => {
-  it('derives a 24-word root exactly as seed[0:32], unchanged from the 12-word rule', () => {
-    const identity = deriveIdentityFromMnemonic(MNEMONIC_24);
-    const expected = bytesToHex(mnemonicToSeedSync(MNEMONIC_24).slice(0, 32));
-    expect(identity.kind).toBe('mnemonic');
-    expect(identity.privateKey).toBe(expected);
-    expect(identity.publicKey).toBe(deriveSecp256k1PublicKey(expected));
-  });
-
-  it('reads a phrase or a raw key, and nothing else', () => {
-    expect(parseRecoveryMaterial(`  ${MNEMONIC_24.toUpperCase()} `)).toEqual({ kind: 'mnemonic', mnemonic: MNEMONIC_24 });
-    expect(parseRecoveryMaterial(`0x${RAW_KEY.toUpperCase()}`)).toEqual({ kind: 'raw-key', privateKey: `0x${RAW_KEY.toUpperCase()}` });
-    expect(() => parseRecoveryMaterial('abandon abandon')).toThrow('Invalid recovery material');
-    expect(() => parseRecoveryMaterial('zz'.repeat(32))).toThrow('Invalid recovery material');
-  });
-
-  it('keeps a raw key a raw key: no phrase is ever derived for it', () => {
-    const identity = deriveIdentityFromRecoveryMaterial({ kind: 'raw-key', privateKey: `0x${RAW_KEY}` });
-    expect(identity).toEqual({ kind: 'raw-key', mnemonic: null, privateKey: RAW_KEY, publicKey: deriveSecp256k1PublicKey(RAW_KEY) });
-    expect(() => deriveIdentityFromPrivateKey('00'.repeat(32))).toThrow('Invalid private key');
-  });
-
-  it('treats only an actual 32-byte PRF output as usable', () => {
-    expect(isUsablePrfOutput(prf(1))).toBe(true);
-    expect(isUsablePrfOutput(new Uint8Array(31))).toBe(false);
-    expect(isUsablePrfOutput(null)).toBe(false);
-  });
-});
-
-describe('envelopes', () => {
-  it.each([
-    ['12 words', () => deriveIdentityFromMnemonic(MNEMONIC_12)],
-    ['24 words', () => deriveIdentityFromMnemonic(MNEMONIC_24)],
-    ['a raw key', () => deriveIdentityFromPrivateKey(RAW_KEY)],
-  ])('seals and reopens the same root from %s', (_label, make) => {
-    const identity = make();
-    const { envelope, dataKey } = sealWebIdentity(identity, { prfOutput: prf(7), credentialId: CREDENTIAL, rpId: 'oxy.so' });
-    wipeBytes(dataKey);
-
-    expect(webIdentityEnvelopeSchema.safeParse(envelope).success).toBe(true);
-    expect(envelope.version).toBe(2);
-    expect(envelope.wraps[0].rpId).toBe('oxy.so');
-    const opened = unlockWebIdentity(envelope, prf(7), CREDENTIAL);
-    expect(opened).toEqual(make());
-  });
-
-  it('binds the RP ID into the wrap, so a relabelled wrap does not open', () => {
-    const { envelope, dataKey } = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC_12), { prfOutput: prf(3), credentialId: CREDENTIAL, rpId: 'oxy.so' });
-    wipeBytes(dataKey);
-    const relabelled = { ...envelope, wraps: envelope.wraps.map((wrap) => ({ ...wrap, rpId: 'auth.oxy.so' })) };
-    expect(failureOf(() => unwrapDataKey(relabelled, prf(3), CREDENTIAL))).toBe('prf-mismatch');
-  });
-
-  it('refuses a secret kind that was swapped after sealing', () => {
-    const { envelope, dataKey } = sealWebIdentity(deriveIdentityFromMnemonic(MNEMONIC_24), { prfOutput: prf(3), credentialId: CREDENTIAL });
-    const swapped = { ...envelope, secretKind: 'raw-private-key' as const };
-    expect(failureOf(() => unlockWebIdentity(swapped, prf(3), CREDENTIAL))).toBe('corrupt');
-    wipeBytes(dataKey);
-  });
-
-  it('adds a second passkey and records which wraps have proven they open the root', () => {
-    const identity = deriveIdentityFromMnemonic(MNEMONIC_12);
-    const { envelope, dataKey } = sealWebIdentity(identity, { prfOutput: prf(1), credentialId: CREDENTIAL, rpId: 'oxy.so' });
-    const second = 'credential-bbbbbbbbbbbbbbbb';
-    const both = addWrap(envelope, dataKey, { prfOutput: prf(2), credentialId: second, rpId: 'oxy.so' });
-    wipeBytes(dataKey);
-
-    expect(unlockWebIdentity(both, prf(2), second).publicKey).toBe(identity.publicKey);
-    const verified = markWrapVerified(both, second, new Date('2026-09-16T00:00:00.000Z'));
-    expect(verified.wraps.find((wrap) => wrap.credentialId === second)?.verifiedAt).toBe('2026-09-16T00:00:00.000Z');
-    expect(verified.wraps.find((wrap) => wrap.credentialId === CREDENTIAL)?.verifiedAt).toBeUndefined();
-    // Holder metadata is not part of the AEAD: marking does not change what opens.
