@ternent/seal-cli 0.1.8 → 0.3.0

package/dist/proof.js.map

@@ -1 +1 @@
-{"version":3,"file":"proof.js","sources":["../src/proof.ts"],"sourcesContent":["import { canonicalStringify, hashBytes } from \"ternent-utils\";\nimport {\n  importPublicKeyFromBase64,\n  resolveSealSigner,\n  signUtf8,\n  verifyPublicKeyKeyId,\n  verifyUtf8,\n  type SealSignerInput,\n} from \"./crypto\";\n\nexport const SEAL_PROOF_VERSION = \"1\" as const;\nexport const SEAL_PROOF_TYPE = \"seal-proof\" as const;\nexport const SEAL_SIGNATURE_ALGORITHM = \"ECDSA-P256-SHA256\" as const;\n\nexport type SealSubjectKind = \"file\" | \"manifest\";\n\nexport type SealProofV1 = {\n  version: typeof SEAL_PROOF_VERSION;\n  type: typeof SEAL_PROOF_TYPE;\n  algorithm: typeof SEAL_SIGNATURE_ALGORITHM;\n  createdAt: string;\n  subject: {\n    kind: SealSubjectKind;\n    path: string;\n    hash: `sha256:${string}`;\n  };\n  signer: {\n    publicKey: string;\n    keyId: string;\n  };\n  signature: string;\n};\n\nexport type SealPublicKeyArtifact = {\n  algorithm: typeof SEAL_SIGNATURE_ALGORITHM;\n  publicKey: string;\n  keyId: string;\n};\n\ntype SealProofSignableFields = Omit<SealProofV1, \"signature\">;\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction hasOnlyKeys(\n  value: Record<string, unknown>,\n  allowed: string[]\n): boolean {\n  return Object.keys(value).every((key) => allowed.includes(key));\n}\n\nfunction isSealHash(value: unknown): value is `sha256:${string}` {\n  return typeof value === \"string\" && /^sha256:[0-9a-f]{64}$/.test(value);\n}\n\nfunction isIsoDate(value: string): boolean {\n  return !Number.isNaN(Date.parse(value));\n}\n\nexport function getSealProofSignableFields(\n  proof: SealProofV1 | SealProofSignableFields\n): SealProofSignableFields {\n  return {\n    version: proof.version,\n    type: proof.type,\n    algorithm: proof.algorithm,\n    createdAt: proof.createdAt,\n    subject: proof.subject,\n    signer: proof.signer,\n  };\n}\n\nexport function getSealProofSigningPayload(\n  proof: SealProofV1 | SealProofSignableFields\n): string {\n  return canonicalStringify(getSealProofSignableFields(proof));\n}\n\nexport async function createSealHash(\n  bytes: Uint8Array | ArrayBuffer\n): Promise<`sha256:${string}`> {\n  const hash = await hashBytes(bytes);\n  return `sha256:${hash}`;\n}\n\nexport async function createSealProof(input: {\n  createdAt?: string;\n  signer: SealSignerInput;\n  subject: SealProofV1[\"subject\"];\n}): Promise<SealProofV1> {\n  const signer = await resolveSealSigner(input.signer);\n  const fields: SealProofSignableFields = {\n    version: SEAL_PROOF_VERSION,\n    type: SEAL_PROOF_TYPE,\n    algorithm: SEAL_SIGNATURE_ALGORITHM,\n    createdAt: input.createdAt ?? new Date().toISOString(),\n    subject: input.subject,\n    signer: {\n      publicKey: signer.publicKeyBase64,\n      keyId: signer.keyId,\n    },\n  };\n\n  const signature = await signUtf8(\n    signer.privateKey,\n    getSealProofSigningPayload(fields)\n  );\n\n  return {\n    ...fields,\n    signature,\n  };\n}\n\nexport async function createSealPublicKeyArtifact(\n  signer: SealSignerInput\n): Promise<SealPublicKeyArtifact> {\n  const resolved = await resolveSealSigner(signer);\n  return {\n    algorithm: SEAL_SIGNATURE_ALGORITHM,\n    publicKey: resolved.publicKeyBase64,\n    keyId: resolved.keyId,\n  };\n}\n\nexport function validateSealProofShape(value: unknown): {\n  ok: boolean;\n  errors: string[];\n  proof: SealProofV1 | null;\n} {\n  if (!isRecord(value)) {\n    return { ok: false, errors: [\"Proof must be a JSON object.\"], proof: null };\n  }\n\n  const errors: string[] = [];\n\n  if (\n    !hasOnlyKeys(value, [\n      \"version\",\n      \"type\",\n      \"algorithm\",\n      \"createdAt\",\n      \"subject\",\n      \"signer\",\n      \"signature\",\n    ])\n  ) {\n    errors.push(\"Proof contains unsupported fields.