@swal/edge-mesh 0.0.0-stage → 0.1.0

package/dist/web/trust/docs.d.ts

@@ -0,0 +1,51 @@
+import { type Signer } from "./keys.js";
+import { type Grant, type Permissions, type Revocation, type TrustSchema } from "./types.js";
+export interface GrantInput {
+    /** base64url ML-DSA-65 public key of the device (and optionally its ECDH / ML-KEM keys for key wraps) */
+    subject: {
+        pub: string;
+        ecdh?: string;
+        kem?: string;
+    };
+    role: string;
+    permissions: Permissions;
+    delegate?: number;
+    name?: string;
+    notBefore?: number;
+    expiresAt?: number;
+    seqCutoff?: number;
+    issuedAt?: number;
+    /** mesh key epoch handed over with the grant (web/provider pairing) */
+    epoch?: number;
+}
+export interface IssueContext {
+    inst: string;
+    /** the issuer's own grant (or its id); omit when signing with the root key */
+    parent?: Grant | string;
+    /** ms; default Date.now() */
+    now?: number;
+}
+/** Resolve a role preset of the schema into GrantInput fields. Throws on unknown role. */
+export declare function rolePreset(schema: TrustSchema, role: string): Pick<GrantInput, "role" | "permissions" | "delegate">;
+export declare function issueGrant(issuer: Signer, input: GrantInput, ctx: IssueContext): Promise<Grant>;
+export interface RevocationInput {
+    target: string;
+    lastSeq: number;
+    lastId?: string;
+    upTo?: Record<string, number>;
+    upToIds?: Record<string, string>;
+    reason?: string;
+    issuedAt?: number;
+}
+export declare function issueRevocation(issuer: Signer, input: RevocationInput, ctx: IssueContext): Promise<Revocation>;
+export declare function bodyOf<T extends {
+    id: string;
+    sig: string;
+}>(doc: T): Omit<T, "id" | "sig">;
+/** Shape check of an untrusted grant. Returns a reason string when malformed. */
+export declare function checkGrantShape(x: unknown, schema: TrustSchema): string | null;
+export declare function checkRevocationShape(x: unknown): string | null;
+/** id == hash(body) and (for grants) subject.fp == fingerprint(subject.pub). */
+export declare function checkIntegrity(doc: Grant | Revocation): Promise<string | null>;
+export declare const verifyDocSignature: (doc: Grant | Revocation, issuerPub: string) => Promise<boolean>;
+//# sourceMappingURL=docs.d.ts.map

package/dist/web/trust/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../../src/web/trust/docs.ts"],"names":[],"mappings":"AAEA,OAAO,EAKN,KAAK,MAAM,EAGX,MAAM,WAAW,CAAC;AACnB,OAAO,EAEN,KAAK,KAAK,EAGV,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,WAAW,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,UAAU;IAC1B,yGAAyG;IACzG,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACxB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAKD,0FAA0F;AAC1F,wBAAgB,UAAU,CACzB,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,GACV,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC,CAQvD;AAED,wBAAsB,UAAU,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,YAAY,GACf,OAAO,CAAC,KAAK,CAAC,CAkChB;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,eAAe,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,YAAY,GACf,OAAO,CAAC,UAAU,CAAC,CA2BrB;AAaD,wBAAgB,MAAM,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC3D,GAAG,EAAE,CAAC,GACJ,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,CAGvB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAC9B,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,WAAW,GACjB,MAAM,GAAG,IAAI,CAgCf;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA4B9D;AAED,gFAAgF;AAChF,wBAAsB,cAAc,CACnC,GAAG,EAAE,KAAK,GAAG,UAAU,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,eAAO,MAAM,kBAAkB,QACzB,KAAK,GAAG,UAAU,aACZ,MAAM,KACf,OAAO,CAAC,OAAO,CAAqD,CAAC"}

