cesr-ts 0.4.0 → 0.6.0

package/esm/src/primitives/siger.js

@@ -1,5 +1,5 @@
 import { UnknownCodeError } from "../core/errors.js";
-import { SIGER_CODES } from "./codex.js";
+import { IdrDex, MtrDex, SIGER_CODES } from "./codex.js";
 import { Indexer, parseIndexer } from "./indexer.js";
 /**
  * Indexed signature primitive with optional verifier association.
@@ -9,8 +9,7 @@ import { Indexer, parseIndexer } from "./indexer.js";
  */
 export class Siger extends Indexer {
     constructor(init, verfer) {
-        const indexer = init instanceof Indexer ? init : new Indexer(init);
-        super(indexer);
+        super(init);
         Object.defineProperty(this, "verfer", {
             enumerable: true,
             configurable: true,
@@ -22,6 +21,62 @@ export class Siger extends Indexer {
         }
         this.verfer = verfer;
     }
+    /** Rebuild indexed signature material from detached signature bytes plus verifier context. */
+    static fromCigar(cigar, { index, ondex, only = false, verfer = cigar.verfer }) {
+        if (!verfer) {
+            throw new Error("Cannot derive indexed signature code from detached signature without verifier context.");
+        }
+        const normalizedOndex = only ? undefined : ondex ?? index;
+        return new Siger({
+            code: Siger.indexedSignatureCodeForVerfer(verfer.code, index, {
+                only,
+                ondex: normalizedOndex ?? undefined,
+            }),
+            raw: cigar.raw,
+            index,
+            ondex: normalizedOndex ?? undefined,
+        }, verfer);
+    }
+    /** Resolve the indexed-signature family implied by one verifier suite. */
+    static indexedSignatureFamilyForVerfer(verferCode) {
+        switch (verferCode) {
+            case MtrDex.Ed25519:
+            case MtrDex.Ed25519N:
+                return {
+                    both: IdrDex.Ed25519_Sig,
+                    bigBoth: IdrDex.Ed25519_Big_Sig,
+                    currentOnly: IdrDex.Ed25519_Crt_Sig,
+                    bigCurrentOnly: IdrDex.Ed25519_Big_Crt_Sig,
+                };
+            case MtrDex.ECDSA_256k1:
+            case MtrDex.ECDSA_256k1N:
+                return {
+                    both: IdrDex.ECDSA_256k1_Sig,
+                    bigBoth: IdrDex.ECDSA_256k1_Big_Sig,
+                    currentOnly: IdrDex.ECDSA_256k1_Crt_Sig,
+                    bigCurrentOnly: IdrDex.ECDSA_256k1_Big_Crt_Sig,
+                };
+            case MtrDex.ECDSA_256r1:
+            case MtrDex.ECDSA_256r1N:
+                return {
+                    both: IdrDex.ECDSA_256r1_Sig,
+                    bigBoth: IdrDex.ECDSA_256r1_Big_Sig,
+                    currentOnly: IdrDex.ECDSA_256r1_Crt_Sig,
+                    bigCurrentOnly: IdrDex.ECDSA_256r1_Big_Crt_Sig,
+                };
+            default:
+                throw new UnknownCodeError(`Unsupported verifier code ${verferCode} for indexed signature material`);
+        }
+    }
+    /** Resolve the indexed-signature code emitted for one verifier suite and signature shape. */
+    static indexedSignatureCodeForVerfer(verferCode, index, { ondex, only = false, } = {}) {
+        const family = Siger.indexedSignatureFamilyForVerfer(verferCode);
+        if (only) {
+            return index <= 63 ? family.currentOnly : family.bigCurrentOnly;
+        }
+        const ondexValue = ondex ?? index;
+        return ondexValue === index && index <= 63 ? family.both : family.bigBoth;
+    }
 }
 /** Parse and hydrate `Siger` from txt or qb2 encoded bytes. */
 export function parseSiger(input, cold) {

package/esm/src/primitives/signer.js

@@ -1,23 +1,257 @@
+import { ed25519 } from "@noble/curves/ed25519";
+import { p256 } from "@noble/curves/nist";
+import { secp256k1 } from "@noble/curves/secp256k1";
 import { UnknownCodeError } from "../core/errors.js";
-import { SIGNER_CODES } from "./codex.js";
+import { Cigar } from "./cigar.js";
+import { IdrDex, MtrDex, SIGNER_CODES } from "./codex.js";
 import { Matter } from "./matter.js";
+import { Siger } from "./siger.js";
+import { Verfer } from "./verfer.js";
+/** Resolve the explicit signer transferability choice from the supported init forms. */
+function resolveTransferable(init) {
+    if (init instanceof Signer) {
+        return init.transferable;
+    }
+    if (init instanceof Matter) {
+        return true;
+    }
+    return typeof init.transferable === "boolean" ? init.transferable : true;
+}
 /**
  * Signing-seed primitive.
