@qbix/q 1.0.5

package/dist/methods/Q/Crypto/verify.js

@@ -0,0 +1,212 @@
+Q.exports(function (Q) {
+
+	/**
+	 * Verify typed signatures (Q-native or EIP-712).
+	 *
+	 * Always returns a boolean.
+	 *
+	 * Optional recovery:
+	 * - If options.recovered is an object, recovered signer info
+	 *   will be written into it (when supported by the format).
+	 *
+	 * @static
+	 * @method verify
+	 * @param {Object} options
+	 * @param {String} [options.format='ES256']
+	 * @param {Object} options.domain
+	 * @param {Object} options.types
+	 * @param {Object} options.message
+	 * @param {String|Uint8Array} options.signature
+	 * @param {String} [options.address] Expected signer address (EIP712)
+	 * @param {Uint8Array} [options.publicKey] Expected signer public key (ES256)
+	 * @param {Object} [options.recovered] If provided, signer info is written here
+	 * @return {Q.Promise} resolves to true or false
+	 */
+	return function Q_Crypto_verify(options) {
+
+		return new Q.Promise(async function (resolve) {
+
+			if (!options) {
+				throw new Error("options required");
+			}
+
+			const format = options.format || "ES256";
+
+			/* =================================================
+			 * Ethereum / EIP-712
+			 * ================================================= */
+			if (format === "EIP712") {
+
+				if (typeof options.primaryType !== "string") {
+					throw new Error("primaryType required for eip712 verification");
+				}
+
+				let recoveredAddress;
+
+				// Prefer ethers if available (ecosystem parity)
+				if (
+					globalThis.ethers &&
+					typeof globalThis.ethers.verifyTypedData === "function"
+				) {
+					try {
+						recoveredAddress = globalThis.ethers.verifyTypedData(
+							options.domain || {},
+							options.types,
+							options.message,
+							options.signature
+						);
+					} catch (e) {
+						resolve(false);
+						return;
+					}
+
+				} else {
+
+					// Spec-correct fallback
+					try {
+						const [{ hashTypedData }, { keccak_256 }] = await Promise.all([
+							import(Q.url("{{Q}}/src/js/crypto/eip712.js")),
+							import(Q.url("{{Q}}/src/js/crypto/sha3.js"))
+						]);
+
+						const digest = hashTypedData(
+							options.domain || {},
+							options.primaryType,
+							options.message,
+							options.types
+						);
+
+						const secp = await import(
+							Q.url("{{Q}}/src/js/crypto/secp256k1.js")
+						);
+
+						let sigBytes = options.signature;
+
+						if (typeof sigBytes === "string") {
+							sigBytes = Q.Data.fromHex(sigBytes);
+						}
+
+						if (!(sigBytes instanceof Uint8Array)) {
+							resolve(false);
+							return;
+						}
+
+						// Accept 65-byte RSV → drop v
+						if (sigBytes.length === 65) {
+							sigBytes = sigBytes.slice(0, 64);
+						}
+
+						if (sigBytes.length !== 64) {
+							resolve(false);
+							return;
+						}
+
+						const sig = secp.secp256k1.Signature.fromCompact(sigBytes);
+
+						// Enforce low-s (EIP-2)
+						if (sig.s > secp.secp256k1.CURVE.n / 2n) {
+							resolve(false);
+							return;
+						}
+
+						const pub = sig
+							.recoverPublicKey(digest)
+							.toRawBytes(false); // uncompressed
+
+						if (!secp.secp256k1.verify(sig, digest, pub)) {
+							resolve(false);
+							return;
+						}
+
+						// Address = last 20 bytes of keccak(pub[1:])
+						const addrBytes = keccak_256(pub.slice(1)).slice(-20);
+						recoveredAddress =
+							"0x" +
+							[...addrBytes].map(b =>
+								b.toString(16).padStart(2, "0")
+							).join("");
+
+					} catch (e) {
+						resolve(false);
+						return;
+					}
+				}
+
+				if (options.recovered && typeof options.recovered === "object") {
+					options.recovered.address = recoveredAddress;
+				}
+
+				if (options.address) {
+					resolve(
+						recoveredAddress.toLowerCase() ===
+						options.address.toLowerCase()
+					);
+					return;
+				}
+
+				resolve(true);
+				return;
+			}
+
+			/* =================================================
+			 * es256 (P-256 + SHA-256)
+			 * =================================================
+			 *
+			 * es256 signatures are DER-encoded ECDSA (WebCrypto compatible)
+			 */
+			if (format === "ES256") {
+
+				if (!(options.publicKey instanceof Uint8Array)) {
+					throw new Error("ES256 verify requires publicKey (Uint8Array)");
+				}
+				if (!(options.signature instanceof Uint8Array)) {
+					throw new Error("ES256 verify requires signature (Uint8Array)");
+				}
+
+				const payload = {
+					domain: options.domain || {},
+					primaryType: options.primaryType,
+					types: options.types,
+					message: options.message
+				};
+
+				// Deep canonicalization (must match sign.js)
+				const canonical = Q.serialize(payload);
+				const data = new TextEncoder().encode(canonical);
+
+				try {
+					const digestBytes = await Q.Data.digest("SHA-256", data);
+
+					const key = await crypto.subtle.importKey(
+						"raw",
+						options.publicKey,
+						{ name: "ECDSA", namedCurve: "P-256" },
+						false,
+						["verify"]
+					);
+
+					try {
+						const ok = await crypto.subtle.verify(
+							{ name: "ECDSA", hash: "SHA-256" },
+							key,
+							options.signature, // DER-encoded ECDSA
+							digestBytes
+						);
+						resolve(ok);
+					} catch (e) {
+						resolve(false);
+					}
+
+					return;
+
+				} catch (e) {
+					resolve(false);
+					return;
+				}
+			}
+
+			throw new Error("Unknown signature format: " + format);
+		});
+	};
+
+});

