@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,EACN,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,MAAM,mBAAmB,CAAC"}

package/dist/keys/index.js

@@ -0,0 +1,13 @@
+/**
+ * `@vibesdotdev/auth/keys`: the versioned key envelope contract.
+ *
+ * Universal: this closure is jose (WebCrypto build), zod/v4, the
+ * @vibesdotdev/kernel root (for `CapabilityError`) and sibling files only. Device key generation and replay-guard implementations are not
+ * exported; features obtain both through the auth/key kind.
+ */
+export { KeyEnvelopeError, keyEnvelopeErrorCodeSchema } from "./errors.js";
+export { didKeyFromEd25519PublicKey, didKeyVerificationMethodId, ed25519DidKeySchema, ed25519PublicKeyFromDidKey, importDidKeyVerificationKey } from "./did-key.js";
+export { createRecipientKeyBundle, RECIPIENT_KEY_BUNDLE_TYP, RECIPIENT_KEY_BUNDLE_VERSION, recipientKeyBundleClaimsV1Schema, verifyRecipientKeyBundle, x25519PublicJwkSchema } from "./recipient-key-bundle.js";
+export { KEY_ENVELOPE_TYP, KEY_ENVELOPE_VERSIONS, keyEnvelopeClaimsV1Schema, openKeyEnvelope, sealKeyEnvelope } from "./key-envelope.js";
+export { keyEnvelopeReplayClaimSchema } from "./replay-guard.js";
+//# sourceMappingURL=index.js.map

package/dist/keys/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAA6B,MAAM,aAAa,CAAC;AACtG,OAAO,EACN,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAE3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,gCAAgC,EAChC,wBAAwB,EACxB,qBAAqB,EAKrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,eAAe,EAMf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,4BAA4B,EAG5B,MAAM,mBAAmB,CAAC"}

package/dist/keys/jws.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod/v4';
+import { type Ed25519DidKey } from './did-key.ts';
+/** A parsed JSON object: any decoded JWS header or payload, before a strict claims schema reads it. */
+export declare const jsonObjectSchema: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export type JsonObject = z.infer<typeof jsonObjectSchema>;
+export interface VerifiedJws {
+    readonly signer: Ed25519DidKey;
+    readonly payload: JsonObject;
+}
+export declare function decodeJsonObject(bytes: Uint8Array, what: string): JsonObject;
+export declare function decodeBase64urlSegment(segment: string, what: string): Uint8Array;
+/** Split a compact serialization into exactly `count` base64url segments. */
+export declare function splitCompact(token: unknown, count: number, what: string): string[];
+/**
+ * Verify an EdDSA compact JWS whose protected header must be exactly
+ * {alg, typ, kid} with typ === expectedTyp and kid a did:key verification
+ * method. Returns the signer did:key (from kid) and the verified JSON payload.
+ */
+export declare function verifyEd25519CompactJws(token: unknown, expectedTyp: string, what: string): Promise<VerifiedJws>;
+/**
+ * Read `v` from a verified payload before any strict parse: an integer outside
+ * `accepted` is unsupported_version, never malformed.
+ */
+export declare function readVersion(payload: JsonObject, accepted: readonly number[], what: string): number;
+//# sourceMappingURL=jws.d.ts.map

package/dist/keys/jws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jws.d.ts","sourceRoot":"","sources":["../../src/keys/jws.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAgE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAiBhH,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,2QAAwC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAM5E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAIhF;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQlF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC5C,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,WAAW,CAAC,CAkCtB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOlG"}