  *
- * KERIpy substance: Signer wraps private seed material that is used to derive
- * signing key pairs and associated verifier material; this TS layer constrains
- * codex validity while higher crypto layers perform key derivation/signing.
+ * KERIpy substance: Signer wraps private seed material, derives the associated
+ * verifier, and owns suite-driven signature creation.
+ *
+ * TypeScript difference:
+ * - seed derivation codes do not themselves encode transferability, so
+ *   `Signer` carries an explicit transferability choice rather than inheriting
+ *   `Matter.transferable`
  */
 export class Signer extends Matter {
     constructor(init) {
-        const matter = init instanceof Matter ? init : new Matter(init);
-        super(matter);
-        if (!SIGNER_CODES.has(this.code)) {
-            throw new UnknownCodeError(`Expected signer seed code, got ${this.code}`);
-        }
+        super(init);
+        Object.defineProperty(this, "_transferable", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "_signRaw", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Public verifier derived from this seed and the explicit transferability choice. */
+        Object.defineProperty(this, "verfer", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Signer.assertSupportedSeedCode(this.code);
+        this._transferable = resolveTransferable(init);
+        const suite = Signer.bindSuite(this.code, this.raw, this.transferable);
+        this.verfer = suite.verfer;
+        this._signRaw = suite.signRaw;
+    }
+    /**
+     * Explicit signer transferability override.
+     *
+     * Seed codes do not encode transferability, so `Signer` intentionally does
+     * not inherit the generic `Matter.transferable` rule.
+     */
+    get transferable() {
+        return this._transferable;
     }
     /** Raw seed bytes for signer key-derivation/instantiation. */
     get seed() {
         return this.raw;
     }
+    /** Return the raw seed size implied by one signer-suite code. */
+    static seedSizeForCode(code) {
+        Signer.assertSupportedSeedCode(code);
+        return 32;
+    }
+    /**
+     * Project one verifier code back to the signer seed code for the same suite.
+     *
+     * Keeper-style derivation flows use this without reopening a free helper seam.
