@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/keys/did-key.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod/v4';
+/**
+ * Ed25519 did:key codec (W3C did:key, multibase base58btc 'z' over an
+ * unsigned-varint multicodec). Only Ed25519 (multicodec 0xed) is accepted, and
+ * only when its 32-byte key passes the strict acceptance checks in
+ * `ed25519-strict.ts`: a did:key naming a small-order, mixed-order,
+ * non-canonical or off-curve point is `malformed_did`, because WebCrypto would
+ * otherwise verify forged signatures for it.
+ *
+ * base58 decoding is quadratic in the input length, and a did:key reaches the
+ * decoder from untrusted input before any signature is checked (a JWS header
+ * kid, an iss or aud claim). So a multibase longer than
+ * MAX_DID_KEY_MULTIBASE_LENGTH is `malformed_did` before it is decoded.
+ */
+export type Ed25519DidKey = `did:key:z6Mk${string}`;
+/**
+ * Decode an Ed25519 did:key to its raw 32-byte public key. The order is
+ * pinned: 'did:key:' prefix, then the 'z' multibase prefix, then the multibase
+ * length bound, then the base58btc alphabet (all malformed_did), then the
+ * multicodec (a non-Ed25519 codec is unsupported_key_type; a wrong Ed25519
+ * payload length is malformed_did), then the strict point checks
+ * (malformed_did).
+ */
+export declare function ed25519PublicKeyFromDidKey(did: string): Uint8Array;
+/**
+ * An Ed25519 did:key string. The regex is only a prefilter: a string can match
+ * it and still decode to another multicodec (for example 'did:key:z6Mk' + 44
+ * 'z' decodes to 0x16d), so the refine runs the full codec. The prefilter
+ * aborts: zod v4 runs later checks after a failed one unless it aborts, and
+ * the codec never runs on a string the prefilter refused.
+ */
+export declare const ed25519DidKeySchema: z.ZodString & z.ZodType<`did:key:z6Mk${string}`, string, z.core.$ZodTypeInternals<`did:key:z6Mk${string}`, string>>;
+/** Encode a raw 32-byte Ed25519 public key as a did:key. Rejects keys the decoder would reject. */
+export declare function didKeyFromEd25519PublicKey(publicKey: Uint8Array): Ed25519DidKey;
+/** The did:key verification method id: `${did}#${multibase}`. */
+export declare function didKeyVerificationMethodId(did: Ed25519DidKey): string;
+/**
+ * Parse a verification method id back to its did:key. The did part decodes
+ * first (malformed_did / unsupported_key_type); a missing or foreign fragment is
+ * malformed.
+ */
+export declare function parseDidKeyVerificationMethodId(value: unknown): Ed25519DidKey;
+/** Import the did:key's Ed25519 public key as a verify-only WebCrypto key. */
+export declare function importDidKeyVerificationKey(did: Ed25519DidKey): Promise<CryptoKey>;
+//# sourceMappingURL=did-key.d.ts.map

package/dist/keys/did-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-key.d.ts","sourceRoot":"","sources":["../../src/keys/did-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,aAAa,GAAG,eAAe,MAAM,EAAE,CAAC;AAqFpD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAIlE;AA2CD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qHAG4C,CAAC;AAE7E,mGAAmG;AACnG,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,UAAU,GAAG,aAAa,CAY/E;AAED,iEAAiE;AACjE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAGrE;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAa7E;AAED,8EAA8E;AAC9E,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAOxF"}

