@ziffer-io/verify 0.1.0 → 0.2.0

package/dist/webauthn.js

@@ -0,0 +1,414 @@
+/**
+ * §8.6c HM-1..HM-7 -- a human attester's WebAuthn assertion, verified in the
+ * customer's own process.
+ *
+ * The third writing of `crates/acp-crypto/src/webauthn.rs` and
+ * `reference/src/acp_crypto.py`, and the mirrored corpus
+ * `fixtures/refused_webauthn.json` is what holds the three to one rule: 18
+ * vectors, two ACCEPT and one refusal per HM-4 step, replayed by
+ * `webauthn.test.ts` against this file.
+ *
+ * # What a human leg is NOT (HM-6, CR-8)
+ *
+ * **CLASSICAL, and this function must never be read as though it were more.**
+ * No passkey, platform authenticator or security key in existence produces a
+ * post-quantum signature, so a `webauthn` entry is never compared against the
+ * bundle's `min_suite` (CR-8) -- the absence of a floor check here IS the
+ * clause, not an omission. The post-quantum binding of a human's decision is
+ * the receipt AB-1 digests the whole entry into and the §11 anchor over it.
+ *
+ * # The order is normative and the NAMES are the product (HM-4)
+ *
+ * HM-4 states six checks in order and says no step is skipped for a smaller one
+ * that already failed. What the implementations must agree on is not "refused"
+ * but WHICH step refused: `WebauthnOrigin` is a phishing finding and
+ * `WebauthnChallenge` is a replay, and one name for both would make them one
+ * event in an audit record. That is why this throws a named
+ * {@link WebauthnRefusal} rather than returning a boolean.
+ *
+ * Step (f), the signature counter, is NOT here: comparing it needs the stored
+ * value for the credential, which is Consumption Ledger state. What this
+ * returns is the counter the assertion carried; `quorum.ts` compares it against
+ * what the caller stored, and discloses that this package holds no ledger.
+ */
+import { createHash } from 'node:crypto';
+import { p256 } from '@noble/curves/nist.js';
+import { cborAsBytes, cborGetInt, cborGetText, cborIsMap, cborKeys, decodeCanonical } from './cbor.js';
+import { ED25519_PK_LEN, ED25519_SIG_LEN, ed25519IsSmallOrder, verifyEd25519Strict } from './ed25519.js';
+/**
+ * HM-1 / CR-8: the two names an entry's `alg` may take.
+ *
+ * ATTESTATION-ENTRY SUITES ONLY. `suite.ts`'s table is the machine one and
+ * these are deliberately absent from it, because CR-8 forbids either as a
+ * bundle, receipt or door suite -- a name present in both tables is a name
+ * whose meaning depends on where it was read.
+ */
+export const WEBAUTHN_ALGS = ['webauthn-es256', 'webauthn-ed25519'];
+/** The one primitive name a human entry's `sig` map carries (HM-3). */
+export const WEBAUTHN_PRIMITIVE = 'webauthn';
+/**
+ * HM-3's three fields.
+ *
+ * **This is not their canonical ORDER**, and the difference looks like one.
+ * RFC 8949 §4.2.1 sorts map keys by their ENCODED bytes and a text key's head
+ * carries its length, so the wire order is by length first: `signature` (9),
+ * `client_data_json` (16), `authenticator_data` (18). The decoder gets that
+ * right by construction; a reader who assumed this array's order was the wire
+ * order would write a decoder that refuses every real assertion.
+ */
+export const ASSERTION_FIELDS = [
+    'authenticator_data',
+    'client_data_json',
+    'signature',
+];
+/** The registry entry, the COSE_Key or the assertion is not the declared shape. */
+export const MALFORMED = 'Malformed';
+/** PB-9 / HM-5, at enrolment: an off-curve ES256 key or a small-order Ed25519 one. */
+export const REGISTRY_KEY_WEAK = 'RegistryKeyWeak';
+/** HM-4 (a). */
+export const WEBAUTHN_TYPE = 'WebauthnType';
+/** HM-4 (b). */
+export const WEBAUTHN_CHALLENGE = 'WebauthnChallenge';
+/** HM-4 (c). */
+export const WEBAUTHN_ORIGIN = 'WebauthnOrigin';
+/** HM-4 (d). */
+export const WEBAUTHN_AUTHENTICATOR_DATA = 'WebauthnAuthenticatorData';
+/** HM-4 (e). */
+export const WEBAUTHN_SIGNATURE = 'WebauthnSignature';
+/**
+ * One HM-4 step refused, named.