package/dist/web/trust/docs.js

@@ -0,0 +1,170 @@
+// Signed trust documents: create, parse (shape), id and signature checks. No policy here (see store.ts).
+import { contentId } from "./canonical.js";
+import { isPublicKey, isSignature, keyFingerprint, SIG_ALG, signCanonical, verifyCanonical, } from "./keys.js";
+import { isLevel, } from "./types.js";
+const parentId = (p) => typeof p === "string" ? p : p?.id;
+/** Resolve a role preset of the schema into GrantInput fields. Throws on unknown role. */
+export function rolePreset(schema, role) {
+    const preset = schema.roles?.[role];
+    if (!preset)
+        throw new Error(`unknown role "${role}"`);
+    return {
+        role,
+        permissions: { ...preset.permissions },
+        delegate: preset.delegate ?? 0,
+    };
+}
+export async function issueGrant(issuer, input, ctx) {
+    const now = ctx.now ?? Date.now();
+    if (!isPublicKey(input.subject.pub))
+        throw new Error("subject is not an ML-DSA-65 public key");
+    const subject = {
+        fp: await keyFingerprint(input.subject.pub),
+        pub: input.subject.pub,
+        ecdh: input.subject.ecdh,
+        kem: input.subject.kem,
+    };
+    const body = {
+        t: "grant",
+        v: 1,
+        alg: SIG_ALG,
+        inst: ctx.inst,
+        subject,
+        name: input.name,
+        role: input.role,
+        permissions: { ...input.permissions },
+        delegate: input.delegate ?? 0,
+        notBefore: input.notBefore ?? now,
+        expiresAt: input.expiresAt,
+        seqCutoff: input.seqCutoff,
+        issuer: issuer.fp,
+        parent: parentId(ctx.parent),
+        issuedAt: input.issuedAt ?? now,
+        epoch: input.epoch,
+    };
+    const clean = JSON.parse(JSON.stringify(body)); // drop undefined members for a stable wire shape
+    return {
+        ...clean,
+        id: await contentId(clean),
+        sig: await signCanonical(issuer, clean),
+    };
+}
+export async function issueRevocation(issuer, input, ctx) {
+    // R4-N6: history kept up to lastSeq is anchored on the revoker's head op; without it the S3 fork protection is off
+    if (input.lastSeq > 0 && !input.lastId)
+        throw new Error("a revocation that keeps history (lastSeq > 0) needs lastId: pass {seq, id} heads to prepareRevocation");
+    const body = {
+        t: "revoke",
+        v: 1,
+        alg: SIG_ALG,
+        inst: ctx.inst,
+        target: input.target,
+        lastSeq: input.lastSeq,
+        lastId: input.lastId,
+        upTo: input.upTo ? { ...input.upTo } : undefined,
+        upToIds: input.upToIds ? { ...input.upToIds } : undefined,
+        reason: input.reason,
+        issuer: issuer.fp,
+        parent: parentId(ctx.parent),
+        issuedAt: input.issuedAt ?? ctx.now ?? Date.now(),
+    };
+    const clean = JSON.parse(JSON.stringify(body));
+    return {
+        ...clean,
+        id: await contentId(clean),
+        sig: await signCanonical(issuer, clean),
+    };
+}
+// ─── parsing ────────────────────────────────────────────────────────────────
+const isStr = (x, max = 512) => typeof x === "string" && x.length > 0 && x.length <= max;
+const isOptStr = (x, max = 512) => x === undefined || isStr(x, max);
+const isNat = (x) => typeof x === "number" && Number.isSafeInteger(x) && x >= 0;
+const isOptNat = (x) => x === undefined || isNat(x);
+const isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+export function bodyOf(doc) {
+    const { id: _id, sig: _sig, ...body } = doc;
+    return body;
+}
+/** Shape check of an untrusted grant. Returns a reason string when malformed. */
+export function checkGrantShape(x, schema) {
+    if (!isObj(x) || x.t !== "grant")
+        return "not a grant";
+    if (x.v !== 1 || x.alg !== SIG_ALG)
+        return "unsupported version/alg";
+    if (!isStr(x.id) ||
+        !isSignature(x.sig) ||
+        !isStr(x.inst) ||
+        !isStr(x.issuer) ||
+        !isStr(x.role, 128)) {
+        return "missing fields";
+    }
+    if (!isOptStr(x.parent) || !isOptStr(x.name, 256))
+        return "bad parent/name";
+    const s = x.subject;
+    if (!isObj(s) ||
+        !isStr(s.fp) ||
+        !isPublicKey(s.pub) ||
+        !isOptStr(s.ecdh) ||
+        !isOptStr(s.kem, 2048))
+        return "bad subject";
+    if (!isNat(x.delegate) || !isNat(x.notBefore) || !isNat(x.issuedAt))
+        return "bad numbers";
+    if (!isOptNat(x.expiresAt) || !isOptNat(x.seqCutoff) || !isOptNat(x.epoch))
+        return "bad numbers";
+    if (!isObj(x.permissions))
+        return "bad permissions";
+    for (const [mod, lvl] of Object.entries(x.permissions)) {
+        if (!schema.modules.includes(mod))
+            return `unknown module "${mod}"`;
+        if (!isLevel(lvl))
+            return `bad level for "${mod}"`;
+    }
+    return null;
+}
+export function checkRevocationShape(x) {
+    if (!isObj(x) || x.t !== "revoke")
+        return "not a revocation";
+    if (x.v !== 1 || x.alg !== SIG_ALG)
+        return "unsupported version/alg";
+    if (!isStr(x.id) ||
+        !isSignature(x.sig) ||
+        !isStr(x.inst) ||
+        !isStr(x.issuer) ||
+        !isStr(x.target)) {
+        return "missing fields";
+    }
+    if (!isOptStr(x.parent) || !isOptStr(x.reason, 1024))
+        return "bad parent/reason";
+    if (!isNat(x.lastSeq) || !isNat(x.issuedAt))
+        return "bad numbers";
+    if (!isOptStr(x.lastId, 128))
+        return "bad lastId";
+    if (x.lastSeq > 0 && x.lastId === undefined)
+        return "missing lastId (lastSeq > 0)";
+    if (x.upTo !== undefined) {
+        if (!isObj(x.upTo))
+            return "bad upTo";
+        for (const v of Object.values(x.upTo))
+            if (!isNat(v))
+                return "bad upTo";
+    }
+    if (x.upToIds !== undefined) {
+        if (!isObj(x.upToIds))
+            return "bad upToIds";
+        for (const v of Object.values(x.upToIds))
+            if (!isStr(v, 128))
+                return "bad upToIds";
+    }
+    return null;
+}
+/** id == hash(body) and (for grants) subject.fp == fingerprint(subject.pub). */
+export async function checkIntegrity(doc) {
+    if ((await contentId(bodyOf(doc))) !== doc.id)
+        return "id mismatch";
+    if (doc.t === "grant" &&
+        (await keyFingerprint(doc.subject.pub)) !== doc.subject.fp)
+        return "subject fp mismatch";
+    return null;
+}
+export const verifyDocSignature = (doc, issuerPub) => verifyCanonical(issuerPub, bodyOf(doc), doc.sig);
+//# sourceMappingURL=docs.js.map