package/dist/keys/did-key.js

@@ -0,0 +1,198 @@
+import { z } from 'zod/v4';
+import { checkEd25519PublicKey } from "./ed25519-strict.js";
+import { attempt } from "./attempt.js";
+import { KeyEnvelopeError, stepFailure } from "./errors.js";
+/** Text that may be a did:key or a verification method id; the check that it is a string stays at runtime for untyped callers. */
+const didTextSchema = z.string();
+const DID_KEY_PREFIX = 'did:key:';
+const MULTIBASE_BASE58BTC = 'z';
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const BASE58_INDEX = new Map([...BASE58_ALPHABET].map((char, index) => [char, index]));
+const ED25519_PUB_MULTICODEC = 0xed;
+const ED25519_PUBLIC_KEY_BYTES = 32;
+/** Unsigned-varint multicodec codes used by did:key fit in far fewer than 9 bytes. */
+const MAX_VARINT_BYTES = 9;
+const ED25519_DID_KEY_PATTERN = /^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$/;
+/**
+ * The longest multibase ('z' included) the decoder accepts. The largest key
+ * type the did:key method registers, RSA-4096 (multicodec 0x1205 plus a
+ * 526-byte PKCS#1 key), is 722 characters, so every registered non-Ed25519
+ * did:key still reaches the multicodec check and is `unsupported_key_type`.
+ * Decoding 1024 characters takes about 0.25 ms in Bun 1.4.0.
+ */
+const MAX_DID_KEY_MULTIBASE_LENGTH = 1024;
+function base58Encode(bytes) {
+    let zeros = 0;
+    while (zeros < bytes.length && bytes[zeros] === 0)
+        zeros += 1;
+    const digits = [];
+    for (let index = zeros; index < bytes.length; index += 1) {
+        let carry = bytes[index];
+        for (let digit = 0; digit < digits.length; digit += 1) {
+            carry += digits[digit] << 8;
+            digits[digit] = carry % 58;
+            carry = Math.floor(carry / 58);
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = Math.floor(carry / 58);
+        }
+    }
+    let out = '1'.repeat(zeros);
+    for (let digit = digits.length - 1; digit >= 0; digit -= 1)
+        out += BASE58_ALPHABET[digits[digit]];
+    return out;
+}
+/** Returns undefined when any character is outside the base58btc alphabet. */
+function base58Decode(text) {
+    let zeros = 0;
+    while (zeros < text.length && text[zeros] === '1')
+        zeros += 1;
+    const bytes = [];
+    for (let index = zeros; index < text.length; index += 1) {
+        const value = BASE58_INDEX.get(text[index]);
+        if (value === undefined)
+            return undefined;
+        let carry = value;
+        for (let byte = 0; byte < bytes.length; byte += 1) {
+            carry += bytes[byte] * 58;
+            bytes[byte] = carry & 0xff;
+            carry >>= 8;
+        }
+        while (carry > 0) {
+            bytes.push(carry & 0xff);
+            carry >>= 8;
+        }
+    }
+    const out = new Uint8Array(zeros + bytes.length);
+    for (let index = 0; index < bytes.length; index += 1)
+        out[out.length - 1 - index] = bytes[index];
+    return out;
+}
+/** Minimal unsigned LEB128; an overlong or truncated varint is undefined. */
+function readVarint(bytes) {
+    let value = 0;
+    for (let index = 0; index < Math.min(bytes.length, MAX_VARINT_BYTES); index += 1) {
+        const byte = bytes[index];
+        value += (byte & 0x7f) * 2 ** (7 * index);
+        if ((byte & 0x80) === 0) {
+            if (index > 0 && byte === 0)
+                return undefined;
+            return { value, length: index + 1 };
+        }
+    }
+    return undefined;
+}
+function malformedDid(reason) {
+    return new KeyEnvelopeError('malformed_did', `did:key is malformed: ${reason}`);
+}
+/**
+ * Decode an Ed25519 did:key to its raw 32-byte public key. The order is
+ * pinned: 'did:key:' prefix, then the 'z' multibase prefix, then the multibase
+ * length bound, then the base58btc alphabet (all malformed_did), then the
+ * multicodec (a non-Ed25519 codec is unsupported_key_type; a wrong Ed25519
+ * payload length is malformed_did), then the strict point checks
+ * (malformed_did).
+ */
+export function ed25519PublicKeyFromDidKey(did) {
+    const decoded = decodeEd25519DidKey(did);
+    if (decoded.error !== undefined)
+        throw decoded.error;
+    return decoded.publicKey;
+}
+/** The decoding steps of `ed25519PublicKeyFromDidKey`, in their pinned order, answering the rejection instead of throwing it. */
+function decodeEd25519DidKey(did) {
+    if (!didTextSchema.safeParse(did).success || !did.startsWith(DID_KEY_PREFIX)) {
+        return { error: malformedDid("missing 'did:key:' prefix") };
+    }
+    const multibase = did.slice(DID_KEY_PREFIX.length);
+    if (!multibase.startsWith(MULTIBASE_BASE58BTC)) {
+        return { error: malformedDid("multibase prefix is not 'z' (base58btc)") };
+    }
+    if (multibase.length > MAX_DID_KEY_MULTIBASE_LENGTH) {
+        return { error: malformedDid(`multibase is longer than ${MAX_DID_KEY_MULTIBASE_LENGTH} characters`) };
+    }
+    const decoded = base58Decode(multibase.slice(1));
+    if (decoded === undefined)
+        return { error: malformedDid('not base58btc') };
+    const codec = readVarint(decoded);
+    if (codec === undefined)
+        return { error: malformedDid('multicodec varint is truncated or overlong') };
+    if (codec.value !== ED25519_PUB_MULTICODEC) {
+        return {
+            error: new KeyEnvelopeError('unsupported_key_type', `did:key multicodec 0x${codec.value.toString(16)} is not Ed25519 (0xed)`)
+        };
+    }
+    const publicKey = decoded.slice(codec.length);
+    if (publicKey.length !== ED25519_PUBLIC_KEY_BYTES) {
+        return { error: malformedDid(`Ed25519 key must be ${ED25519_PUBLIC_KEY_BYTES} bytes`) };
+    }
+    const check = checkEd25519PublicKey(publicKey);
+    if (check !== 'ok')
+        return { error: malformedDid(`Ed25519 key rejected (${check})`) };
+    return { publicKey };
+}
+function isStrictEd25519DidKey(value) {
+    return decodeEd25519DidKey(value).error === undefined;
+}
+/**
+ * An Ed25519 did:key string. The regex is only a prefilter: a string can match
+ * it and still decode to another multicodec (for example 'did:key:z6Mk' + 44
+ * 'z' decodes to 0x16d), so the refine runs the full codec. The prefilter
+ * aborts: zod v4 runs later checks after a failed one unless it aborts, and
+ * the codec never runs on a string the prefilter refused.
+ */
+export const ed25519DidKeySchema = z
+    .string()
+    .regex(ED25519_DID_KEY_PATTERN, { abort: true })
+    .refine(isStrictEd25519DidKey, { message: 'not a strict Ed25519 did:key' });
+/** Encode a raw 32-byte Ed25519 public key as a did:key. Rejects keys the decoder would reject. */
+export function didKeyFromEd25519PublicKey(publicKey) {
+    if (!(publicKey instanceof Uint8Array) || publicKey.length !== ED25519_PUBLIC_KEY_BYTES) {
+        throw malformedDid(`Ed25519 key must be ${ED25519_PUBLIC_KEY_BYTES} bytes`);
+    }
+    const check = checkEd25519PublicKey(publicKey);
+    if (check !== 'ok')
+        throw malformedDid(`Ed25519 key rejected (${check})`);
+    const prefixed = new Uint8Array(2 + ED25519_PUBLIC_KEY_BYTES);
+    prefixed[0] = ED25519_PUB_MULTICODEC;
+    prefixed[1] = 0x01;
+    prefixed.set(publicKey, 2);
+    // SAFETY: the key passed the strict point checks above, so the encoded string decodes to a strict Ed25519 did:key.
+    return `${DID_KEY_PREFIX}${MULTIBASE_BASE58BTC}${base58Encode(prefixed)}`;
+}
+/** The did:key verification method id: `${did}#${multibase}`. */
+export function didKeyVerificationMethodId(did) {
+    ed25519PublicKeyFromDidKey(did);
+    return `${did}#${did.slice(DID_KEY_PREFIX.length)}`;
+}
+/**
+ * Parse a verification method id back to its did:key. The did part decodes
+ * first (malformed_did / unsupported_key_type); a missing or foreign fragment is
+ * malformed.
+ */
+export function parseDidKeyVerificationMethodId(value) {
+    const text = didTextSchema.safeParse(value);
+    if (!text.success)
+        throw new KeyEnvelopeError('malformed', 'kid is not a string');
+    const kid = text.data;
+    const hash = kid.indexOf('#');
+    if (hash < 0)
+        throw new KeyEnvelopeError('malformed', 'kid is not a did:key verification method');
+    const did = kid.slice(0, hash);
+    ed25519PublicKeyFromDidKey(did);
+    if (kid.slice(hash + 1) !== did.slice(DID_KEY_PREFIX.length)) {
+        throw new KeyEnvelopeError('malformed', 'kid fragment does not name the did:key');
+    }
+    // SAFETY: ed25519PublicKeyFromDidKey accepted `did` above, which is the strict Ed25519 did:key check.
+    return did;
+}
+/** Import the did:key's Ed25519 public key as a verify-only WebCrypto key. */
+export async function importDidKeyVerificationKey(did) {
+    const publicKey = ed25519PublicKeyFromDidKey(did);
+    const imported = await attempt(() => crypto.subtle.importKey('raw', new Uint8Array(publicKey), { name: 'Ed25519' }, true, ['verify']));
+    if (!imported.ok)
+        throw stepFailure(imported.failure, 'malformed_did', 'import the did:key verification key');
+    return imported.value;
+}
+//# sourceMappingURL=did-key.js.map