+ *
+ * `name` is the STEP and is what the cross-implementation comparison is on; the
+ * clause is HM-4 for all of them, and six failures under one clause id would be
+ * one name for six objects. Deliberately NOT a {@link import('./refusal.js').Refusal}:
+ * `quorum.ts` maps these to §9.3's vocabulary at its own boundary, and a type
+ * that could travel straight out would let an unmapped name reach a caller.
+ */
+export class WebauthnRefusal extends Error {
+    refusalName;
+    detail;
+    constructor(refusalName, detail) {
+        super(`${refusalName}: ${detail}`);
+        this.name = 'WebauthnRefusal';
+        this.refusalName = refusalName;
+        this.detail = detail;
+    }
+}
+// COSE_Key labels (RFC 9052 §7). NAMED, because `1` and `-2` mean nothing at a
+// call site and a transposed pair of integers is a defect no reader would see.
+const COSE_KTY = 1n;
+const COSE_CRV = -1n;
+const COSE_X = -2n;
+const COSE_Y = -3n;
+/**
+ * HM-4 (d): the flags byte of `authenticator_data`. UP is "a person touched the
+ * authenticator", UV is "the authenticator verified WHO". Both required -- UP
+ * alone is possession, and HM-1 says possession is not a person.
+ */
+const AD_FLAG_UP = 0x01;
+const AD_FLAG_UV = 0x04;
+/** 32 bytes rpIdHash + 1 flags + 4 counter. */
+const AD_MIN_LEN = 37;
+/**
+ * The FIXED shape of a credential's public key, per `alg`.
+ *
+ * EXACTLY THESE LABELS AND NOTHING ELSE, which is stricter than "whatever the
+ * authenticator returned" and is taken deliberately: an optional label gives one
+ * key two canonical encodings, hence two `public_key` strings for one
+ * credential, and PB-7's distinctness -- which HM-5 takes over exactly that
+ * string -- is a comparison over it. Two spellings of one credential enrolled
+ * under two names is one holder satisfying k=2 alone.
+ *
+ * What that costs, disclosed rather than buried: a real authenticator's
+ * COSE_Key also carries label 3 (`alg`), so the enrolling service must drop it
+ * before writing the registry entry. The registry's own `alg` field is the one
+ * definition of which key type HM-4 (e) verifies under, and a second copy inside
+ * the key bytes is a second definition CR-5 does not cover. The engine reports
+ * this as a spec wording problem; this implementation inherits the reading
+ * rather than taking a different one.
+ */
+const COSE_SHAPES = {
+    'webauthn-es256': { kty: 2n, crv: 1n, labels: [COSE_KTY, COSE_CRV, COSE_X, COSE_Y] },
+    'webauthn-ed25519': { kty: 1n, crv: 6n, labels: [COSE_KTY, COSE_CRV, COSE_X] },
+};
+function sortedLabelText(labels) {
+    return labels
+        .map((l) => (typeof l === 'bigint' ? l.toString() : JSON.stringify(l)))
+        .sort()
+        .join(',');
+}
+/**
+ * HM-1 / HM-5: decode a credential's COSE_Key.
+ *
+ * The decode is CANONICAL AND VALIDATING (AT-8a) because the registry entry is
+ * signed policy: a key that decodes from two different byte strings is a
+ * credential with two names.
+ *
+ * WEAKNESS IS REFUSED HERE, at enrolment, not left to the verifier: an ES256
+ * point off the curve and an Ed25519 point of small order are both
+ * `RegistryKeyWeak` (HM-5, PB-9). The curve-membership question is asked of
+ * `p256`'s own construction -- the same one the verifier will use -- rather than
+ * of a second copy of the curve equation, which would be a second definition of
+ * the curve. {@link ed25519IsSmallOrder} is the predicate `verifyEd25519Strict`
+ * already applies: one rule, two callers (ACP-109).
+ */
+export function coseKeyParse(alg, raw) {
+    const shape = COSE_SHAPES[alg];
+    if (shape === undefined) {
+        throw new WebauthnRefusal(MALFORMED, `no WebAuthn alg ${JSON.stringify(alg)}`);
+    }
+    let key;
+    try {
+        key = decodeCanonical(raw);
+    }
+    catch (e) {
+        const why = e instanceof Error ? e.message : 'not canonical CBOR';
+        throw new WebauthnRefusal(MALFORMED, `COSE_Key: ${why}`);
+    }
+    if (!cborIsMap(key))
+        throw new WebauthnRefusal(MALFORMED, 'COSE_Key is not a map');
+    // Compared as SETS. The decoder has already refused a duplicate key and a key
+    // out of canonical order, so what is left is membership -- and an extra label
+    // and a missing one are one refusal, because "this is not the key shape" is
+    // one fact.