\");\n  }\n\n  if (value.version !== SEAL_PROOF_VERSION) {\n    errors.push(`Proof version must be ${SEAL_PROOF_VERSION}.`);\n  }\n  if (value.type !== SEAL_PROOF_TYPE) {\n    errors.push(`Proof type must be ${SEAL_PROOF_TYPE}.`);\n  }\n  if (value.algorithm !== SEAL_SIGNATURE_ALGORITHM) {\n    errors.push(`Proof algorithm must be ${SEAL_SIGNATURE_ALGORITHM}.`);\n  }\n  if (typeof value.createdAt !== \"string\" || !isIsoDate(value.createdAt)) {\n    errors.push(\"Proof createdAt must be an ISO timestamp.\");\n  }\n  if (typeof value.signature !== \"string\" || value.signature.length === 0) {\n    errors.push(\"Proof signature must be a non-empty base64 string.\");\n  }\n  if (!isRecord(value.subject)) {\n    errors.push(\"Proof subject must be an object.\");\n  }\n  if (!isRecord(value.signer)) {\n    errors.push(\"Proof signer must be an object.\");\n  }\n\n  if (errors.length > 0 || !isRecord(value.subject) || !isRecord(value.signer)) {\n    return { ok: false, errors, proof: null };\n  }\n\n  if (!hasOnlyKeys(value.subject, [\"kind\", \"path\", \"hash\"])) {\n    errors.push(\"Proof subject contains unsupported fields.\");\n  }\n  if (!hasOnlyKeys(value.signer, [\"publicKey\", \"keyId\"])) {\n    errors.push(\"Proof signer contains unsupported fields.\");\n  }\n\n  if (value.subject.kind !== \"file\" && value.subject.kind !== \"manifest\") {\n    errors.push(\"Proof subject kind must be file or manifest.\");\n  }\n  if (typeof value.subject.path !== \"string\" || value.subject.path.length === 0) {\n    errors.push(\"Proof subject path must be a non-empty string.\");\n  }\n  if (!isSealHash(value.subject.hash)) {\n    errors.push(\"Proof subject hash must be a sha256 hash.\");\n  }\n  if (\n    typeof value.signer.publicKey !== \"string\" ||\n    value.signer.publicKey.length === 0\n  ) {\n    errors.push(\"Proof signer publicKey must be a non-empty base64 string.\");\n  }\n  if (typeof value.signer.keyId !== \"string\" || value.signer.keyId.length === 0) {\n    errors.push(\"Proof signer keyId must be a non-empty string.\");\n  }\n\n  if (errors.length > 0) {\n    return { ok: false, errors, proof: null };\n  }\n\n  return {\n    ok: true,\n    errors: [],\n    proof: value as SealProofV1,\n  };\n}\n\nexport function parseSealProofJson(raw: string): {\n  ok: boolean;\n  errors: string[];\n  proof: SealProofV1 | null;\n} {\n  try {\n    return validateSealProofShape(JSON.parse(raw));\n  } catch {\n    return {\n      ok: false,\n      errors: [\"Proof JSON is not valid JSON.\"],\n      proof: null,\n    };\n  }\n}\n\nexport function validateSealPublicKeyShape(value: unknown): {\n  ok: boolean;\n  errors: string[];\n  artifact: SealPublicKeyArtifact | null;\n} {\n  if (!isRecord(value)) {\n    return {\n      ok: false,\n      errors: [\"Public key artifact must be a JSON object.\"],\n      artifact: null,\n    };\n  }\n\n  const errors: string[] = [];\n\n  if (!hasOnlyKeys(value, [\"algorithm\", \"publicKey\", \"keyId\"])) {\n    errors.push(\"Public key artifact contains unsupported fields.\");\n  }\n  if (value.algorithm !== SEAL_SIGNATURE_ALGORITHM) {\n    errors.push(`Public key artifact algorithm must be ${SEAL_SIGNATURE_ALGORITHM}.`);\n  }\n  if (typeof value.publicKey !== \"string\" || value.publicKey.length === 0) {\n    errors.push(\"Public key artifact publicKey must be a non-empty base64 string.\");\n  }\n  if (typeof value.keyId !== \"string\" || value.keyId.length === 0) {\n    errors.push(\"Public key artifact keyId must be a non-empty string.