@oxy.so/protocol 1.0.0

package/dist/cjs/chain/continuity.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * Chain continuity — the pure "does this record extend the head by exactly one?"
+ * check, with NO storage or crypto dependency.
+ *
+ * This is the single definition of continuity that used to be duplicated in
+ * oxy-api (`verifyChainContinuity`) and the node store (`appendTxn`). The engine
+ * calls it with the head it read from the injected store; a store MAY call it
+ * again inside its atomic append, but the unique-index backstop (surfaced as
+ * `chain_conflict`) is the real race guard.
+ *
+ * v1 envelopes have no chain coordinates, so they always pass (the caller does
+ * not advance a chain for them).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkContinuity = checkContinuity;
+/**
+ * True when `head` represents an actual existing chain (as opposed to `null` or
+ * the "no chain yet" sentinel head a store may return).
+ */
+function hasChain(head) {
+    return head !== null && head.headRecordId !== null && head.seq >= 0;
+}
+/**
+ * Check that `env` validly extends `head`:
+ *
+ *  - **v1** (no chain coordinates): always `{ ok: true }` — v1 records are not
+ *    chained.
+ *  - **no head** (genesis position): only a genesis (`seq === 0`, `prev` null)
+ *    is accepted; anything else is `chain_gap` (it claims to extend a chain that
+ *    does not exist).
+ *  - **head exists**: `env.prev` MUST equal `head.headRecordId` (else
+ *    `chain_fork`, which also covers a re-genesis whose `prev` is `null`), and
+ *    `env.seq` MUST equal `head.seq + 1` (else `bad_seq`).
+ */
+function checkContinuity(head, env) {
+    if (env.version !== 2) {
+        return { ok: true };
+    }
+    const isGenesis = env.seq === 0 && (env.prev === null || env.prev === undefined);
+    if (!hasChain(head)) {
+        if (!isGenesis) {
+            return { ok: false, reason: 'chain_gap' };
+        }
+        return { ok: true };
+    }
+    if (env.prev !== head.headRecordId) {
+        return { ok: false, reason: 'chain_fork' };
+    }
+    if (env.seq !== head.seq + 1) {
+        return { ok: false, reason: 'bad_seq' };
+    }
+    return { ok: true };
+}

package/dist/cjs/chain/engine.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Chain engine — verify-then-append orchestration.
+ *
+ * The one entry point an app's adapter calls to publish a record: it runs the
+ * full {@link verifyEnvelope} state machine, computes the content address
+ * (`recordId`), and hands the verified envelope to the injected
+ * {@link RecordStore} to persist atomically. The store owns the durable
+ * concurrency backstop (`chain_conflict` on a unique-index collision); the
+ * engine owns the verification + ordering policy.
+ *
+ * Storage and identity are both injected, so the engine has zero knowledge of
+ * Mongo/SQLite, Oxy DIDs, or any app's lexicon — exactly what makes it reusable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAndAppend = verifyAndAppend;
+const recordId_1 = require("../envelope/recordId");
+const verify_1 = require("./verify");
+/**
+ * Verify `env` and, if it passes, append it to the subject's chain.
+ *
+ * On a verification failure the rejection is returned WITHOUT touching the store.
+ * On success the (engine-computed) `recordId` is passed to `store.append`, whose
+ * own outcome — including the `chain_conflict` backstop on a concurrent-writer
+ * collision — is returned verbatim.
+ */
+async function verifyAndAppend(store, resolver, env, opts = {}) {
+    const verification = await (0, verify_1.verifyEnvelope)(store, resolver, env, opts);
+    if (!verification.ok) {
+        return verification;
+    }
+    const recordId = await (0, recordId_1.computeRecordId)(env);
+    return store.append(env.subject, env, recordId);
+}

package/dist/cjs/chain/recordStore.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Storage interfaces — the injected persistence the chain engine drives.
+ *
+ * The engine ({@link ./verify}, {@link ./engine}) is storage-agnostic: it owns
+ * the verification state machine and continuity logic, and delegates EVERY read
+ * and write to an injected {@link RecordStore}. An app supplies a store over its
+ * own backend (oxy-api over Mongo `SignedRecord`/`RepoHead`, a node over SQLite,
+ * Mention over its own Mongo) without the engine knowing anything Oxy- or
+ * app-specific.
