@vouch-protocol-official/core-wasm 0.1.0

package/LICENSE

@@ -0,0 +1,198 @@
+Apache License 2.0
+==================
+
+Copyright 2025 Vouch Protocol Contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+NOTE: The Vouch Protocol specification may be contributed to W3C
+Verifiable Credentials Working Group as a separate standards track.
+
+================================================================================
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/README.md

@@ -0,0 +1,103 @@
+# @vouch-protocol-official/core-wasm
+
+The canonical Vouch Protocol core, compiled to WebAssembly for browsers and
+Node.js. It is a thin wrapper over one byte-exact Rust crate (`vouch-core`), the
+same core that powers the native and mobile SDKs, so every platform produces and
+verifies identical bytes. No JCS or proof logic is re-implemented per language.
+
+Apache-2.0. Part of the Vouch Protocol (https://vouch-protocol.com).
+
+## What it does
+
+- **JCS canonicalization** (RFC 8785)
+- **Ed25519** keygen, sign, verify
+- **did:key** and **multikey** (Ed25519, ML-DSA-44) encode/decode
+- **Data Integrity proofs**, cryptosuite `eddsa-jcs-2022` (build/verify)
+- **Vouch credentials** build and verify (with validity-window checks)
+- **Delegation** time-bound chain validation
+- **Post-quantum**: ML-DSA-44 (FIPS 204) and dual proofs (Ed25519 + ML-DSA, two
+  independent proofs), plus verification of the v1.6.x composite profile
+- **Revocation**: BitstringStatusList status checks
+
+## Install
+
+```
+npm install @vouch-protocol-official/core-wasm
+```
+
+## Usage (browser)
+
+The package is built with the `web` target, so you initialize the WASM module
+once, then call the functions. Binary values (keys, messages, signatures) are
+base64 strings; credentials and proofs are JSON strings.
+
+```js
+import init, * as core from '@vouch-protocol-official/core-wasm';
+
+await init(); // fetches the .wasm next to the module
+
+const kp = JSON.parse(core.generateEd25519());
+const signed = core.signCredential(
+  JSON.stringify(myCredential),
+  kp.seed_b64,
+  kp.did_key + '#key-1',
+  '2026-04-26T10:00:00Z'
+);
+const ok = core.verifyProof(signed, kp.public_b64); // true
+```
+
+## Usage (Node.js, ESM)
+
+Two Node-specific notes:
+
+1. Pass the wasm bytes to `init` (no fetch in Node):
+
+   ```js
+   import init, * as core from '@vouch-protocol-official/core-wasm';
+   import { readFileSync } from 'fs';
+   import { createRequire } from 'module';
+   const require = createRequire(import.meta.url);
+   const wasmPath = require.resolve('@vouch-protocol-official/core-wasm/vouch_core_wasm_bg.wasm');
+   await init({ module_or_path: readFileSync(wasmPath) });
+   ```
+
+2. Key generation and ML-DSA signing need a CSPRNG. Browsers expose it natively;
+   under Node ESM you must make Web Crypto global before calling those functions
+   (verification and deterministic signing do not need this):
+
+   ```js
+   import { webcrypto } from 'node:crypto';
+   if (!globalThis.crypto) globalThis.crypto = webcrypto;
+   ```
+
+## Next.js / bundlers
+
+This is a WASM module. With the App Router, call `init()` in a client component
+(or a server action) before using the API, and ensure your bundler serves the
+`.wasm` asset. With Webpack set `experiments.asyncWebAssembly = true`; with
+Turbopack and Vite the default wasm handling works.
+
+## API
+
+All functions return strings (JSON or base64) or booleans, and throw on bad
+input. Highlights:
+
+- `canonicalize(json) -> string`
+- `generateEd25519() -> {seed_b64, public_b64, multikey, did_key}` (JSON)
+- `ed25519Sign(seed_b64, message_b64) -> string`, `ed25519Verify(public_b64, message_b64, signature_b64) -> bool`
+- `encodeEd25519Multikey(public_b64) -> string`, `decodeMultikey(mk) -> {algorithm, raw_b64}`
+- `didKeyFromEd25519(public_b64) -> string`, `ed25519FromDidKey(did) -> string`
+- `buildProof(credentialJson, seed_b64, verificationMethod, createdIso) -> proofJson`
+- `signCredential(...)`, `verifyProof(credentialJson, public_b64) -> bool`
+- `verifyCredential(credentialJson, public_b64, nowIso, clockSkewSeconds) -> {proofValid, timeValid, valid}`
+- `verifyChainTimeBound(chainJson, nowIso, clockSkewSeconds) -> bool`
+- `generateMldsa44() -> {secret_b64, public_b64}`, `mldsa44Sign(...)`, `mldsa44Verify(...)`
+- `signDual(...)`, `verifyDual(...)`, `verifyComposite(...)`
+- `verifyStatus(credentialStatusJson, statusListCredentialJson) -> bool`
+- `version() -> string`
+
+## Interop
+
+Output is verified byte-for-byte against shared cross-language vectors in
+`test-vectors/` (JCS, eddsa-jcs-2022, hybrid ML-DSA, BitstringStatusList). A
+proof built here verifies in the TypeScript, Python, and Go SDKs and vice versa.