\");\n  }\n\n  if (errors.length > 0) {\n    return { ok: false, errors, artifact: null };\n  }\n\n  return {\n    ok: true,\n    errors: [],\n    artifact: value as SealPublicKeyArtifact,\n  };\n}\n\nexport function parseSealPublicKeyJson(raw: string): {\n  ok: boolean;\n  errors: string[];\n  artifact: SealPublicKeyArtifact | null;\n} {\n  try {\n    return validateSealPublicKeyShape(JSON.parse(raw));\n  } catch {\n    return {\n      ok: false,\n      errors: [\"Public key JSON is not valid JSON.\"],\n      artifact: null,\n    };\n  }\n}\n\nexport async function verifySealProofSignature(proof: SealProofV1): Promise<{\n  ok: boolean;\n  errors: string[];\n}> {\n  const validation = validateSealProofShape(proof);\n  if (!validation.ok || !validation.proof) {\n    return { ok: false, errors: validation.errors };\n  }\n\n  if (!(await verifyPublicKeyKeyId(proof.signer.publicKey, proof.signer.keyId))) {\n    return {\n      ok: false,\n      errors: [\"Proof signer keyId does not match signer public key.\"],\n    };\n  }\n\n  try {\n    const publicKey = await importPublicKeyFromBase64(proof.signer.publicKey);\n    const valid = await verifyUtf8(\n      proof.signature,\n      getSealProofSigningPayload(proof),\n      publicKey\n    );\n    if (!valid) {\n      return { ok: false, errors: [\"Invalid signature.\"] };\n    }\n    return { ok: true, errors: [] };\n  } catch (caught) {\n    const message = caught instanceof Error ? caught.message : String(caught);\n    return {\n      ok: false,\n      errors: [`Failed to verify signature: ${message}`],\n    };\n  }\n}\n\nexport async function verifySealProofAgainstBytes(\n  proof: SealProofV1,\n  bytes: Uint8Array | ArrayBuffer\n): Promise<{\n  valid: boolean;\n  hashMatch: boolean;\n  signatureValid: boolean;\n  keyId: string;\n  algorithm: typeof SEAL_SIGNATURE_ALGORITHM;\n  subjectHash: `sha256:${string}`;\n}> {\n  const subjectHash = await createSealHash(bytes);\n  const signatureCheck = await verifySealProofSignature(proof);\n  const hashMatch = subjectHash === proof.subject.hash;\n  const signatureValid = signatureCheck.ok;\n\n  return {\n    valid: hashMatch && signatureValid,\n    hashMatch,\n    signatureValid,\n    keyId: proof.signer.keyId,\n    algorithm: proof.algorithm,\n    subjectHash,\n  };\n}\n"],"names":[],"mappings":";;AAUO,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AACxB,MAAM,2BAA2B;AA6BxC,SAAS,SAAS,OAAkD;AAC3D,SAAA,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YACP,OACA,SACS;AACF,SAAA,OAAO,KAAK,KAAK,EAAE,MAAM,CAAC,QAAQ,QAAQ,SAAS,GAAG,CAAC;AAChE;AAEA,SAAS,WAAW,OAA6C;AAC/D,SAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;AAEA,SAAS,UAAU,OAAwB;AACzC,SAAO,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC;AACxC;AAEO,SAAS,2BACd,OACyB;AAClB,SAAA;AAAA,IACL,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,IACZ,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,EAAA;AAElB;AAEO,SAAS,2BACd,OACQ;AACD,SAAA,mBAAmB,2BAA2B,KAAK,CAAC;AAC7D;AAEA,eAAsB,eACpB,OAC6B;AACvB,QAAA,OAAO,MAAM,UAAU,KAAK;AAClC,SAAO,UAAU;AACnB;AAEA,eAAsB,gBAAgB,OAIb;AACvB,QAAM,SAAS,MAAM,kBAAkB,MAAM,MAAM;AACnD,QAAM,SAAkC;AAAA,IACtC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,WAAW,MAAM,aAAa,IAAI,KAAA,EAAO,YAAY;AAAA,IACrD,SAAS,MAAM;AAAA,IACf,QAAQ;AAAA,MACN,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,IAChB;AAAA,EAAA;AAGF,QAAM,YAAY,MAAM;AAAA,IACtB,OAAO;AAAA,IACP,2BAA2B,MAAM;AAAA,EAAA;AAG5B,SAAA;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EAAA;AAEJ;AAEA,eAAsB,4BACpB,QACgC;AAC1B,QAAA,WAAW,MAAM,kBAAkB,MAAM;AACxC,SAAA;AAAA,IACL,WAAW;AAAA,IACX,WAAW,SAAS;AAAA,IACpB,OAAO,SAAS;AAAA,EAAA;AAEpB;AAEO,SAAS,uBAAuB,OAIrC;AACI,MAAA,CAAC,SAAS,KAAK,GAAG;AACb,WAAA,EAAE,IAAI,OAAO,QAAQ,CAAC,8BAA8B,GAAG,OAAO;EACvE;AAEA,QAAM,SAAmB,CAAA;AAGvB,MAAA,CAAC,YAAY,OAAO;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,CACD,GACD;AACA,WAAO,KAAK,oCAAoC;AAAA,EAClD;AAEI,MAAA,MAAM,YAAY,oBAAoB;AACjC,WAAA,KAAK,yBAAyB,qBAAqB;AAAA,EAC5D;AACI,MAAA,MAAM,SAAS,iBAAiB;AAC3B,WAAA,KAAK,sBAAsB,kBAAkB;AAAA,EACtD;AACI,MAAA,MAAM,cAAc,0BAA0B;AACzC,WAAA,KAAK,2BAA2B,2BAA2B;AAAA,EACpE;AACI,MAAA,OAAO,MAAM,cAAc,YAAY,CAAC,UAAU,MAAM,SAAS,GAAG;AACtE,WAAO,KAAK,2CAA2C;AAAA,EACzD;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG;AACvE,WAAO,KAAK,oDAAoD;AAAA,EAClE;AACA,MAAI,CAAC,SAAS,MAAM,OAAO,GAAG;AAC5B,WAAO,KAAK,kCAAkC;AAAA,EAChD;AACA,MAAI,CAAC,SAAS,MAAM,MAAM,GAAG;AAC3B,WAAO,KAAK,iCAAiC;AAAA,EAC/C;AAEA,MAAI,OAAO,SAAS,KAAK,CAAC,SAAS,MAAM,OAAO,KAAK,CAAC,SAAS,MAAM,MAAM,GAAG;AAC5E,WAAO,EAAE,IAAI,OAAO,QAAQ,OAAO,KAAK;AAAA,EAC1C;AAEI,MAAA,CAAC,YAAY,MAAM,SAAS,CAAC,QAAQ,QAAQ,MAAM,CAAC,GAAG;AACzD,WAAO,KAAK,4CAA4C;AAAA,EAC1D;AACI,MAAA,CAAC,YAAY,MAAM,QAAQ,CAAC,aAAa,OAAO,CAAC,GAAG;AACtD,WAAO,KAAK,2CAA2C;AAAA,EACzD;AAEA,MAAI,MAAM,QAAQ,SAAS,UAAU,MAAM,QAAQ,SAAS,YAAY;AACtE,WAAO,KAAK,8CAA8C;AAAA,EAC5D;AACI,MAAA,OAAO,MAAM,QAAQ,SAAS,YAAY,MAAM,QAAQ,KAAK,WAAW,GAAG;AAC7E,WAAO,KAAK,gDAAgD;AAAA,EAC9D;AACA,MAAI,CAAC,WAAW,MAAM,QAAQ,IAAI,GAAG;AACnC,WAAO,KAAK,2CAA2C;AAAA,EACzD;AAEE,MAAA,OAAO,MAAM,OAAO,cAAc,YAClC,MAAM,OAAO,UAAU,WAAW,GAClC;AACA,WAAO,KAAK,2DAA2D;AAAA,EACzE;AACI,MAAA,OAAO,MAAM,OAAO,UAAU,YAAY,MAAM,OAAO,MAAM,WAAW,GAAG;AAC7E,WAAO,KAAK,gDAAgD;AAAA,EAC9D;AAEI,MAAA,OAAO,SAAS,GAAG;AACrB,WAAO,EAAE,IAAI,OAAO,QAAQ,OAAO,KAAK;AAAA,EAC1C;AAEO,SAAA;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ,CAAC;AAAA,IACT,OAAO;AAAA,EAAA;AAEX;AAEO,SAAS,mBAAmB,KAIjC;AACI,MAAA;AACF,WAAO,uBAAuB,KAAK,MAAM,GAAG,CAAC;AAAA,EAAA,QAC7C;AACO,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,+BAA+B;AAAA,MACxC,OAAO;AAAA,IAAA;AAAA,EAEX;AACF;AAEO,SAAS,2BAA2B,OAIzC;AACI,MAAA,CAAC,SAAS,KAAK,GAAG;AACb,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,4CAA4C;AAAA,MACrD,UAAU;AAAA,IAAA;AAAA,EAEd;AAEA,QAAM,SAAmB,CAAA;AAErB,MAAA,CAAC,YAAY,OAAO,CAAC,aAAa,aAAa,OAAO,CAAC,GAAG;AAC5D,WAAO,KAAK,kDAAkD;AAAA,EAChE;AACI,MAAA,MAAM,cAAc,0BAA0B;AACzC,WAAA,KAAK,yCAAyC,2BAA2B;AAAA,EAClF;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG;AACvE,WAAO,KAAK,kEAAkE;AAAA,EAChF;AACA,MAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,WAAW,GAAG;AAC/D,WAAO,KAAK,uDAAuD;AAAA,EACrE;AAEI,MAAA,OAAO,SAAS,GAAG;AACrB,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU,KAAK;AAAA,EAC7C;AAEO,SAAA;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ,CAAC;AAAA,IACT,UAAU;AAAA,EAAA;AAEd;AAEO,SAAS,uBAAuB,KAIrC;AACI,MAAA;AACF,WAAO,2BAA2B,KAAK,MAAM,GAAG,CAAC;AAAA,EAAA,QACjD;AACO,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,oCAAoC;AAAA,MAC7C,UAAU;AAAA,IAAA;AAAA,EAEd;AACF;AAEA,eAAsB,yBAAyB,OAG5C;AACK,QAAA,aAAa,uBAAuB,KAAK;AAC/C,MAAI,CAAC,WAAW,MAAM,CAAC,WAAW,OAAO;AACvC,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,OAAO;AAAA,EAChD;AAEI,MAAA,CAAE,MAAM,qBAAqB,MAAM,OAAO,WAAW,MAAM,OAAO,KAAK,GAAI;AACtE,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,sDAAsD;AAAA,IAAA;AAAA,EAEnE;AAEI,MAAA;AACF,UAAM,YAAY,MAAM,0BAA0B,MAAM,OAAO,SAAS;AACxE,UAAM,QAAQ,MAAM;AAAA,MAClB,MAAM;AAAA,MACN,2BAA2B,KAAK;AAAA,MAChC;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,IAAI,OAAO,QAAQ,CAAC,oBAAoB,EAAE;AAAA,IACrD;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAG,EAAA;AAAA,WACvB;AACP,UAAM,UAAU,kBAAkB,QAAQ,OAAO,UAAU,OAAO,MAAM;AACjE,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,+BAA+B,SAAS;AAAA,IAAA;AAAA,EAErD;AACF;AAEsB,eAAA,4BACpB,OACA,OAQC;AACK,QAAA,cAAc,MAAM,eAAe,KAAK;AACxC,QAAA,iBAAiB,MAAM,yBAAyB,KAAK;AACrD,QAAA,YAAY,gBAAgB,MAAM,QAAQ;AAChD,QAAM,iBAAiB,eAAe;AAE/B,SAAA;AAAA,IACL,OAAO,aAAa;AAAA,IACpB;AAAA,IACA;AAAA,IACA,OAAO,MAAM,OAAO;AAAA,IACpB,WAAW,MAAM;AAAA,IACjB;AAAA,EAAA;AAEJ;;"}