+ *
+ * All methods are **subject-keyed**: `subject` is the chain's subject DID
+ * (`env.subject`). A store maps that DID to its own primary key (e.g. an Oxy
+ * userId) internally; the engine never sees that mapping.
+ *
+ * ## Concurrency contract
+ *
+ * `append` MUST be atomic (record insert + head advance in one unit) and MUST
+ * translate a duplicate-key collision on the unique `(subject, seq)` /
+ * `recordId` index — i.e. a concurrent writer that already took this `seq` — into
+ * `{ ok: false, reason: 'chain_conflict' }` (Mongo E11000 / SQLite
+ * `SQLITE_CONSTRAINT`). That is the real multi-writer race guard; the engine's
+ * pre-append continuity check is only the fast-path rejection.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/chain/types.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * Chain engine types — the per-subject hash-chain vocabulary.
+ *
+ * A "chain" is a single signer's append-only log of signed-record envelopes
+ * ("personal blockchain": one signer, no consensus/mining), ordered by a
+ * strictly-increasing `seq` with each record's `prev` pointing at the content
+ * address (`recordId`) of the one before it. These types are storage-agnostic:
+ * the engine ({@link ./verify}, {@link ./engine}) drives them over an injected
+ * {@link ./recordStore.RecordStore}, and any app (Oxy identity/civic/node,
+ * Mention posts, …) supplies its own store + resolver.
+ *
+ * The {@link RejectionReason} union is the SINGLE source of truth for every way
+ * an append can fail — it consolidates what used to be three divergent copies
+ * (oxy-api's `EnvelopeRejectionReason`, the node store's `AppendOutcome.reason`,
+ * and the node verifier's `VerifyRejectionReason`). The exact strings match the
+ * ones oxy-api returns today, so API responses are byte-for-byte unchanged.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNCHAINED_SEQ = void 0;
+/** The `seq` reported for a v1 (unchained) append — it has no sequence. */
+exports.UNCHAINED_SEQ = -1;

package/dist/cjs/chain/verify.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * Envelope verification — the ordered state machine that decides whether a
+ * signed-record envelope may be appended to its subject's chain.
+ *
+ * This is the engine that used to live, Oxy-specific, in
+ * `api/services/signedRecord.service.verifyEnvelope`. Every Oxy detail has been
+ * lifted out into the two injected collaborators:
+ *  - the {@link VerificationMethodResolver} owns "is this key authorized for this
+ *    issuer?" (self vs. custodial vs. untrusted),
+ *  - the {@link RecordStore} owns the monotonicity frontier + the chain head.
+ *
+ * The ordered checks (first failure wins):
+ *  1. **shape** — the base `signedRecordEnvelopeSchema` (open `type`, opaque
+ *     `record`). An app re-narrows `type` to its own set in its adapter.
+ *  2. **signature** — `verifyEnvelopeSignature` recomputes the canonical signing
+ *     input and checks the secp256k1 signature against the embedded `publicKey`.
+ *  3. **issuer authorization** — `resolver.resolve(subject)` + {@link isAuthorizedKey}.
+ *  4. **freshness** — `issuedAt` not beyond the tolerated clock skew.
+ *  5. **monotonicity** — `issuedAt` strictly newer than the store's latest record
+ *     for the same logical key (replay/rollback defence).
+ *  6. **continuity** — `checkContinuity` against the store's chain head (v1 skips).
+ *
+ * The `subject_mismatch` binding ("is the caller allowed to write for THIS
+ * subject?") is intentionally NOT here — it is an adapter-policy decision the
+ * caller makes before invoking the engine, not a property of the envelope.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CLOCK_SKEW_MS = void 0;
+exports.verifyEnvelope = verifyEnvelope;
+const contracts_1 = require("@oxy.so/contracts");
+const sign_1 = require("../envelope/sign");
+const resolver_1 = require("../identity/resolver");
+const continuity_1 = require("./continuity");
+/** Default tolerated forward clock skew for a record's `issuedAt` (5 minutes). */
+exports.DEFAULT_CLOCK_SKEW_MS = 5 * 60 * 1000;
+/**
+ * Run the full verification state machine for `env` against the injected
+ * `store` (monotonicity + continuity) and `resolver` (issuer authorization).