+    const got = sortedLabelText(cborKeys(key));
+    const want = sortedLabelText([...shape.labels]);
+    if (got !== want) {
+        throw new WebauthnRefusal(MALFORMED, `COSE_Key labels {${got}} are not {${want}}`);
+    }
+    if (cborGetInt(key, COSE_KTY) !== shape.kty || cborGetInt(key, COSE_CRV) !== shape.crv) {
+        throw new WebauthnRefusal(MALFORMED, `COSE_Key kty/crv is not ${shape.kty}/${shape.crv} for ${alg}`);
+    }
+    const coord = (label) => {
+        const b = cborAsBytes(cborGetInt(key, label));
+        if (b === null)
+            throw new WebauthnRefusal(MALFORMED, 'COSE_Key coordinate is not bytes');
+        // Fixed width, short encodings forbidden: COSE writes P-256 and Ed25519
+        // coordinates at 32 bytes, and a short encoding is a second spelling of one
+        // integer.
+        if (b.length !== 32) {
+            throw new WebauthnRefusal(MALFORMED, 'COSE_Key coordinate is not 32 bytes');
+        }
+        return b;
+    };
+    if (alg === 'webauthn-es256') {
+        const x = coord(COSE_X);
+        const y = coord(COSE_Y);
+        // SEC1 uncompressed, which is what `p256` decodes and what the verifier
+        // below hands it: one encoding of the point, built once.
+        const sec1 = new Uint8Array(65);
+        sec1[0] = 0x04;
+        sec1.set(x, 1);
+        sec1.set(y, 33);
+        if (!p256.utils.isValidPublicKey(sec1, false)) {
+            throw new WebauthnRefusal(REGISTRY_KEY_WEAK, 'ES256 public key is not a point on secp256r1');
+        }
+        return { kind: 'es256', sec1 };
+    }
+    const x = coord(COSE_X);
+    if (x.length !== ED25519_PK_LEN || ed25519IsSmallOrder(x)) {
+        // PB-9 / ACP-106, one clause over: under a small-order key the Ed25519
+        // equation stops mentioning the message and ONE signature verifies every
+        // message. Enrolled as a human approver, that identity is a forgery oracle
+        // for anyone who has seen the public key.
+        throw new WebauthnRefusal(REGISTRY_KEY_WEAK, 'Ed25519 credential key is of small order');
+    }
+    return { kind: 'ed25519', raw: x };
+}
+/**
+ * HM-3: the `webauthn` primitive's value, decoded under a FIXED SHAPE.
+ *
+ * A general CBOR decoder is the wrong tool and is deliberately not offered.
+ * What arrives here is attacker-supplied on the transport path, so the decoder
+ * must accept exactly one shape -- three text keys, each a byte string -- and
+ * refuse everything else as `Malformed`. A tag, a float, a nested map, an extra
+ * key and a missing key are all the same answer, because a decoder that reports
+ * them differently is a parser an attacker can interrogate.
+ */
+export function decodeAssertion(raw) {
+    let obj;
+    try {
+        obj = decodeCanonical(raw);
+    }
+    catch (e) {
+        const why = e instanceof Error ? e.message : 'not canonical CBOR';
+        throw new WebauthnRefusal(MALFORMED, `assertion: ${why}`);
+    }
+    if (!cborIsMap(obj) || sortedLabelText(cborKeys(obj)) !== sortedLabelText([...ASSERTION_FIELDS])) {
+        throw new WebauthnRefusal(MALFORMED, 'assertion is not the HM-3 map');
+    }
+    const field = (name) => {
+        const b = cborAsBytes(cborGetText(obj, name));
+        if (b === null) {
+            throw new WebauthnRefusal(MALFORMED, `assertion ${name} is not a byte string`);
+        }
+        return b;
+    };
+    return {
+        authenticatorData: field('authenticator_data'),
+        clientDataJson: field('client_data_json'),
+        signature: field('signature'),
+    };
+}
+/**
+ * HM-2: the challenge is base64url WITHOUT padding of the message's bytes.
+ *
+ * ONE definition, so "the challenge encoding" cannot mean two things. Note what
+ * the verifier does with it: it RECOMPUTES this from an id it derived itself and
+ * compares (RES-8). It never decodes the challenge the assertion carries and
+ * treats the result as an identifier -- a transmitted id is a name for a
+ * binding, not evidence of one.