package/dist/keys/did-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-key.js","sourceRoot":"","sources":["../../src/keys/did-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkB5D,kIAAkI;AAClI,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AACjC,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,4DAA4D,CAAC;AACrF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC,CAAC,CAAC;AAChG,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,sFAAsF;AACtF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,uBAAuB,GAAG,wCAAwC,CAAC;AACzE;;;;;;GAMG;AACH,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAE1C,SAAS,YAAY,CAAC,KAAiB;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvD,KAAK,IAAI,MAAM,CAAC,KAAK,CAAE,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;QAAE,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,IAAY;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,IAAI,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACnD,KAAK,IAAI,KAAK,CAAC,IAAI,CAAE,GAAG,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YAC3B,KAAK,KAAK,CAAC,CAAC;QACb,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACzB,KAAK,KAAK,CAAC,CAAC;QACb,CAAC;IACF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;IAClG,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAiB;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACrC,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IACnC,OAAO,IAAI,gBAAgB,CAAC,eAAe,EAAE,yBAAyB,MAAM,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrD,OAAO,OAAO,CAAC,SAAS,CAAC;AAC1B,CAAC;AAMD,iIAAiI;AACjI,SAAS,mBAAmB,CAAC,GAAW;IACvC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,yCAAyC,CAAC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,4BAA4B,4BAA4B,aAAa,CAAC,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,4CAA4C,CAAC,EAAE,CAAC;IACtG,IAAI,KAAK,CAAC,KAAK,KAAK,sBAAsB,EAAE,CAAC;QAC5C,OAAO;YACN,KAAK,EAAE,IAAI,gBAAgB,CAC1B,sBAAsB,EACtB,wBAAwB,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,wBAAwB,CACxE;SACD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,uBAAuB,wBAAwB,QAAQ,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,yBAAyB,KAAK,GAAG,CAAC,EAAE,CAAC;IACtF,OAAO,EAAE,SAAS,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC3C,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC/C,MAAM,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAE7E,mGAAmG;AACnG,MAAM,UAAU,0BAA0B,CAAC,SAAqB;IAC/D,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QACzF,MAAM,YAAY,CAAC,uBAAuB,wBAAwB,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,YAAY,CAAC,yBAAyB,KAAK,GAAG,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;IAC9D,QAAQ,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC;IACrC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3B,mHAAmH;IACnH,OAAO,GAAG,cAAc,GAAG,mBAAmB,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAmB,CAAC;AAC5F,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,0BAA0B,CAAC,GAAkB;IAC5D,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/B,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;IACnF,CAAC;IACD,sGAAsG;IACtG,OAAO,GAAoB,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAkB;IACnE,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACnC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAChG,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,qCAAqC,CAAC,CAAC;IAC9G,OAAO,QAAQ,CAAC,KAAK,CAAC;AACvB,CAAC"}