+ * Returns a verdict; it never throws on a bad envelope.
+ */
+async function verifyEnvelope(store, resolver, env, opts = {}) {
+    // 1. Base envelope shape (open `type`, `record` opaque). An app's adapter
+    //    re-narrows `type` to its own accepted set before/around this call.
+    if (!contracts_1.signedRecordEnvelopeSchema.safeParse(env).success) {
+        return { ok: false, reason: 'invalid_envelope' };
+    }
+    // 2. Signature is internally consistent with the embedded `publicKey`. Cheap,
+    //    pure crypto — rejected before any store/resolver I/O.
+    if (!(await (0, sign_1.verifyEnvelopeSignature)(env))) {
+        return { ok: false, reason: 'bad_signature' };
+    }
+    // Enforce that v2 envelopes strictly contain required chain fields.
+    if (env.version === 2 && (typeof env.seq !== 'number' || typeof env.collection !== 'string' || typeof env.rkey !== 'string')) {
+        return { ok: false, reason: 'invalid_envelope' };
+    }
+    // 3. The signing key is an authorized writer for the issuer (self-issued ⇒ a
+    //    current VM of the subject; custodial ⇒ the custodial key; else untrusted).
+    const resolved = await resolver.resolve(env.subject);
+    const authorization = (0, resolver_1.isAuthorizedKey)(resolved, env);
+    if (!authorization.ok) {
+        return authorization;
+    }
+    // 4. Freshness: not issued beyond the tolerated forward clock skew.
+    const now = opts.now ?? Date.now();
+    const clockSkewMs = opts.clockSkewMs ?? exports.DEFAULT_CLOCK_SKEW_MS;
+    if (env.issuedAt > now + clockSkewMs) {
+        return { ok: false, reason: 'issued_in_future' };
+    }
+    // 5. Monotonicity: strictly newer than the latest record for the same key.
+    const latestIssuedAt = await store.latestIssuedAtForKey(env.subject, env);
+    if (latestIssuedAt !== null && env.issuedAt <= latestIssuedAt) {
+        return { ok: false, reason: 'stale_issued_at' };
+    }
+    // 6. Continuity: the record extends the chain head by exactly one. Only v2 is
+    //    chained, so v1 never reads the head (it has no chain to extend).
+    if (env.version !== 2) {
+        return { ok: true };
+    }
+    const head = await store.getHead(env.subject);
+    return (0, continuity_1.checkContinuity)(head, env);
+}

package/dist/cjs/envelope/canonicalJson.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Canonical JSON (RFC 8785 / JCS-style) serialization.
+ *
+ * `canonicalize(value)` produces a deterministic string for any JSON-compatible
+ * value so that a client which SIGNS a record and a server which VERIFIES it
+ * agree byte-for-byte on the signing input — regardless of the order in which
+ * object keys happen to be written, how the value was deserialized, or which
+ * runtime built it.
+ *
+ * This is the load-bearing primitive for the protocol's signed records
+ * (`signEnvelope` + `verifyEnvelopeSignature`): every implementation imports
+ * THIS function from `@oxy.so/protocol`, so cross-implementation number/string
+ * formatting differences cannot cause a verify mismatch.
+ *
+ * Rules (the JSON Canonicalization Scheme subset we need):
+ *  - Objects: keys are sorted (ascending, by UTF-16 code unit — the default
+ *    `Array.prototype.sort` order) and serialized recursively. Properties whose
+ *    value is `undefined`, a function, or a symbol are OMITTED (matching
+ *    `JSON.stringify` object semantics).
+ *  - Arrays: element order is PRESERVED; `undefined`/function/symbol elements
+ *    serialize to `null` (matching `JSON.stringify` array semantics).
+ *  - `null`, booleans, strings, and finite numbers serialize via the standard
+ *    JSON representation.
