burnledger 0.2.1

package/README.md

@@ -0,0 +1,182 @@
+# BurnLedger TypeScript SDK
+
+TypeScript/JavaScript client for the [BurnLedger](https://github.com/fdfretes/burnledger) API — cryptographic deletion certificates for regulatory compliance.
+
+## Install
+
+```bash
+npm install burnledger
+```
+
+**Requirements:** Node.js 18+
+
+## Quick Start
+
+```typescript
+import { BurnLedger } from "burnledger";
+
+const dp = new BurnLedger({ apiKey: "dp_..." });
+
+// 1. Attest — snapshot systems before deletion
+const att = await dp.attest("user@example.com", {
+  systemIds: ["sys_abc", "sys_def"],
+});
+
+// 2. Delete data (your code, your tools)
+
+// 3. Verify — confirm deletion and get certificate
+const result = await dp.verify(att.id, "user@example.com", { timeout: 60 });
+
+// 4. Download certificate PDF
+await dp.savePdf(result.certificate!.id, "./deletion-cert.pdf");
+```
+
+## Browser Support
+
+For browser environments (verification only, no API client):
+
+```typescript
+import { verifyCertificate, publicKeyFromHex } from "burnledger/browser";
+```
+
+Uses WebCrypto (`crypto.subtle`) instead of `node:crypto`. Requires Chrome 113+, Firefox 128+, or Safari 17+.
+
+## Offline Verification
+
+Verify certificates without network access using Ed25519 signatures:
+
+```typescript
+import {
+  verifyCertificate,
+  verifyTransparency,
+  publicKeyFromHex,
+} from "burnledger";
+
+const key = await publicKeyFromHex("abcdef...", { revoked: false });
+const keys = new Map([[key.keyId, key]]);
+
+const certResult = await verifyCertificate(certificate, keys);
+// "VALID" | "INVALID"
+
+const logResult = await verifyTransparency(certificate, keys);
+// "INCLUDED" | "INVALID" | "NOT_AVAILABLE"
+```
+
+## Webhook Verification
+
+Verify incoming webhook signatures (HMAC-SHA256):
+
+```typescript
+import { verifyWebhookSignature } from "burnledger";
+
+const valid = verifyWebhookSignature(
+  webhookSecret,       // from dp.registerWebhook()
+  request.body,        // raw request body
+  request.headers["x-burnledger-signature"],
+);
+```
+
+## API Reference
+
+### Client
+
+```typescript
+new BurnLedger({
+  apiKey: string,
+  baseUrl?: string,    // default: "https://api.burnledger.io"
+  timeout?: number,    // seconds, default: 30
+  maxRetries?: number, // default: 2
+})
+```
+
+### Systems
+
+| Method | Returns |
+|--------|---------|
+| `registerSystem(opts)` | `Promise<System>` |
+| `getSystem(id)` | `Promise<System>` |
+| `listSystems(opts?)` | `Paginator<System>` |
+| `deregisterSystem(id)` | `Promise<void>` |
+| `healthCheck(id)` | `Promise<System>` |
+
+### Attestations
+
+| Method | Returns |
+|--------|---------|
+| `attest(subject, opts?)` | `Promise<Attestation>` |
+| `batchAttest(subjects, opts?)` | `Promise<BatchAttestationResponse>` |
+| `getAttestation(id)` | `Promise<Attestation>` |
+| `waitFor(id, opts?)` | `Promise<Attestation>` |
+| `verify(id, subject, opts?)` | `Promise<VerifyResult>` |
+
+### Certificates
+
+| Method | Returns |
+|--------|---------|
+| `getCertificate(id)` | `Promise<CertificateResponse>` |
+| `listCertificates(opts?)` | `Paginator<CertificateResponse>` |
+| `getCertificateStats()` | `Promise<CertificateStats>` |