+ */
+export function webauthnChallenge(messageIdBytes) {
+    const A = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+    let s = '';
+    for (let i = 0; i < messageIdBytes.length; i += 3) {
+        const b0 = messageIdBytes[i] ?? 0;
+        const b1 = messageIdBytes[i + 1];
+        const b2 = messageIdBytes[i + 2];
+        const v = (b0 << 16) | ((b1 ?? 0) << 8) | (b2 ?? 0);
+        s += A[(v >> 18) & 63];
+        s += A[(v >> 12) & 63];
+        if (b1 !== undefined)
+            s += A[(v >> 6) & 63];
+        if (b2 !== undefined)
+            s += A[v & 63];
+    }
+    return s;
+}
+function sha256(bytes) {
+    return Uint8Array.from(createHash('sha256').update(bytes).digest());
+}
+function bytesEqual(a, b) {
+    return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+function strProp(v, key) {
+    if (typeof v !== 'object' || v === null || Array.isArray(v))
+        return null;
+    const raw = Object.prototype.hasOwnProperty.call(v, key)
+        ? Object.getOwnPropertyDescriptor(v, key)?.value
+        : undefined;
+    return typeof raw === 'string' ? raw : null;
+}
+/**
+ * HM-4 (a)-(e), IN ORDER, returning the assertion's 32-bit signature counter.
+ *
+ * `messageIdBytes` is the UTF-8 bytes of a **recomputed** id -- the attestation
+ * id at §9.3 step 7b(v). Never an id read off the message being verified
+ * (HM-2, RES-8). `rpId` is the entry's SIGNED relying-party id: signed policy,
+ * never a value the assertion supplies, which is the whole of HM-4 (c).
+ *
+ * NO STEP IS SKIPPED FOR AN EARLIER ONE, and the order is normative: an
+ * assertion wrong in two ways must produce the same refusal name in every
+ * implementation, or the corpus is comparing luck.
+ */
+export function verifyWebauthn(alg, coseKey, messageIdBytes, rpId, assertion) {
+    const key = coseKeyParse(alg, coseKey);
+    const a = decodeAssertion(assertion);
+    // (a) A parse failure and a wrong `type` are ONE refusal, because the clause
+    // states them as one condition: what it demands is a `webauthn.get`
+    // assertion, and bytes that are not JSON are not one. A `webauthn.create`
+    // document here is a REGISTRATION ceremony replayed as an approval -- the
+    // person consented to enrolling a key, not to the action.
+    let client;
+    try {
+        client = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(a.clientDataJson));
+    }
+    catch {
+        throw new WebauthnRefusal(WEBAUTHN_TYPE, 'HM-4 (a): clientDataJSON is not JSON');
+    }
+    const type = strProp(client, 'type');
+    if (type !== 'webauthn.get') {
+        throw new WebauthnRefusal(WEBAUTHN_TYPE, `HM-4 (a): clientDataJSON type is ${JSON.stringify(type)}, not 'webauthn.get'`);
+    }
+    // (b) HM-4 (b) / HM-2. RECOMPUTED and compared; never read as a value.
+    if (strProp(client, 'challenge') !== webauthnChallenge(messageIdBytes)) {
+        throw new WebauthnRefusal(WEBAUTHN_CHALLENGE, 'HM-4 (b): the assertion answers a different challenge than the recomputed id');
+    }
+    // (c) EXACTLY `https://` + the entry's signed `rp_id`, and nothing else -- no
+    // port, no path, no scheme substitution. An assertion made for another origin
+    // is an assertion made on another SITE, which is the entire phishing case
+    // this binding exists to refuse: the person really did touch their key, on a
+    // page an attacker served.
+    const wantOrigin = `https://${rpId}`;
+    const origin = strProp(client, 'origin');
+    if (origin !== wantOrigin) {
+        throw new WebauthnRefusal(WEBAUTHN_ORIGIN, `HM-4 (c): origin ${JSON.stringify(origin)} is not ${JSON.stringify(wantOrigin)}`);
+    }
+    // (d) Length, rpIdHash and the two flags are one refusal name because they
+    // are one question: is this authenticator data for this relying party,
+    // produced with the person present and verified? UV is the half that makes
+    // the level AT-10 records mean anything -- without it the entry is possession
+    // of a device, and HM-1 says possession is not a person.