+ *  - Values exposing a `toJSON()` method (e.g. `Date`) are replaced by its
+ *    result first, then serialized — so a `Date` and its ISO-string equivalent
+ *    canonicalize identically (the wire always carries the string form).
+ *  - Non-finite numbers (`NaN`, `Infinity`) and `bigint` are not part of the
+ *    JSON data model and throw, rather than silently producing `null`.
+ *
+ * Platform-agnostic — zero dependencies, no `require()`, no react/react-native/
+ * expo. Safe in the dual CJS + ESM build.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalize = canonicalize;
+function hasToJSON(value) {
+    return typeof value.toJSON === 'function';
+}
+/**
+ * Serialize a single value into its canonical JSON fragment. Recursive; called
+ * on each nested member. Object keys are sorted at every level.
+ */
+function serialize(value) {
+    if (value === null) {
+        return 'null';
+    }
+    const valueType = typeof value;
+    if (valueType === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new Error('canonicalize: non-finite numbers cannot be serialized');
+        }
+        return JSON.stringify(value);
+    }
+    if (valueType === 'string' || valueType === 'boolean') {
+        return JSON.stringify(value);
+    }
+    if (valueType === 'bigint') {
+        throw new Error('canonicalize: bigint values cannot be serialized');
+    }
+    if (Array.isArray(value)) {
+        const items = value.map((item) => {
+            const itemType = typeof item;
+            // JSON array semantics: undefined / function / symbol become null so the
+            // element positions (and therefore the array length) are preserved.
+            if (item === undefined || itemType === 'function' || itemType === 'symbol') {
+                return 'null';
+            }
+            return serialize(item);
+        });
+        return `[${items.join(',')}]`;
+    }
+    if (valueType === 'object') {
+        const obj = value;
+        if (hasToJSON(obj)) {
+            return serialize(obj.toJSON());
+        }
+        const record = obj;
+        const parts = [];
+        for (const key of Object.keys(record).sort()) {
+            const member = record[key];
+            const memberType = typeof member;
+            // JSON object semantics: properties with undefined / function / symbol
+            // values are omitted entirely.
+            if (member === undefined || memberType === 'function' || memberType === 'symbol') {
+                continue;
+            }
+            parts.push(`${JSON.stringify(key)}:${serialize(member)}`);
+        }
+        return `{${parts.join(',')}}`;
+    }
+    // undefined / function / symbol at the top level have no JSON representation.
+    throw new Error(`canonicalize: cannot serialize a value of type ${valueType}`);
+}
+/**
+ * Produce the canonical JSON string for `value`.
+ *
+ * Deterministic: two structurally-equal values yield identical strings even if
+ * their object keys were written in different orders. Use this — never an
+ * ad-hoc `JSON.stringify` of a hand-sorted object — as the signing input for
+ * signed records, so client signing and server verification cannot drift.
+ *
+ * @throws if `value` (or any nested member used as the top-level/primitive)
+ *   contains a non-finite number or a `bigint`, which have no JSON form.
+ */
+function canonicalize(value) {
+    return serialize(value);
+}

package/dist/cjs/envelope/recordId.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Content hashing — SHA-256 + `recordId` (content address).
+ *
+ * `sha256` is the protocol's single platform-aware SHA-256: it uses
+ * `expo-crypto` on React Native, Node's built-in `crypto` on the server, and
+ * the Web Crypto API in the browser — always producing the same lowercase-hex
+ * digest. `computeRecordId` is `sha256(signedRecordSigningInput(fields))`: the
+ * content address that a record's chain `prev` pointer references.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256 = sha256;
+exports.computeRecordId = computeRecordId;
+const platform_1 = require("../platform/platform");
+const crypto_1 = require("../platform/crypto");
+const signingInput_1 = require("./signingInput");
+/**
+ * Compute the SHA-256 hash of a string, returned as lowercase hex.
+ *
+ * Platform-aware: `expo-crypto` (RN) → Node `crypto` (server) → Web Crypto
+ * (browser). The three paths produce byte-identical digests, so a record
+ * hashed on a device and re-hashed on the server agree.