+| `exportCertificates(opts?)` | `Promise<Uint8Array>` |
+| `downloadPdf(id)` | `Promise<Uint8Array>` |
+| `savePdf(id, path)` | `Promise<void>` |
+| `getRevocationStatus(id)` | `Promise<RevocationStatus>` |
+| `revokeCertificate(id, opts)` | `Promise<CertificateResponse>` |
+
+### Webhooks
+
+| Method | Returns |
+|--------|---------|
+| `registerWebhook(opts)` | `Promise<Webhook>` |
+| `listWebhooks(opts?)` | `Paginator<Webhook>` |
+| `deleteWebhook(id)` | `Promise<void>` |
+| `rotateWebhookSecret(id)` | `Promise<WebhookRotateResponse>` |
+| `commitWebhookRotation(id)` | `Promise<void>` |
+| `listFailedDeliveries(id)` | `Promise<WebhookDelivery[]>` |
+| `retryDelivery(webhookId, deliveryId)` | `Promise<void>` |
+| `resolveDelivery(webhookId, deliveryId)` | `Promise<void>` |
+
+### API Keys
+
+| Method | Returns |
+|--------|---------|
+| `listApiKeys()` | `Promise<ApiKeyListItem[]>` |
+| `createApiKey()` | `Promise<ApiKeyResponse>` |
+| `revokeApiKey(id)` | `Promise<void>` |
+
+### Transparency Log
+
+These methods do not require authentication.
+
+| Method | Returns |
+|--------|---------|
+| `getLogHead()` | `Promise<SignedTreeHead>` |
+| `getLogEntry(index)` | `Promise<LogEntry>` |
+| `getLogEntries(opts)` | `Promise<LogEntry[]>` |
+| `getInclusionProof(opts)` | `Promise<InclusionProof>` |
+| `getConsistencyProof(opts)` | `Promise<ConsistencyProof>` |
+
+### Pagination
+
+All `list*` methods return a `Paginator` that auto-fetches pages:
+
+```typescript
+for await (const cert of dp.listCertificates()) {
+  console.log(cert.id);
+}
+```
+
+## Dual ESM/CJS
+
+The package ships both ESM and CommonJS builds:
+
+```javascript
+// ESM
+import { BurnLedger } from "burnledger";
+
+// CommonJS
+const { BurnLedger } = require("burnledger");
+```
+
+## License
+
+MIT

package/dist/cjs/cli.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/** burnledger check — offline certificate verification.
+ * Exit codes: 0=valid, 1=invalid, 2=usage error */
+type Cert = Record<string, unknown>;
+/** The pass/fail decision behind the exit code. A signature failure, a
+ * transparency FAILURE (thrown, not NOT_AVAILABLE), or an online-confirmed
+ * revocation all make the certificate invalid. Exported for testing. */
+export declare function certVerdict(sigResult: string, transparencyFailed: boolean, online: boolean, revocation: {
+    status: string;
+} | undefined): boolean;
+export declare function formatOutput(cert: Cert, sigResult: string, transparency: string, transparencyFailed: boolean, revocation: {
+    status: string;
+    reason?: string;
+} | undefined, online: boolean): string;
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cjs/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAQnD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAiEpC;;wEAEwE;AACxE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,OAAO,EAC3B,MAAM,EAAE,OAAO,EACf,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACzC,OAAO,CAMT;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAChF,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,GAC3E,MAAM,CAmCR"}

package/dist/cjs/cli.js

@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+"use strict";
+/** burnledger check — offline certificate verification.
