ftown 0.20.9 → 0.24.0

package/dist/security/ledger/proof.d.ts

@@ -0,0 +1,36 @@
+import type { LedgerCheckpoint } from './protocol.js';
+export interface AuthProof {
+    accountId: string;
+    kind: 'device' | 'bridge';
+    /** endpoint.id for a device, bridgeId for a bridge. */
+    keyId: string;
+    nonce: string;
+    purpose: 'session' | 'relay';
+    /** Exact server origin. */
+    audience: string;
+    /** Raw r||s, base64url. */
+    signature: string;
+}
+export type AuthProofFields = Omit<AuthProof, 'signature'>;
+/**
+ * ECDSA P-256/SHA-256 over `bytes`, returned as canonical unpadded base64url of raw r||s (64 bytes) with low S. The helper adds NO domain of
+ * its own: every caller must prefix `bytes` with its own protocol domain string (auth proofs: 'ftown-auth-proof-v1\n'; head announcements:
+ * HEAD_ANNOUNCE_DOMAIN), so a signature made for one protocol can never verify as another.
+ */
+export declare function signDomain(privateKey: CryptoKey, bytes: Uint8Array): Promise<string>;
+/**
+ * Whether `signature` (canonical unpadded base64url of raw r||s, exactly 64 bytes, low S) is a valid ECDSA P-256/SHA-256 signature over `bytes`
+ * under `authPublicKey` (raw uncompressed P-256 point, 65 bytes, base64url). No domain of its own: the caller passes the same domain-prefixed
+ * bytes it expects the signer to have signed. High-S, non-canonical, short or long encodings and any malformed input return false; never throws.
+ */
+export declare function verifyDomain(authPublicKey: string, signature: string, bytes: Uint8Array): Promise<boolean>;
+export declare function generateAuthKey(extractable: boolean): Promise<{
+    publicKey: string;
+    privateKey: CryptoKey;
+}>;
+export declare function signAuthProof(privateKey: CryptoKey, fields: AuthProofFields): Promise<AuthProof>;
+export declare function parseAuthProof(value: unknown): AuthProof | null;
+export declare function verifyAuthProof(checkpoint: LedgerCheckpoint, proof: AuthProof, expect: {
+    audience: string;
+    purpose: 'session' | 'relay';
+}): Promise<boolean>;