+ */
+async function sha256(message) {
+    // In React Native, use expo-crypto
+    if ((0, platform_1.isReactNative)()) {
+        const Crypto = await (0, crypto_1.loadExpoCrypto)();
+        return Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, message);
+    }
+    if ((0, platform_1.isNodeJS)()) {
+        try {
+            const nodeCrypto = await (0, crypto_1.loadNodeCrypto)();
+            return nodeCrypto.createHash('sha256').update(message).digest('hex');
+        }
+        catch {
+            // Node crypto failed to load — fall through to the Web Crypto API below,
+            // which is a correct, equivalent SHA-256 on any runtime that exposes it.
+        }
+    }
+    // Browser: use Web Crypto API
+    const encoder = new TextEncoder();
+    const data = encoder.encode(message);
+    const hashBuffer = await globalThis.crypto.subtle.digest('SHA-256', data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Compute the `recordId` (content address) of a signed record: the SHA-256 hex
+ * digest of its canonical {@link signedRecordSigningInput}.
+ *
+ * Deterministic and stable across runtimes (it reuses the same canonicalization
+ * + SHA-256 the signature itself is built on). The recordId is what `prev`
+ * references in the per-subject hash chain, so every implementation MUST
+ * compute it identically — all call this function. It is taken over the SIGNING
+ * input (excluding `publicKey`/`signature`), so it is a pure content address of
+ * the record's meaning, independent of who signed.
+ */
+async function computeRecordId(fields) {
+    return sha256((0, signingInput_1.signedRecordSigningInput)(fields));
+}

package/dist/cjs/envelope/sign.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * Signing & verification — explicit-key crypto for signed-record envelopes.
+ *
+ * Stateless: every function takes the key material explicitly (no KeyManager,
+ * no secure storage). `@oxy.so/core` binds these to a device key; nodes and the
+ * API verify with them. The scheme is `ES256K-DER-SHA256` everywhere:
+ * secp256k1 over the SHA-256 of the canonical bytes, DER-encoded.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signMessage = signMessage;
+exports.verifySignature = verifySignature;
+exports.signEnvelope = signEnvelope;
+exports.verifyEnvelopeSignature = verifyEnvelopeSignature;
+const signingInput_1 = require("./signingInput");
+const recordId_1 = require("./recordId");
+const secp256k1_1 = require("../secp256k1");
+/** The one signature algorithm identifier the protocol emits. */
+const ALG = 'ES256K-DER-SHA256';
+/**
+ * Sign an arbitrary message with an explicit private key.
+ *
+ * Hashes the message with SHA-256, then signs the digest with secp256k1,
+ * returning the DER-encoded hex signature. The low-level primitive behind both
+ * {@link signEnvelope} and `@oxy.so/core`'s device-key signing helpers.
+ */
+async function signMessage(message, privateKeyHex) {
+    const digest = await (0, recordId_1.sha256)(message);
+    return (0, secp256k1_1.signSecp256k1Digest)(privateKeyHex, digest);
+}
+/**
+ * Verify a DER-encoded signature over a message against a public key.
+ *
+ * Returns `false` on any error (invalid signature, malformed key/signature,
+ * etc.) rather than throwing, so callers can treat verification as a boolean.
+ */
+async function verifySignature(message, signature, publicKeyHex) {
+    try {
+        const digest = await (0, recordId_1.sha256)(message);
+        return (0, secp256k1_1.verifySecp256k1Digest)(publicKeyHex, digest, signature);
+    }
+    catch {
+        // Malformed key / signature / input is not a valid signature.
+        return false;
+    }
+}
+/**
+ * Build a fully-signed {@link SignedRecordEnvelope} from its signing fields and
+ * an explicit private key.
+ *
+ * Computes the canonical {@link signedRecordSigningInput}, signs it
+ * (`ES256K-DER-SHA256`), and attaches the DERIVED `publicKey` (uncompressed
+ * hex — identical to `KeyManager`'s stored key for the same private key) plus
+ * the `alg`/`signature`. The signature covers every field EXCEPT
+ * `publicKey`/`signature`.