package/dist/web/trust/docs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.js","sourceRoot":"","sources":["../../../src/web/trust/docs.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACN,WAAW,EACX,WAAW,EACX,cAAc,EACd,OAAO,EAEP,aAAa,EACb,eAAe,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAIN,OAAO,GAKP,MAAM,YAAY,CAAC;AAyBpB,MAAM,QAAQ,GAAG,CAAC,CAA6B,EAAE,EAAE,CAClD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAEnC,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CACzB,MAAmB,EACnB,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;IACvD,OAAO;QACN,IAAI;QACJ,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE;QACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;KAC9B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,MAAc,EACd,KAAiB,EACjB,GAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAc;QAC1B,EAAE,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3C,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;QACxB,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG;KACtB,CAAC;IACF,MAAM,IAAI,GAAc;QACvB,CAAC,EAAE,OAAO;QACV,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG;QACjC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,MAAM,CAAC,EAAE;QACjB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,GAAG;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAc,CAAC,CAAC,iDAAiD;IAC9G,OAAO;QACN,GAAG,KAAK;QACR,EAAE,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC;QAC1B,GAAG,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;KACvC,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,MAAc,EACd,KAAsB,EACtB,GAAiB;IAEjB,mHAAmH;IACnH,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;QACrC,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;IACH,MAAM,IAAI,GAAmB;QAC5B,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;QACzD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,MAAM,CAAC,EAAE;QACjB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;KACjD,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAmB,CAAC;IACjE,OAAO;QACN,GAAG,KAAK;QACR,EAAE,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC;QAC1B,GAAG,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;KACvC,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,GAAG,GAAG,GAAG,EAAe,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;AAC1D,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7E,MAAM,KAAK,GAAG,CAAC,CAAU,EAAe,EAAE,CACzC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7D,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC1D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEnD,MAAM,UAAU,MAAM,CACrB,GAAM;IAEN,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAC5C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAC9B,CAAU,EACV,MAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,yBAAyB,CAAC;IACrE,IACC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;QACnB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACd,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAChB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAClB,CAAC;QACF,OAAO,gBAAgB,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,IACC,CAAC,KAAK,CAAC,CAAC,CAAC;QACT,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;QACnB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACjB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC;QAEtB,OAAO,aAAa,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClE,OAAO,aAAa,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACzE,OAAO,aAAa,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,mBAAmB,GAAG,GAAG,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,kBAAkB,GAAG,GAAG,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAU;IAC9C,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IAC7D,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,yBAAyB,CAAC;IACrE,IACC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;QACnB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACd,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAChB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EACf,CAAC;QACF,OAAO,gBAAgB,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;QACnD,OAAO,mBAAmB,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAClD,IAAK,CAAC,CAAC,OAAkB,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QACtD,OAAO,8BAA8B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,UAAU,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,aAAa,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAAE,OAAO,aAAa,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,GAAuB;IAEvB,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IACpE,IACC,GAAG,CAAC,CAAC,KAAK,OAAO;QACjB,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE;QAE1D,OAAO,qBAAqB,CAAC;IAC9B,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,GAAuB,EACvB,SAAiB,EACE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC"}