package/dist/security/ledger/proof.js

@@ -0,0 +1,193 @@
+const PROOF_DOMAIN = 'ftown-auth-proof-v1\n';
+const ECDSA = { name: 'ECDSA', namedCurve: 'P-256' };
+const SIGN = { name: 'ECDSA', hash: 'SHA-256' };
+const MAX_NONCE = 128;
+const B64URL = /^[A-Za-z0-9_-]+$/;
+const KEYS = ['accountId', 'kind', 'keyId', 'nonce', 'purpose', 'audience', 'signature'];
+const MAX_ACCOUNT = 64;
+const MAX_KEY_ID = 128;
+const MAX_AUDIENCE = 256;
+const SIGNATURE_LENGTH = 86;
+/** 65 bytes unpadded base64url; bounds the decode of a hostile key string. */
+const PUBLIC_KEY_LENGTH = 87;
+const LOOPBACK = ['localhost', '127.0.0.1', '[::1]'];
+const ORDER = hexBytes('FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551');
+const HALF_ORDER = hexBytes('7FFFFFFF800000007FFFFFFFFFFFFFFFDE737D56D38BCF4279DCE5617E3192A8');
+function hexBytes(hex) {
+    const out = [];
+    for (let i = 0; i < hex.length; i += 2)
+        out.push(parseInt(hex.slice(i, i + 2), 16));
+    return out;
+}
+function isHighS(s) {
+    for (let i = 0; i < 32; i++) {
+        if (s[i] !== HALF_ORDER[i])
+            return s[i] > HALF_ORDER[i];
+    }
+    return false;
+}
+function lowS(signature) {
+    if (!isHighS(signature.subarray(32)))
+        return signature;
+    const out = new Uint8Array(signature);
+    let borrow = 0;
+    for (let i = 31; i >= 0; i--) {
+        let value = ORDER[i] - signature[32 + i] - borrow;
+        borrow = value < 0 ? 1 : 0;
+        if (value < 0)
+            value += 256;
+        out[32 + i] = value;
+    }
+    return out;
+}
+function validAudience(value) {
+    if (value.length === 0 || value.length > MAX_AUDIENCE)
+        return false;
+    try {
+        const url = new URL(value);
+        if (url.origin !== value)
+            return false;
+        return url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.indexOf(url.hostname) !== -1);
+    }
+    catch {
+        return false;
+    }
+}
+function encode(data) {
+    let binary = '';
+    for (let i = 0; i < data.length; i++)
+        binary += String.fromCharCode(data[i]);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function decode(value) {
+    if (!B64URL.test(value) || value.length % 4 === 1)
+        return null;
+    try {
+        const binary = atob(value.replace(/-/g, '+').replace(/_/g, '/'));
+        const out = new Uint8Array(new ArrayBuffer(binary.length));
+        for (let i = 0; i < binary.length; i++)
+            out[i] = binary.charCodeAt(i);
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * ECDSA P-256/SHA-256 over `bytes`, returned as canonical unpadded base64url of raw r||s (64 bytes) with low S. The helper adds NO domain of
+ * its own: every caller must prefix `bytes` with its own protocol domain string (auth proofs: 'ftown-auth-proof-v1\n'; head announcements:
+ * HEAD_ANNOUNCE_DOMAIN), so a signature made for one protocol can never verify as another.
+ */
+export async function signDomain(privateKey, bytes) {
+    const data = new Uint8Array(new ArrayBuffer(bytes.length));
+    data.set(bytes);
+    return encode(lowS(new Uint8Array(await crypto.subtle.sign(SIGN, privateKey, data))));
+}
+/**
+ * Whether `signature` (canonical unpadded base64url of raw r||s, exactly 64 bytes, low S) is a valid ECDSA P-256/SHA-256 signature over `bytes`
+ * under `authPublicKey` (raw uncompressed P-256 point, 65 bytes, base64url). No domain of its own: the caller passes the same domain-prefixed
+ * bytes it expects the signer to have signed. High-S, non-canonical, short or long encodings and any malformed input return false; never throws.
+ */
+export async function verifyDomain(authPublicKey, signature, bytes) {
+    try {
+        if (typeof authPublicKey !== 'string' || typeof signature !== 'string' || signature.length !== SIGNATURE_LENGTH)
+            return false;
+        // Tag check instead of instanceof so typed arrays from another realm are accepted.
+        if (authPublicKey.length > PUBLIC_KEY_LENGTH || Object.prototype.toString.call(bytes) !== '[object Uint8Array]')
+            return false;
+        const raw = decode(authPublicKey);
+        const decoded = decode(signature);
+        if (!raw || raw.length !== 65 || !decoded || decoded.length !== 64 || encode(decoded) !== signature || isHighS(decoded.subarray(32)))
+            return false;
+        const data = new Uint8Array(new ArrayBuffer(bytes.length));
+        data.set(bytes);
+        const key = await crypto.subtle.importKey('raw', raw, ECDSA, false, ['verify']);
+        return await crypto.subtle.verify(SIGN, key, decoded, data);
+    }
+    catch {
+        return false;
+    }
+}
+function canonicalBytes(fields) {
+    const ordered = {
+        accountId: fields.accountId,
+        audience: fields.audience,
+        keyId: fields.keyId,
+        kind: fields.kind,
+        nonce: fields.nonce,
+        purpose: fields.purpose,
+    };
+    const text = PROOF_DOMAIN + JSON.stringify(ordered);
+    const out = new Uint8Array(new ArrayBuffer(text.length * 3));
+    const { written } = new TextEncoder().encodeInto(text, out);
+    return out.slice(0, written);
+}
+export async function generateAuthKey(extractable) {
+    const pair = await crypto.subtle.generateKey(ECDSA, extractable, ['sign', 'verify']);
+    const publicKey = encode(new Uint8Array(await crypto.subtle.exportKey('raw', pair.publicKey)));
+    return { publicKey, privateKey: pair.privateKey };
+}
+export async function signAuthProof(privateKey, fields) {
+    const { accountId, kind, keyId, nonce, purpose, audience } = fields;
+    const signature = await signDomain(privateKey, canonicalBytes({ accountId, kind, keyId, nonce, purpose, audience }));
+    return { accountId, kind, keyId, nonce, purpose, audience, signature };
+}
+export function parseAuthProof(value) {
+    try {
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            return null;
+        const record = value;
+        const keys = Object.keys(record);
+        if (keys.length !== KEYS.length || !keys.every(key => KEYS.indexOf(key) !== -1))
+            return null;
+        const { accountId, kind, keyId, nonce, purpose, audience, signature } = record;
+        if (typeof accountId !== 'string' || !accountId || accountId.length > MAX_ACCOUNT)
+            return null;
+        if (typeof keyId !== 'string' || !keyId || keyId.length > MAX_KEY_ID)
+            return null;
+        if (kind !== 'device' && kind !== 'bridge')
+            return null;
+        if (purpose !== 'session' && purpose !== 'relay')
+            return null;
+        if (typeof nonce !== 'string' || nonce.length === 0 || nonce.length > MAX_NONCE || !B64URL.test(nonce))
+            return null;
+        if (typeof audience !== 'string' || !validAudience(audience))
+            return null;
+        if (typeof signature !== 'string' || signature.length !== SIGNATURE_LENGTH || !B64URL.test(signature))
+            return null;
+        return { accountId, kind, keyId, nonce, purpose, audience, signature };
+    }
+    catch {
+        return null;
+    }
+}
+// Nonce freshness and single use are enforced by the server, not here.
+export async function verifyAuthProof(checkpoint, proof, expect) {
+    try {
+        const parsed = parseAuthProof(proof);
+        if (!parsed || parsed.accountId !== checkpoint.accountId)
+            return false;
+        if (parsed.audience !== expect.audience || parsed.purpose !== expect.purpose)
+            return false;
+        if (parsed.kind === 'bridge' && parsed.purpose === 'session')
+            return false;
+        let authPublicKey;
+        if (parsed.kind === 'device') {
+            if (checkpoint.revokedDeviceIds.indexOf(parsed.keyId) !== -1)
+                return false;
+            authPublicKey = checkpoint.devices.filter(entry => entry.endpoint.id === parsed.keyId)[0]?.authPublicKey;
+        }
+        else {
+            if (checkpoint.revokedBridgeIds.indexOf(parsed.keyId) !== -1)
+                return false;
+            authPublicKey = checkpoint.bridges.filter(entry => entry.bridgeId === parsed.keyId)[0]?.authPublicKey;
+        }
+        if (!authPublicKey)
+            return false;
+        return await verifyDomain(authPublicKey, parsed.signature, canonicalBytes(parsed));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=proof.js.map