package/dist/methods/Q/Crypto/verifyDelegated.js

@@ -0,0 +1,214 @@
+Q.exports(function (Q) {
+
+	/**
+	 * Verify a single delegation step.
+	 *
+	 * Verifies exactly ONE level of delegation. Intended to be called
+	 * repeatedly to validate a delegation chain.
+	 *
+	 * Guarantees:
+	 * - The derived secret matches `statement.secretHash`
+	 * - The delegation statement was correctly signed
+	 * - The signer matches the parent identity declared in the statement
+	 *
+	 * Does NOT verify:
+	 * - Parent legitimacy beyond this step
+	 * - Expiration or revocation policy
+	 *
+	 * Secret hash algorithm matches the signing format:
+	 * - EIP712 → keccak256(derivedSecret)
+	 * - ES256  → SHA-256(derivedSecret)
+	 * This must match delegate.js exactly.
+	 *
+	 * @static
+	 * @method verifyDelegated
+	 *
+	 * @param {Object}            options
+	 * @param {String}            [options.format="ES256"] "ES256" or "EIP712".
+	 * @param {Object}            options.statement        Delegation statement.
+	 * @param {String|Uint8Array} options.signature        Signature bytes.
+	 * @param {Uint8Array}        options.derivedSecret    Derived child secret.
+	 * @param {Uint8Array}        [options.parentPublicKey] Expected parent key (ES256).
+	 * @param {Object}            [options.domain]          EIP-712 domain (EIP712 only).
+	 * @param {Object}            [options.recovered]       Optional recovered signer output.
+	 *
+	 * @return {Q.Promise<Boolean>}
+	 */
+	return function Q_Crypto_verifyDelegated(options) {
+
+		return new Q.Promise(function (resolve, reject) {
+
+			try {
+
+				if (!options) {
+					throw new Error("options required");
+				}
+
+				const format        = options.format || "ES256";
+				const statement     = options.statement;
+				const derivedSecret = options.derivedSecret;
+
+				// -------------------------------------------------
+				// Validate inputs
+				// -------------------------------------------------
+				if (!statement || typeof statement !== "object") {
+					throw new Error("statement required");
+				}
+				if (!(derivedSecret instanceof Uint8Array)) {
+					throw new Error("derivedSecret must be Uint8Array");
+				}
+				if (typeof statement.parent !== "string") {
+					throw new Error("statement.parent required");
+				}
+				if (typeof statement.label !== "string") {
+					throw new Error("statement.label required");
+				}
+				if (typeof statement.issuedTime !== "number") {
+					throw new Error("statement.issuedTime required");
+				}
+				if (typeof statement.secretHash !== "string") {
+					throw new Error("statement.secretHash required");
+				}
+				if ("context" in statement && typeof statement.context !== "string") {
+					throw new Error("statement.context must be string when present");
+				}
+
+				const context = statement.context || "";
+
+				// -------------------------------------------------
+				// Verify secret binding
+				// Algorithm matches delegate.js: keccak256 for EIP712, SHA-256 for ES256
+				// -------------------------------------------------
+				const secretHashPromise = format === "EIP712"
+					? import(Q.url("{{Q}}/src/js/crypto/sha3.js"))
+						.then(function ({ keccak_256 }) {
+							return Q.Data.toHex(keccak_256(derivedSecret));
+						})
+					: Q.Data.digest("SHA-256", derivedSecret)
+						.then(function (h) {
+							return Q.Data.toHex(h);