+     */
+    static seedCodeForVerferCode(verferCode) {
+        Signer.assertSupportedVerferCode(verferCode);
+        switch (verferCode) {
+            case MtrDex.Ed25519:
+            case MtrDex.Ed25519N:
+                return MtrDex.Ed25519_Seed;
+            case MtrDex.ECDSA_256k1:
+            case MtrDex.ECDSA_256k1N:
+                return MtrDex.ECDSA_256k1_Seed;
+            case MtrDex.ECDSA_256r1:
+            case MtrDex.ECDSA_256r1N:
+                return MtrDex.ECDSA_256r1_Seed;
+        }
+    }
+    /** Create one explicit random signer seed for creator-style flows. */
+    static random({ code = MtrDex.Ed25519_Seed, transferable = true } = {}) {
+        const raw = crypto.getRandomValues(new Uint8Array(Signer.seedSizeForCode(code)));
+        return new Signer({ code, raw, transferable });
+    }
+    static assertSupportedSeedCode(code) {
+        if (!SIGNER_CODES.has(code)) {
+            throw new UnknownCodeError(`Expected signer seed code, got ${code}`);
+        }
+    }
+    static assertSupportedVerferCode(code) {
+        if (code !== MtrDex.Ed25519
+            && code !== MtrDex.Ed25519N
+            && code !== MtrDex.ECDSA_256k1
+            && code !== MtrDex.ECDSA_256k1N
+            && code !== MtrDex.ECDSA_256r1
+            && code !== MtrDex.ECDSA_256r1N) {
+            throw new UnknownCodeError(`Unsupported verifier code ${code}`);
+        }
+    }
+    /** Resolve the verifier code implied by one signer seed code and transferability choice. */
+    static verferCodeForSeedCode(code, transferable) {
+        switch (code) {
+            case MtrDex.Ed25519_Seed:
+                return transferable ? MtrDex.Ed25519 : MtrDex.Ed25519N;
+            case MtrDex.ECDSA_256k1_Seed:
+                return transferable ? MtrDex.ECDSA_256k1 : MtrDex.ECDSA_256k1N;
+            case MtrDex.ECDSA_256r1_Seed:
+                return transferable ? MtrDex.ECDSA_256r1 : MtrDex.ECDSA_256r1N;
+        }
+    }
+    /** Derive one raw public verification key from signer seed bytes and suite code. */
+    static publicKeyForSeedCode(code, seed) {
+        switch (code) {
+            case MtrDex.Ed25519_Seed:
+                return ed25519.getPublicKey(seed);
+            case MtrDex.ECDSA_256k1_Seed:
+                return secp256k1.getPublicKey(seed);
+            case MtrDex.ECDSA_256r1_Seed:
+                return p256.getPublicKey(seed);
+        }
+    }
+    /** Bind one KERIpy-style signer suite at construction time. */
+    static bindSuite(code, seed, transferable) {
+        const verfer = new Verfer({
+            code: Signer.verferCodeForSeedCode(code, transferable),
+            raw: Signer.publicKeyForSeedCode(code, seed),
+        });
+        switch (code) {
+            case MtrDex.Ed25519_Seed:
+                return {
+                    verfer,
+                    signRaw: (ser) => ed25519.sign(ser, seed),
+                };
+            case MtrDex.ECDSA_256k1_Seed:
+                return {
+                    verfer,
+                    signRaw: (ser) => secp256k1.sign(ser, seed, {
+                        format: "compact",
+                        lowS: false,
+                        prehash: true,
+                    }).toBytes("compact"),
+                };
+            case MtrDex.ECDSA_256r1_Seed:
+                return {
+                    verfer,
+                    signRaw: (ser) => p256.sign(ser, seed, {
+                        format: "compact",
+                        lowS: false,
+                        prehash: true,
+                    }).toBytes("compact"),
+                };
+        }
+    }
+    /** Resolve the detached-signature code emitted by this signer suite. */
+    detachedSignatureCode() {
+        switch (this.code) {
+            case MtrDex.Ed25519_Seed:
+                return MtrDex.Ed25519_Sig;
+            case MtrDex.ECDSA_256k1_Seed:
+                return MtrDex.ECDSA_256k1_Sig;
+            case MtrDex.ECDSA_256r1_Seed:
+                return MtrDex.ECDSA_256r1_Sig;
+            default:
