@oxyhq/core 3.11.0 → 3.13.0

package/dist/esm/crypto/signatureService.js

@@ -16,15 +16,42 @@ const ec = new EC('secp256k1');
 /**
  * Compute the canonical signing input for a signed-record envelope.
  *
- * This is the single definition of "what the signature covers": the canonical
- * JSON of `{version, type, subject, issuer, record, issuedAt}`. `@oxyhq/core`
+ * This is the single definition of "what the signature covers". `@oxyhq/core`
  * (client signing) and `@oxyhq/api` (server verification) both call this, so a
  * record signed by a client and verified by the server cannot drift.
+ *
+ * - **v1**: the canonical JSON of `{version, type, subject, issuer, record,
+ *   issuedAt}` — BYTE-IDENTICAL to the original scheme, so every signature
+ *   already in production keeps verifying.
+ * - **v2**: the canonical JSON additionally includes the hash-chain fields
+ *   `{seq, prev, collection, rkey}`. Because {@link canonicalize} sorts keys,
+ *   the on-the-wire field order is irrelevant; the resulting canonical key
+ *   order is `collection, issuedAt, issuer, prev, record, rkey, seq, subject,
+ *   type, version`. `prev` is `null` at genesis (serialized as `null`, not
+ *   omitted), so it is always part of the signed bytes.
  */
 export function signedRecordSigningInput(fields) {
     const { version, type, subject, issuer, record, issuedAt } = fields;
+    if (version === 2) {
+        const { seq, prev, collection, rkey } = fields;
+        return canonicalize({ version, type, subject, issuer, record, issuedAt, seq, prev, collection, rkey });
+    }
     return canonicalize({ version, type, subject, issuer, record, issuedAt });
 }
+/**
+ * Compute the `recordId` (content address) of a signed record: the SHA-256 hex
+ * digest of its canonical {@link signedRecordSigningInput}.
+ *
+ * Deterministic and stable across runtimes (it reuses the same canonicalization
+ * + SHA-256 the signature itself is built on). The recordId is what `prev`
+ * references in the per-subject hash chain, so `@oxyhq/core` (client) and
+ * `@oxyhq/api` (server) MUST compute it identically — both call this function.
+ * It is taken over the SIGNING input (excluding `publicKey`/`signature`), so it
+ * is a pure content address of the record's meaning, independent of who signed.
+ */
+export async function computeRecordId(fields) {
+    return sha256(signedRecordSigningInput(fields));
+}
 /**
  * Compute SHA-256 hash of a string
  */
@@ -340,6 +367,64 @@ export class SignatureService {
             signature,
         };
     }
+    /**
+     * Build a signed-record envelope (v2) carrying the per-subject hash-chain
+     * fields.
+     *
+     * Identical to {@link signRecord} (self-issued: `issuer === subject`; same
+     * `ES256K-DER-SHA256` scheme over {@link signedRecordSigningInput}) but
+     * `version` is `2` and the signed bytes additionally cover the chain fields:
+     *
+     * @param type - The record category.
+     * @param subject - The subject DID the record is about (also the issuer).
+     * @param record - The arbitrary record payload to attest to.
+     * @param chain - The hash-chain coordinates:
+     *   - `seq` — strictly-increasing sequence number for this subject's chain.
+     *   - `prev` — the `recordId` of the previous record, or `null` at genesis.
+     *   - `collection` + `rkey` — the AtProto-style record key.
+     *
+     * The caller is responsible for fetching the current chain head (so `seq` /
+     * `prev` are correct) before signing. Requires a stored identity; throws if
+     * none exists.
+     */
+    static async signRecordV2(type, subject, record, chain) {
+        const publicKey = await KeyManager.getPublicKey();
+        if (!publicKey) {
+            throw new Error('No identity found. Please create or import an identity first.');
+        }
+        const version = 2;
+        const issuer = subject;
+        const issuedAt = Date.now();
+        const { seq, prev, collection, rkey } = chain;
+        const signingInput = signedRecordSigningInput({
+            version,
+            type,
+            subject,
+            issuer,
+            record,
+            issuedAt,
+            seq,
+            prev,
+            collection,
+            rkey,
+        });
+        const signature = await SignatureService.sign(signingInput);
+        return {
+            version,
+            type,
+            subject,
+            issuer,
+            record,
+            issuedAt,
+            seq,
+            prev,
+            collection,
+            rkey,
+            publicKey,
+            alg: 'ES256K-DER-SHA256',
+            signature,
+        };
+    }
     /**
      * Verify a signed-record envelope: recompute the canonical signing input from
      * the envelope's own fields and check the signature against the envelope's

package/dist/esm/index.js

@@ -35,6 +35,7 @@ export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 // ---------------------------------------------------------------------------
 export { getNormalizedUserId, normalizeUserIdentity, normalizeUserIdentityOrNull, } from './utils/userIdentity.js';
 export { getCanonicalUserHandle, getNormalizedUserHandle, } from './utils/userHandle.js';
+export { normalizeProfileLinks } from './utils/profileLinks.js';
 // ---------------------------------------------------------------------------
 // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping,
 // verified domains). Wire shapes (DidDocument, SignedRecordEnvelope,
@@ -43,6 +44,15 @@ export { getCanonicalUserHandle, getNormalizedUserHandle, } from './utils/userHa
 // ---------------------------------------------------------------------------
 export { buildUserDid } from './mixins/OxyServices.identity.js';
 // ---------------------------------------------------------------------------
+// Civic / Commons "Oxy ID" (public signed cards + Oxy ID QR payload) and Fase 2
+// anti-gaming (real-life attestation QR + validator/jury). Wire shapes
+// (PublicCard, SignedPublicCard, RealLifeAttestationResult,
+// ValidationRequestSummary, ValidationVoteResult, ValidationVerdict, …) live in
+// `@oxyhq/contracts` — import them from there. The SDK adds the client verdict
+// wrapper, the QR payload parsers/builders, and the submit inputs/results.
+// ---------------------------------------------------------------------------
+export { parseIdPayload, parseAttestPayload, verifyPublicCardAttestation, } from './mixins/OxyServices.civic.js';
+// ---------------------------------------------------------------------------
 // Auth helpers (token refresh, error normalisation, retry policies)
 // ---------------------------------------------------------------------------
 export { SessionSyncRequiredError, AuthenticationFailedError, ensureValidToken, isAuthenticationError, withAuthErrorHandling, authenticatedApiCall, } from './utils/authHelpers.js';
@@ -54,7 +64,7 @@ export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual, } from '.
 // Crypto / identity
 // ---------------------------------------------------------------------------
 export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, } from './crypto/keyManager.js';
-export { SignatureService, signedRecordSigningInput } from './crypto/signatureService.js';
+export { SignatureService, signedRecordSigningInput, computeRecordId } from './crypto/signatureService.js';
 export { canonicalize } from './crypto/canonicalJson.js';
 export { RecoveryPhraseService } from './crypto/recoveryPhrase.js';
 // ---------------------------------------------------------------------------