+						});
+
+				secretHashPromise.then(function (actualSecretHashHex) {
+
+					if (actualSecretHashHex !== statement.secretHash) {
+						resolve(false);
+						return;
+					}
+
+					// -------------------------------------------------
+					// Schema — must match delegate.js types exactly
+					// -------------------------------------------------
+					const types = {
+						EIP712Domain: [
+							{ name: "name",    type: "string"  },
+							{ name: "version", type: "string"  },
+							{ name: "salt",    type: "bytes32" }
+						],
+						Delegation: [
+							{
+								name: "parent",
+								type: format === "EIP712" ? "address" : "bytes32"
+							},
+							{ name: "label",      type: "string"  },
+							{ name: "issuedTime", type: "uint64"  },
+							{ name: "context",    type: "string"  },
+							{ name: "secretHash", type: "bytes32" }
+						]
+					};
+
+					// -------------------------------------------------
+					// Normalize signature
+					// -------------------------------------------------
+					let signature = options.signature;
+					if (typeof signature === "string") {
+						signature = Q.Data.fromBase64(signature);
+					}
+
+					// -------------------------------------------------
+					// EIP712 path
+					// -------------------------------------------------
+					if (format === "EIP712") {
+
+						return Q.Crypto.verify({
+							format:      "EIP712",
+							domain:      options.domain || {},
+							types:       types,
+							primaryType: "Delegation",
+							message:     Q.extend({}, statement, { context: context }),
+							signature:   signature,
+							recovered:   options.recovered
+						}).then(function (verified) {
+
+							if (!verified) {
+								resolve(false);
+								return;
+							}
+
+							const recoveredAddress =
+								options.recovered && options.recovered.address;
+
+							if (
+								!recoveredAddress ||
+								recoveredAddress.toLowerCase() !==
+								statement.parent.toLowerCase()
+							) {
+								resolve(false);
+								return;
+							}
+
+							resolve(true);
+						});
+					}
+
+					// -------------------------------------------------
+					// ES256 path
+					// -------------------------------------------------
+					if (!(options.parentPublicKey instanceof Uint8Array)) {
+						throw new Error("parentPublicKey required for ES256");
+					}
+
+					const pubBytes = Q.Data.toUint8Array(options.parentPublicKey);
+
+					return Q.Data.digest("SHA-256", pubBytes)
+					.then(function (digest) {
+
+						const expectedParent = Q.Data.toHex(digest);
+
+						if (expectedParent !== statement.parent) {
+							resolve(false);
+							return;
+						}
+
+						return Q.Crypto.verify({
+							format:      "ES256",
+							domain:      options.domain || {},
+							types:       types,
+							primaryType: "Delegation",
+							message:     Q.extend({}, statement, { context: context }),
+							signature:   signature,
+							publicKey:   pubBytes
+						}).then(function (verified) {
+
+							if (!verified) {
+								resolve(false);
+								return;
+							}
+
+							if (options.recovered && typeof options.recovered === "object") {
+								options.recovered.publicKey = pubBytes;
+							}
+
+							resolve(true);
+						});
+					});
+
+				}).catch(reject);
+
+			} catch (e) {
+				reject(e);
+			}
+		});
+	};
+
+});