+    if (a.authenticatorData.length < AD_MIN_LEN) {
+        throw new WebauthnRefusal(WEBAUTHN_AUTHENTICATOR_DATA, `HM-4 (d): authenticator_data is ${a.authenticatorData.length} bytes, under the ${AD_MIN_LEN}-byte minimum`);
+    }
+    if (!bytesEqual(a.authenticatorData.subarray(0, 32), sha256(new TextEncoder().encode(rpId)))) {
+        throw new WebauthnRefusal(WEBAUTHN_AUTHENTICATOR_DATA, "HM-4 (d): rpIdHash is not SHA-256 of the entry's rp_id");
+    }
+    const flags = a.authenticatorData[32] ?? 0;
+    if ((flags & AD_FLAG_UP) === 0) {
+        throw new WebauthnRefusal(WEBAUTHN_AUTHENTICATOR_DATA, 'HM-4 (d): the user-present flag is clear');
+    }
+    if ((flags & AD_FLAG_UV) === 0) {
+        throw new WebauthnRefusal(WEBAUTHN_AUTHENTICATOR_DATA, 'HM-4 (d): the user-verified flag is clear');
+    }
+    // (e) The signed message is the authenticator's own bytes followed by the
+    // hash of the client data -- NOT the challenge, and not the id. That is what
+    // binds (a)-(d) to the signature: tamper with the origin and the client-data
+    // hash moves, so an attacker who wants to pass (c) must re-sign, which needs
+    // the credential.
+    const signed = new Uint8Array(a.authenticatorData.length + 32);
+    signed.set(a.authenticatorData, 0);
+    signed.set(sha256(a.clientDataJson), a.authenticatorData.length);
+    if (key.kind === 'es256') {
+        let ok;
+        try {
+            // DER, as WebAuthn's ES256 is defined and as every authenticator emits.
+            // The fixed-width form is a different encoding of the same pair and is
+            // NOT accepted: two encodings of one signature is two entry digests for
+            // one human decision (AB-1).
+            //
+            // `lowS: false` is a PIN, not a default left alone. noble refuses a
+            // high-S signature unless told otherwise; neither engine side does --
+            // RustCrypto's `VerifyingKey::verify` and `cryptography`'s
+            // `ECDSA(SHA256())` both accept one -- so leaving noble's default in
+            // place would make this verifier refuse an assertion the engine accepts.
+            // A guard on one side only converts a closed defect into a divergence
+            // (ACP-106's lesson, one primitive over), and malleability buys an
+            // attacker nothing here: the receipt commits to the exact entry bytes
+            // under AB-1, so a re-encoded signature is a different entry the receipt
+            // never authorised.
+            ok = p256.verify(a.signature, signed, key.sec1, {
+                format: 'der',
+                prehash: true,
+                lowS: false,
+            });
+        }
+        catch {
+            ok = false;
+        }
+        if (!ok) {
+            throw new WebauthnRefusal(WEBAUTHN_SIGNATURE, 'HM-4 (e): ES256 assertion signature is not DER, or does not verify');
+        }
+    }
+    else {
+        // ACP-106's strict rule, on the human leg. `coseKeyParse` has already
+        // refused a small-order public key; `verifyEd25519Strict` refuses a
+        // small-order `R` as well -- the half that lets a signer emit a signature a
+        // non-strict verifier accepts over a message it never committed to. The two
+        // halves are one rule, and a human leg verified with only half of it would
+        // be the ACP-106 defect reopened for the one signature class where the
+        // signer is a person.
+        if (a.signature.length !== ED25519_SIG_LEN ||
+            !verifyEd25519Strict(key.raw, signed, a.signature)) {
+            throw new WebauthnRefusal(WEBAUTHN_SIGNATURE, 'HM-4 (e): Ed25519 assertion signature is malformed, non-canonical (ACP-106) or does not verify');
+        }
+    }
+    // HM-4 (f)'s INPUT. Big-endian, bytes 33..37, per the WebAuthn
+    // authenticator-data layout. The comparison against the stored value is the
+    // caller's -- see the module header on why it is not here.