package/dist/keys/jws.js

@@ -0,0 +1,102 @@
+import { base64url, compactVerify } from 'jose';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { z } from 'zod/v4';
+import { importDidKeyVerificationKey, parseDidKeyVerificationMethodId } from "./did-key.js";
+import { checkEd25519Signature } from "./ed25519-strict.js";
+import { attempt, attemptSync } from "./attempt.js";
+import { KeyEnvelopeError, stepFailure } from "./errors.js";
+/**
+ * INTERNAL. The EdDSA compact-JWS reader shared by recipient key bundles and
+ * the envelope's inner token. It runs the pinned order: shape and header,
+ * typ, alg allowlist, kid, strict signature bytes, then WebCrypto verify with
+ * the key derived from kid. Nothing reaches jose or WebCrypto before the
+ * header, kid and signature bytes have passed their checks.
+ */
+const BASE64URL_SEGMENT = /^[A-Za-z0-9_-]*$/;
+const ALLOWED_JWS_HEADER_MEMBERS = new Set(['alg', 'typ', 'kid']);
+const utf8 = new TextDecoder('utf-8', { fatal: true });
+/** A parsed JSON object: any decoded JWS header or payload, before a strict claims schema reads it. */
+export const jsonObjectSchema = z.record(z.string(), JsonValueSchema);
+const compactTokenSchema = z.string();
+export function decodeJsonObject(bytes, what) {
+    const decoded = attemptSync(() => jsonObjectSchema.safeParse(JSON.parse(utf8.decode(bytes))));
+    if (!decoded.ok)
+        throw new KeyEnvelopeError('malformed', `${what} is not JSON`, { cause: decoded.failure });
+    const parsed = decoded.value;
+    if (!parsed.success)
+        throw new KeyEnvelopeError('malformed', `${what} is not a JSON object`);
+    return parsed.data;
+}
+export function decodeBase64urlSegment(segment, what) {
+    const decoded = attemptSync(() => base64url.decode(segment));
+    if (!decoded.ok)
+        throw new KeyEnvelopeError('malformed', `${what} is not base64url`, { cause: decoded.failure });
+    return decoded.value;
+}
+/** Split a compact serialization into exactly `count` base64url segments. */
+export function splitCompact(token, count, what) {
+    const text = compactTokenSchema.safeParse(token);
+    if (!text.success)
+        throw new KeyEnvelopeError('malformed', `${what} is not a string`);
+    const segments = text.data.split('.');
+    if (segments.length !== count || !segments.every((segment) => BASE64URL_SEGMENT.test(segment))) {
+        throw new KeyEnvelopeError('malformed', `${what} is not a ${count}-part compact serialization`);
+    }
+    return segments;
+}
+/**
+ * Verify an EdDSA compact JWS whose protected header must be exactly
+ * {alg, typ, kid} with typ === expectedTyp and kid a did:key verification
+ * method. Returns the signer did:key (from kid) and the verified JSON payload.
+ */
+export async function verifyEd25519CompactJws(token, expectedTyp, what) {
+    const text = compactTokenSchema.safeParse(token);
+    if (!text.success)
+        throw new KeyEnvelopeError('malformed', `${what} is not a string`);
+    const compact = text.data;
+    const [headerSegment, payloadSegment, signatureSegment] = splitCompact(compact, 3, what);
+    if (!headerSegment || !payloadSegment) {
+        throw new KeyEnvelopeError('malformed', `${what} has an empty header or payload`);
+    }
+    const header = decodeJsonObject(decodeBase64urlSegment(headerSegment, `${what} header`), `${what} header`);
+    for (const member of Object.keys(header)) {
+        if (!ALLOWED_JWS_HEADER_MEMBERS.has(member)) {
+            throw new KeyEnvelopeError('malformed', `${what} header carries an unexpected member`);
+        }
+    }
+    if (header.typ !== expectedTyp) {
+        throw new KeyEnvelopeError('wrong_type', `${what} typ is not ${expectedTyp}`);
+    }
+    // Explicit allowlist, checked before any key import or verify: HS256 or
+    // 'none' never reach jose, so algorithm confusion has its own code.
+    if (header.alg !== 'EdDSA') {
+        throw new KeyEnvelopeError('unsupported_algorithm', `${what} alg is not EdDSA`);
+    }
+    const signer = parseDidKeyVerificationMethodId(header.kid);
+    // Strict signature bytes before WebCrypto: canonical R in the prime-order
+    // subgroup and S < L. WebCrypto alone accepts small-order R.
+    const signature = decodeBase64urlSegment(signatureSegment, `${what} signature`);
+    const signatureCheck = checkEd25519Signature(signature);
+    if (signatureCheck !== 'ok') {
+        throw new KeyEnvelopeError('bad_signature', `${what} signature rejected (${signatureCheck})`);
+    }
+    const verificationKey = await importDidKeyVerificationKey(signer);
+    const verified = await attempt(() => compactVerify(compact, verificationKey, { algorithms: ['EdDSA'] }));
+    if (!verified.ok)
+        throw stepFailure(verified.failure, 'bad_signature', `verify ${what} signature`);
+    return { signer, payload: decodeJsonObject(verified.value.payload, `${what} payload`) };
+}
+/**
+ * Read `v` from a verified payload before any strict parse: an integer outside
+ * `accepted` is unsupported_version, never malformed.
+ */
+export function readVersion(payload, accepted, what) {
+    const parsed = z.number().int().safeParse(payload.v);
+    if (!parsed.success)
+        throw new KeyEnvelopeError('malformed', `${what} has no integer version`);
+    if (!accepted.includes(parsed.data)) {
+        throw new KeyEnvelopeError('unsupported_version', `${what} version ${parsed.data} is not supported`);
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=jws.js.map