+ * Exit codes: 0=valid, 1=invalid, 2=usage error */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.certVerdict = certVerdict;
+exports.formatOutput = formatOutput;
+const promises_1 = require("node:fs/promises");
+const crypto_node_js_1 = require("./crypto-node.js");
+const verify_js_1 = require("./verify.js");
+const keys_js_1 = require("./keys.js");
+const USAGE = "Usage: burnledger check --cert <file> --keys <file> [--online --api-url <url> --api-key <key>]\n";
+function die(msg) { process.stderr.write(msg); process.exit(2); }
+function parseArgs(argv) {
+    const args = argv.slice(2);
+    if (args[0] !== "check")
+        die(USAGE);
+    let certPath = "", keysPath = "", online = false, apiUrl = "", apiKey = "";
+    for (let i = 1; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--cert") {
+            certPath = args[++i] ?? die("--cert requires a value\n");
+        }
+        else if (a === "--keys") {
+            keysPath = args[++i] ?? die("--keys requires a value\n");
+        }
+        else if (a === "--online") {
+            online = true;
+        }
+        else if (a === "--api-url") {
+            apiUrl = args[++i] ?? die("--api-url requires a value\n");
+        }
+        else if (a === "--api-key") {
+            apiKey = args[++i] ?? die("--api-key requires a value\n");
+        }
+        else
+            die(`Unknown argument: ${a}\n`);
+    }
+    if (!certPath || !keysPath)
+        die("Both --cert and --keys are required.\n");
+    if (online && (!apiUrl || !apiKey))
+        die("--online requires --api-url and --api-key.\n");
+    return { certPath, keysPath, online, apiUrl, apiKey };
+}
+async function loadKeys(path) {
+    let entries;
+    try {
+        entries = (0, keys_js_1.parseKeyEntries)(JSON.parse(await (0, promises_1.readFile)(path, "utf-8")));
+    }
+    catch (e) {
+        die(e.message + "\n");
+    }
+    const map = new Map();
+    for (const e of entries) {
+        // Fail closed: trust a key only if it explicitly declares active/retired.
+        const revoked = !(e.key_status === "active" || e.key_status === "retired");
+        let pki;
+        try {
+            pki = await (0, verify_js_1.publicKeyFromHex)(crypto_node_js_1.nodeCrypto, e.public_key, { revoked });
+        }
+        catch (err) {
+            die(`invalid public_key: ${err.message}\n`);
+        }
+        // Key-substitution defense: a declared key_id must match the id derived from
+        // the public key (dp_k_ + sha256(key)), and the map is keyed on the DERIVED
+        // id so a lying key_id cannot shadow a genuine one.
+        if (e.key_id !== undefined && e.key_id !== pki.keyId) {
+            die(`key_id ${e.key_id} does not match sha256(public_key) (${pki.keyId})\n`);
+        }
+        const existing = map.get(pki.keyId);
+        if (existing !== undefined && existing.revoked !== pki.revoked) {
+            die(`conflicting key_status for duplicate key ${pki.keyId}\n`);
+        }
+        map.set(pki.keyId, pki);
+    }
+    return map;
+}
+async function checkRevocation(apiUrl, apiKey, certId) {
+    const res = await fetch(`${apiUrl}/v1/certificates/${certId}/revocation-status`, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+    });
+    if (!res.ok)
+        throw new Error(`Revocation check failed: HTTP ${res.status}`);
+    return (await res.json()).data;
+}
+/** The pass/fail decision behind the exit code. A signature failure, a
+ * transparency FAILURE (thrown, not NOT_AVAILABLE), or an online-confirmed