package/dist/methods/Q/Data/Bloom/_internal.js

@@ -0,0 +1,163 @@
+/**
+ * Shared helpers for Q.Data.Bloom method files.
+ * Loaded once via options.require and passed as _ to each method file.
+ *
+ * Exports a plain object containing:
+ *   - BloomFilter constructor (used by all four method files)
+ *   - _positions, _optimalParams, _setBit, _testBit, _fromUint8Array
+ */
+Q.exports(function (Q) {
+
+    var LN2  = Math.LN2;
+    var LN2S = LN2 * LN2;
+
+    // -------------------------------------------------------------------------
+    // Sizing
+    // -------------------------------------------------------------------------
+
+    function _optimalParams(n, p) {
+        var m = Math.ceil(-n * Math.log(p) / LN2S);
+        var k = Math.max(1, Math.round((m / n) * LN2));
+        return { m: m, k: k };
+    }
+
+    // -------------------------------------------------------------------------
+    // Bit array ops
+    // -------------------------------------------------------------------------
+
+    function _setBit(bits, pos)  { bits[pos >>> 3] |= (1 << (pos & 7)); }
+    function _testBit(bits, pos) { return (bits[pos >>> 3] & (1 << (pos & 7))) !== 0; }
+
+    // -------------------------------------------------------------------------
+    // Kirsch-Mitzenmacher double hashing
+    // Two SHA-256 calls -> k positions, as effective as k independent hashes.
+    // h_i(x) = (h1(x) + i * h2(x)) mod m
+    // -------------------------------------------------------------------------
+
+    function _positions(element, k, m) {
+        var enc = new TextEncoder();
+        return Promise.all([
+            Q.Data.digest('SHA-256', enc.encode('\x00' + element)),
+            Q.Data.digest('SHA-256', enc.encode('\x01' + element))
+        ]).then(function (digests) {
+            var view = function (d) {
+                return ((d[0] << 24) | (d[1] << 16) | (d[2] << 8) | d[3]) >>> 0;
+            };
+            var h1 = view(digests[0]);
+            var h2 = view(digests[1]);
+            var positions = [];
+            for (var i = 0; i < k; i++) {
+                var combined = ((h1 >>> 0) + Math.imul(i, h2 >>> 0)) >>> 0;
+                positions.push(combined % m);
+            }
+            return positions;
+        });
+    }
+
+    // -------------------------------------------------------------------------
+    // BloomFilter class
+    // -------------------------------------------------------------------------
+
+    function BloomFilter(bits, k, m, count) {
+        this._bits  = bits;
+        this._k     = k;
+        this._m     = m;
+        this._count = count || 0;
+    }
+
+    BloomFilter.prototype.add = Q.promisify(function (element, callback) {
+        var self = this;
+        _positions(element, self._k, self._m).then(function (positions) {
+            positions.forEach(function (pos) { _setBit(self._bits, pos); });
+            self._count++;
+            callback(null);
+        }).catch(callback);
+    }, false, 1);
+
+    BloomFilter.prototype.has = Q.promisify(function (element, callback) {
+        var self = this;
+        _positions(element, self._k, self._m).then(function (positions) {
+            callback(null, positions.every(function (pos) { return _testBit(self._bits, pos); }));
+        }).catch(callback);
+    }, false, 1);
+
+    BloomFilter.prototype.hasMany = Q.promisify(function (elements, callback) {
+        var self = this;
+        Promise.all(elements.map(function (el) {
+            return _positions(el, self._k, self._m).then(function (positions) {
+                return positions.every(function (pos) { return _testBit(self._bits, pos); });
+            });
+        })).then(function (results) {
+            callback(null, results);
+        }).catch(callback);
+    }, false, 1);
+
+    BloomFilter.prototype.merge = Q.promisify(function (other, callback) {
+        if (other._m !== this._m || other._k !== this._k) {
+            return callback(new Error('Q.Data.Bloom.merge: incompatible filters'));
+        }
+        for (var i = 0; i < this._bits.length; i++) {
+            this._bits[i] |= other._bits[i];
+        }
+        this._count += other._count;
+        callback(null);
+    }, false, 1);
+
+    BloomFilter.prototype.falsePositiveRate = function () {
+        return Math.pow(1 - Math.exp(-this._k * this._count / this._m), this._k);
+    };
+
+    BloomFilter.prototype.elementCount = function () { return this._count; };
+
+    BloomFilter.prototype.toBytes = function () {
+        var out = new Uint8Array(9 + this._bits.length);
+        out[0] = (this._m >>> 24) & 0xff;
+        out[1] = (this._m >>> 16) & 0xff;
+        out[2] = (this._m >>> 8)  & 0xff;
+        out[3] =  this._m         & 0xff;
+        out[4] =  this._k         & 0xff;
+        out[5] = (this._count >>> 24) & 0xff;
+        out[6] = (this._count >>> 16) & 0xff;
+        out[7] = (this._count >>> 8)  & 0xff;
+        out[8] =  this._count         & 0xff;
+        out.set(this._bits, 9);
+        return out;
+    };
+
+    BloomFilter.prototype.toBase64 = function () {
+        return Q.Data.toBase64(this.toBytes());
+    };
+
+    // -------------------------------------------------------------------------
+    // Deserialise helper shared by fromBytes + fromBase64
+    // -------------------------------------------------------------------------
+
+    function _fromUint8Array(bytes, callback) {
+        if (bytes.length < 9) {
+            return callback(new Error('Q.Data.Bloom: buffer too short'));
+        }
+        var view  = function (d, o) { return ((d[o] << 24) | (d[o+1] << 16) | (d[o+2] << 8) | d[o+3]) >>> 0; };
+        var m     = view(bytes, 0);
+        var k     = bytes[4];
+        var count = view(bytes, 5);
+        var bits  = new Uint8Array(bytes.buffer, bytes.byteOffset + 9);
+        if (bits.length < Math.ceil(m / 8)) {
+            return callback(new Error('Q.Data.Bloom: truncated bit array'));
+        }
+        callback(null, new BloomFilter(new Uint8Array(bits), k, m, count));
+    }
+
+    // -------------------------------------------------------------------------
+    // Exported helpers object
+    // -------------------------------------------------------------------------
+
+    return {
+        BloomFilter:    BloomFilter,
+        optimalParams:  _optimalParams,
+        positions:      _positions,
+        setBit:         _setBit,
+        testBit:        _testBit,
+        fromUint8Array: _fromUint8Array
+    };
+
+});