package/dist/keys/jws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jws.js","sourceRoot":"","sources":["../../src/keys/jws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,+BAA+B,EAAsB,MAAM,cAAc,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;GAMG;AAEH,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvD,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;AAGtE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAOtC,MAAM,UAAU,gBAAgB,CAAC,KAAiB,EAAE,IAAY;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,IAAY;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,mBAAmB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjH,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAa,EAAE,IAAY;IACvE,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,kBAAkB,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,aAAa,KAAK,6BAA6B,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,KAAc,EACd,WAAmB,EACnB,IAAY;IAEZ,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,kBAAkB,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAC1B,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,iCAAiC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,aAAa,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IAC3G,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,sCAAsC,CAAC,CAAC;QACxF,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,SAAS,GAAG,sBAAsB,CAAC,gBAAiB,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,GAAG,IAAI,wBAAwB,cAAc,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,IAAI,YAAY,CAAC,CAAC;IACnG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAmB,EAAE,QAA2B,EAAE,IAAY;IACzF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,GAAG,IAAI,yBAAyB,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,GAAG,IAAI,YAAY,MAAM,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC"}

package/dist/keys/key-envelope.d.ts

@@ -0,0 +1,85 @@
+import { z } from 'zod/v4';
+import { type Ed25519DidKey } from './did-key.ts';
+import { KEY_ENVELOPE_VERSIONS } from './envelope-versions.ts';
+import type { KeyEnvelopeReplayGuard } from './replay-guard.ts';
+/**
+ * Sign-then-encrypt envelope v1. The sender signs an inner compact JWS
+ * (typ vibes-envelope+jwt, kid = sender did:key verification method) whose
+ * claims bind the recipient (aud) and a replay id (jti); it is then encrypted
+ * to the recipient's X25519 agreement key as a compact JWE (ECDH-ES, A256GCM).
+ * The sender's identity appears only inside the ciphertext.
+ */
+export { KEY_ENVELOPE_VERSIONS };
+export declare const KEY_ENVELOPE_TYP = "vibes-envelope+jwt";
+export declare const keyEnvelopeClaimsV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    iss: z.ZodString & z.ZodType<`did:key:z6Mk${string}`, string, z.core.$ZodTypeInternals<`did:key:z6Mk${string}`, string>>;
+    aud: z.ZodString & z.ZodType<`did:key:z6Mk${string}`, string, z.core.$ZodTypeInternals<`did:key:z6Mk${string}`, string>>;
+    jti: z.ZodString;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    pld: z.ZodUnknown;
+}, z.core.$strict>;
+export interface KeyEnvelopeSender {
+    readonly did: Ed25519DidKey;
+    /** Ed25519 private signing key for `did`. */
+    readonly signingKey: CryptoKey;
+}
+export interface KeyEnvelopeRecipientKeys {
+    readonly did: Ed25519DidKey;
+    readonly agreement: {
+        readonly kid: string;
+        /** X25519 private key-agreement key. */
+        readonly privateKey: CryptoKey;
+    };
+}
+export interface OpenedKeyEnvelope<T> {
+    readonly sender: Ed25519DidKey;
+    readonly payload: T;
+    readonly jti: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+    readonly version: number;
+}
+export interface SealKeyEnvelopeInput<T> {
+    readonly sender: KeyEnvelopeSender;
+    /** The recipient's bundle string; seal verifies it itself. */
+    readonly recipientBundle: string;
+    readonly payloadSchema: z.ZodType<T>;
+    readonly payload: T;
+    readonly ttlSeconds: number;
+    /** Epoch milliseconds. */
+    readonly now?: () => number;
+}
+export interface OpenKeyEnvelopeOptions<T> {
+    readonly recipient: KeyEnvelopeRecipientKeys;
+    readonly payloadSchema: z.ZodType<T>;
+    /** Required: there is no default replay guard. */
+    readonly replayGuard: KeyEnvelopeReplayGuard;
+    /** Required: there is no default sender policy. */
+    readonly acceptSender: (sender: Ed25519DidKey) => boolean | Promise<boolean>;
+    /** Default 300. */
+    readonly maxTtlSeconds?: number;
+    /** Default 30. */
+    readonly clockToleranceSeconds?: number;
+    /** Default 262144. */
+    readonly maxEnvelopeBytes?: number;
+    /** Epoch milliseconds. */
+    readonly now?: () => number;
+}
+/**
+ * Sign-then-encrypt `payload` from `sender` to the device that signed
+ * `recipientBundle`. Order: ttlSeconds (malformed), bundle verification (its
+ * own codes), version negotiation (unsupported_version), payload schema
+ * (payload_invalid), sender did (malformed_did, checked by
+ * didKeyVerificationMethodId before signing), sign, encrypt.
+ */
+export declare function sealKeyEnvelope<T>(input: SealKeyEnvelopeInput<T>): Promise<string>;
+/**
+ * Decrypt, authenticate and admit one envelope. The order is pinned and fails
+ * closed; every step has its own code. Sender policy and payload validation run
+ * after authentication and before the replay claim, so rejected envelopes and
+ * unaccepted senders consume no guard capacity.
+ */
+export declare function openKeyEnvelope<T>(envelope: string, options: OpenKeyEnvelopeOptions<T>): Promise<OpenedKeyEnvelope<T>>;
+//# sourceMappingURL=key-envelope.d.ts.map

package/dist/keys/key-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-envelope.d.ts","sourceRoot":"","sources":["../../src/keys/key-envelope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAK/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,CAAC;AACjC,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAOrD,eAAO,MAAM,yBAAyB;;;;;;;;kBAU5B,CAAC;AAaX,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE;QACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,wCAAwC;QACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;KAC/B,CAAC;CACF;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,8DAA8D;IAC9D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0BAA0B;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,mBAAmB;IACnB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB;IAClB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,sBAAsB;IACtB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,0BAA0B;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AASD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CA0CxF;AAID;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAgF/B"}