+ * revocation all make the certificate invalid. Exported for testing. */
+function certVerdict(sigResult, transparencyFailed, online, revocation) {
+    return (sigResult === "VALID" &&
+        !transparencyFailed &&
+        !(online && revocation?.status === "REVOKED"));
+}
+function formatOutput(cert, sigResult, transparency, transparencyFailed, revocation, online) {
+    const id = cert.certificate_id.slice(0, 6);
+    const sub = cert.subject.identifier_hash;
+    const att = cert.attestation;
+    const ver = cert.verification;
+    const L = [];
+    if (sigResult !== "VALID")
+        return `Certificate dc_${id}: INVALID (${sigResult})\n`;
+    if (transparencyFailed)
+        return `Certificate dc_${id}: INVALID (transparency: ${transparency})\n`;
+    if (online && revocation?.status === "REVOKED") {
+        L.push(`Certificate dc_${id}: INVALID (REVOKED)`);
+        if (revocation.reason)
+            L.push(`  Revocation reason: ${revocation.reason}`);
+        return L.join("\n") + "\n";
+    }
+    const tag = online ? "" : " (offline — revocation status not checked)";
+    L.push(`Certificate dc_${id}: VALID${tag}`);
+    L.push(`  Subject: sha256:${sub.slice(0, 6)}...`);
+    L.push(`  Canonical version: ${cert.certificate_format_version}`);
+    const sys = att.systems;
+    L.push(`  Systems: ${sys.length} (${sys.map((s) => `${s.connector_type} [${s.hash_scope}]`).join(", ")})`);
+    L.push(`  Records before: ${sys.reduce((n, s) => n + s.record_count, 0)}`);
+    L.push(`  Records after: ${ver.systems.reduce((n, s) => n + s.record_count, 0)}`);
+    L.push(`  Committed: ${att.attested_at}`);
+    L.push(`  Verified: ${ver.verified_at}`);
+    if (transparency === "INCLUDED") {
+        const t = cert.transparency;
+        L.push(`  Transparency log: entry #${t.entry_index}, inclusion proof VALID`);
+    }
+    else {
+        L.push(`  Transparency log: ${transparency === "NOT_AVAILABLE" ? "not included" : transparency}`);
+    }
+    if (online && revocation)
+        L.push(`  Revocation status: ${revocation.status}`);
+    return L.join("\n") + "\n";
+}
+async function main() {
+    const args = parseArgs(process.argv);
+    const cert = JSON.parse(await (0, promises_1.readFile)(args.certPath, "utf-8"));
+    const keys = await loadKeys(args.keysPath);
+    let sigResult = "VALID";
+    try {
+        await (0, verify_js_1.verifyCertificate)(crypto_node_js_1.nodeCrypto, cert, keys);
+    }
+    catch (e) {
+        sigResult = e instanceof Error ? e.message : "unknown error";
+    }
+    // NOT_AVAILABLE (no proof) is a legitimate result; only a thrown error is a
+    // transparency FAILURE and must fail the verdict + exit code.
+    let transparency = "NOT_AVAILABLE";
+    let transparencyFailed = false;
+    try {
+        transparency = await (0, verify_js_1.verifyTransparency)(crypto_node_js_1.nodeCrypto, cert, keys);
+    }
+    catch (e) {
+        transparency = e instanceof Error ? e.message : "unknown error";
+        transparencyFailed = true;
+    }
+    let revocation;
+    if (args.online)
+        revocation = await checkRevocation(args.apiUrl, args.apiKey, cert.certificate_id);
+    const valid = certVerdict(sigResult, transparencyFailed, args.online, revocation);
+    process.stdout.write(formatOutput(cert, sigResult, transparency, transparencyFailed, revocation, args.online));
+    process.exit(valid ? 0 : 1);
+}
+// Only run as a CLI entry point — importing this module (e.g. from tests) must
+// not execute main(). argv[1] is the script path when invoked as the binary.