package/dist/web/trust/index.d.ts

@@ -0,0 +1,10 @@
+export { canonicalBytes, canonicalJson, contentId, sha256B64u, } from "./canonical.js";
+export type { GrantInput, IssueContext, RevocationInput } from "./docs.js";
+export { bodyOf, checkGrantShape, checkIntegrity, checkRevocationShape, issueGrant, issueRevocation, rolePreset, verifyDocSignature, } from "./docs.js";
+export type { SigAlg, Signer } from "./keys.js";
+export { createSigner, generateSigner, isPublicKey, isSignature, keyFingerprint, PUBLIC_KEY_BYTES, SIG_ALG, SIGNATURE_BYTES, signBytes, signCanonical, verifyBytes, verifyCanonical, } from "./keys.js";
+export type { Anchor, TrustStoreOptions } from "./store.js";
+export { createTrustStore, TrustStore } from "./store.js";
+export type { AddResult, AddStatus, At, Decision, DenyReason, DeviceRef, Grant, GrantBody, Level, Permissions, Revocation, RevocationBody, RolePreset, TrustDoc, TrustSchema, } from "./types.js";
+export { isLevel, LEVELS, levelRank } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/web/trust/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/web/trust/index.ts"],"names":[],"mappings":"AACA,OAAO,EACN,cAAc,EACd,aAAa,EACb,SAAS,EACT,UAAU,GACV,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EACN,MAAM,EACN,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACN,YAAY,EACZ,cAAc,EACd,WAAW,EACX,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,eAAe,EACf,SAAS,EACT,aAAa,EACb,WAAW,EACX,eAAe,GACf,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,YAAY,EACX,SAAS,EACT,SAAS,EACT,EAAE,EACF,QAAQ,EACR,UAAU,EACV,SAAS,EACT,KAAK,EACL,SAAS,EACT,KAAK,EACL,WAAW,EACX,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,WAAW,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/web/trust/index.js

@@ -0,0 +1,7 @@
+// @iberi22/edge-mesh/web/trust — signed capabilities (grants/revocations) chained to a root key.
+export { canonicalBytes, canonicalJson, contentId, sha256B64u, } from "./canonical.js";
+export { bodyOf, checkGrantShape, checkIntegrity, checkRevocationShape, issueGrant, issueRevocation, rolePreset, verifyDocSignature, } from "./docs.js";
+export { createSigner, generateSigner, isPublicKey, isSignature, keyFingerprint, PUBLIC_KEY_BYTES, SIG_ALG, SIGNATURE_BYTES, signBytes, signCanonical, verifyBytes, verifyCanonical, } from "./keys.js";
+export { createTrustStore, TrustStore } from "./store.js";
+export { isLevel, LEVELS, levelRank } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/web/trust/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/web/trust/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,OAAO,EACN,cAAc,EACd,aAAa,EACb,SAAS,EACT,UAAU,GACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACN,MAAM,EACN,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,UAAU,EACV,kBAAkB,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACN,YAAY,EACZ,cAAc,EACd,WAAW,EACX,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,OAAO,EACP,eAAe,EACf,SAAS,EACT,aAAa,EACb,WAAW,EACX,eAAe,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAkB1D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/web/trust/keys.d.ts