+{"version":3,"file":"proof.js","sources":["../src/proof.ts"],"sourcesContent":["import { canonicalStringify, hashBytes } from \"ternent-utils\";\nimport {\n  resolveSealSigner,\n  signSealUtf8,\n  verifyPublicKeyKeyId,\n  verifySealUtf8,\n  type SealSignerInput,\n} from \"./crypto\";\n\nexport const SEAL_PROOF_VERSION = \"2\" as const;\nexport const SEAL_PROOF_TYPE = \"seal-proof\" as const;\nexport const SEAL_PUBLIC_KEY_TYPE = \"seal-public-key\" as const;\nexport const SEAL_SIGNATURE_ALGORITHM = \"Ed25519\" as const;\n\nexport type SealSubjectKind = \"file\" | \"manifest\";\n\nexport type SealProofV1 = {\n  version: typeof SEAL_PROOF_VERSION;\n  type: typeof SEAL_PROOF_TYPE;\n  algorithm: typeof SEAL_SIGNATURE_ALGORITHM;\n  createdAt: string;\n  subject: {\n    kind: SealSubjectKind;\n    path: string;\n    hash: `sha256:${string}`;\n  };\n  signer: {\n    publicKey: string;\n    keyId: string;\n  };\n  signature: string;\n};\n\nexport type SealPublicKeyArtifact = {\n  version: typeof SEAL_PROOF_VERSION;\n  type: typeof SEAL_PUBLIC_KEY_TYPE;\n  algorithm: typeof SEAL_SIGNATURE_ALGORITHM;\n  publicKey: string;\n  keyId: string;\n};\n\ntype SealProofSignableFields = Omit<SealProofV1, \"signature\">;\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction hasOnlyKeys(\n  value: Record<string, unknown>,\n  allowed: string[]\n): boolean {\n  return Object.keys(value).every((key) => allowed.includes(key));\n}\n\nfunction isSealHash(value: unknown): value is `sha256:${string}` {\n  return typeof value === \"string\" && /^sha256:[0-9a-f]{64}$/.test(value);\n}\n\nfunction isIsoDate(value: string): boolean {\n  return !Number.isNaN(Date.parse(value));\n}\n\nexport function getSealProofSignableFields(\n  proof: SealProofV1 | SealProofSignableFields\n): SealProofSignableFields {\n  return {\n    version: proof.version,\n    type: proof.type,\n    algorithm: proof.algorithm,\n    createdAt: proof.createdAt,\n    subject: proof.subject,\n    signer: proof.signer,\n  };\n}\n\nexport function getSealProofSigningPayload(\n  proof: SealProofV1 | SealProofSignableFields\n): string {\n  return canonicalStringify(getSealProofSignableFields(proof));\n}\n\nexport async function createSealHash(\n  bytes: Uint8Array | ArrayBuffer\n): Promise<`sha256:${string}`> {\n  const hash = await hashBytes(bytes);\n  return `sha256:${hash}`;\n}\n\nexport async function createSealProof(input: {\n  createdAt?: string;\n  signer: SealSignerInput;\n  subject: SealProofV1[\"subject\"];\n}): Promise<SealProofV1> {\n  const signer = await resolveSealSigner(input.signer);\n  const fields: SealProofSignableFields = {\n    version: SEAL_PROOF_VERSION,\n    type: SEAL_PROOF_TYPE,\n    algorithm: SEAL_SIGNATURE_ALGORITHM,\n    createdAt: input.createdAt ?? new Date().toISOString(),\n    subject: input.subject,\n    signer: {\n      publicKey: signer.publicKey,\n      keyId: signer.keyId,\n    },\n  };\n\n  const signature = await signSealUtf8(\n    signer.identity,\n    getSealProofSigningPayload(fields)\n  );\n\n  return {\n    ...fields,\n    signature,\n  };\n}\n\nexport async function createSealPublicKeyArtifact(\n  signer: SealSignerInput\n): Promise<SealPublicKeyArtifact> {\n  const resolved = await resolveSealSigner(signer);\n  return {\n    version: SEAL_PROOF_VERSION,\n    type: SEAL_PUBLIC_KEY_TYPE,\n    algorithm: SEAL_SIGNATURE_ALGORITHM,\n    publicKey: resolved.publicKey,\n    keyId: resolved.keyId,\n  };\n}\n\nexport function validateSealProofShape(value: unknown): {\n  ok: boolean;\n  errors: string[];\n  proof: SealProofV1 | null;\n} {\n  if (!isRecord(value)) {\n    return { ok: false, errors: [\"Proof must be a JSON object.\"], proof: null };\n  }\n\n  const errors: string[] = [];\n\n  if (\n    !hasOnlyKeys(value, [\n      \"version\",\n      \"type\",\n      \"algorithm\",\n      \"createdAt\",\n      \"subject\",\n      \"signer\",\n      \"signature\",\n    ])\n  ) {\n    errors.push(\"Proof contains unsupported fields.\");\n  }\n\n  if (value.version !== SEAL_PROOF_VERSION) {\n    errors.push(`Proof version must be ${SEAL_PROOF_VERSION}.`);\n  }\n  if (value.type !== SEAL_PROOF_TYPE) {\n    errors.push(`Proof type must be ${SEAL_PROOF_TYPE}.