package/dist/keys/ed25519-strict.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Strict Ed25519 acceptance checks, run before any WebCrypto verify.
+ *
+ * WebCrypto Ed25519 verify is cofactorless and does not reject small-order
+ * points. Bun 1.4.0 and Chromium 151 both verify the universal forgery (public
+ * key A = identity, R = identity, S = 0) as TRUE for every message, so a
+ * did:key naming the identity point would let anyone sign as it. `./keys`
+ * therefore accepts an Ed25519 key or signature only when:
+ *
+ * - A and R are canonical encodings (y < p, and no sign bit on x = 0),
+ * - A and R decode to points on the curve,
+ * - A and R lie in the prime-order subgroup ([8]P != O and [L]P == O),
+ * - S < L.
+ *
+ * For such inputs the cofactored and cofactorless verification equations
+ * agree, so the verdict does not depend on the engine's choice. This is the
+ * same rule Hyperspace adopts as SIG2, so both kernels return the same verdict
+ * on the same input. Pure BigInt arithmetic: no WebCrypto, clock or
+ * randomness, and no Node or Bun API, so it runs in every universal runtime.
+ */
+export type Ed25519PublicKeyCheck = 'ok' | 'length' | 'non_canonical' | 'not_on_curve' | 'small_order' | 'mixed_order';
+export type Ed25519SignatureCheck = 'ok' | 'length' | 'r_non_canonical' | 'r_not_on_curve' | 'r_small_order' | 'r_mixed_order' | 's_not_reduced';
+/** Classify a raw 32-byte Ed25519 public key. Only 'ok' may reach WebCrypto. */
+export declare function checkEd25519PublicKey(bytes: Uint8Array): Ed25519PublicKeyCheck;
+/** Classify a raw 64-byte Ed25519 signature R || S. Only 'ok' may reach WebCrypto. */
+export declare function checkEd25519Signature(bytes: Uint8Array): Ed25519SignatureCheck;
+//# sourceMappingURL=ed25519-strict.d.ts.map

package/dist/keys/ed25519-strict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-strict.d.ts","sourceRoot":"","sources":["../../src/keys/ed25519-strict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAUH,MAAM,MAAM,qBAAqB,GAC9B,IAAI,GACJ,QAAQ,GACR,eAAe,GACf,cAAc,GACd,aAAa,GACb,aAAa,CAAC;AAEjB,MAAM,MAAM,qBAAqB,GAC9B,IAAI,GACJ,QAAQ,GACR,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,eAAe,CAAC;AA2GnB,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,qBAAqB,CAE9E;AASD,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,qBAAqB,CAO9E"}

package/dist/keys/ed25519-strict.js

@@ -0,0 +1,147 @@
+/**
+ * Strict Ed25519 acceptance checks, run before any WebCrypto verify.
+ *
+ * WebCrypto Ed25519 verify is cofactorless and does not reject small-order
+ * points. Bun 1.4.0 and Chromium 151 both verify the universal forgery (public
+ * key A = identity, R = identity, S = 0) as TRUE for every message, so a
+ * did:key naming the identity point would let anyone sign as it. `./keys`
+ * therefore accepts an Ed25519 key or signature only when:
+ *
+ * - A and R are canonical encodings (y < p, and no sign bit on x = 0),
+ * - A and R decode to points on the curve,
+ * - A and R lie in the prime-order subgroup ([8]P != O and [L]P == O),
+ * - S < L.
+ *
+ * For such inputs the cofactored and cofactorless verification equations
+ * agree, so the verdict does not depend on the engine's choice. This is the
+ * same rule Hyperspace adopts as SIG2, so both kernels return the same verdict
+ * on the same input. Pure BigInt arithmetic: no WebCrypto, clock or
+ * randomness, and no Node or Bun API, so it runs in every universal runtime.
+ */
+const P = 2n ** 255n - 19n;
+const L = 2n ** 252n + 27742317777372353535851937790883648493n;
+/** d = -121665 / 121666 mod p */
+const D = 37095705934669439343138083508754565189542113879843219016388785533085940283555n;
+const D2 = (2n * D) % P;
+/** sqrt(-1) mod p */
+const SQRT_M1 = 19681161376707505956807079304988542015446066515923890162744021073123829784752n;
+const IDENTITY = { x: 0n, y: 1n, z: 1n, t: 0n };
+function mod(value) {
+    const result = value % P;
+    return result >= 0n ? result : result + P;
+}
+function pow(base, exponent) {
+    let result = 1n;
+    let b = mod(base);
+    let e = exponent;
+    while (e > 0n) {
+        if (e & 1n)
+            result = (result * b) % P;
+        b = (b * b) % P;
+        e >>= 1n;
+    }
+    return result;
+}
+function littleEndian(bytes) {
+    let value = 0n;
+    for (let index = bytes.length - 1; index >= 0; index -= 1) {
+        value = (value << 8n) | BigInt(bytes[index]);
+    }
+    return value;
+}
+/** RFC 8032 §5.1.3 point decoding, with the canonical-encoding checks made explicit. */
+function decodePoint(bytes) {
+    const encoded = littleEndian(bytes);
+    const sign = encoded >> 255n;
+    const y = encoded & ((1n << 255n) - 1n);
+    if (y >= P)
+        return { ok: false, reason: 'non_canonical' };
+    const yy = (y * y) % P;
+    const u = mod(yy - 1n);
+    const v = mod(D * yy + 1n);
+    const v3 = (v * v % P) * v % P;
+    const v7 = (v3 * v3 % P) * v % P;
+    let x = (u * v3 % P) * pow(u * v7, (P - 5n) / 8n) % P;
+    const vxx = (v * x % P) * x % P;
+    if (vxx !== u) {
+        if (vxx === mod(-u))
+            x = (x * SQRT_M1) % P;
+        else
+            return { ok: false, reason: 'not_on_curve' };
+    }
+    if (x === 0n && sign === 1n)
+        return { ok: false, reason: 'non_canonical' };
+    if ((x & 1n) !== sign)
+        x = P - x;
+    return { ok: true, point: { x, y, z: 1n, t: (x * y) % P } };
+}
+/** Extended twisted Edwards addition for a = -1 (RFC 8032 §5.1.4). */
+function add(p, q) {
+    const a = mod((p.y - p.x) * (q.y - q.x));
+    const b = mod((p.y + p.x) * (q.y + q.x));
+    const c = mod(p.t * D2 % P * q.t);
+    const d = mod(2n * p.z * q.z);
+    const e = b - a;
+    const f = d - c;
+    const g = d + c;
+    const h = b + a;
+    return { x: mod(e * f), y: mod(g * h), z: mod(f * g), t: mod(e * h) };
+}
+function double(p) {
+    const a = (p.x * p.x) % P;
+    const b = (p.y * p.y) % P;
+    const c = (2n * p.z * p.z) % P;
+    const h = a + b;
+    const xy = p.x + p.y;
+    const e = mod(h - xy * xy);
+    const g = mod(a - b);
+    const f = mod(c + g);
+    return { x: mod(e * f), y: mod(g * h), z: mod(f * g), t: mod(e * h) };
+}
+function multiply(point, scalar) {
+    let result = IDENTITY;
+    for (let bit = BigInt(scalar.toString(2).length - 1); bit >= 0n; bit -= 1n) {
+        result = double(result);
+        if ((scalar >> bit) & 1n)
+            result = add(result, point);
+    }
+    return result;
+}
+function isIdentity(point) {
+    return mod(point.x) === 0n && mod(point.y - point.z) === 0n;
+}
+function checkPoint(bytes) {
+    if (bytes.length !== 32)
+        return 'length';
+    const decoded = decodePoint(bytes);
+    if (!decoded.ok)
+        return decoded.reason;
+    if (isIdentity(double(double(double(decoded.point)))))
+        return 'small_order';
+    if (!isIdentity(multiply(decoded.point, L)))
+        return 'mixed_order';
+    return 'ok';
+}
+/** Classify a raw 32-byte Ed25519 public key. Only 'ok' may reach WebCrypto. */
+export function checkEd25519PublicKey(bytes) {
+    return checkPoint(bytes);
+}
+const R_REJECTIONS = {
+    non_canonical: 'r_non_canonical',
+    not_on_curve: 'r_not_on_curve',
+    small_order: 'r_small_order',
+    mixed_order: 'r_mixed_order'
+};
+/** Classify a raw 64-byte Ed25519 signature R || S. Only 'ok' may reach WebCrypto. */
+export function checkEd25519Signature(bytes) {
+    if (bytes.length !== 64)
+        return 'length';
+    const r = checkPoint(bytes.subarray(0, 32));
+    // R is exactly 32 bytes here, so 'length' cannot occur.
+    if (r !== 'ok' && r !== 'length')
+        return R_REJECTIONS[r];
+    if (littleEndian(bytes.subarray(32, 64)) >= L)
+        return 's_not_reduced';
+    return 'ok';
+}
+//# sourceMappingURL=ed25519-strict.js.map