-    expect(unlockWebIdentity(verified, prf(1), CREDENTIAL).publicKey).toBe(identity.publicKey);
-  });
-});

package/src/crypto/identityMove.ts

@@ -1,167 +0,0 @@
-/**
- * Identity move — the crypto of giving a web root to Commons (ADR 0024 D6).
- *
- * Both sides run this: the web holder (the initiator, holding the root) and
- * Commons (the responder, receiving it). The relay in between sees a commitment,
- * two ephemeral public keys and ciphertext. The initiator commits to its key
- * before the responder chooses one and reveals it only afterwards, so the 6-digit
- * code both screens show exposes a relay that substituted a key — it cannot grind
- * one until the codes agree. The receipt binds the move, the root, both keys and
- * the ciphertext actually relayed.
- *
- * PURE: no storage, no network. Contract: `@oxy.so/contracts` `identityMove`.
- */
-
-import './polyfill';
-import { entropyToMnemonic, mnemonicToEntropy } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils';
-import { verifySignature } from '@oxy.so/protocol';
-import { generateSecp256k1KeyPair } from '@oxy.so/protocol/secp256k1';
-import {
-  IDENTITY_MOVE_QR_PREFIX,
-  buildMoveCiphertextDigestInput,
-  buildMoveCommitmentInput,
-  buildMoveReceiptMessage,
-  buildMoveSasInput,
-} from '@oxy.so/contracts';
-import { decryptAead, encryptAead, AEAD_KEY_LENGTH } from './aead';
-import { deriveSharedSecret } from './ecdh';
-import { hkdfSha256 } from './kdf';
-import { deriveIdentityFromMnemonic, wipeBytes, type OpenedMnemonicIdentity } from './webIdentityCarrier';
-
-const MOVE_KDF_INFO = utf8ToBytes('oxy-identity-move-v1');
-
-function sha256Hex(input: string): string {
-  return bytesToHex(sha256(utf8ToBytes(input)));
-}
-
-/** A fresh ephemeral key pair for one move. Keep the private key in memory only. */
-export function generateMoveEphemeralKeyPair(): { privateKey: string; publicKey: string } {
-  return generateSecp256k1KeyPair();
-}
-
-/** The symmetric key both sides derive: HKDF(ECDH, salt = moveId). */
-export function deriveMoveKey(ownEphemeralPrivateKey: string, otherEphemeralPublicKey: string, moveId: string): Uint8Array {
-  const shared = deriveSharedSecret(ownEphemeralPrivateKey, otherEphemeralPublicKey);
-  try {
-    return hkdfSha256(shared, utf8ToBytes(moveId.toLowerCase()), MOVE_KDF_INFO, AEAD_KEY_LENGTH);
-  } finally {
-    wipeBytes(shared);
-  }
-}
-
-/** Initiator: commit to the ephemeral key before anyone else's key is known. The nonce stays in memory until the reveal. */
-export function createMoveCommitment(initiatorEphemeralPublicKey: string): { commitment: string; nonce: string } {
-  const nonceBytes = new Uint8Array(32);
-  globalThis.crypto.getRandomValues(nonceBytes);
-  const nonce = bytesToHex(nonceBytes);
-  return { commitment: sha256Hex(buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce)), nonce };
-}
-
-/** Responder: does the revealed key match the commitment read before joining? */
-export function verifyMoveCommitment(initiatorEphemeralPublicKey: string, nonce: string, commitment: string): boolean {
-  return sha256Hex(buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce)) === commitment.toLowerCase();
-}
-
-/** The 6-digit code, bound to the move, both keys in their roles, and the commitment. */
-export function deriveMoveSas(input: {
-  moveId: string;
-  initiatorEphemeralPublicKey: string;
-  responderEphemeralPublicKey: string;
-  initiatorCommitment: string;
-}): string {
-  const digest = sha256(utf8ToBytes(buildMoveSasInput(input)));
-  const value = ((digest[0] << 24) | (digest[1] << 16) | (digest[2] << 8) | digest[3]) >>> 0;
-  return String(value % 1_000_000).padStart(6, '0');
-}
-
-/** The digest a receipt binds: what was actually relayed. */
-export function digestMoveCiphertext(sealed: { nonce: string; ciphertext: string }): string {
-  return sha256Hex(buildMoveCiphertextDigestInput(sealed));
-}
-
-export interface MoveReceiptClaims {
-  moveId: string;
-  rootPublicKey: string;
-  initiatorEphemeralPublicKey: string;
-  responderEphemeralPublicKey: string;
-  ciphertextDigest: string;
-}
-
-/**
- * Responder: sign the receipt with a signer that reads the root back from durable
- * storage (Commons passes its keychain signer), so a receipt exists only for a
- * root that was actually stored.