+if (process.argv[1]?.endsWith("cli.js")) {
+    main().catch((e) => {
+        process.stderr.write(`Error: ${e instanceof Error ? e.message : String(e)}\n`);
+        process.exit(2);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cjs/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";;AACA;mDACmD;;AA4EnD,kCAWC;AAED,oCAsCC;AA7HD,+CAA4C;AAC5C,qDAA8C;AAC9C,2CAAsF;AACtF,uCAA2D;AAI3D,MAAM,KAAK,GAAG,kGAAkG,CAAC;AAEjH,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAG/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;aACrF,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;;YACrF,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;QAC3E,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAA,4BAAgB,EAAC,2BAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YAC/D,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,oBAAoB,MAAM,oBAAoB,EAAE;QAC/E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAoD,CAAA,CAAC,IAAI,CAAC;AAClF,CAAC;AAED;;wEAEwE;AACxE,SAAgB,WAAW,CACzB,SAAiB,EACjB,kBAA2B,EAC3B,MAAe,EACf,UAA0C;IAE1C,OAAO,CACL,SAAS,KAAK,OAAO;QACrB,CAAC,kBAAkB;QACnB,CAAC,CAAC,MAAM,IAAI,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,UAA2D,EAAE,MAAe;IAE5E,MAAM,EAAE,GAAI,IAAI,CAAC,cAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAI,IAAI,CAAC,OAAmC,CAAC,eAAyB,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAuC,CAAC;IACzD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,kBAAkB,EAAE,cAAc,SAAS,KAAK,CAAC;IACnF,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,EAAE,4BAA4B,YAAY,KAAK,CAAC;IACjG,IAAI,MAAM,IAAI,UAAU,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM;YAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,CAAC;IACvE,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAE5E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAoC,CAAC;IACrD,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,YAAuB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,IAAI,CAAC,oBAAqB,GAAG,CAAC,OAAqC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,YAAuB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IAEnD,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,IAAI,UAAU;QAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAS,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QAAC,MAAM,IAAA,6BAAiB,EAAC,2BAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,CAAC,EAAE,CAAC;QAAC,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAAC,CAAC;IAE3E,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,IAAA,8BAAkB,EAAC,2BAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QAAC,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAAC,kBAAkB,GAAG,IAAI,CAAC;IAAC,CAAC;IAEzG,IAAI,UAA2D,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM;QAAE,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;IAE7G,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAElF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/G,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/client.d.ts

@@ -0,0 +1,116 @@
+/** Async BurnLedger API client.
+ *
+ * Single class — Node.js is all-async, no sync/async split needed.
+ * Pagination uses AsyncIterable<T> via Paginator.
+ */
+import type { ApiKeyListItem, ApiKeyResponse, Attestation, BatchAttestationResponse, CertificateResponse, CertificateStats, ConsistencyProof, InclusionProof, LogEntry, Profile, RevocationStatus, SignedTreeHead, System, SystemHealth, VerifyResult, Webhook, WebhookDelivery, WebhookRotateResponse } from "./models.js";
+import { Paginator } from "./pagination.js";
+export interface BurnLedgerOptions {
+    apiKey: string;
+    baseUrl?: string;
+    timeout?: number;
+    maxRetries?: number;
+}
+export declare class BurnLedger {
+    private readonly transport;
+    constructor(opts: BurnLedgerOptions);
+    close(): void;
+    [Symbol.asyncDispose](): Promise<void>;
+    registerSystem(opts: {
+        name: string;
+        connectorType: string;
+        connectionConfig?: Record<string, unknown>;
+        dsn?: string;
+        uri?: string;
+        subjectQuery: string;
+        hashScope?: string;
+        maxRecords?: number;
+        maxBytes?: number;
+        queryTimeout?: string;
+    }): Promise<System>;
+    getSystem(systemId: string): Promise<System>;
+    listSystems(opts?: {
+        limit?: number;
+    }): Paginator<System>;
+    deregisterSystem(systemId: string): Promise<void>;
+    healthCheck(systemId: string): Promise<System>;
+    attest(subjectIdentifier: string, opts?: {
+        systemIds?: string[];
+        proofMode?: string;
+        expiresIn?: string;
+        webhookUrl?: string;
+    }): Promise<Attestation>;
+    getAttestation(attestationId: string): Promise<Attestation>;
+    waitFor(attestationId: string, opts?: {
+        timeout?: number;
+        pollInterval?: number;
+    }): Promise<Attestation>;
+    verify(attestationId: string, subjectIdentifier: string, opts?: {
+        timeout?: number;
+        pollInterval?: number;
+    }): Promise<VerifyResult>;
+    batchAttest(opts: {
+        subjectIdentifiers: string[];