+ */
+async function signEnvelope(fields, privateKeyHex) {
+    const signingInput = (0, signingInput_1.signedRecordSigningInput)(fields);
+    const signature = await signMessage(signingInput, privateKeyHex);
+    const publicKey = (0, secp256k1_1.deriveSecp256k1PublicKey)(privateKeyHex);
+    return { ...fields, publicKey, alg: ALG, signature };
+}
+/**
+ * Verify a signed-record envelope: recompute the canonical signing input from
+ * the envelope's own fields and check the signature against the envelope's
+ * `publicKey`.
+ *
+ * This confirms the signature is internally consistent with the embedded
+ * `publicKey`. It does NOT establish that `publicKey` is an authorized
+ * verification method for `subject` — that authorization check belongs to the
+ * server / node owner check.
+ */
+async function verifyEnvelopeSignature(envelope) {
+    return verifySignature((0, signingInput_1.signedRecordSigningInput)(envelope), envelope.signature, envelope.publicKey);
+}

package/dist/cjs/envelope/signingInput.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * Signed-record signing input — "what the signature covers".
+ *
+ * The single definition shared by every implementation (client signing and
+ * server verification), so a record signed by one and verified by another
+ * cannot drift.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signedRecordSigningInput = signedRecordSigningInput;
+const canonicalJson_1 = require("./canonicalJson");
+/**
+ * Compute the canonical signing input for a signed-record envelope.
+ *
+ * - **v1**: the canonical JSON of `{version, type, subject, issuer, record,
+ *   issuedAt}` — BYTE-IDENTICAL to the original scheme, so every signature
+ *   already in production keeps verifying.
+ * - **v2**: the canonical JSON additionally includes the hash-chain fields
+ *   `{seq, prev, collection, rkey}`. Because {@link canonicalize} sorts keys,
+ *   the on-the-wire field order is irrelevant; the resulting canonical key
+ *   order is `collection, issuedAt, issuer, prev, record, rkey, seq, subject,
+ *   type, version`. `prev` is `null` at genesis (serialized as `null`, not
+ *   omitted), so it is always part of the signed bytes.
+ */
+function signedRecordSigningInput(fields) {
+    const { version, type, subject, issuer, record, issuedAt } = fields;
+    if (version === 2) {
+        const { seq, prev, collection, rkey } = fields;
+        return (0, canonicalJson_1.canonicalize)({ version, type, subject, issuer, record, issuedAt, seq, prev, collection, rkey });
+    }
+    return (0, canonicalJson_1.canonicalize)({ version, type, subject, issuer, record, issuedAt });
+}

package/dist/cjs/identity/resolver.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Verification-method resolution — the injected authorization policy the chain
+ * engine consults to decide whether an envelope's signing key is allowed to
+ * write to the subject's chain.
+ *
+ * The engine is identity-agnostic: it does NOT know about Oxy DIDs, the `User`
+ * model, custodial keys, or any app's notion of "current key". It asks an
+ * injected {@link VerificationMethodResolver} to resolve a subject DID to its
+ * current verification methods (plus the optional custodial issuer that may sign
+ * provenance records ABOUT the subject), then applies the uniform authorization
+ * rule in {@link isAuthorizedKey}.
+ *
+ * This is what lets the SAME engine serve Oxy identity/civic records (where the
+ * resolver reads `User.publicKey`/`authMethods` and the Oxy custodial key), a
+ * self-hosted node (where the authority is a configured owner key), and Mention
+ * posts (subject VMs from the Oxy DID + a Mention custodial server key) — each
+ * supplies its own resolver; the decision logic lives here, once.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAuthorizedKey = isAuthorizedKey;
+/**
+ * Decide whether `env`'s signing key (`env.publicKey`) is authorized for its
+ * `issuer`, given the subject's resolved verification methods:
+ *
+ *  - **Self-issued** (`issuer === subject`): the key MUST be one of the subject's
+ *    `currentPublicKeys`; otherwise `public_key_not_a_current_verification_method`.
+ *  - **Custodial** (`issuer === custodialIssuer`): the key MUST equal
+ *    `custodialPublicKey`; otherwise `public_key_not_a_current_verification_method`.