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@vouch-protocol-official/core-wasm",
+  "type": "module",
+  "collaborators": [
+    "Ramprasad Anandam Gaddam"
+  ],
+  "description": "Vouch Protocol canonical core (WASM): JCS canonicalization, Ed25519, did:key/multikey, Data Integrity (eddsa-jcs-2022), credentials, delegation, dual-proof ML-DSA-44, and BitstringStatusList revocation. One byte-exact Rust implementation shared across every Vouch SDK.",
+  "version": "0.1.0",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vouch-protocol/vouch",
+    "directory": "core/wasm"
+  },
+  "files": [
+    "vouch_core_wasm_bg.wasm",
+    "vouch_core_wasm.js",
+    "vouch_core_wasm.d.ts",
+    "vouch_core_wasm_bg.wasm.d.ts",
+    "README.md",
+    "LICENSE"
+  ],
+  "main": "vouch_core_wasm.js",
+  "types": "vouch_core_wasm.d.ts",
+  "sideEffects": [
+    "./snippets/*"
+  ],
+  "homepage": "https://vouch-protocol.com",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/vouch_core_wasm.d.ts

@@ -0,0 +1,123 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/**
+ * Build a delegation link. Pass null/undefined for the optional validFrom,
+ * validUntil, parentProofValue. Returns the link as a JSON string.
+ */
+export function buildDelegationLink(issuer: string, subject: string, intent_json: string, valid_from?: string | null, valid_until?: string | null, parent_proof_value?: string | null): string;
+
+export function buildProof(credential_json: string, seed_b64: string, verification_method: string, created: string): string;
+
+/**
+ * RFC 8785 canonicalization of a JSON string.
+ */
+export function canonicalize(json_str: string): string;
+
+export function decodeMultikey(multikey_str: string): string;
+
+export function didKeyFromEd25519(public_b64: string): string;
+
+export function ed25519FromDidKey(did: string): string;
+
+export function ed25519Sign(seed_b64: string, message_b64: string): string;
+
+export function ed25519Verify(public_b64: string, message_b64: string, signature_b64: string): boolean;
+
+export function encodeEd25519Multikey(public_b64: string): string;
+
+/**
+ * Generate an Ed25519 key pair. Returns {seed_b64, public_b64, multikey, did_key}.
+ */
+export function generateEd25519(): string;
+
+/**
+ * Generate an ML-DSA-44 key pair. Returns {secret_b64, public_b64}.
+ */
+export function generateMldsa44(): string;
+
+export function mldsa44Sign(secret_b64: string, public_b64: string, message_b64: string): string;
+
+export function mldsa44Verify(public_b64: string, message_b64: string, signature_b64: string): boolean;
+
+export function signCredential(credential_json: string, seed_b64: string, verification_method: string, created: string): string;
+
+/**
+ * Build a dual proof (Ed25519 + ML-DSA-44) and attach it to the credential.
+ */
+export function signDual(credential_json: string, ed25519_seed_b64: string, mldsa_secret_b64: string, mldsa_public_b64: string, ed25519_vm: string, mldsa_vm: string, created: string): string;
+
+/**
+ * Validate the time-bound rule over a delegation chain (JSON array of links).
+ */
+export function verifyChainTimeBound(chain_json: string, now_iso: string, clock_skew_seconds: number): boolean;
+
+export function verifyComposite(credential_json: string, ed25519_public_b64: string, mldsa_public_b64: string): boolean;
+
+export function verifyCredential(credential_json: string, public_b64: string, now_iso: string, clock_skew_seconds: number): string;
+
+export function verifyDual(credential_json: string, ed25519_public_b64: string, mldsa_public_b64: string): boolean;
+
+export function verifyProof(credential_json: string, public_b64: string): boolean;
+
+export function verifyStatus(credential_status_json: string, status_list_credential_json: string): boolean;
+
+/**
+ * Library version (matches the crate version).
+ */
+export function version(): string;
+
+export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
+
+export interface InitOutput {
+    readonly memory: WebAssembly.Memory;
+    readonly buildDelegationLink: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number, k: number, l: number, m: number) => void;
+    readonly buildProof: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number) => void;
+    readonly canonicalize: (a: number, b: number, c: number) => void;
+    readonly decodeMultikey: (a: number, b: number, c: number) => void;
+    readonly didKeyFromEd25519: (a: number, b: number, c: number) => void;
+    readonly ed25519FromDidKey: (a: number, b: number, c: number) => void;
+    readonly ed25519Sign: (a: number, b: number, c: number, d: number, e: number) => void;
+    readonly ed25519Verify: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+    readonly encodeEd25519Multikey: (a: number, b: number, c: number) => void;
+    readonly generateEd25519: (a: number) => void;
+    readonly generateMldsa44: (a: number) => void;
+    readonly mldsa44Sign: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+    readonly mldsa44Verify: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+    readonly signCredential: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number) => void;
+    readonly signDual: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number, k: number, l: number, m: number, n: number, o: number) => void;
+    readonly verifyChainTimeBound: (a: number, b: number, c: number, d: number, e: number, f: number) => void;
+    readonly verifyComposite: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+    readonly verifyCredential: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => void;
+    readonly verifyDual: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+    readonly verifyProof: (a: number, b: number, c: number, d: number, e: number) => void;
+    readonly verifyStatus: (a: number, b: number, c: number, d: number, e: number) => void;
+    readonly version: (a: number) => void;
+    readonly __wbindgen_export: (a: number) => void;
+    readonly __wbindgen_add_to_stack_pointer: (a: number) => number;
+    readonly __wbindgen_export2: (a: number, b: number) => number;
+    readonly __wbindgen_export3: (a: number, b: number, c: number, d: number) => number;
+    readonly __wbindgen_export4: (a: number, b: number, c: number) => void;
+}
+
+export type SyncInitInput = BufferSource | WebAssembly.Module;
+
+/**
+ * Instantiates the given `module`, which can either be bytes or
+ * a precompiled `WebAssembly.Module`.
+ *
+ * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
+ *
+ * @returns {InitOutput}
+ */
+export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
+
+/**
+ * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
+ * for everything else, calls `WebAssembly.instantiate` directly.
+ *
+ * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
+ *
+ * @returns {Promise<InitOutput>}
+ */
+export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;