@@ -0,0 +1,37 @@
+export declare const SIG_ALG: "ML-DSA-65";
+export type SigAlg = typeof SIG_ALG;
+export declare const PUBLIC_KEY_BYTES = 1952;
+export declare const SECRET_KEY_BYTES = 4032;
+export declare const SIGNATURE_BYTES = 3309;
+/** A base64url ML-DSA-65 public key (exactly 1952 bytes). */
+export declare function isPublicKey(pub: unknown): pub is string;
+/** R5-B3: a base64url ML-DSA-65 signature in its one canonical encoding (exactly 3309 bytes). */
+export declare function isSignature(sig: unknown): sig is string;
+/** Stable key id: base64url(SHA-256(canonicalJson({ alg: "ML-DSA-65", pub }))). */
+export declare function keyFingerprint(pub: string): Promise<string>;
+/** Something that signs with a device (or root) key. */
+export interface Signer {
+    readonly alg: SigAlg;
+    /** fingerprint of `pub` */
+    readonly fp: string;
+    /** base64url ML-DSA-65 public key */
+    readonly pub: string;
+    sign(data: Uint8Array): Promise<Uint8Array>;
+}
+/** Wrap an ML-DSA-65 key pair. The secret key stays with the caller (keep it in the device's vault). */
+export declare function createSigner(keys: {
+    secretKey: Uint8Array;
+    publicKey: Uint8Array;
+}): Promise<Signer>;
+/** New ML-DSA-65 device key (keep `secretKey` in the device's vault). */
+export declare function generateSigner(): Promise<Signer & {
+    secretKey: Uint8Array;
+    publicKey: Uint8Array;
+}>;
+export declare function signBytes(signer: Signer, data: Uint8Array): Promise<string>;
+/** Never throws: malformed key / signature or another algorithm's key => false. */
+export declare function verifyBytes(pub: string, data: Uint8Array, sigB64u: string): Promise<boolean>;
+/** Sign canonicalJson(value) with ML-DSA-65 (shared contract with apps such as Fize). */
+export declare const signCanonical: (signer: Signer, value: unknown) => Promise<string>;
+export declare const verifyCanonical: (pub: string, value: unknown, sig: string) => Promise<boolean>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/web/trust/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/web/trust/keys.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,OAAO,EAAG,WAAoB,CAAC;AAC5C,MAAM,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC;AACpC,eAAO,MAAM,gBAAgB,OAAO,CAAC;AACrC,eAAO,MAAM,gBAAgB,OAAO,CAAC;AACrC,eAAO,MAAM,eAAe,OAAO,CAAC;AAcpC,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAEvD;AAED,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAEvD;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3D;AAED,wDAAwD;AACxD,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5C;AAED,wGAAwG;AACxG,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACxC,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,yEAAyE;AACzE,wBAAsB,cAAc,IAAI,OAAO,CAC9C,MAAM,GAAG;IAAE,SAAS,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,CACzD,CAGA;AAED,wBAAsB,SAAS,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GACd,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,mFAAmF;AACnF,wBAAsB,WAAW,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,yFAAyF;AACzF,eAAO,MAAM,aAAa,WACjB,MAAM,SACP,OAAO,KACZ,OAAO,CAAC,MAAM,CAA6C,CAAC;AAE/D,eAAO,MAAM,eAAe,QACtB,MAAM,SACJ,OAAO,OACT,MAAM,KACT,OAAO,CAAC,OAAO,CAAiD,CAAC"}

package/dist/web/trust/keys.js

@@ -0,0 +1,75 @@
+// Device / root signing keys: ML-DSA-65 (FIPS 204, `@noble/post-quantum`), as required by AGENTS.md (post-quantum
+// identity signatures; no ECDSA fallback for security payloads). Public keys travel as base64url of the raw 1952-byte
+// key; signatures as base64url of the raw 3309-byte signature; the fingerprint is
+// base64url(SHA-256(canonicalJson({ alg: "ML-DSA-65", pub }))) so a future algorithm can never collide with this one.
+// `canonicalJson` itself is unchanged (Fize shares it).
+import { ml_dsa65 } from "@noble/post-quantum/ml-dsa.js";
+import { b64uDecode, b64uEncode, isCanonicalB64u } from "../util.js";
+import { canonicalBytes, sha256B64u } from "./canonical.js";
+export const SIG_ALG = "ML-DSA-65";
+export const PUBLIC_KEY_BYTES = 1952;
+export const SECRET_KEY_BYTES = 4032;
+export const SIGNATURE_BYTES = 3309;
+const decodeLen = (s, n) => {
+    // R4-N3: only the canonical encoding, so one key has one fingerprint (keyFingerprint hashes the string)
+    if (typeof s !== "string" || s.length > 2 * n || !isCanonicalB64u(s))
+        return null;
+    try {
+        const b = b64uDecode(s);
+        return b.length === n ? b : null;
+    }
+    catch {
+        return null;
+    }
+};
+/** A base64url ML-DSA-65 public key (exactly 1952 bytes). */
+export function isPublicKey(pub) {
+    return decodeLen(pub, PUBLIC_KEY_BYTES) !== null;
+}
+/** R5-B3: a base64url ML-DSA-65 signature in its one canonical encoding (exactly 3309 bytes). */
+export function isSignature(sig) {
+    return decodeLen(sig, SIGNATURE_BYTES) !== null;
+}
+/** Stable key id: base64url(SHA-256(canonicalJson({ alg: "ML-DSA-65", pub }))). */
+export function keyFingerprint(pub) {
+    return sha256B64u(canonicalBytes({ alg: SIG_ALG, pub }));
+}
+/** Wrap an ML-DSA-65 key pair. The secret key stays with the caller (keep it in the device's vault). */
+export async function createSigner(keys) {
+    if (keys.publicKey.length !== PUBLIC_KEY_BYTES ||
+        keys.secretKey.length !== SECRET_KEY_BYTES)
+        throw new Error("not an ML-DSA-65 key pair");
+    const pub = b64uEncode(keys.publicKey);
+    const sk = keys.secretKey;
+    return {
+        alg: SIG_ALG,
+        fp: await keyFingerprint(pub),
+        pub,
+        sign: async (data) => ml_dsa65.sign(data, sk),
+    };
+}
+/** New ML-DSA-65 device key (keep `secretKey` in the device's vault). */
+export async function generateSigner() {
+    const kp = ml_dsa65.keygen();
+    return Object.assign(await createSigner(kp), kp);
+}
+export async function signBytes(signer, data) {
+    return b64uEncode(await signer.sign(data));
+}
+/** Never throws: malformed key / signature or another algorithm's key => false. */
+export async function verifyBytes(pub, data, sigB64u) {
+    const pk = decodeLen(pub, PUBLIC_KEY_BYTES);
+    const sig = decodeLen(sigB64u, SIGNATURE_BYTES);
+    if (!pk || !sig)
+        return false;
+    try {
+        return ml_dsa65.verify(sig, data, pk);
+    }
+    catch {
+        return false;
+    }
+}
+/** Sign canonicalJson(value) with ML-DSA-65 (shared contract with apps such as Fize). */
+export const signCanonical = (signer, value) => signBytes(signer, canonicalBytes(value));
+export const verifyCanonical = (pub, value, sig) => verifyBytes(pub, canonicalBytes(value), sig);
+//# sourceMappingURL=keys.js.map