+ *  - **Any other issuer** (including an unresolvable subject): `untrusted_issuer`.
+ *
+ * The signature itself is checked separately (against `env.publicKey`), so this
+ * only decides whether that key is an authorized writer — it is not a trust
+ * shortcut.
+ */
+function isAuthorizedKey(resolved, env) {
+    if (resolved !== null && env.issuer === env.subject) {
+        return resolved.currentPublicKeys.includes(env.publicKey)
+            ? { ok: true }
+            : { ok: false, reason: 'public_key_not_a_current_verification_method' };
+    }
+    if (resolved !== null &&
+        resolved.custodialIssuer !== undefined &&
+        env.issuer === resolved.custodialIssuer) {
+        return resolved.custodialPublicKey !== undefined && env.publicKey === resolved.custodialPublicKey
+            ? { ok: true }
+            : { ok: false, reason: 'public_key_not_a_current_verification_method' };
+    }
+    return { ok: false, reason: 'untrusted_issuer' };
+}

package/dist/cjs/index.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * @oxy.so/protocol — the app-agnostic Oxy Protocol base.
+ *
+ * The reusable substrate any Oxy app can use to decentralize its own content:
+ * the signed-record envelope grammar (canonical JSON, signing input, content
+ * address), explicit-key signing/verification, and the platform-aware crypto
+ * loaders. App-specific lexicons and the chain engine layer on top of this.
+ *
+ * Platform-agnostic root entry. Node-only pieces live under the `./node`
+ * subpath so they never enter React Native / web bundles.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadSharedIdentityBridge = exports.getRandomBytesRN = exports.loadAsyncStorage = exports.loadSecureStore = exports.loadExpoCrypto = exports.loadNodeCrypto = exports.isNodeJS = exports.isReactNative = exports.isAuthorizedKey = exports.verifyCheckpointSignature = exports.signCheckpoint = exports.checkpointHash = exports.checkpointSigningInput = exports.verifyInclusionProof = exports.inclusionProof = exports.buildTransparencyTreeFromHeads = exports.buildTransparencyTree = exports.transparencyLeafHash = exports.EMPTY_TRANSPARENCY_ROOT = exports.verifyAndAppend = exports.DEFAULT_CLOCK_SKEW_MS = exports.verifyEnvelope = exports.checkContinuity = exports.UNCHAINED_SEQ = exports.verifyEnvelopeSignature = exports.signEnvelope = exports.verifySignature = exports.signMessage = exports.computeRecordId = exports.sha256 = exports.signedRecordSigningInput = exports.canonicalize = void 0;
+// ---------------------------------------------------------------------------
+// Envelope — canonical JSON, signing input, content address, signing/verify
+// ---------------------------------------------------------------------------
+var canonicalJson_1 = require("./envelope/canonicalJson");
+Object.defineProperty(exports, "canonicalize", { enumerable: true, get: function () { return canonicalJson_1.canonicalize; } });
+var signingInput_1 = require("./envelope/signingInput");
+Object.defineProperty(exports, "signedRecordSigningInput", { enumerable: true, get: function () { return signingInput_1.signedRecordSigningInput; } });
+var recordId_1 = require("./envelope/recordId");
+Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return recordId_1.sha256; } });
+Object.defineProperty(exports, "computeRecordId", { enumerable: true, get: function () { return recordId_1.computeRecordId; } });
+var sign_1 = require("./envelope/sign");
+Object.defineProperty(exports, "signMessage", { enumerable: true, get: function () { return sign_1.signMessage; } });
+Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return sign_1.verifySignature; } });
+Object.defineProperty(exports, "signEnvelope", { enumerable: true, get: function () { return sign_1.signEnvelope; } });
+Object.defineProperty(exports, "verifyEnvelopeSignature", { enumerable: true, get: function () { return sign_1.verifyEnvelopeSignature; } });
+var types_1 = require("./chain/types");
+Object.defineProperty(exports, "UNCHAINED_SEQ", { enumerable: true, get: function () { return types_1.UNCHAINED_SEQ; } });
+var continuity_1 = require("./chain/continuity");
