@zanii/core 0.5.5 → 0.5.6

package/README.md

@@ -61,6 +61,7 @@ revocations, and on-chain anchor consistency.
 
 ## Changelog
 
+- **0.5.6** — `createSTHAsync`: sign tree heads with a key held outside the process.
 - **0.5.5** — `createReceiptAsync` and `signA2ABodyAsync`: sign receipts with a key held outside the process (HSM, KMS, signing service). Same bytes, same receipts.
 - **0.5.4** — `signObject` / `verifySignedObject`: sign any statement as a did:key over its RFC 8785 bytes (used by the domain packages for device readings, reports and attestations).
 - **0.5.3** — protocol 1.3: `payloadBytes` encodes non-integer numbers as RFC 8785 specifies instead of refusing them; whole numbers beyond ±(2^53−1) stay refused.

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { generateKeypair, didFromPublicKey, publicKeyFromDid, type Keypair } fro
 export { canonicalBytes, jcsHash } from './encoding.js';
 export { createCert, certHash, createRevocation, verifyRevocation, verifyCertSignature, verifyChain, scopeCovers, scopesAllow, type DelegationCert, type RevocationRecord, type ChainResult, } from './delegation.js';
 export { leafHash, merkleRoot, inclusionProof, verifyInclusion, consistencyProof, verifyConsistency, } from './merkle.js';
-export { createSTH, verifySTH, type SignedTreeHead } from './sth.js';
+export { createSTH, createSTHAsync, verifySTH, type SignedTreeHead } from './sth.js';
 export { buildA2ABody, signA2ABody, signA2ABodyAsync, assembleA2AReceipt, a2aHash, bodyOf, verifyA2AReceipt, participantsOf, prevFor, type A2AReceipt, type A2ABody, type A2AParty, } from './a2a.js';
 export { verifyAuditBundle, type AuditBundle, type BundledReceipt, type BundledRevocation, type BundledAnchor, type BundleReport, type BundleCheck, } from './bundle.js';
 export { createReceipt, createReceiptAsync, receiptHash, hashPayload, payloadBytes, saltedPayloadHash, verifyPayload, verifyPayloadLegacy, RISK_LEVELS, SESSION_CLOSE_TARGET, isSessionClose, isRiskLevel, type RiskLevel, type PayloadDialect, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, type Receipt, type VerifyResult, } from './receipt.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -2,7 +2,7 @@ export { generateKeypair, didFromPublicKey, publicKeyFromDid } from './keys.js';
 export { canonicalBytes, jcsHash } from './encoding.js';
 export { createCert, certHash, createRevocation, verifyRevocation, verifyCertSignature, verifyChain, scopeCovers, scopesAllow, } from './delegation.js';
 export { leafHash, merkleRoot, inclusionProof, verifyInclusion, consistencyProof, verifyConsistency, } from './merkle.js';
-export { createSTH, verifySTH } from './sth.js';
+export { createSTH, createSTHAsync, verifySTH } from './sth.js';
 export { buildA2ABody, signA2ABody, signA2ABodyAsync, assembleA2AReceipt, a2aHash, bodyOf, verifyA2AReceipt, participantsOf, prevFor, } from './a2a.js';
 export { verifyAuditBundle, } from './bundle.js';
 export { createReceipt, createReceiptAsync, receiptHash, hashPayload, payloadBytes, saltedPayloadHash, verifyPayload, verifyPayloadLegacy, RISK_LEVELS, SESSION_CLOSE_TARGET, isSessionClose, isRiskLevel, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, } from './receipt.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EAGX,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAqE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAqB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrF,OAAO,EACL,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,WAAW,EAGX,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAqE,MAAM,YAAY,CAAC;AACnH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAqB,MAAM,aAAa,CAAC"}