+                throw new UnknownCodeError(`Unsupported signer seed code ${this.code}`);
+        }
+    }
+    /** Resolve the indexed-signature family emitted by this signer suite. */
+    indexedSignatureFamily() {
+        switch (this.code) {
+            case MtrDex.Ed25519_Seed:
+                return {
+                    both: IdrDex.Ed25519_Sig,
+                    bigBoth: IdrDex.Ed25519_Big_Sig,
+                    currentOnly: IdrDex.Ed25519_Crt_Sig,
+                    bigCurrentOnly: IdrDex.Ed25519_Big_Crt_Sig,
+                };
+            case MtrDex.ECDSA_256k1_Seed:
+                return {
+                    both: IdrDex.ECDSA_256k1_Sig,
+                    bigBoth: IdrDex.ECDSA_256k1_Big_Sig,
+                    currentOnly: IdrDex.ECDSA_256k1_Crt_Sig,
+                    bigCurrentOnly: IdrDex.ECDSA_256k1_Big_Crt_Sig,
+                };
+            case MtrDex.ECDSA_256r1_Seed:
+                return {
+                    both: IdrDex.ECDSA_256r1_Sig,
+                    bigBoth: IdrDex.ECDSA_256r1_Big_Sig,
+                    currentOnly: IdrDex.ECDSA_256r1_Crt_Sig,
+                    bigCurrentOnly: IdrDex.ECDSA_256r1_Big_Crt_Sig,
+                };
+            default:
+                throw new UnknownCodeError(`Unsupported signer seed code ${this.code}`);
+        }
+    }
+    /**
+     * Resolve the indexed-signature code emitted by this signer and signature shape.
+     *
+     * KERIpy correspondence:
+     * - `only=true` selects the current-list-only family
+     * - otherwise `ondex` defaults to `index`
+     * - the small `both` family is valid only when `index === ondex <= 63`
+     */
+    indexedSignatureCode(index, { ondex, only = false, } = {}) {
+        const family = this.indexedSignatureFamily();
+        if (only) {
+            return index <= 63 ? family.currentOnly : family.bigCurrentOnly;
+        }
+        const ondexValue = ondex ?? index;
+        return ondexValue === index && index <= 63 ? family.both : family.bigBoth;
+    }
+    /**
+     * Sign one message and return either a detached `Cigar` or indexed `Siger`.
+     *
+     * KERIpy correspondence:
+     * - `index === undefined` returns a detached non-indexed signature
+     * - otherwise the seed suite decides the emitted indexed signature code family
+     * - `only=true` selects the current-list-only family and ignores any caller
+     *   `ondex` override
+     * - otherwise `ondex` defaults to `index`, preserving KERIpy's implicit
+     *   same-index rule for ordinary indexed signatures
+     */
+    sign(ser, { index, only = false, ondex } = {}) {
+        const sig = this._signRaw(ser);
+        if (index === undefined) {
+            return new Cigar({
+                code: this.detachedSignatureCode(),
+                raw: sig,
+            }, this.verfer);
+        }
+        const normalizedOndex = only ? undefined : ondex ?? index;
+        return new Siger({
+            code: this.indexedSignatureCode(index, {
+                only,
+                ondex: normalizedOndex ?? undefined,
+            }),
+            raw: sig,
+            index,
+            ondex: normalizedOndex ?? undefined,
+        }, this.verfer);
+    }
 }

package/esm/src/primitives/streamer.js

@@ -0,0 +1,28 @@
+import { normalizeByteLike } from "./byte-like.js";
+/**
+ * Sniffable CESR stream holder.
+ *
+ * KERIpy substance: `Streamer` is the minimal primitive used when encryption
+ * and decryption round-trip whole CESR streams instead of one qualified matter
+ * instance.
+ *
+ * Current `keri-ts` scope:
+ * - owns raw stream bytes only
+ * - does not yet port KERIpy's `text` / `binary` / `texter` / `bexter`
+ *   projection helpers or sniffability verification behavior
+ */
+export class Streamer {
+    constructor({ stream }) {
+        Object.defineProperty(this, "_stream", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this._stream = normalizeByteLike(stream);
+    }
+    /** Raw sniffable CESR stream bytes. */
+    get stream() {
+        return this._stream.slice();
+    }
+}