+Object.defineProperty(exports, "checkContinuity", { enumerable: true, get: function () { return continuity_1.checkContinuity; } });
+var verify_1 = require("./chain/verify");
+Object.defineProperty(exports, "verifyEnvelope", { enumerable: true, get: function () { return verify_1.verifyEnvelope; } });
+Object.defineProperty(exports, "DEFAULT_CLOCK_SKEW_MS", { enumerable: true, get: function () { return verify_1.DEFAULT_CLOCK_SKEW_MS; } });
+var engine_1 = require("./chain/engine");
+Object.defineProperty(exports, "verifyAndAppend", { enumerable: true, get: function () { return engine_1.verifyAndAppend; } });
+// ---------------------------------------------------------------------------
+// Transparency — Merkle commitment over chain heads + co-signable checkpoints
+// ---------------------------------------------------------------------------
+var tree_1 = require("./transparency/tree");
+Object.defineProperty(exports, "EMPTY_TRANSPARENCY_ROOT", { enumerable: true, get: function () { return tree_1.EMPTY_TRANSPARENCY_ROOT; } });
+Object.defineProperty(exports, "transparencyLeafHash", { enumerable: true, get: function () { return tree_1.transparencyLeafHash; } });
+Object.defineProperty(exports, "buildTransparencyTree", { enumerable: true, get: function () { return tree_1.buildTransparencyTree; } });
+Object.defineProperty(exports, "buildTransparencyTreeFromHeads", { enumerable: true, get: function () { return tree_1.buildTransparencyTreeFromHeads; } });
+Object.defineProperty(exports, "inclusionProof", { enumerable: true, get: function () { return tree_1.inclusionProof; } });
+Object.defineProperty(exports, "verifyInclusionProof", { enumerable: true, get: function () { return tree_1.verifyInclusionProof; } });
+var checkpoint_1 = require("./transparency/checkpoint");
+Object.defineProperty(exports, "checkpointSigningInput", { enumerable: true, get: function () { return checkpoint_1.checkpointSigningInput; } });
+Object.defineProperty(exports, "checkpointHash", { enumerable: true, get: function () { return checkpoint_1.checkpointHash; } });
+Object.defineProperty(exports, "signCheckpoint", { enumerable: true, get: function () { return checkpoint_1.signCheckpoint; } });
+Object.defineProperty(exports, "verifyCheckpointSignature", { enumerable: true, get: function () { return checkpoint_1.verifyCheckpointSignature; } });
+// ---------------------------------------------------------------------------
+// Identity — injected verification-method resolution + authorization rule
+// ---------------------------------------------------------------------------
+var resolver_1 = require("./identity/resolver");
+Object.defineProperty(exports, "isAuthorizedKey", { enumerable: true, get: function () { return resolver_1.isAuthorizedKey; } });
+// ---------------------------------------------------------------------------
+// Platform — runtime predicates + lazy crypto/storage loaders
+// ---------------------------------------------------------------------------
+var platform_1 = require("./platform/platform");
+Object.defineProperty(exports, "isReactNative", { enumerable: true, get: function () { return platform_1.isReactNative; } });
+Object.defineProperty(exports, "isNodeJS", { enumerable: true, get: function () { return platform_1.isNodeJS; } });
+var crypto_1 = require("./platform/crypto");
+Object.defineProperty(exports, "loadNodeCrypto", { enumerable: true, get: function () { return crypto_1.loadNodeCrypto; } });
+Object.defineProperty(exports, "loadExpoCrypto", { enumerable: true, get: function () { return crypto_1.loadExpoCrypto; } });
+Object.defineProperty(exports, "loadSecureStore", { enumerable: true, get: function () { return crypto_1.loadSecureStore; } });
+Object.defineProperty(exports, "loadAsyncStorage", { enumerable: true, get: function () { return crypto_1.loadAsyncStorage; } });
+Object.defineProperty(exports, "getRandomBytesRN", { enumerable: true, get: function () { return crypto_1.getRandomBytesRN; } });
+Object.defineProperty(exports, "loadSharedIdentityBridge", { enumerable: true, get: function () { return crypto_1.loadSharedIdentityBridge; } });