+        systemIds: string[];
+        proofMode?: string;
+        expiresIn?: string;
+    }): Promise<BatchAttestationResponse>;
+    getCertificate(certificateId: string): Promise<CertificateResponse>;
+    listCertificates(opts?: {
+        limit?: number;
+    }): Paginator<CertificateResponse>;
+    downloadPdf(certificateId: string): Promise<Uint8Array>;
+    savePdf(certificateId: string, path: string): Promise<void>;
+    getRevocationStatus(certificateId: string): Promise<RevocationStatus>;
+    revokeCertificate(certificateId: string, opts: {
+        reason: string;
+    }): Promise<CertificateResponse>;
+    getCertificateStats(): Promise<CertificateStats>;
+    exportCertificates(opts?: {
+        format?: "csv" | "jsonl";
+        status?: "ACTIVE" | "REVOKED";
+        issuedAfter?: string;
+        issuedBefore?: string;
+    }): Promise<Uint8Array>;
+    registerWebhook(opts: {
+        url: string;
+    }): Promise<Webhook>;
+    listWebhooks(opts?: {
+        limit?: number;
+    }): Paginator<Webhook>;
+    deleteWebhook(webhookId: string): Promise<void>;
+    rotateWebhookSecret(webhookId: string): Promise<WebhookRotateResponse>;
+    commitWebhookRotation(webhookId: string): Promise<void>;
+    listFailedDeliveries(opts?: {
+        limit?: number;
+    }): Paginator<WebhookDelivery>;
+    retryDelivery(deliveryId: string): Promise<void>;
+    resolveDelivery(deliveryId: string): Promise<void>;
+    listApiKeys(opts?: {
+        limit?: number;
+    }): Paginator<ApiKeyListItem>;
+    createApiKey(): Promise<ApiKeyResponse>;
+    revokeApiKey(keyId: string): Promise<void>;
+    getMe(): Promise<Profile>;
+    updateMe(params: {
+        name: string;
+        email: string;
+    }): Promise<Profile>;
+    deleteMe(): Promise<void>;
+    getSystemHealth(systemId: string): Promise<SystemHealth>;
+    getLogHead(): Promise<SignedTreeHead>;
+    getLogEntry(index: number): Promise<LogEntry>;
+    getLogEntries(opts: {
+        start: number;
+        end: number;
+    }): Promise<LogEntry[]>;
+    getInclusionProof(opts: {
+        index: number;
+        treeSize: number;
+    }): Promise<InclusionProof>;
+    getConsistencyProof(opts: {
+        oldSize: number;
+        newSize: number;
+    }): Promise<ConsistencyProof>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/cjs/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,eAAe,EACf,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAqBrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,IAAI,EAAE,iBAAiB;IASnC,KAAK,IAAI,IAAI;IAKb,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC,cAAc,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,MAAM,CAAC;IAsBb,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQlD,WAAW,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,MAAM,CAAC;IAMnD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU9C,MAAM,CACV,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACA,OAAO,CAAC,WAAW,CAAC;IAejB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3D,OAAO,CACX,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,WAAW,CAAC;IAUjB,MAAM,CACV,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,YAAY,CAAC;IA8BlB,WAAW,CAAC,IAAI,EAAE;QACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAe/B,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAQzE,gBAAgB,CAAC,IAAI,CAAC,EAAE;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,SAAS,CAAC,mBAAmB,CAAC;IAS5B,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAOvD,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3D,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQrE,iBAAiB,CACrB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC;IASzB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAKhD,kBAAkB,CAAC,IAAI,CAAC,EAAE;QAC9B,MAAM,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,UAAU,CAAC;IAcjB,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAO9D,YAAY,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,OAAO,CAAC;IAMrD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQtE,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,oBAAoB,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,eAAe,CAAC;IASrE,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOhD,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxD,WAAW,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,cAAc,CAAC;IAS3D,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC;IAOvC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1C,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAKzB,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOnE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAMzB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAUxD,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC;IAOrC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS7C,aAAa,CAAC,IAAI,EAAE;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAQjB,iBAAiB,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,cAAc,CAAC;IAYrB,mBAAmB,CAAC,IAAI,EAAE;QAC9B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAW9B"}