+    const c = a.authenticatorData;
+    return (((c[33] ?? 0) << 24) | ((c[34] ?? 0) << 16) | ((c[35] ?? 0) << 8) | (c[36] ?? 0)) >>> 0;
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../src/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAa,MAAM,WAAW,CAAC;AAClH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;AAEvF,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,oBAAoB;IACpB,kBAAkB;IAClB,WAAW;CACZ,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AACnD,gBAAgB;AAChB,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAC5C,gBAAgB;AAChB,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AACtD,gBAAgB;AAChB,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAChD,gBAAgB;AAChB,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AACvE,gBAAgB;AAChB,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,WAAW,CAAS;IACpB,MAAM,CAAS;IAExB,YAAY,WAAmB,EAAE,MAAc;QAC7C,KAAK,CAAC,GAAG,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,CAAC,EAAE,CAAC;AACrB,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC;AACnB,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC;AAEnB;;;;GAIG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,+CAA+C;AAC/C,MAAM,UAAU,GAAG,EAAE,CAAC;AAatB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAAwC;IACvD,gBAAgB,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;IACpF,kBAAkB,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;CAC/E,CAAC;AAEF,SAAS,eAAe,CAAC,MAAuB;IAC9C,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;SACtE,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAe;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,GAAS,CAAC;IACd,IAAI,CAAC;QACH,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAClE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACnF,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,YAAY;IACZ,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,oBAAoB,GAAG,cAAc,IAAI,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,KAAK,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QACvF,MAAM,IAAI,eAAe,CACvB,SAAS,EACT,2BAA2B,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,QAAQ,GAAG,EAAE,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAc,EAAE;QAC1C,MAAM,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;QACzF,wEAAwE;QACxE,4EAA4E;QAC5E,WAAW;QACX,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACrC,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,IAAI,GAAS,CAAC;IACd,IAAI,CAAC;QACH,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAClE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,cAAc,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAc,EAAE;QACzC,MAAM,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,aAAa,IAAI,uBAAuB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,oBAAoB,CAAC;QAC9C,cAAc,EAAE,KAAK,CAAC,kBAAkB,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAA0B;IAC1D,MAAM,CAAC,GAAG,kEAAkE,CAAC;IAC7E,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QACvB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,KAAK,SAAS;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5C,IAAI,EAAE,KAAK,SAAS;YAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,OAAO,CAAC,CAAU,EAAE,GAAW;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK;QAChD,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,OAAmB,EACnB,cAA0B,EAC1B,IAAY,EACZ,SAAqB;IAErB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAErC,6EAA6E;IAC7E,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CACvB,aAAa,EACb,oCAAoC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAC/E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,2BAA2B;IAC3B,MAAM,UAAU,GAAG,WAAW,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,mCAAmC,CAAC,CAAC,iBAAiB,CAAC,MAAM,qBAAqB,UAAU,eAAe,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CACvB,2BAA2B,EAC3B,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEjE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,EAAW,CAAC;QAChB,IAAI,CAAC;YACH,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,6BAA6B;YAC7B,EAAE;YACF,oEAAoE;YACpE,sEAAsE;YACtE,2DAA2D;YAC3D,qEAAqE;YACrE,yEAAyE;YACzE,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,yEAAyE;YACzE,oBAAoB;YACpB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC9C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,EAAE,GAAG,KAAK,CAAC;QACb,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,oEAAoE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,oEAAoE;QACpE,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,uEAAuE;QACvE,sBAAsB;QACtB,IACE,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,eAAe;YACtC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gGAAgG,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC;IAC9B,OAAO,CACL,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CACjF,KAAK,CAAC,CAAC;AACV,CAAC"}

package/dist/wire.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Wire-value predicates shared by the receipt gate and the §9.3 step 7b quorum.
+ *
+ * They live here rather than in `verify.ts` for one reason: `quorum.ts` needs
+ * every one of them, `verify.ts` imports `quorum.ts`, and a second copy in the
+ * quorum would be two definitions of WE-4 in one package -- the encoding-split
+ * defect at the source level, in the exact rule whose whole point is that one
+ * nonce has one spelling. `verify.ts` re-exports these so the published surface
+ * is unchanged.
+ */
+/** The one wire nonce size, 128-bit (`Nonce128`, cited by AT-1 and L-17). */
+export declare const NONCE128_BYTES = 16;
+/**
+ * `"b64:"` plus base64 of 16 bytes: 4 + 24.
+ *
+ * Counted, never decoded -- a rule whose behaviour on bad input is "throw" is
+ * not a refusal, and the reference learned that the hard way (its first
+ * spelling decoded the body, which raises on the URL-safe alphabet).
+ */
+export declare const NONCE128_LEN: number;
+/**
+ * WE-4: is this the ASCII string `b64:` followed by RFC 4648 §4 base64, WITH
+ * padding? Ported from `quorum.rs::is_we4_b64` -- the body is whole
+ * four-character groups, the alphabet is §4's (`+` and `/`, never §5's `-` and
+ * `_`), and `=` appears only as one or two characters at the very end.