package/dist/security/ledger/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../../../src/security/ledger/proof.ts"],"names":[],"mappings":"AAiBA,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AAC9D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AACzD,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAClC,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AACzF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,kEAAkE,CAAC,CAAC;AAC3F,MAAM,UAAU,GAAG,QAAQ,CAAC,kEAAkE,CAAC,CAAC;AAEhG,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAoB;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,SAAqB;IACjC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;QAClD,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,IAAI,GAAG,CAAC;QAC5B,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,IAAgB;IAC9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAqB,EAAE,KAAiB;IACvE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,aAAqB,EAAE,SAAiB,EAAE,KAAiB;IAC5F,IAAI,CAAC;QACH,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC9H,mFAAmF;QACnF,IAAI,aAAa,CAAC,MAAM,GAAG,iBAAiB,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,qBAAqB;YAAE,OAAO,KAAK,CAAC;QAC9H,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnJ,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,MAAM,IAAI,GAAG,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAoB;IACxD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAqB,EAAE,MAAuB;IAChF,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrF,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;YAAE,OAAO,IAAI,CAAC;QAClF,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpH,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACnH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA4B,EAC5B,KAAgB,EAChB,MAA0D;IAE1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3F,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC3E,IAAI,aAAiC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3E,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC;QAC3G,CAAC;aAAM,CAAC;YACN,IAAI,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3E,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACjC,OAAO,MAAM,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC"}