`);\n  }\n  if (value.algorithm !== SEAL_SIGNATURE_ALGORITHM) {\n    errors.push(`Proof algorithm must be ${SEAL_SIGNATURE_ALGORITHM}.`);\n  }\n  if (typeof value.createdAt !== \"string\" || !isIsoDate(value.createdAt)) {\n    errors.push(\"Proof createdAt must be an ISO timestamp.\");\n  }\n  if (typeof value.signature !== \"string\" || value.signature.length === 0) {\n    errors.push(\"Proof signature must be a non-empty base64url string.\");\n  }\n  if (!isRecord(value.subject)) {\n    errors.push(\"Proof subject must be an object.\");\n  }\n  if (!isRecord(value.signer)) {\n    errors.push(\"Proof signer must be an object.\");\n  }\n\n  if (errors.length > 0 || !isRecord(value.subject) || !isRecord(value.signer)) {\n    return { ok: false, errors, proof: null };\n  }\n\n  if (!hasOnlyKeys(value.subject, [\"kind\", \"path\", \"hash\"])) {\n    errors.push(\"Proof subject contains unsupported fields.\");\n  }\n  if (!hasOnlyKeys(value.signer, [\"publicKey\", \"keyId\"])) {\n    errors.push(\"Proof signer contains unsupported fields.\");\n  }\n  if (value.subject.kind !== \"file\" && value.subject.kind !== \"manifest\") {\n    errors.push(\"Proof subject kind must be file or manifest.\");\n  }\n  if (typeof value.subject.path !== \"string\" || value.subject.path.length === 0) {\n    errors.push(\"Proof subject path must be a non-empty string.\");\n  }\n  if (!isSealHash(value.subject.hash)) {\n    errors.push(\"Proof subject hash must be a sha256 hash.\");\n  }\n  if (\n    typeof value.signer.publicKey !== \"string\" ||\n    value.signer.publicKey.length === 0\n  ) {\n    errors.push(\"Proof signer publicKey must be a non-empty base64url string.\");\n  }\n  if (typeof value.signer.keyId !== \"string\" || value.signer.keyId.length === 0) {\n    errors.push(\"Proof signer keyId must be a non-empty string.\");\n  }\n\n  if (errors.length > 0) {\n    return { ok: false, errors, proof: null };\n  }\n\n  return {\n    ok: true,\n    errors: [],\n    proof: value as SealProofV1,\n  };\n}\n\nexport function parseSealProofJson(raw: string): {\n  ok: boolean;\n  errors: string[];\n  proof: SealProofV1 | null;\n} {\n  try {\n    return validateSealProofShape(JSON.parse(raw));\n  } catch {\n    return {\n      ok: false,\n      errors: [\"Proof JSON is not valid JSON.\"],\n      proof: null,\n    };\n  }\n}\n\nexport function validateSealPublicKeyShape(value: unknown): {\n  ok: boolean;\n  errors: string[];\n  artifact: SealPublicKeyArtifact | null;\n} {\n  if (!isRecord(value)) {\n    return {\n      ok: false,\n      errors: [\"Public key artifact must be a JSON object.\"],\n      artifact: null,\n    };\n  }\n\n  const errors: string[] = [];\n\n  if (!hasOnlyKeys(value, [\"version\", \"type\", \"algorithm\", \"publicKey\", \"keyId\"])) {\n    errors.push(\"Public key artifact contains unsupported fields.\");\n  }\n  if (value.version !== SEAL_PROOF_VERSION) {\n    errors.push(`Public key artifact version must be ${SEAL_PROOF_VERSION}.`);\n  }\n  if (value.type !== SEAL_PUBLIC_KEY_TYPE) {\n    errors.push(`Public key artifact type must be ${SEAL_PUBLIC_KEY_TYPE}.`);\n  }\n  if (value.algorithm !== SEAL_SIGNATURE_ALGORITHM) {\n    errors.push(`Public key artifact algorithm must be ${SEAL_SIGNATURE_ALGORITHM}.`);\n  }\n  if (typeof value.publicKey !== \"string\" || value.publicKey.length === 0) {\n    errors.push(\"Public key artifact publicKey must be a non-empty base64url string.\");\n  }\n  if (typeof value.keyId !== \"string\" || value.keyId.length === 0) {\n    errors.push(\"Public key artifact keyId must be a non-empty string.