package/dist/sth.d.ts

@@ -13,5 +13,12 @@ export declare function createSTH(fields: {
     root: string;
     ts: string;
 }, logPrivateKey: Uint8Array): SignedTreeHead;
+/** `createSTH` for a key held outside the process; `sign` returns the raw Ed25519 signature. */
+export declare function createSTHAsync(fields: {
+    logId: string;
+    size: number;
+    root: string;
+    ts: string;
+}, sign: (message: Uint8Array) => Promise<Uint8Array>): Promise<SignedTreeHead>;
 export declare function verifySTH(sth: SignedTreeHead): boolean;
 //# sourceMappingURL=sth.d.ts.map

package/dist/sth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sth.d.ts","sourceRoot":"","sources":["../src/sth.ts"],"names":[],"mappings":"AAIA,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACjE,aAAa,EAAE,UAAU,GACxB,cAAc,CAIhB;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAWtD"}
+{"version":3,"file":"sth.d.ts","sourceRoot":"","sources":["../src/sth.ts"],"names":[],"mappings":"AAIA,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACjE,aAAa,EAAE,UAAU,GACxB,cAAc,CAIhB;AAED,gGAAgG;AAChG,wBAAsB,cAAc,CAClC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACjE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,GACjD,OAAO,CAAC,cAAc,CAAC,CAGzB;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAWtD"}

package/dist/sth.js

@@ -6,6 +6,11 @@ export function createSTH(fields, logPrivateKey) {
     const sig = ed25519.sign(canonicalBytes(unsigned), logPrivateKey);
     return { ...unsigned, sig: encodeSig(sig) };
 }
+/** `createSTH` for a key held outside the process; `sign` returns the raw Ed25519 signature. */
+export async function createSTHAsync(fields, sign) {
+    const unsigned = { v: 1, log_id: fields.logId, size: fields.size, root: fields.root, ts: fields.ts };
+    return { ...unsigned, sig: encodeSig(await sign(canonicalBytes(unsigned))) };
+}
 export function verifySTH(sth) {
     if (sth.v !== 1 || !Number.isInteger(sth.size) || sth.size < 0)
         return false;

package/dist/sth.js.map

@@ -1 +1 @@
-{"version":3,"file":"sth.js","sourceRoot":"","sources":["../src/sth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAY7C,MAAM,UAAU,SAAS,CACvB,MAAiE,EACjE,aAAyB;IAEzB,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAU,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9G,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;IAClE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAmB;IAC3C,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"sth.js","sourceRoot":"","sources":["../src/sth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAY7C,MAAM,UAAU,SAAS,CACvB,MAAiE,EACjE,aAAyB;IAEzB,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAU,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9G,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;IAClE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAiE,EACjE,IAAkD;IAElD,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAU,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9G,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAmB;IAC3C,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/core",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Zanii protocol: verifiable identity, signed action receipts, Merkle transparency-log proofs. Pure, no I/O.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",

package/src/index.ts

@@ -21,7 +21,7 @@ export {
   consistencyProof,
   verifyConsistency,
 } from './merkle.js';
-export { createSTH, verifySTH, type SignedTreeHead } from './sth.js';
+export { createSTH, createSTHAsync, verifySTH, type SignedTreeHead } from './sth.js';
 export {
   buildA2ABody,
   signA2ABody,

package/src/sth.ts

@@ -21,6 +21,15 @@ export function createSTH(
   return { ...unsigned, sig: encodeSig(sig) };
 }
 
+/** `createSTH` for a key held outside the process; `sign` returns the raw Ed25519 signature. */
+export async function createSTHAsync(
+  fields: { logId: string; size: number; root: string; ts: string },
+  sign: (message: Uint8Array) => Promise<Uint8Array>,
+): Promise<SignedTreeHead> {
+  const unsigned = { v: 1 as const, log_id: fields.logId, size: fields.size, root: fields.root, ts: fields.ts };
+  return { ...unsigned, sig: encodeSig(await sign(canonicalBytes(unsigned))) };
+}
+
 export function verifySTH(sth: SignedTreeHead): boolean {
   if (sth.v !== 1 || !Number.isInteger(sth.size) || sth.size < 0) return false;
   const pub = publicKeyFromDid(sth.log_id);