package/dist/web/trust/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/web/trust/keys.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,sHAAsH;AACtH,kFAAkF;AAClF,sHAAsH;AACtH,wDAAwD;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5D,MAAM,CAAC,MAAM,OAAO,GAAG,WAAoB,CAAC;AAE5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAE,CAAS,EAAqB,EAAE;IAC9D,wGAAwG;IACxG,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACb,IAAI,CAAC;QACJ,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAY;IACvC,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,GAAY;IACvC,OAAO,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,OAAO,UAAU,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAYD,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAGlC;IACA,IACC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB;QAC1C,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,gBAAgB;QAE1C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC1B,OAAO;QACN,GAAG,EAAE,OAAO;QACZ,EAAE,EAAE,MAAM,cAAc,CAAC,GAAG,CAAC;QAC7B,GAAG;QACH,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,cAAc;IAGnC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,MAAc,EACd,IAAgB;IAEhB,OAAO,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,GAAW,EACX,IAAgB,EAChB,OAAe;IAEf,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC;QACJ,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,CAC5B,MAAc,EACd,KAAc,EACI,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,GAAW,EACX,KAAc,EACd,GAAW,EACQ,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC"}

package/dist/web/trust/store.d.ts

@@ -0,0 +1,150 @@
+import type { RevocationInput } from "./docs.js";
+import { type AddResult, type At, type Decision, type Grant, type Level, type Permissions, type Revocation, type TrustDoc, type TrustSchema } from "./types.js";
+export interface TrustStoreOptions {
+    inst: string;
+    /** Root public key (restaurant / tenant key). Only grants chaining to it are trusted. */
+    root: string;
+    /** Optional cross-check: must equal keyFingerprint(root). */
+    rootFingerprint?: string;
+    schema: TrustSchema;
+    /** clock used only when `At.time` is omitted (UI checks) and to expire parked documents. Default Date.now */
+    now?: () => number;
+    /** max documents waiting for a parent, every issuer together. Default 1000 */
+    maxPending?: number;
+    /**
+     * R6-S2: max documents waiting for a parent that ONE issuer may hold at once (the peer that sent them), so a single
+     * member cannot take the whole waiting set and turn away documents that are waiting for a parent of their own.
+     * Default 32.
+     */
+    maxPendingPerIssuer?: number;
+    /**
+     * R6-S2b: max documents waiting for a parent that ONE SENDING PEER may hold at once. The per-issuer cap counts
+     * issuers, so it is worn off by signing with fresh random keys: one member then parks an unlimited number of
+     * documents, each under an issuer of its own, and fills the waiting set again. Counting senders closes that.
+     * `from` is the transport-level id of the peer that sent the documents (undefined for local/own documents, which
+     * are not charged to anybody). Default 32.
+     */
+    maxPendingPerSender?: number;
+    /**
+     * R6-S2: how long a parked document waits for its parent before it is dropped (its slots are then reclaimed). It
+     * bounds what a document that arrives before its parent can hold: without it, orphans waiting for a parent that
+     * never comes keep their slots for good. Default 10 minutes.
+     */
+    pendingTtlMs?: number;
+}
+export declare function createTrustStore(opts: TrustStoreOptions): Promise<TrustStore>;
+/** Who is offering these documents: R6-S2b charges the waiting slots they take to the peer that sent them. */
+export interface IngestOpts {
+    /** transport-level id of the sending peer; undefined for local/own documents (no per-sender quota). */
+    from?: string;
+}
+/** "The op of this subject at `seq` is `id`" (from an effective revocation): its earlier ops must chain to it. */
+export interface Anchor {
+    seq: number;
+    id: string;
+}
+export declare class TrustStore {