package/dist/security/ledger/protocol.d.ts

@@ -0,0 +1,113 @@
+import type { EndpointPublic } from '../protocol.js';
+export declare const LEDGER_DOMAIN = "ftown-account-trust-v2\n";
+/** Sign-in assertions are over SHA-256(SIGNIN_DOMAIN + nonce); never over raw server bytes. */
+export declare const SIGNIN_DOMAIN = "ftown-signin-v2\n";
+/** A new authority's consent is its own assertion over SHA-256(AUTHORITY_CONSENT_DOMAIN + canonical({accountId, credentialId, publicKey})). */
+export declare const AUTHORITY_CONSENT_DOMAIN = "ftown-authority-consent-v2\n";
+export interface LedgerAuthority {
+    credentialId: string;
+    /** Raw uncompressed P-256 point, 65 bytes, base64url. */
+    publicKey: string;
+    label: string;
+    addedAt: number;
+}
+export interface LedgerDevice {
+    endpoint: EndpointPublic;
+    authPublicKey: string;
+    label: string;
+    approvedAt: number;
+}
+export interface LedgerBridge {
+    bridgeId: string;
+    endpoint: EndpointPublic;
+    authPublicKey: string;
+    label: string;
+    approvedAt: number;
+}
+export interface LedgerGenesis {
+    type: 'ftown_account_genesis';
+    version: 2;
+    rpId: string;
+    origins: string[];
+    /** WebAuthn user.id: 32 random bytes, base64url. */
+    handle: string;
+    createdAt: number;
+    authority: LedgerAuthority;
+}
+/** Authorities are add-only: a lost or compromised passkey means a new account. `consent` is the added passkey's own assertion
+ *  over authorityConsentChallenge(accountId, authority), so no account can claim a passkey that did not agree to join it.
+ *  `resolve_fork` is the owner's choice between two diverged histories, appended to the chosen chain: `forkHead` is the head of the last
+ *  record both share, `discardedFirst` the head of the other branch's first record after it (what identifies the branch it discards),
+ *  `discardedHead`/`discardedRevision` the tip of the other chain as the signer saw it. It changes no membership. Valid only if forkHead is
+ *  an earlier record of the same chain (or its genesis), the signer was already an authority at forkHead, discardedRevision is after
+ *  forkHead's revision, discardedFirst and discardedHead are no record of this chain, and discardedHead equals discardedFirst exactly when
+ *  discardedRevision is forkHead's revision + 1 (see chooseLedger for its effect).
+ *  revoke_device / revoke_bridge of an id that is not a member only tombstones it; a revoked id can never be added again. */
+export type LedgerOperation = {
+    type: 'add_device';
+    device: LedgerDevice;
+} | {
+    type: 'revoke_device';
+    endpointId: string;
+} | {
+    type: 'add_bridge';
+    bridge: LedgerBridge;
+} | {
+    type: 'revoke_bridge';
+    bridgeId: string;
+} | {
+    type: 'add_authority';
+    authority: LedgerAuthority;
+    consent: PasskeySignature;
+} | {
+    type: 'resolve_fork';
+    forkHead: string;
+    discardedFirst: string;
+    discardedHead: string;
+    discardedRevision: number;
+};
+export interface LedgerTransition {
+    type: 'ftown_account_transition';
+    version: 2;
+    accountId: string;
+    revision: number;
+    previousHead: string;
+    issuedAt: number;
+    credentialId: string;
+    operation: LedgerOperation;
+}
+/** All fields base64url; signature is DER. */
+export interface PasskeySignature {
+    authenticatorData: string;
+    clientDataJSON: string;
+    signature: string;
+}
+export interface Signed<T> {
+    payload: T;
+    signature: PasskeySignature;
+}
+export interface Ledger {
+    genesis: Signed<LedgerGenesis>;
+    transitions: Signed<LedgerTransition>[];
+}
+export interface LedgerCheckpoint {
+    version: 2;
+    accountId: string;
+    revision: number;
+    head: string;
+    authorities: LedgerAuthority[];
+    devices: LedgerDevice[];
+    bridges: LedgerBridge[];
+    revokedDeviceIds: string[];
+    revokedBridgeIds: string[];
+}
+export declare const LEDGER_LIMITS: {
+    readonly maxBytes: 2097152;
+    readonly maxTransitions: 1024;
+    readonly maxAuthorities: 8;
+    readonly maxDevices: 128;
+    readonly maxBridges: 128;
+    readonly maxFutureSkewMs: 30000;
+    readonly maxLabelLength: 200;
+    readonly offlineGraceMs: 86400000;
+};