package/dist/keys/key-envelope.js

@@ -0,0 +1,189 @@
+import { base64url, CompactEncrypt, compactDecrypt, CompactSign, importJWK } from 'jose';
+import { z } from 'zod/v4';
+import { didKeyVerificationMethodId, ed25519DidKeySchema } from "./did-key.js";
+import { KEY_ENVELOPE_VERSIONS } from "./envelope-versions.js";
+import { attempt, attemptSync } from "./attempt.js";
+import { KeyEnvelopeError, stepFailure } from "./errors.js";
+import { decodeBase64urlSegment, decodeJsonObject, readVersion, splitCompact, verifyEd25519CompactJws } from "./jws.js";
+import { epochSeconds, verifyRecipientKeyBundle, x25519PublicJwkSchema } from "./recipient-key-bundle.js";
+/**
+ * Sign-then-encrypt envelope v1. The sender signs an inner compact JWS
+ * (typ vibes-envelope+jwt, kid = sender did:key verification method) whose
+ * claims bind the recipient (aud) and a replay id (jti); it is then encrypted
+ * to the recipient's X25519 agreement key as a compact JWE (ECDH-ES, A256GCM).
+ * The sender's identity appears only inside the ciphertext.
+ */
+export { KEY_ENVELOPE_VERSIONS };
+export const KEY_ENVELOPE_TYP = 'vibes-envelope+jwt';
+const DEFAULT_MAX_TTL_SECONDS = 300;
+const DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+const DEFAULT_MAX_ENVELOPE_BYTES = 262_144;
+const JTI_BYTES = 16;
+export const keyEnvelopeClaimsV1Schema = z
+    .object({
+    v: z.literal(1),
+    iss: ed25519DidKeySchema,
+    aud: ed25519DidKeySchema,
+    jti: z.string().regex(/^[A-Za-z0-9_-]{22}$/),
+    iat: z.number().int().nonnegative(),
+    exp: z.number().int().positive(),
+    pld: z.unknown()
+})
+    .strict();
+/** The v1 outer JWE protected header, exactly. */
+const outerHeaderV1Schema = z
+    .object({
+    alg: z.literal('ECDH-ES'),
+    enc: z.literal('A256GCM'),
+    cty: z.literal('JWT'),
+    kid: z.string().min(1),
+    epk: x25519PublicJwkSchema
+})
+    .strict();
+const positiveInteger = z.number().int().positive();
+const nonNegativeInteger = z.number().int().nonnegative();
+function requireOption(valid, message) {
+    if (!valid)
+        throw new KeyEnvelopeError('malformed', message);
+}
+/**
+ * Sign-then-encrypt `payload` from `sender` to the device that signed
+ * `recipientBundle`. Order: ttlSeconds (malformed), bundle verification (its
+ * own codes), version negotiation (unsupported_version), payload schema
+ * (payload_invalid), sender did (malformed_did, checked by
+ * didKeyVerificationMethodId before signing), sign, encrypt.
+ */
+export async function sealKeyEnvelope(input) {
+    requireOption(positiveInteger.safeParse(input.ttlSeconds).success, 'ttlSeconds must be a positive integer');
+    const recipient = await verifyRecipientKeyBundle(input.recipientBundle, { now: input.now });
+    const mutual = KEY_ENVELOPE_VERSIONS.filter((version) => recipient.envelopeVersions.includes(version));
+    if (mutual.length === 0) {
+        throw new KeyEnvelopeError('unsupported_version', 'the recipient accepts no envelope version this sender writes');
+    }
+    const version = Math.max(...mutual);
+    const parsed = await input.payloadSchema.safeParseAsync(input.payload);
+    if (!parsed.success)
+        throw new KeyEnvelopeError('payload_invalid', 'payload does not match payloadSchema');
+    const iat = epochSeconds(input.now);
+    const claims = {
