@val-protocol/qes-validator 0.1.0

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/esm/index.d.ts

@@ -0,0 +1,127 @@
+/**
+ * @val-protocol/qes-validator — eIDAS QES validation for VAL Profile C (ADR 0063).
+ *
+ * The `validateQes` entry point a relying party runs THEMSELVES (so verification stays trustless), plus
+ * the `QesValidationReport` contract the zero-dep `@val-protocol/chain-verifier` consumes
+ * (`options.qesValidation.reports`). Structurally a superset of the core's `QesVerdict`
+ * ({ qualified, signerIdentity?, reportRef? }) so it drops into the seam unchanged, PLUS `signatureRef`
+ * (per-signature keying the WS6 verifier PR / §11.4 item 5 will match on) and `status`/`reason`
+ * (conclusive-vs-indeterminate, never collapsed into a bare boolean for the operator).
+ *
+ * ── BACKEND DECISION (supersedes the scaffold's "S1: wrap DSS") ────────────────────────────────────
+ * The closeout build prompt (operator-ratified, 2026-06-29) makes this a **no-DSS, no-server, pure-JS**
+ * validator — that is the entire point of "the auditor's trustless tool": a relying party verifies a VAL
+ * grant's qualified signature WITHOUT standing up a Java DSS. The earlier scaffold wrapped a self-hosted
+ * DSS over REST; that defeated trustlessness and is replaced here. (`@val-protocol/chain-verifier` stays
+ * zero-dep; this package carries the X.509/LOTL logic + reuses `@val-protocol/anchor-lotl-resolver`.)
+ *
+ * ── DOCUMENTED SUBSET (honest scope, ETSI) ─────────────────────────────────────────────────────────
+ * Implements a SUBSET of the ETSI validation chain, labelled per document:
+ *   (1) JWS/JAdES parse (ETSI TS 119 182-1);
+ *   (2) signature-value verification over the JWS signing input via the embedded x5c — ETSI TS 119 102-1;
+ *   (3) certificate-path build + verification leaf→issuer→trust-anchor — ETSI TS 119 102-1;
+ *   (4) qualification-status determination — ETSI TS 119 615: QcStatements in the signing cert
+ *       (QcCompliance 0.4.0.1862.1.1 AND QcType-eSign 0.4.0.1862.1.6.1) AND the issuer resolves to a
+ *       Trusted-List service of type CA/QC, granted-for-eSignatures, granted at signing time.
+ * NOT in scope (this is DSS's job, not reimplemented here): per-certificate OCSP/CRL revocation, full
+ * AdES-LTA/archive-timestamp LTV. Revocation here is at the Trusted-List SERVICE-STATUS granularity
+ * (granted/withdrawn at signing time), NOT per-cert OCSP. Anything this subset cannot conclude returns
+ * `indeterminate` — never a silent `qualified:true`.
+ *
+ * PRECONDITION (cert path): the full chain leaf → … → TL-listed granted CA/QC service MUST be present in
+ * `x5c` or `trust.intermediateHintsDer`. There is NO AIA/caIssuers chasing (it would need network + break
+ * the offline model). A partial `x5c` (leaf only) ⇒ `not_qualified`/`CHAIN_INCOMPLETE` (supply the chain),
+ * NOT a false `qualified`, and distinct from `ANCHOR_NOT_ON_TRUSTED_LIST` (complete chain, top not on the TL).
+ *
+ * Honesty: this validator — not the core — is the authority for "qualified". `qualified` is TRUE only on
+ * a conclusive positive determination; anything else is `not_qualified` (conclusive negative) or
+ * `indeterminate` (could not conclude). The core treats only `qualified` as the gate, so neither a null
+ * identity nor an indeterminate verdict can fake a green.