package/dist/keys/ed25519-strict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519-strict.js","sourceRoot":"","sources":["../../src/keys/ed25519-strict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG,CAAC;AAC3B,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,uCAAuC,CAAC;AAC/D,iCAAiC;AACjC,MAAM,CAAC,GAAG,8EAA8E,CAAC;AACzF,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AACxB,qBAAqB;AACrB,MAAM,OAAO,GAAG,8EAA8E,CAAC;AA0B/F,MAAM,QAAQ,GAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAE/D,SAAS,GAAG,CAAC,KAAa;IACzB,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,QAAgB;IAC1C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,IAAI,CAAC,GAAG,QAAQ,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACtC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAID,wFAAwF;AACxF,SAAS,WAAW,CAAC,KAAiB;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC3E,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI;QAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,sEAAsE;AACtE,SAAS,GAAG,CAAC,CAAgB,EAAE,CAAgB;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,CAAgB;IAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoB,EAAE,MAAc;IACrD,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,KAAK,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QAC5E,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;YAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACvC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACvC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IAClE,OAAO,IAAI,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACtD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,YAAY,GAAG;IACpB,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,gBAAgB;IAC9B,WAAW,EAAE,eAAe;IAC5B,WAAW,EAAE,eAAe;CACsE,CAAC;AAEpG,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5C,wDAAwD;IACxD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IACtE,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/keys/envelope-versions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * INTERNAL. The envelope wire versions this reader and writer speak. Kept in
+ * its own module so recipient bundles (which advertise it) and the envelope
+ * (which negotiates against it) share one value without an import cycle.
+ * Re-exported publicly from `key-envelope.ts`.
+ */
+export declare const KEY_ENVELOPE_VERSIONS: readonly [1];
+//# sourceMappingURL=envelope-versions.d.ts.map

package/dist/keys/envelope-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-versions.d.ts","sourceRoot":"","sources":["../../src/keys/envelope-versions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,cAAe,CAAC"}

package/dist/keys/envelope-versions.js

@@ -0,0 +1,8 @@
+/**
+ * INTERNAL. The envelope wire versions this reader and writer speak. Kept in
+ * its own module so recipient bundles (which advertise it) and the envelope
+ * (which negotiates against it) share one value without an import cycle.
+ * Re-exported publicly from `key-envelope.ts`.
+ */
+export const KEY_ENVELOPE_VERSIONS = [1];
+//# sourceMappingURL=envelope-versions.js.map

package/dist/keys/envelope-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope-versions.js","sourceRoot":"","sources":["../../src/keys/envelope-versions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,CAAU,CAAC"}