+        v: version,
+        iss: input.sender.did,
+        aud: recipient.did,
+        jti: base64url.encode(crypto.getRandomValues(new Uint8Array(JTI_BYTES))),
+        iat,
+        exp: iat + input.ttlSeconds,
+        pld: parsed.data
+    };
+    const serialized = attemptSync(() => JSON.stringify(claims));
+    if (!serialized.ok) {
+        throw new KeyEnvelopeError('payload_invalid', 'payload is not JSON-serializable', { cause: serialized.failure });
+    }
+    const claimsJson = serialized.value;
+    const signed = await attempt(() => new CompactSign(new TextEncoder().encode(claimsJson))
+        .setProtectedHeader({ alg: 'EdDSA', typ: KEY_ENVELOPE_TYP, kid: didKeyVerificationMethodId(input.sender.did) })
+        .sign(input.sender.signingKey));
+    if (!signed.ok)
+        throw stepFailure(signed.failure, 'unsupported_key_type', 'sign the envelope');
+    const inner = signed.value;
+    const encrypted = await attempt(async () => {
+        const recipientKey = await importJWK({ ...recipient.publicJwk }, 'ECDH-ES');
+        return new CompactEncrypt(new TextEncoder().encode(inner))
+            .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A256GCM', cty: 'JWT', kid: recipient.kid })
+            .encrypt(recipientKey);
+    });
+    if (!encrypted.ok)
+        throw stepFailure(encrypted.failure, 'unsupported_key_type', 'encrypt the envelope');
+    return encrypted.value;
+}
+const utf8 = new TextDecoder('utf-8', { fatal: true });
+/**
+ * Decrypt, authenticate and admit one envelope. The order is pinned and fails
+ * closed; every step has its own code. Sender policy and payload validation run
+ * after authentication and before the replay claim, so rejected envelopes and
+ * unaccepted senders consume no guard capacity.
+ */
+export async function openKeyEnvelope(envelope, options) {
+    const maxTtlSeconds = options.maxTtlSeconds ?? DEFAULT_MAX_TTL_SECONDS;
+    const tolerance = options.clockToleranceSeconds ?? DEFAULT_CLOCK_TOLERANCE_SECONDS;
+    const maxEnvelopeBytes = options.maxEnvelopeBytes ?? DEFAULT_MAX_ENVELOPE_BYTES;
+    requireOption(positiveInteger.safeParse(maxTtlSeconds).success, 'maxTtlSeconds must be a positive integer');
+    requireOption(nonNegativeInteger.safeParse(tolerance).success, 'clockToleranceSeconds must be a non-negative integer');
+    requireOption(positiveInteger.safeParse(maxEnvelopeBytes).success, 'maxEnvelopeBytes must be a positive integer');
+    requireOption(options.replayGuard?.claim instanceof Function, 'openKeyEnvelope requires a replayGuard');
+    requireOption(options.acceptSender instanceof Function, 'openKeyEnvelope requires an acceptSender policy');
+    requireOption(options.payloadSchema?.safeParseAsync instanceof Function, 'openKeyEnvelope requires a payloadSchema');
+    const { recipient } = options;
+    if (!z.string().safeParse(envelope).success)
+        throw new KeyEnvelopeError('malformed', 'envelope is not a string');
+    if (envelope.length > maxEnvelopeBytes)
+        throw new KeyEnvelopeError('too_large', 'envelope exceeds maxEnvelopeBytes');
+    const [headerSegment] = splitCompact(envelope, 5, 'envelope');
+    const header = outerHeaderV1Schema.safeParse(decodeJsonObject(decodeBase64urlSegment(headerSegment, 'envelope header'), 'envelope header'));
+    if (!header.success)