\");\n  }\n\n  if (errors.length > 0) {\n    return { ok: false, errors, artifact: null };\n  }\n\n  return {\n    ok: true,\n    errors: [],\n    artifact: value as SealPublicKeyArtifact,\n  };\n}\n\nexport function parseSealPublicKeyJson(raw: string): {\n  ok: boolean;\n  errors: string[];\n  artifact: SealPublicKeyArtifact | null;\n} {\n  try {\n    return validateSealPublicKeyShape(JSON.parse(raw));\n  } catch {\n    return {\n      ok: false,\n      errors: [\"Public key JSON is not valid JSON.\"],\n      artifact: null,\n    };\n  }\n}\n\nexport async function verifySealProofSignature(proof: SealProofV1): Promise<{\n  ok: boolean;\n  errors: string[];\n}> {\n  const validation = validateSealProofShape(proof);\n  if (!validation.ok || !validation.proof) {\n    return { ok: false, errors: validation.errors };\n  }\n\n  if (!(await verifyPublicKeyKeyId(proof.signer.publicKey, proof.signer.keyId))) {\n    return {\n      ok: false,\n      errors: [\"Proof signer keyId does not match signer public key.\"],\n    };\n  }\n\n  try {\n    const valid = await verifySealUtf8(\n      proof.signature,\n      getSealProofSigningPayload(proof),\n      proof.signer.publicKey\n    );\n    if (!valid) {\n      return { ok: false, errors: [\"Invalid signature.\"] };\n    }\n    return { ok: true, errors: [] };\n  } catch (caught) {\n    return {\n      ok: false,\n      errors: [\"Invalid signature.\"],\n    };\n  }\n}\n\nexport async function verifySealProofAgainstBytes(\n  proof: SealProofV1,\n  bytes: Uint8Array | ArrayBuffer\n): Promise<{\n  valid: boolean;\n  hashMatch: boolean;\n  signatureValid: boolean;\n  keyId: string;\n  algorithm: typeof SEAL_SIGNATURE_ALGORITHM;\n  subjectHash: `sha256:${string}`;\n}> {\n  const subjectHash = await createSealHash(bytes);\n  const signatureCheck = await verifySealProofSignature(proof);\n  const hashMatch = subjectHash === proof.subject.hash;\n  const signatureValid = signatureCheck.ok;\n\n  return {\n    valid: hashMatch && signatureValid,\n    hashMatch,\n    signatureValid,\n    keyId: proof.signer.keyId,\n    algorithm: proof.algorithm,\n    subjectHash,\n  };\n}\n"],"names":[],"mappings":";;AASO,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AACxB,MAAM,uBAAuB;AAC7B,MAAM,2BAA2B;AA+BxC,SAAS,SAAS,OAAkD;AAC3D,SAAA,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YACP,OACA,SACS;AACF,SAAA,OAAO,KAAK,KAAK,EAAE,MAAM,CAAC,QAAQ,QAAQ,SAAS,GAAG,CAAC;AAChE;AAEA,SAAS,WAAW,OAA6C;AAC/D,SAAO,OAAO,UAAU,YAAY,wBAAwB,KAAK,KAAK;AACxE;AAEA,SAAS,UAAU,OAAwB;AACzC,SAAO,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC;AACxC;AAEO,SAAS,2BACd,OACyB;AAClB,SAAA;AAAA,IACL,SAAS,MAAM;AAAA,IACf,MAAM,MAAM;AAAA,IACZ,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,EAAA;AAElB;AAEO,SAAS,2BACd,OACQ;AACD,SAAA,mBAAmB,2BAA2B,KAAK,CAAC;AAC7D;AAEA,eAAsB,eACpB,OAC6B;AACvB,QAAA,OAAO,MAAM,UAAU,KAAK;AAClC,SAAO,UAAU;AACnB;AAEA,eAAsB,gBAAgB,OAIb;AACvB,QAAM,SAAS,MAAM,kBAAkB,MAAM,MAAM;AACnD,QAAM,SAAkC;AAAA,IACtC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,WAAW,MAAM,aAAa,IAAI,KAAA,EAAO,YAAY;AAAA,IACrD,SAAS,MAAM;AAAA,IACf,QAAQ;AAAA,MACN,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,IAChB;AAAA,EAAA;AAGF,QAAM,YAAY,MAAM;AAAA,IACtB,OAAO;AAAA,IACP,2BAA2B,MAAM;AAAA,EAAA;AAG5B,SAAA;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EAAA;AAEJ;AAEA,eAAsB,4BACpB,QACgC;AAC1B,QAAA,WAAW,MAAM,kBAAkB,MAAM;AACxC,SAAA;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,WAAW;AAAA,IACX,WAAW,SAAS;AAAA,IACpB,OAAO,SAAS;AAAA,EAAA;AAEpB;AAEO,SAAS,uBAAuB,OAIrC;AACI,MAAA,CAAC,SAAS,KAAK,GAAG;AACb,WAAA,EAAE,IAAI,OAAO,QAAQ,CAAC,8BAA8B,GAAG,OAAO;EACvE;AAEA,QAAM,SAAmB,CAAA;AAGvB,MAAA,CAAC,YAAY,OAAO;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,CACD,GACD;AACA,WAAO,KAAK,oCAAoC;AAAA,EAClD;AAEI,MAAA,MAAM,YAAY,oBAAoB;AACjC,WAAA,KAAK,yBAAyB,qBAAqB;AAAA,EAC5D;AACI,MAAA,MAAM,SAAS,iBAAiB;AAC3B,WAAA,KAAK,sBAAsB,kBAAkB;AAAA,EACtD;AACI,MAAA,MAAM,cAAc,0BAA0B;AACzC,WAAA,KAAK,2BAA2B,2BAA2B;AAAA,EACpE;AACI,MAAA,OAAO,MAAM,cAAc,YAAY,CAAC,UAAU,MAAM,SAAS,GAAG;AACtE,WAAO,KAAK,2CAA2C;AAAA,EACzD;