+ *
+ * Rejected, never normalised: normalising would make this verifier accept two
+ * spellings of one value, which is how one nonce comes to hold two ledger slots
+ * (ACP-87) and how one attestation comes to hold two ids.
+ */
+export declare function isWe4B64(s: string): boolean;
+/** A parsed JSON object, narrowed by a predicate rather than an `as` cast. */
+export declare function isRecord(v: unknown): v is Record<string, unknown>;
+/** A string field of a parsed object, or null -- never a coerced value. */
+export declare function strField(v: Record<string, unknown>, key: string): string | null;
+/**
+ * RFC 4648 §4 base64 with padding, decoded. The carrier WE-4 declares.
+ *
+ * Returns null rather than throwing, and is called only after
+ * {@link isWe4B64} has accepted the string: the type check is the refusal, and
+ * this is the decode that follows it.
+ */
+export declare function b64Decode(s: string): Uint8Array | null;
+//# sourceMappingURL=wire.d.ts.map

package/dist/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QAAwC,CAAC;AAElE;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAc3C;AAED,8EAA8E;AAC9E,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG/E;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoBtD"}

package/dist/wire.js

@@ -0,0 +1,90 @@
+/**
+ * Wire-value predicates shared by the receipt gate and the §9.3 step 7b quorum.
+ *
+ * They live here rather than in `verify.ts` for one reason: `quorum.ts` needs
+ * every one of them, `verify.ts` imports `quorum.ts`, and a second copy in the
+ * quorum would be two definitions of WE-4 in one package -- the encoding-split
+ * defect at the source level, in the exact rule whose whole point is that one
+ * nonce has one spelling. `verify.ts` re-exports these so the published surface
+ * is unchanged.
+ */
+/** The one wire nonce size, 128-bit (`Nonce128`, cited by AT-1 and L-17). */
+export const NONCE128_BYTES = 16;
+/**
+ * `"b64:"` plus base64 of 16 bytes: 4 + 24.
+ *
+ * Counted, never decoded -- a rule whose behaviour on bad input is "throw" is
+ * not a refusal, and the reference learned that the hard way (its first
+ * spelling decoded the body, which raises on the URL-safe alphabet).
+ */
+export const NONCE128_LEN = 4 + Math.ceil(NONCE128_BYTES / 3) * 4;
+/**
+ * WE-4: is this the ASCII string `b64:` followed by RFC 4648 §4 base64, WITH
+ * padding? Ported from `quorum.rs::is_we4_b64` -- the body is whole
+ * four-character groups, the alphabet is §4's (`+` and `/`, never §5's `-` and
+ * `_`), and `=` appears only as one or two characters at the very end.
+ *
+ * Rejected, never normalised: normalising would make this verifier accept two
+ * spellings of one value, which is how one nonce comes to hold two ledger slots
+ * (ACP-87) and how one attestation comes to hold two ids.
+ */
+export function isWe4B64(s) {
+    if (!s.startsWith('b64:'))
+        return false;
+    const body = s.slice(4);
+    if (body.length % 4 !== 0)
+        return false;
+    let pad = 0;
+    for (let i = body.length - 1; i >= 0 && body[i] === '='; i -= 1)
+        pad += 1;
+    if (pad > 2)
+        return false;
+    for (let i = 0; i < body.length - pad; i += 1) {
+        const c = body.charCodeAt(i);
+        const alnum = (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
+        if (!alnum && c !== 0x2b /* + */ && c !== 0x2f /* / */)
+            return false;
+    }
+    return true;
+}
+/** A parsed JSON object, narrowed by a predicate rather than an `as` cast. */
+export function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/** A string field of a parsed object, or null -- never a coerced value. */
+export function strField(v, key) {
+    const raw = v[key];
+    return typeof raw === 'string' ? raw : null;
+}
+/**
+ * RFC 4648 §4 base64 with padding, decoded. The carrier WE-4 declares.
+ *
+ * Returns null rather than throwing, and is called only after
+ * {@link isWe4B64} has accepted the string: the type check is the refusal, and
+ * this is the decode that follows it.