package/dist/security/ledger/protocol.js

@@ -0,0 +1,16 @@
+export const LEDGER_DOMAIN = 'ftown-account-trust-v2\n';
+/** Sign-in assertions are over SHA-256(SIGNIN_DOMAIN + nonce); never over raw server bytes. */
+export const SIGNIN_DOMAIN = 'ftown-signin-v2\n';
+/** A new authority's consent is its own assertion over SHA-256(AUTHORITY_CONSENT_DOMAIN + canonical({accountId, credentialId, publicKey})). */
+export const AUTHORITY_CONSENT_DOMAIN = 'ftown-authority-consent-v2\n';
+export const LEDGER_LIMITS = {
+    maxBytes: 2097152,
+    maxTransitions: 1024,
+    maxAuthorities: 8,
+    maxDevices: 128,
+    maxBridges: 128,
+    maxFutureSkewMs: 30000,
+    maxLabelLength: 200,
+    offlineGraceMs: 86400000,
+};
+//# sourceMappingURL=protocol.js.map

package/dist/security/ledger/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../src/security/ledger/protocol.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACxD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AACjD,+IAA+I;AAC/I,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AA8DvE,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,OAAO;IACjB,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,CAAC;IACjB,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,GAAG;IACf,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,QAAQ;CAChB,CAAC"}

package/dist/security/ledger/testing.d.ts

@@ -0,0 +1,27 @@
+import type { PasskeySignature } from './protocol.js';
+export interface SoftPasskeySignOptions {
+    origin?: string;
+    rpId?: string;
+    /** false clears, true sets, the UV bit on top of `flags`. */
+    uv?: boolean;
+    /** false clears, true sets, the UP bit on top of `flags`. */
+    up?: boolean;
+    type?: string;
+    crossOrigin?: boolean;
+    /** authenticatorData flags byte. Defaults to 0x1D (UP|UV|BE|BS), as synced Apple and Google passkeys emit. */
+    flags?: number;
+    /** Big-endian uint32 signature counter. Defaults to 0. */
+    signCount?: number;
+}
+/** Byte-faithful assertions: authenticatorData = rpIdHash | flags | signCount, browser-style clientDataJSON, DER signature. */
+export interface SoftPasskey {
+    credentialId: string;
+    publicKey: string;
+    sign(challenge: Uint8Array, options?: SoftPasskeySignOptions): Promise<PasskeySignature>;
+}
+/** 64-byte r||s to a minimal DER SEQUENCE of two INTEGERs. */
+export declare function rawToDerSignature(raw: Uint8Array): Uint8Array<ArrayBuffer>;
+export declare function createSoftPasskey(defaults: {
+    rpId: string;
+    origin: string;
+}): Promise<SoftPasskey>;