+ */
+/** eIDAS natural-person minimum dataset, surfaced verbatim from the qualified certificate. */
+export interface QesSignerIdentity {
+    given_name: string;
+    family_name: string;
+    date_of_birth: string | null;
+    persistent_id: string | null;
+    country: string | null;
+}
+/** Conclusive-vs-indeterminate (refinement 2). `qualified` (the core gate) is TRUE only iff `'qualified'`. */
+export type QesStatus = 'qualified' | 'not_qualified' | 'indeterminate';
+/** A reproducible QES validation verdict over one qualified delegation signature. */
+export interface QesValidationReport {
+    /** The ONLY field the core verifier treats as the qualified gate. TRUE only iff `status==='qualified'`. */
+    qualified: boolean;
+    /** Conclusive positive / conclusive negative / could-not-conclude (refinement 2). */
+    status: QesStatus;
+    /** Human-readable reason — distinguishes "off the EU Trusted List" from "LOTL unreachable". */
+    reason: string;
+    /** Per-signature key (refinement 1 / WS6): sha256-hex of the delegation `signature.signature` bytes,
+     *  so §11.4 item 5 can match THIS report to THIS signature instead of "first qualified report". */
+    signatureRef: string | null;
+    /** Proven natural-person identity (minimum dataset), present iff `qualified`. */
+    signerIdentity: QesSignerIdentity | null;
+    /** ETSI EN 319 102-1 main indication: 'TOTAL-PASSED' | 'TOTAL-FAILED' | 'INDETERMINATE'. */
+    indication: string;
+    /** Sub-indication when not passed (e.g. 'SIG_CRYPTO_FAILURE', 'NO_CERTIFICATE_CHAIN_FOUND'), else null. */
+    subIndication: string | null;
+    /** AdES level proven (best-effort from the JAdES header), for LTV/retention reasoning. */
+    adesLevel: string | null;
+    /** Opaque reference to this verdict's reproducible inputs (the relying party can re-run). */
+    reportRef: string | null;
+    /** Which backend produced this report. */
+    backend: 'offline-js';
+    /** sha256-hex of the TL-granted CA/QC cert the path anchored at (present iff `qualified`). Ruling 2:
+     *  feeding this back through `matchGrantedCaQc` MUST return granted — the walker cannot drift from the
+     *  DSS-cross-checked resolver. */
+    anchorFingerprint?: string | null;
+}
+/**
+ * Trust inputs for the offline determination.
+ *
+ * INVARIANT (ADR 0063, ruling 1): **the trust anchor is ONLY derived from the EU Trusted List.** No caller
+ * can inject a trust anchor — `x5c`-supplied and `intermediateHintsDer` certificates are untrusted path-
+ * building HINTS, validated per RFC 5280 §6 but NEVER trusted as a root. A path is anchored only when it
+ * reaches a cert the LOTL resolver (`matchGrantedCaQc`) calls a granted CA/QC-for-eSignatures service at
+ * signing time. (Replaces the prior `trustAnchorsDer`, which let the x5c top become the anchor — a forgeable
+ * trust root.)
+ */
+export interface QesTrustInput {
+    /** Pre-fetched member-state Trusted List XML (ETSI TS 119 612). Offline/test path. */
+    tslXml?: string;
+    /** Fetch the EU LOTL → member-state TSL live (network). */
+    fetchLive?: boolean;
+    lotlUrl?: string;
+    fetchImpl?: typeof fetch;
+    /** Extra intermediate CA certs (base64 DER) to help BUILD the path when `x5c` omits them. HINTS ONLY —
+     *  validated as path links, never a trust source. The anchor is always the TL-matched cert. */
+    intermediateHintsDer?: string[];
+}
+/** Input to validate one qualified delegation signature carried on a VAL root ASSIGNMENT. */
+export interface QesValidationInput {
+    /** The canonical bytes the QES was computed over (the root ASSIGNMENT canonical_details). */
+    signedCanonical: string;
+    /** The qualified signature carried in `human_attestation.delegator_authority.signature`
+     *  (a ValQesSignature { alg, signature } or a bare base64 JAdES string). */
+    signature: unknown;
+    /** Validation/signing time (defaults to now). For LTV, pass a chain anchor genTime (ADR 0062). */
+    validationTime?: string;
+    /** Trust material for the offline determination. */
+    trust: QesTrustInput;
+}
+/**
+ * Validate a QES → a reproducible `QesValidationReport`, with NO DSS and NO server (pure JS). The relying
+ * party runs this THEMSELVES; its output feeds `verifyValChain({ qesValidation: { reports: [...] } })`,
+ * so the core never trusts RIGA for "qualified" (Charter §II claim #12). See the file header for the
+ * documented ETSI subset and the never-silently-upgrade discipline.
+ */
+export declare function validateQes(input: QesValidationInput): Promise<QesValidationReport>;
+interface CaQcMatch {
+    matched: boolean;
+    serviceName?: string;
+    statusStartingTimeMs?: number;
+    reason?: string;
+}
+export declare function matchGrantedCaQc(tslXml: string, issuerCaFingerprintHex: string, signingTimeMs: number): CaQcMatch;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAkDH,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8GAA8G;AAC9G,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,eAAe,GAAG,eAAe,CAAC;AAExE,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,2GAA2G;IAC3G,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,SAAS,CAAC;IAClB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf;uGACmG;IACnG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iFAAiF;IACjF,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,6FAA6F;IAC7F,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0CAA0C;IAC1C,OAAO,EAAE,YAAY,CAAC;IACtB;;sCAEkC;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;mGAC+F;IAC/F,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,eAAe,EAAE,MAAM,CAAC;IACxB;gFAC4E;IAC5E,SAAS,EAAE,OAAO,CAAC;IACnB,kGAAkG;IAClG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,KAAK,EAAE,aAAa,CAAC;CACtB;AAuCD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAezF;AA+iBD,UAAU,SAAS;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,CA+BjH"}