+ */
+export function b64Decode(s) {
+    const A = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+    if (s.length === 0 || s.length % 4 !== 0)
+        return null;
+    let pad = 0;
+    while (pad < 2 && s[s.length - 1 - pad] === '=')
+        pad += 1;
+    const out = [];
+    let acc = 0;
+    let bits = 0;
+    for (let i = 0; i < s.length - pad; i += 1) {
+        const v = A.indexOf(s[i] ?? '');
+        if (v < 0)
+            return null;
+        acc = (acc << 6) | v;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out.push((acc >> bits) & 0xff);
+            acc &= (1 << bits) - 1;
+        }
+    }
+    return Uint8Array.from(out);
+}
+//# sourceMappingURL=wire.js.map

package/dist/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAC,CAA0B,EAAE,GAAW;IAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,MAAM,CAAC,GAAG,kEAAkE,CAAC;IAC7E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/B,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/package.json

@@ -1,14 +1,20 @@
 {
   "name": "@ziffer-io/verify",
-  "version": "0.1.0",
-  "description": "ZIFFER receipt verification: the stateless half of the ACP 9.3 checklist, refusals named by clause.",
+  "version": "0.2.0",
+  "description": "Verify a ZIFFER decision receipt in your own process, against a key you configured.",
+  "keywords": [
+    "ziffer",
+    "agent",
+    "ai-agent",
+    "guardrail",
+    "approval",
+    "receipt"
+  ],
   "author": "code75 SASU",
   "license": "SEE LICENSE IN LICENSE",
-  "comment-license": "The SDK is proprietary (code75 SASU). \"license\" is the SPDX escape hatch for exactly this case: there is no SPDX identifier for these terms, so the field points at the file that states them, and LICENSE ships in the tarball beside THIRD-PARTY-NOTICES. Do not put an OSI identifier here -- Apache-2.0 stood in these four files until ACP-214 and was wrong the whole time.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "comment-exports": "The `./dist/*` entry is not laziness and removing it breaks a caller. `exports` is a gate as well as a map: declaring only `.` makes every other path unreachable, and packages/mcp/src/tools.test.ts imports `@ziffer-io/verify/dist/testkeys.js` ON PURPOSE -- testkeys is deliberately absent from index.ts so it cannot be reached by accident, and the deep import is how the MCP package's tests get a signing key without a second definition of one identity. That import resolves today because there is no exports map; adding a `.`-only one would break it at publish time, which is the class of defect an exports map introduces rather than prevents. So the dist is declared addressable, and the reason is here rather than in a reviewer's memory.",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -34,12 +40,9 @@
   "publishConfig": {
     "access": "public"
   },
-  "comment-no-provenance": "There is deliberately no \"provenance\": true here, and it was removed rather than never added. npm generates a provenance attestation only from a recognised CI runner, and its documentation states plainly that provenance is NOT SUPPORTED for private repositories (docs.npmjs.com/trusted-publishers, read 2026-09-03) -- ziffer-hq/ziffer is private (`gh api` says so). Setting the flag does not degrade to a warning: npm attempts the attestation and the publish FAILS, so the field would have broken the operator's very first publish from a laptop and every CI publish after it. tools/release-npm.sh asserts the field stays absent, and that assertion is the thing to delete on the day this repository becomes public -- at which point trusted publishing generates provenance on its own, with no flag at all.",
   "ziffer": {
-    "enginePin": "fed43d10b427e0a4435a8f04e474334d88a5aa6e"
+    "enginePin": "7fd84dbe1a430e6deea4b241ebe1ba641103ffbe"
   },
-  "comment-enginePin": "The engine commit whose clause spellings, canon and mirrored corpus this implementation is bound to. A COPY of the rev in Cargo.toml, which is the one authority tools/guard.sh reads; tools/release-npm.sh refuses to release when the two differ, by name. tools/bump-pin.sh does not move this field -- see packages/types/package.json for why and what closing it costs.",
-  "comment-deps": "Exactly the two signature primitives, at the versions services/approval already pins -- the DR-2 permitted common set minus the wire types, which this package does not consume: it verifies raw parsed JSON, and typing the wire is the client's (@ziffer-io/client) business. Adding anything else needs written justification (ACP-197 runbook section 5).",
   "dependencies": {
     "@noble/curves": "2.3.0",
     "@noble/post-quantum": "0.7.0"
@@ -51,7 +54,7 @@
   "scripts": {
     "build": "tsc -b",
     "typecheck": "tsc -b",
-    "pretest": "tsc -b && if ! find dist -name '*.test.js' -print -quit | grep -q .; then echo 'ACP-248: no compiled test file under dist/ -- node --test reports 0 tests and exits 0, so this package would go green having run nothing' >&2; exit 1; fi",
+    "pretest": "tsc -b && if ! find dist -name '*.test.js' -print -quit | grep -q .; then echo 'no compiled test file under dist/ -- node --test reports 0 tests and exits 0, so this package would go green having run nothing' >&2; exit 1; fi",
     "test": "tsc -b && node --test \"dist/**/*.test.js\""
   }
 }