package/dist/security/ledger/testing.js

@@ -0,0 +1,70 @@
+const encoder = new TextEncoder();
+const FLAG_UP = 0x01;
+const FLAG_UV = 0x04;
+const DEFAULT_FLAGS = 0x1d;
+function b64url(data) {
+    let binary = '';
+    for (let index = 0; index < data.length; index += 1)
+        binary += String.fromCharCode(data[index]);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function derInteger(value) {
+    let start = 0;
+    while (start < value.length - 1 && value[start] === 0)
+        start += 1;
+    const body = [];
+    if ((value[start] & 0x80) !== 0)
+        body.push(0);
+    for (let index = start; index < value.length; index += 1)
+        body.push(value[index]);
+    return [0x02, body.length].concat(body);
+}
+function withBit(flags, bit, value) {
+    if (value === true)
+        return flags | bit;
+    if (value === false)
+        return flags & ~bit & 0xff;
+    return flags;
+}
+/** 64-byte r||s to a minimal DER SEQUENCE of two INTEGERs. */
+export function rawToDerSignature(raw) {
+    if (raw.length !== 64)
+        throw new Error('Raw P-256 signature must be 64 bytes');
+    const content = derInteger(raw.subarray(0, 32)).concat(derInteger(raw.subarray(32, 64)));
+    return new Uint8Array([0x30, content.length].concat(content));
+}
+export async function createSoftPasskey(defaults) {
+    const keyPair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+    const publicKey = b64url(new Uint8Array(await crypto.subtle.exportKey('raw', keyPair.publicKey)));
+    const credentialId = b64url(crypto.getRandomValues(new Uint8Array(32)));
+    async function sign(challenge, options = {}) {
+        const baseFlags = options.flags ?? DEFAULT_FLAGS;
+        const signCount = options.signCount ?? 0;
+        if (!Number.isInteger(baseFlags) || baseFlags < 0 || baseFlags > 0xff)
+            throw new Error('flags must be one byte');
+        if (!Number.isInteger(signCount) || signCount < 0 || signCount > 0xffffffff)
+            throw new Error('signCount must be a uint32');
+        const rpIdHash = new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(options.rpId ?? defaults.rpId)));
+        const authenticatorData = new Uint8Array(37);
+        authenticatorData.set(rpIdHash, 0);
+        authenticatorData[32] = withBit(withBit(baseFlags, FLAG_UP, options.up), FLAG_UV, options.uv);
+        authenticatorData[33] = (signCount >>> 24) & 0xff;
+        authenticatorData[34] = (signCount >>> 16) & 0xff;
+        authenticatorData[35] = (signCount >>> 8) & 0xff;
+        authenticatorData[36] = signCount & 0xff;
+        const clientDataJSON = encoder.encode(JSON.stringify({
+            type: options.type ?? 'webauthn.get',
+            challenge: b64url(challenge),
+            origin: options.origin ?? defaults.origin,
+            crossOrigin: options.crossOrigin ?? false,
+        }));
+        const clientDataHash = new Uint8Array(await crypto.subtle.digest('SHA-256', clientDataJSON));
+        const signed = new Uint8Array(authenticatorData.length + clientDataHash.length);
+        signed.set(authenticatorData, 0);
+        signed.set(clientDataHash, authenticatorData.length);
+        const raw = new Uint8Array(await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, keyPair.privateKey, signed));
+        return { authenticatorData: b64url(authenticatorData), clientDataJSON: b64url(clientDataJSON), signature: b64url(rawToDerSignature(raw)) };
+    }
+    return { credentialId, publicKey, sign };
+}
+//# sourceMappingURL=testing.js.map

package/dist/security/ledger/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/security/ledger/testing.ts"],"names":[],"mappings":"AA4BA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,MAAM,CAAC,IAAgB;IAC9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AACD,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,OAAO,CAAC,KAAa,EAAE,GAAW,EAAE,KAA0B;IACrE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,GAAG,GAAG,CAAC;IACvC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAA0C;IAChF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,UAAU,IAAI,CAAC,SAAqB,EAAE,UAAkC,EAAE;QAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC3H,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtH,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7C,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnC,iBAAiB,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9F,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAClD,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAClD,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QACjD,iBAAiB,CAAC,EAAE,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;QACzC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACnD,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,cAAc;YACpC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;YACzC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;SAC1C,CAAC,CAAC,CAAC;QACJ,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACrH,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IAC7I,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC"}

package/dist/security/ledger/webauthn.d.ts

@@ -0,0 +1,12 @@
+import type { PasskeySignature } from './protocol.js';
+export declare function derToRawSignature(der: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Pure. True iff: clientData.type==='webauthn.get'; clientData.challenge === b64url(challenge); clientData.origin ∈ origins;
+ *  authenticatorData[0..32) === SHA-256(rpId); flags UP and UV set; ECDSA P-256/SHA-256 verifies over authenticatorData || SHA-256(clientDataJSON). Never throws.
+ *  Also fails closed on crossOrigin other than absent/false and on challenges shorter than 16 bytes. The signature counter is ignored. */
+export declare function verifyPasskeyAssertion(input: {
+    publicKey: string;
+    rpId: string;
+    origins: readonly string[];
+    challenge: Uint8Array;
+    signature: PasskeySignature;
+}): Promise<boolean>;