package/dist/methods/Q/Data/Bloom/create.js

@@ -0,0 +1,23 @@
+/**
+ * Q.Data.Bloom.create
+ * Create a new empty Bloom filter sized for n elements at false positive rate p.
+ *
+ * @param {Number}   n
+ * @param {Number}   [p=0.01]
+ * @param {Function} [callback]  (err, BloomFilter)
+ * @return {Q.Promise<BloomFilter>}
+ */
+Q.exports(function (Q, _) {
+
+    return Q.promisify(function (n, p, callback) {
+        if (typeof p === 'function') { callback = p; p = 0.01; }
+        p = p || 0.01;
+        if (n <= 0)           { return callback(new Error('Q.Data.Bloom.create: n must be > 0')); }
+        if (p <= 0 || p >= 1) { return callback(new Error('Q.Data.Bloom.create: p must be in (0,1)')); }
+
+        var params = _.optimalParams(n, p);
+        var bits   = new Uint8Array(Math.ceil(params.m / 8));
+        callback(null, new _.BloomFilter(bits, params.k, params.m, 0));
+    }, false, 2);
+
+});

package/dist/methods/Q/Data/Bloom/fromBase64.js

@@ -0,0 +1,21 @@
+/**
+ * Q.Data.Bloom.fromBase64
+ * Deserialise a BloomFilter from a base64 string produced by filter.toBase64().
+ *
+ * @param {String}   base64
+ * @param {Function} [callback]  (err, BloomFilter)
+ * @return {Q.Promise<BloomFilter>}
+ */
+Q.exports(function (Q, _) {
+
+    return Q.promisify(function (base64, callback) {
+        var bytes;
+        try {
+            bytes = Q.Data.fromBase64(base64);
+        } catch (e) {
+            return callback(e);
+        }
+        _.fromUint8Array(bytes, callback);
+    }, false, 1);
+
+});

package/dist/methods/Q/Data/Bloom/fromBytes.js

@@ -0,0 +1,15 @@
+/**
+ * Q.Data.Bloom.fromBytes
+ * Deserialise a BloomFilter from a Uint8Array produced by filter.toBytes().
+ *
+ * @param {Uint8Array} bytes
+ * @param {Function}   [callback]  (err, BloomFilter)
+ * @return {Q.Promise<BloomFilter>}
+ */
+Q.exports(function (Q, _) {
+
+    return Q.promisify(function (bytes, callback) {
+        _.fromUint8Array(bytes, callback);
+    }, false, 1);
+
+});

package/dist/methods/Q/Data/Bloom/fromElements.js

@@ -0,0 +1,33 @@
+/**
+ * Q.Data.Bloom.fromElements
+ * Build a Bloom filter from an existing array of elements in one call.
+ * All SHA-256 calls run in parallel for speed.
+ *
+ * @param {Array<String>} elements
+ * @param {Number}   [p=0.01]
+ * @param {Function} [callback]  (err, BloomFilter)
+ * @return {Q.Promise<BloomFilter>}
+ */
+Q.exports(function (Q, _) {
+
+    return Q.promisify(function (elements, p, callback) {
+        if (typeof p === 'function') { callback = p; p = 0.01; }
+        p = p || 0.01;
+
+        if (!elements || !elements.length) {
+            return callback(new Error('Q.Data.Bloom.fromElements: no elements provided'));
+        }
+
+        var params = _.optimalParams(elements.length, p);
+        var bits   = new Uint8Array(Math.ceil(params.m / 8));
+
+        Promise.all(elements.map(function (el) {
+            return _.positions(el, params.k, params.m).then(function (positions) {
+                positions.forEach(function (pos) { _.setBit(bits, pos); });
+            });
+        })).then(function () {
+            callback(null, new _.BloomFilter(bits, params.k, params.m, elements.length));
+        }).catch(callback);
+    }, false, 2);
+
+});