+        throw new KeyEnvelopeError('malformed', 'envelope header is not the v1 JWE header');
+    if (header.data.kid !== recipient.agreement.kid) {
+        throw new KeyEnvelopeError('wrong_recipient', 'envelope is addressed to another agreement key');
+    }
+    const decrypted = await attempt(() => compactDecrypt(envelope, recipient.agreement.privateKey, {
+        keyManagementAlgorithms: ['ECDH-ES'],
+        contentEncryptionAlgorithms: ['A256GCM']
+    }));
+    if (!decrypted.ok)
+        throw stepFailure(decrypted.failure, 'decrypt_failed', 'decrypt the envelope');
+    const text = attemptSync(() => utf8.decode(decrypted.value.plaintext));
+    if (!text.ok)
+        throw new KeyEnvelopeError('malformed', 'envelope plaintext is not UTF-8', { cause: text.failure });
+    const inner = text.value;
+    const { signer, payload } = await verifyEd25519CompactJws(inner, KEY_ENVELOPE_TYP, 'envelope');
+    const version = readVersion(payload, KEY_ENVELOPE_VERSIONS, 'envelope');
+    const parsed = keyEnvelopeClaimsV1Schema.safeParse(payload);
+    if (!parsed.success)
+        throw new KeyEnvelopeError('malformed', 'envelope claims are malformed');
+    const claims = parsed.data;
+    if (claims.iss !== signer) {
+        throw new KeyEnvelopeError('sender_mismatch', 'envelope iss is not the did:key that signed it');
+    }
+    if (claims.aud !== recipient.did) {
+        throw new KeyEnvelopeError('wrong_audience', 'envelope is addressed to another did:key');
+    }
+    const assertTimeWindow = () => {
+        const now = epochSeconds(options.now);
+        if (claims.iat > now + tolerance)
+            throw new KeyEnvelopeError('not_yet_valid', 'envelope is not valid yet');
+        if (now > claims.exp + tolerance)
+            throw new KeyEnvelopeError('expired', 'envelope has expired');
+    };
+    assertTimeWindow();
+    if (claims.exp <= claims.iat)
+        throw new KeyEnvelopeError('malformed', 'envelope exp is not after iat');
+    if (claims.exp - claims.iat > maxTtlSeconds) {
+        throw new KeyEnvelopeError('ttl_exceeded', 'envelope lifetime exceeds maxTtlSeconds');
+    }
+    if ((await options.acceptSender(claims.iss)) !== true) {
+        throw new KeyEnvelopeError('sender_not_accepted', 'sender policy rejected the envelope sender');
+    }
+    const pld = await options.payloadSchema.safeParseAsync(claims.pld);
+    if (!pld.success)
+        throw new KeyEnvelopeError('payload_invalid', 'envelope payload does not match payloadSchema');
+    // Policy/schema work may outlive replay retention. An expired claim can be
+    // pruned immediately, so it cannot authorize a fresh opening.
+    assertTimeWindow();
+    const claimed = await options.replayGuard.claim({
+        sender: claims.iss,
+        jti: claims.jti,
+        retainUntil: claims.exp + tolerance
+    });
+    // A storage-backed atomic claim may itself return after the accept window.
+    assertTimeWindow();
+    if (claimed !== 'fresh')
+        throw new KeyEnvelopeError('replayed', 'envelope was already opened');
+    return Object.freeze({
+        sender: claims.iss,
+        payload: pld.data,
+        jti: claims.jti,
+        issuedAt: claims.iat,
+        expiresAt: claims.exp,
+        version
+    });
+}
+//# sourceMappingURL=key-envelope.js.map