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG;AACvE,WAAO,KAAK,uDAAuD;AAAA,EACrE;AACA,MAAI,CAAC,SAAS,MAAM,OAAO,GAAG;AAC5B,WAAO,KAAK,kCAAkC;AAAA,EAChD;AACA,MAAI,CAAC,SAAS,MAAM,MAAM,GAAG;AAC3B,WAAO,KAAK,iCAAiC;AAAA,EAC/C;AAEA,MAAI,OAAO,SAAS,KAAK,CAAC,SAAS,MAAM,OAAO,KAAK,CAAC,SAAS,MAAM,MAAM,GAAG;AAC5E,WAAO,EAAE,IAAI,OAAO,QAAQ,OAAO,KAAK;AAAA,EAC1C;AAEI,MAAA,CAAC,YAAY,MAAM,SAAS,CAAC,QAAQ,QAAQ,MAAM,CAAC,GAAG;AACzD,WAAO,KAAK,4CAA4C;AAAA,EAC1D;AACI,MAAA,CAAC,YAAY,MAAM,QAAQ,CAAC,aAAa,OAAO,CAAC,GAAG;AACtD,WAAO,KAAK,2CAA2C;AAAA,EACzD;AACA,MAAI,MAAM,QAAQ,SAAS,UAAU,MAAM,QAAQ,SAAS,YAAY;AACtE,WAAO,KAAK,8CAA8C;AAAA,EAC5D;AACI,MAAA,OAAO,MAAM,QAAQ,SAAS,YAAY,MAAM,QAAQ,KAAK,WAAW,GAAG;AAC7E,WAAO,KAAK,gDAAgD;AAAA,EAC9D;AACA,MAAI,CAAC,WAAW,MAAM,QAAQ,IAAI,GAAG;AACnC,WAAO,KAAK,2CAA2C;AAAA,EACzD;AAEE,MAAA,OAAO,MAAM,OAAO,cAAc,YAClC,MAAM,OAAO,UAAU,WAAW,GAClC;AACA,WAAO,KAAK,8DAA8D;AAAA,EAC5E;AACI,MAAA,OAAO,MAAM,OAAO,UAAU,YAAY,MAAM,OAAO,MAAM,WAAW,GAAG;AAC7E,WAAO,KAAK,gDAAgD;AAAA,EAC9D;AAEI,MAAA,OAAO,SAAS,GAAG;AACrB,WAAO,EAAE,IAAI,OAAO,QAAQ,OAAO,KAAK;AAAA,EAC1C;AAEO,SAAA;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ,CAAC;AAAA,IACT,OAAO;AAAA,EAAA;AAEX;AAEO,SAAS,mBAAmB,KAIjC;AACI,MAAA;AACF,WAAO,uBAAuB,KAAK,MAAM,GAAG,CAAC;AAAA,EAAA,QAC7C;AACO,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,+BAA+B;AAAA,MACxC,OAAO;AAAA,IAAA;AAAA,EAEX;AACF;AAEO,SAAS,2BAA2B,OAIzC;AACI,MAAA,CAAC,SAAS,KAAK,GAAG;AACb,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,4CAA4C;AAAA,MACrD,UAAU;AAAA,IAAA;AAAA,EAEd;AAEA,QAAM,SAAmB,CAAA;AAErB,MAAA,CAAC,YAAY,OAAO,CAAC,WAAW,QAAQ,aAAa,aAAa,OAAO,CAAC,GAAG;AAC/E,WAAO,KAAK,kDAAkD;AAAA,EAChE;AACI,MAAA,MAAM,YAAY,oBAAoB;AACjC,WAAA,KAAK,uCAAuC,qBAAqB;AAAA,EAC1E;AACI,MAAA,MAAM,SAAS,sBAAsB;AAChC,WAAA,KAAK,oCAAoC,uBAAuB;AAAA,EACzE;AACI,MAAA,MAAM,cAAc,0BAA0B;AACzC,WAAA,KAAK,yCAAyC,2BAA2B;AAAA,EAClF;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG;AACvE,WAAO,KAAK,qEAAqE;AAAA,EACnF;AACA,MAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,WAAW,GAAG;AAC/D,WAAO,KAAK,uDAAuD;AAAA,EACrE;AAEI,MAAA,OAAO,SAAS,GAAG;AACrB,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU,KAAK;AAAA,EAC7C;AAEO,SAAA;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ,CAAC;AAAA,IACT,UAAU;AAAA,EAAA;AAEd;AAEO,SAAS,uBAAuB,KAIrC;AACI,MAAA;AACF,WAAO,2BAA2B,KAAK,MAAM,GAAG,CAAC;AAAA,EAAA,QACjD;AACO,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,oCAAoC;AAAA,MAC7C,UAAU;AAAA,IAAA;AAAA,EAEd;AACF;AAEA,eAAsB,yBAAyB,OAG5C;AACK,QAAA,aAAa,uBAAuB,KAAK;AAC/C,MAAI,CAAC,WAAW,MAAM,CAAC,WAAW,OAAO;AACvC,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,OAAO;AAAA,EAChD;AAEI,MAAA,CAAE,MAAM,qBAAqB,MAAM,OAAO,WAAW,MAAM,OAAO,KAAK,GAAI;AACtE,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,sDAAsD;AAAA,IAAA;AAAA,EAEnE;AAEI,MAAA;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB,MAAM;AAAA,MACN,2BAA2B,KAAK;AAAA,MAChC,MAAM,OAAO;AAAA,IAAA;AAEf,QAAI,CAAC,OAAO;AACV,aAAO,EAAE,IAAI,OAAO,QAAQ,CAAC,oBAAoB,EAAE;AAAA,IACrD;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAG,EAAA;AAAA,WACvB;AACA,WAAA;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,CAAC,oBAAoB;AAAA,IAAA;AAAA,EAEjC;AACF;AAEsB,eAAA,4BACpB,OACA,OAQC;AACK,QAAA,cAAc,MAAM,eAAe,KAAK;AACxC,QAAA,iBAAiB,MAAM,yBAAyB,KAAK;AACrD,QAAA,YAAY,gBAAgB,MAAM,QAAQ;AAChD,QAAM,iBAAiB,eAAe;AAE/B,SAAA;AAAA,IACL,OAAO,aAAa;AAAA,IACpB;AAAA,IACA;AAAA,IACA,OAAO,MAAM,OAAO;AAAA,IACpB,WAAW,MAAM;AAAA,IACjB;AAAA,EAAA;AAEJ;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ternent/seal-cli",
-  "version": "0.1.8",
+  "version": "0.3.0",
   "description": "Deterministic artifact signing for Seal",
   "license": "ISC",
   "type": "module",
@@ -45,7 +45,7 @@
     "vite": "^2.9.18",
     "vitest": "^1.6.0",
     "ternent-utils": "1.1.1",
-    "ternent-identity": "0.0.13"
+    "@ternent/identity": "0.3.0"
   },
   "scripts": {
     "build": "vite build",