+    readonly inst: string;
+    readonly rootFp: string;
+    readonly schema: TrustSchema;
+    readonly maxDepth: number;
+    private readonly root;
+    private readonly now;
+    private readonly maxPending;
+    private readonly maxPendingPerIssuer;
+    private readonly maxPendingPerSender;
+    private readonly pendingTtlMs;
+    private readonly grants;
+    private readonly depth;
+    private readonly revs;
+    private readonly pending;
+    private pendingCount;
+    /** R6-S2: parked documents per issuer, so no single peer can take the whole waiting set. */
+    private readonly waitingByIssuer;
+    /** R6-S2b: parked documents per SENDING PEER, so fresh random issuers cannot buy more room. */
+    private readonly waitingBySender;
+    /** R6-S2: last instant the waiting set was swept for expired documents (see `expireWaiting`). */
+    private lastSweepAt;
+    private readonly rejected;
+    private readonly listeners;
+    private derived;
+    private queue;
+    /** increments on every accepted document */
+    version: number;
+    constructor(opts: TrustStoreOptions, rootFp: string);
+    add(doc: unknown, opts?: IngestOpts): Promise<AddResult>;
+    /**
+     * Ingest documents (serialized). Listeners fire once if anything was accepted.
+     * `opts.from` is the transport-level id of the peer that sent them: it is charged the waiting slots they take
+     * (R6-S2b) and left undefined for local/own documents, which no sender can be blamed for.
+     */
+    addMany(docs: readonly unknown[], opts?: IngestOpts): Promise<AddResult[]>;
+    private reject;
+    private ingest;
+    private verifyAndStore;
+    /** A parent was rejected for a body-determined reason: its waiting descendants can never be valid. */
+    private rejectWaiting;
+    /**
+     * R6-S4: forget accepted documents (`ids`) so a per-issuer cap can be applied as a rule on the SET held instead
+     * of on the arrival order (web/secstate keeps the cap-N smallest ids of each bucket and evicts the rest).
+     * Documents are still only ever ADDED from the network: nothing here reads the wire, and the only caller is the
+     * cap enforcement, which evicts one document per accepted one, so the store never loses ground.
+     * Returns the ids that were actually dropped.
+     */
+    dropAccepted(ids: readonly string[]): string[];
+    private park;
+    /**
+     * R6-S2: drop every parked document that has been waiting longer than the TTL. Its parent may still arrive later
+     * (the document is not remembered as bad, so it is asked for again), but the slot it held is reclaimed now.
+     */
+    private expireWaiting;
+    /** Give back the global, per-issuer and per-sender (R6-S2b) waiting slots of a document that leaves the waiting set. */
+    private releaseWaiting;
+    /** Delegation rules of a grant w.r.t. its (accepted) issuer grant; undefined parent = root-issued. */
+    private checkDelegation;
+    private d;
+    /** May `fp` do `level` in `module` for an op at (seq, time)? Synchronous: uses only accepted documents. */
+    can(fp: string, module: string, level: Level, at?: At): boolean;
+    explain(fp: string, module: string, level: Level, at?: At): Decision;
+    /** null if grant `g` is in force at `at` (ignoring module/level). */
+    private grantDenial;
+    /** Grants of `fp` in force at `at`. */
+    activeGrants(fp: string, at?: At): Grant[];
+    /** Has at least one grant in force (e.g. provider `authorizeDevice`). */
+    isMember(fp: string, at?: At): boolean;
+    /** Union (max level per module) of the grants in force. */
+    effectivePermissions(fp: string, at?: At): Permissions;
+    /** Public signing key of a device with any accepted grant (also revoked ones: old ops still verify). */
+    keyOf(fp: string): string | undefined;
+    grantsOf(fp: string): Grant[];
+    getGrant(id: string): Grant | undefined;
+    /** S3: anchors of a subject (from effective revocations), highest seq first. */
+    anchorsOf(fp: string): Anchor[];
+    /** Effective seq cut-off of a grant (Infinity = not revoked). */
+    cutOf(grantId: string): number;