package/dist/keys/key-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-envelope.js","sourceRoot":"","sources":["../../src/keys/key-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACzF,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAsB,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxH,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAG1G;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAC3C,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;CAChB,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,kDAAkD;AAClD,MAAM,mBAAmB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACP,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,qBAAqB;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAsDX,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AACpD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAE1D,SAAS,aAAa,CAAC,KAAc,EAAE,OAAe;IACrD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,KAA8B;IACtE,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;IAC5G,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,8DAA8D,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;IAE3G,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG;QACd,CAAC,EAAE,OAAO;QACV,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;QACrB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,UAAU;QAC3B,GAAG,EAAE,MAAM,CAAC,IAAI;KAChB,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,kCAAkC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACjC,IAAI,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;SACnD,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;SAC9G,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAC/B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO,IAAI,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aACxD,kBAAkB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;aACtF,OAAO,CAAC,YAAY,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;IACxG,OAAO,SAAS,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,QAAgB,EAChB,OAAkC;IAElC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IACnF,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAChF,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;IAC5G,aAAa,CAAC,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,sDAAsD,CAAC,CAAC;IACvH,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,6CAA6C,CAAC,CAAC;IAClH,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,YAAY,QAAQ,EAAE,wCAAwC,CAAC,CAAC;IACxG,aAAa,CAAC,OAAO,CAAC,YAAY,YAAY,QAAQ,EAAE,iDAAiD,CAAC,CAAC;IAC3G,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,YAAY,QAAQ,EAAE,0CAA0C,CAAC,CAAC;IACrH,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAE9B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;IACjH,IAAI,QAAQ,CAAC,MAAM,GAAG,gBAAgB;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;IACrH,MAAM,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAC3C,gBAAgB,CAAC,sBAAsB,CAAC,aAAc,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,CAC9F,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IACzG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACpC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE;QACxD,uBAAuB,EAAE,CAAC,SAAS,CAAC;QACpC,2BAA2B,EAAE,CAAC,SAAS,CAAC;KACxC,CAAC,CACF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAEzB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,gBAAgB,GAAG,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;QAC3G,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACjG,CAAC,CAAC;IACF,gBAAgB,EAAE,CAAC;IACnB,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,aAAa,EAAE,CAAC;QAC7C,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IACjH,2EAA2E;IAC3E,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;QAC/C,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,WAAW,EAAE,MAAM,CAAC,GAAG,GAAG,SAAS;KACnC,CAAC,CAAC;IACH,2EAA2E;IAC3E,gBAAgB,EAAE,CAAC;IACnB,IAAI,OAAO,KAAK,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAE/F,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,OAAO;KACP,CAAC,CAAC;AACJ,CAAC"}