package/dist/keys/errors.d.ts

@@ -0,0 +1,56 @@
+import { z } from 'zod/v4';
+import { CapabilityError, type CaughtFailure } from '@vibesdotdev/kernel';
+/**
+ * Every rejection `@vibesdotdev/auth/keys` can raise. The set is part of the
+ * public contract: callers branch on `KeyEnvelopeError.reason` (also kept as
+ * `legacyCode`), never on the message text.
+ */
+export declare const keyEnvelopeErrorCodeSchema: z.ZodEnum<{
+    expired: "expired";
+    malformed_did: "malformed_did";
+    unsupported_key_type: "unsupported_key_type";
+    unsupported_runtime: "unsupported_runtime";
+    unsupported_algorithm: "unsupported_algorithm";
+    unsupported_version: "unsupported_version";
+    malformed: "malformed";
+    wrong_type: "wrong_type";
+    too_large: "too_large";
+    wrong_recipient: "wrong_recipient";
+    decrypt_failed: "decrypt_failed";
+    bad_signature: "bad_signature";
+    sender_mismatch: "sender_mismatch";
+    wrong_audience: "wrong_audience";
+    not_yet_valid: "not_yet_valid";
+    ttl_exceeded: "ttl_exceeded";
+    sender_not_accepted: "sender_not_accepted";
+    payload_invalid: "payload_invalid";
+    replayed: "replayed";
+    replay_guard_full: "replay_guard_full";
+}>;
+export type KeyEnvelopeErrorCode = z.infer<typeof keyEnvelopeErrorCodeSchema>;
+/**
+ * The only error type `./keys` throws for its own failures: a `CapabilityError`
+ * whose `reason` is the rejection code (`legacyCode` keeps the same value for
+ * readers of the old `code` field). Messages name the failed step and never
+ * carry key material, plaintext or payload values; `cause` is the failure that
+ * ended the step, kept for a logger.
+ */
+export declare class KeyEnvelopeError extends CapabilityError {
+    readonly legacyCode: KeyEnvelopeErrorCode;
+    /**
+     * A failure whose `cause` is WebCrypto's `NotSupportedError` (Ed25519 or
+     * X25519 unavailable) means the runtime cannot run this contract, whichever
+     * step hit it: it is `unsupported_runtime`, and a step message ending in
+     * ' failed' names the unsupported algorithm instead.
+     */
+    constructor(code: KeyEnvelopeErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * What a captured failure of `step` becomes: a `KeyEnvelopeError` already
+ * raised inside the step stays as it is; anything else is `code` for the step,
+ * with the failure kept as `cause` and its text dropped.
+ */
+export declare function stepFailure(failure: CaughtFailure, code: KeyEnvelopeErrorCode, step: string): KeyEnvelopeError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/keys/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/keys/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,eAAe,EAA4B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpG;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;EAqBrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AA0B9E;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,eAAe;IACpD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAE1C;;;;;OAKG;gBACS,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAa1F;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAG9G"}

package/dist/keys/errors.js

@@ -0,0 +1,88 @@
+import { z } from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+/**
+ * Every rejection `@vibesdotdev/auth/keys` can raise. The set is part of the
+ * public contract: callers branch on `KeyEnvelopeError.reason` (also kept as
+ * `legacyCode`), never on the message text.
+ */
+export const keyEnvelopeErrorCodeSchema = z.enum([
+    'malformed_did',
+    'unsupported_key_type',
+    'unsupported_runtime',
+    'unsupported_algorithm',
+    'unsupported_version',
+    'malformed',
+    'wrong_type',
+    'too_large',
+    'wrong_recipient',
+    'decrypt_failed',
+    'bad_signature',
+    'sender_mismatch',
+    'wrong_audience',
+    'expired',
+    'not_yet_valid',
+    'ttl_exceeded',
+    'sender_not_accepted',
+    'payload_invalid',
+    'replayed',
+    'replay_guard_full'
+]);
+/** The `CapabilityError` code each rejection belongs to. */
+const CAPABILITY_CODE = {
+    malformed_did: 'INVALID_INPUT',
+    unsupported_key_type: 'INVALID_INPUT',
+    unsupported_runtime: 'UNAVAILABLE',
+    unsupported_algorithm: 'INVALID_INPUT',
+    unsupported_version: 'INVALID_INPUT',
+    malformed: 'INVALID_INPUT',
+    wrong_type: 'INVALID_INPUT',
+    too_large: 'INVALID_INPUT',
+    wrong_recipient: 'INVALID_INPUT',
+    decrypt_failed: 'INVALID_INPUT',
+    bad_signature: 'INVALID_INPUT',
+    sender_mismatch: 'INVALID_INPUT',
+    wrong_audience: 'INVALID_INPUT',
+    expired: 'INVALID_INPUT',
+    not_yet_valid: 'INVALID_INPUT',
+    ttl_exceeded: 'INVALID_INPUT',
+    sender_not_accepted: 'PERMISSION_DENIED',
+    payload_invalid: 'INVALID_INPUT',
+    replayed: 'INVALID_INPUT',
+    replay_guard_full: 'UNAVAILABLE'
+};
+/**
+ * The only error type `./keys` throws for its own failures: a `CapabilityError`
+ * whose `reason` is the rejection code (`legacyCode` keeps the same value for
+ * readers of the old `code` field). Messages name the failed step and never
+ * carry key material, plaintext or payload values; `cause` is the failure that
+ * ended the step, kept for a logger.
+ */
+export class KeyEnvelopeError extends CapabilityError {
+    legacyCode;
+    /**
+     * A failure whose `cause` is WebCrypto's `NotSupportedError` (Ed25519 or
+     * X25519 unavailable) means the runtime cannot run this contract, whichever
+     * step hit it: it is `unsupported_runtime`, and a step message ending in
+     * ' failed' names the unsupported algorithm instead.
+     */
+    constructor(code, message, options = {}) {
+        const unsupported = options.cause instanceof Error && options.cause.name === 'NotSupportedError';
+        const rejection = keyEnvelopeErrorCodeSchema.parse(unsupported ? 'unsupported_runtime' : code);
+        super(unsupported
+            ? `${message.endsWith(' failed') ? message.slice(0, -' failed'.length) : message}: this runtime does not support the required WebCrypto algorithm`
+            : message, CAPABILITY_CODE[rejection], { reason: rejection, retryable: rejection === 'replay_guard_full', cause: options.cause });
+        this.name = 'KeyEnvelopeError';
+        this.legacyCode = rejection;
+    }
+}
+/**
+ * What a captured failure of `step` becomes: a `KeyEnvelopeError` already
+ * raised inside the step stays as it is; anything else is `code` for the step,
+ * with the failure kept as `cause` and its text dropped.
+ */
+export function stepFailure(failure, code, step) {
+    if (failure instanceof KeyEnvelopeError)
+        return failure;
+    return new KeyEnvelopeError(code, `${step} failed`, { cause: failure });
+}
+//# sourceMappingURL=errors.js.map