+    /** Chain length root -> grant (1 = issued by the root). */
+    depthOf(grantId: string): number | undefined;
+    /** Grants issued (transitively) under `grantId`. */
+    descendants(grantId: string): Grant[];
+    /** Would a revocation of `targetId` signed by `fp` (with grant `parentId`, or as root) be effective? */
+    canRevoke(fp: string, targetId: string, parentId?: string): boolean;
+    /**
+     * Build the revocation input for `targetId` with cut-offs taken from the revoker's log heads
+     * (`heads[fp]` = last seq the revoker has seen from that device, or `{ seq, id }` from `OpLog.headIds()` to also
+     * anchor the history, S3), including every cascaded grant (by grant id).
+     */
+    prepareRevocation(targetId: string, heads: Readonly<Record<string, number | {
+        seq: number;
+        id: string;
+    }>>, reason?: string): RevocationInput;
+    /** Every accepted document (replicate / persist these; re-`addMany` them on boot). */
+    docs(): TrustDoc[];
+    revocations(): Revocation[];
+    /** Reason a document id was rejected for a body-determined cause (bounded memory; bad signatures are not kept). */
+    rejection(id: string): string | undefined;
+    pendingIds(): string[];
+    /** Called after documents are accepted (e.g. web/oplog re-evaluates quarantined/pending ops). */
+    onChange(cb: () => void): () => void;
+    private emit;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/web/trust/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/web/trust/store.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAQjD,OAAO,EACN,KAAK,SAAS,EACd,KAAK,EAAE,EACP,KAAK,QAAQ,EAEb,KAAK,KAAK,EACV,KAAK,KAAK,EAEV,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,UAAU,CAAC,CAOrB;AAUD,8GAA8G;AAC9G,MAAM,WAAW,UAAU;IAC1B,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAUD,kHAAkH;AAClH,MAAM,WAAW,MAAM;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACX;AAoBD,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IACnE,OAAO,CAAC,YAAY,CAAK;IACzB,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D,iGAAiG;IACjG,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,KAAK,CAAuC;IACpD,4CAA4C;IAC5C,OAAO,SAAK;IAEZ,YAAY,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAalD;IAID,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAEvD;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAUzE;IAED,OAAO,CAAC,MAAM;YAWA,MAAM;YA2CN,cAAc;IAsD5B,sGAAsG;IACtG,OAAO,CAAC,aAAa;IAerB;;;;;;OAMG;IACH,YAAY,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAY7C;IAED,OAAO,CAAC,IAAI;IAkDZ;;;OAGG;IACH,OAAO,CAAC,aAAa;IAerB,wHAAwH;IACxH,OAAO,CAAC,cAAc;IAYtB,sGAAsG;IACtG,OAAO,CAAC,eAAe;IAoBvB,OAAO,CAAC,CAAC;IA6DT,2GAA2G;IAC3G,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAE,EAAO,GAAG,OAAO,CAElE;IAED,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAE,EAAO,GAAG,QAAQ,CAiBvE;IAED,qEAAqE;IACrE,OAAO,CAAC,WAAW;IAcnB,uCAAuC;IACvC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAE,EAAO,GAAG,KAAK,EAAE,CAI7C;IAED,yEAAyE;IACzE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAE,EAAO,GAAG,OAAO,CAEzC;IAED,2DAA2D;IAC3D,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAE,EAAO,GAAG,WAAW,CAQzD;IAED,wGAAwG;IACxG,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpC;IAED,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,CAE5B;IAED,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAEtC;IAED,gFAAgF;IAChF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAE9B;IAED,iEAAiE;IACjE,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7B;IAED,2DAA2D;IAC3D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3C;IAED,oDAAoD;IACpD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,EAAE,CAOpC;IAED,wGAAwG;IACxG,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAOlE;IAED;;;;OAIG;IACH,iBAAiB,CAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,EACrE,MAAM,CAAC,EAAE,MAAM,GACb,eAAe,CA2BjB;IAED,sFAAsF;IACtF,IAAI,IAAI,QAAQ,EAAE,CAEjB;IAED,WAAW,IAAI,UAAU,EAAE,CAE1B;IAED,mHAAmH;IACnH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExC;IAED,UAAU,IAAI,MAAM,EAAE,CAQrB;IAED,iGAAiG;IACjG,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAGnC;IAED,OAAO,CAAC,IAAI;CASZ"}