- */
-export async function signMoveReceipt(sign: (message: string) => Promise<string>, claims: MoveReceiptClaims): Promise<{ signature: string }> {
-  return { signature: await sign(buildMoveReceiptMessage(claims)) };
-}
-
-/** Initiator: is this receipt the root's, for exactly this move and ciphertext? */
-export function verifyMoveReceipt(claims: MoveReceiptClaims, signature: string): Promise<boolean> {
-  return verifySignature(buildMoveReceiptMessage(claims), signature, claims.rootPublicKey);
-}
-
-function moveAad(moveId: string, publicKey: string): Uint8Array {
-  return utf8ToBytes(JSON.stringify({ v: 1, purpose: 'identity-move', moveId: moveId.toLowerCase(), publicKey: publicKey.toLowerCase() }));
-}
-
-/** Initiator: seal the phrase entropy (12–24 words) for the responder. */
-export function sealIdentityForMove(
-  identity: Pick<OpenedMnemonicIdentity, 'mnemonic' | 'publicKey'>,
-  moveKey: Uint8Array,
-  moveId: string,
-): { nonce: string; ciphertext: string } {
-  if (typeof identity.mnemonic !== 'string' || !identity.mnemonic) {
-    throw new Error('Only an identity with a recovery phrase can be moved this way');
-  }
-  const entropy = mnemonicToEntropy(identity.mnemonic, wordlist);
-  try {
-    const { nonce, ciphertext } = encryptAead(moveKey, entropy, moveAad(moveId, identity.publicKey));
-    return { nonce: bytesToHex(nonce), ciphertext: bytesToHex(ciphertext) };
-  } finally {
-    wipeBytes(entropy);
-  }
-}
-
-/**
- * Responder: open the sealed identity. The derived public key must be the one
- * the move declared — anything else is refused, never imported.
- */
-export function openMovedIdentity(
-  sealed: { nonce: string; ciphertext: string },
-  moveKey: Uint8Array,
-  moveId: string,
-  expectedPublicKey: string,
-): OpenedMnemonicIdentity {
-  let entropy: Uint8Array;
-  try {
-    entropy = decryptAead(moveKey, hexToBytes(sealed.nonce), hexToBytes(sealed.ciphertext), moveAad(moveId, expectedPublicKey));
-  } catch {
-    throw new Error('The identity could not be opened. The codes may not have matched — start again.');
-  }
-  try {
-    const identity = deriveIdentityFromMnemonic(entropyToMnemonic(entropy, wordlist));
-    if (identity.publicKey !== expectedPublicKey.toLowerCase()) {
-      throw new Error('The received identity is not the one being moved');
-    }
-    return identity;
-  } finally {
-    wipeBytes(entropy);
-  }
-}
-
-/** The QR payload for a move. */
-export function buildMoveQrPayload(moveId: string): string {
-  return `${IDENTITY_MOVE_QR_PREFIX}${moveId.toLowerCase()}`;
-}
-
-/** The move id in a scanned payload, or `null` when it is not a move QR. */
-export function parseMoveQrPayload(raw: string): string | null {
-  const value = raw.trim();
-  if (!value.toLowerCase().startsWith(IDENTITY_MOVE_QR_PREFIX)) return null;
-  const id = value.slice(IDENTITY_MOVE_QR_PREFIX.length).toLowerCase();
-  return /^[0-9a-f]{32}$/.test(id) ? id : null;
-}