package/dist/keys/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/keys/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAgD,MAAM,qBAAqB,CAAC;AAEpG;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,eAAe;IACf,sBAAsB;IACtB,qBAAqB;IACrB,uBAAuB;IACvB,qBAAqB;IACrB,WAAW;IACX,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,SAAS;IACT,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,iBAAiB;IACjB,UAAU;IACV,mBAAmB;CACnB,CAAC,CAAC;AAIH,4DAA4D;AAC5D,MAAM,eAAe,GAAG;IACvB,aAAa,EAAE,eAAe;IAC9B,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,aAAa;IAClC,qBAAqB,EAAE,eAAe;IACtC,mBAAmB,EAAE,eAAe;IACpC,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,eAAe;IAC3B,SAAS,EAAE,eAAe;IAC1B,eAAe,EAAE,eAAe;IAChC,cAAc,EAAE,eAAe;IAC/B,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,eAAe;IAChC,cAAc,EAAE,eAAe;IAC/B,OAAO,EAAE,eAAe;IACxB,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,eAAe;IAC7B,mBAAmB,EAAE,mBAAmB;IACxC,eAAe,EAAE,eAAe;IAChC,QAAQ,EAAE,eAAe;IACzB,iBAAiB,EAAE,aAAa;CACqC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IAC3C,UAAU,CAAuB;IAE1C;;;;;OAKG;IACH,YAAY,IAA0B,EAAE,OAAe,EAAE,UAA+B,EAAE;QACzF,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,YAAY,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC;QACjG,MAAM,SAAS,GAAG,0BAA0B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/F,KAAK,CACJ,WAAW;YACV,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,kEAAkE;YAClJ,CAAC,CAAC,OAAO,EACV,eAAe,CAAC,SAAS,CAAC,EAC1B,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,KAAK,mBAAmB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC7B,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAsB,EAAE,IAA0B,EAAE,IAAY;IAC3F,IAAI,OAAO,YAAY,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACxD,OAAO,IAAI,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AACzE,CAAC"}

package/dist/keys/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@vibesdotdev/auth/keys`: the versioned key envelope contract.
+ *
+ * Universal: this closure is jose (WebCrypto build), zod/v4, the
+ * @vibesdotdev/kernel root (for `CapabilityError`) and sibling files only. Device key generation and replay-guard implementations are not
+ * exported; features obtain both through the auth/key kind.
+ */
+export { KeyEnvelopeError, keyEnvelopeErrorCodeSchema, type KeyEnvelopeErrorCode } from './errors.ts';
+export { didKeyFromEd25519PublicKey, didKeyVerificationMethodId, ed25519DidKeySchema, ed25519PublicKeyFromDidKey, importDidKeyVerificationKey, type Ed25519DidKey } from './did-key.ts';
+export { createRecipientKeyBundle, RECIPIENT_KEY_BUNDLE_TYP, RECIPIENT_KEY_BUNDLE_VERSION, recipientKeyBundleClaimsV1Schema, verifyRecipientKeyBundle, x25519PublicJwkSchema, type RecipientKeyBundleClaimsV1, type RecipientKeyBundleDevice, type VerifiedRecipient, type X25519PublicJwk } from './recipient-key-bundle.ts';
+export { KEY_ENVELOPE_TYP, KEY_ENVELOPE_VERSIONS, keyEnvelopeClaimsV1Schema, openKeyEnvelope, sealKeyEnvelope, type KeyEnvelopeRecipientKeys, type KeyEnvelopeSender, type OpenedKeyEnvelope, type OpenKeyEnvelopeOptions, type SealKeyEnvelopeInput } from './key-envelope.ts';
+export { keyEnvelopeReplayClaimSchema, type KeyEnvelopeReplayClaim, type KeyEnvelopeReplayGuard } from './replay-guard.ts';
+//# sourceMappingURL=index.d.ts.map