package/dist/keys/recipient-key-bundle.d.ts

@@ -0,0 +1,70 @@
+import { z } from 'zod/v4';
+import { type Ed25519DidKey } from './did-key.ts';
+/**
+ * Recipient key bundle v1: a device's self-signed statement "my X25519
+ * agreement key is cnf.jwk, and I accept these envelope versions". A compact
+ * JWS signed by the device's Ed25519 did:key; the verifier derives the key
+ * from the header kid and never from anything the payload says.
+ */
+export declare const RECIPIENT_KEY_BUNDLE_TYP = "vibes-agreement-key+jwt";
+export declare const RECIPIENT_KEY_BUNDLE_VERSION = 1;
+export declare const x25519PublicJwkSchema: z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodLiteral<"X25519">;
+    x: z.ZodString;
+}, z.core.$strict>;
+export type X25519PublicJwk = z.infer<typeof x25519PublicJwkSchema>;
+export declare const recipientKeyBundleClaimsV1Schema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    iss: z.ZodString & z.ZodType<`did:key:z6Mk${string}`, string, z.core.$ZodTypeInternals<`did:key:z6Mk${string}`, string>>;
+    kid: z.ZodString;
+    cnf: z.ZodObject<{
+        jwk: z.ZodObject<{
+            kty: z.ZodLiteral<"OKP">;
+            crv: z.ZodLiteral<"X25519">;
+            x: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    envelopeVersions: z.ZodArray<z.ZodNumber>;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$strict>;
+export type RecipientKeyBundleClaimsV1 = z.infer<typeof recipientKeyBundleClaimsV1Schema>;
+/** Verified, frozen, serializable plain data. Holds no CryptoKey. */
+export interface VerifiedRecipient {
+    readonly did: Ed25519DidKey;
+    readonly kid: string;
+    readonly publicJwk: Readonly<X25519PublicJwk>;
+    readonly envelopeVersions: readonly number[];
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+export interface RecipientKeyBundleDevice {
+    readonly did: Ed25519DidKey;
+    readonly signingKey: CryptoKey;
+    readonly agreement: {
+        readonly kid: string;
+        readonly publicJwk: X25519PublicJwk;
+    };
+}
+export declare function epochSeconds(now: (() => number) | undefined): number;
+/** Sign a v1 recipient key bundle advertising KEY_ENVELOPE_VERSIONS. */
+export declare function createRecipientKeyBundle(device: RecipientKeyBundleDevice, options: {
+    ttlSeconds: number;
+    now?: () => number;
+}): Promise<string>;
+/**
+ * Verify a recipient key bundle. Pinned order: length over 4096 characters
+ * (too_large), shape and header (malformed), typ (wrong_type), alg
+ * (unsupported_algorithm), kid (malformed_did /
+ * unsupported_key_type / malformed), strict signature bytes and verify with
+ * kid's key (bad_signature), payload JSON (malformed), v (unsupported_version),
+ * cnf.jwk kty/crv (unsupported_key_type), strict claims (malformed), iss equals
+ * kid's did (sender_mismatch), kid equals thumbprint(cnf.jwk) (malformed), iat
+ * (not_yet_valid), exp (expired).
+ */
+export declare function verifyRecipientKeyBundle(bundle: string, options?: {
+    now?: () => number;
+    clockToleranceSeconds?: number;
+}): Promise<VerifiedRecipient>;
+//# sourceMappingURL=recipient-key-bundle.d.ts.map

package/dist/keys/recipient-key-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-key-bundle.d.ts","sourceRoot":"","sources":["../../src/keys/recipient-key-bundle.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAmD,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAMnG;;;;;GAKG;AAEH,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAClE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAU9C,eAAO,MAAM,qBAAqB;;;;kBAMxB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;kBAUnC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;KAAE,CAAC;CAClF;AAUD,wBAAgB,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,CAIpE;AAED,wEAAwE;AACxE,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,wBAAwB,EAChC,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAO,GAClE,OAAO,CAAC,iBAAiB,CAAC,CA+C5B"}