package/dist/security/ledger/webauthn.js

@@ -0,0 +1,147 @@
+const encoder = new TextEncoder();
+const FLAG_UP = 0x01;
+const FLAG_UV = 0x04;
+const MIN_CHALLENGE_BYTES = 16;
+const MAX_AUTHENTICATOR_DATA_BYTES = 4096;
+const MAX_CLIENT_DATA_BYTES = 4096;
+const MAX_DER_SIGNATURE_BYTES = 72;
+function malformed() {
+    throw new Error('Malformed DER signature');
+}
+function isBytes(value) {
+    // Tag check instead of instanceof so typed arrays from another realm are accepted.
+    return ArrayBuffer.isView(value) && Object.prototype.toString.call(value) === '[object Uint8Array]';
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function b64url(data) {
+    let binary = '';
+    for (let index = 0; index < data.length; index += 1)
+        binary += String.fromCharCode(data[index]);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Canonical unpadded base64url only; the length bound is checked before decoding. */
+function fromB64url(value, min, max) {
+    if (typeof value !== 'string' || value.length > Math.ceil(max * 4 / 3) || !/^[A-Za-z0-9_-]+$/.test(value)) {
+        throw new Error('Invalid base64url');
+    }
+    const binary = atob(value.replace(/-/g, '+').replace(/_/g, '/'));
+    if (binary.length < min || binary.length > max)
+        throw new Error('Invalid length');
+    const result = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1)
+        result[index] = binary.charCodeAt(index);
+    if (b64url(result) !== value)
+        throw new Error('Non-canonical base64url');
+    return result;
+}
+function sameBytes(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1)
+        difference |= left[index] ^ right[index];
+    return difference === 0;
+}
+/** Returns [length, offset of the content]. Definite lengths only, minimally encoded. */
+function derLength(der, offset) {
+    if (offset >= der.length)
+        return malformed();
+    const first = der[offset];
+    if (first < 0x80)
+        return [first, offset + 1];
+    const count = first & 0x7f;
+    if (count < 1 || count > 2 || offset + 1 + count > der.length)
+        return malformed();
+    let length = 0;
+    for (let index = 0; index < count; index += 1)
+        length = length * 256 + der[offset + 1 + index];
+    if (length < (count === 1 ? 0x80 : 0x100))
+        return malformed();
+    return [length, offset + 1 + count];
+}
+/** One positive, minimally encoded INTEGER of at most 32 significant bytes, left-padded to 32. */
+function derInteger(der, offset, end) {
+    if (offset >= end || der[offset] !== 0x02)
+        return malformed();
+    const [length, start] = derLength(der, offset + 1);
+    const next = start + length;
+    if (length < 1 || next > end)
+        return malformed();
+    let value = der.subarray(start, next);
+    if ((value[0] & 0x80) !== 0)
+        return malformed();
+    if (value[0] === 0) {
+        // A leading zero is only legal as the sign pad of a high-bit byte; a lone zero is r or s = 0.
+        if (value.length === 1 || (value[1] & 0x80) === 0)
+            return malformed();
+        value = value.subarray(1);
+    }
+    if (value.length > 32)
+        return malformed();
+    const padded = new Uint8Array(32);
+    padded.set(value, 32 - value.length);
+    return { value: padded, next };
+}
+export function derToRawSignature(der) {
+    if (!isBytes(der) || der.length < 8 || der.length > MAX_DER_SIGNATURE_BYTES || der[0] !== 0x30)
+        return malformed();
+    const [length, start] = derLength(der, 1);
+    if (start + length !== der.length)
+        return malformed();
+    const r = derInteger(der, start, der.length);
+    const s = derInteger(der, r.next, der.length);
+    if (s.next !== der.length)
+        return malformed();
+    const raw = new Uint8Array(64);
+    raw.set(r.value, 0);
+    raw.set(s.value, 32);
+    return raw;
+}
+/** Pure. True iff: clientData.type==='webauthn.get'; clientData.challenge === b64url(challenge); clientData.origin ∈ origins;
+ *  authenticatorData[0..32) === SHA-256(rpId); flags UP and UV set; ECDSA P-256/SHA-256 verifies over authenticatorData || SHA-256(clientDataJSON). Never throws.
+ *  Also fails closed on crossOrigin other than absent/false and on challenges shorter than 16 bytes. The signature counter is ignored. */
+export async function verifyPasskeyAssertion(input) {
+    try {
+        const { publicKey, rpId, origins, challenge, signature } = input;
+        if (!isBytes(challenge) || challenge.length < MIN_CHALLENGE_BYTES)
+            return false;
+        if (typeof rpId !== 'string' || rpId.length === 0 || !Array.isArray(origins) || !isRecord(signature))
+            return false;
+        const authenticatorData = fromB64url(signature.authenticatorData, 37, MAX_AUTHENTICATOR_DATA_BYTES);
+        const clientDataBytes = fromB64url(signature.clientDataJSON, 1, MAX_CLIENT_DATA_BYTES);
+        const clientData = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(clientDataBytes));
+        if (!isRecord(clientData))
+            return false;
+        if (clientData.type !== 'webauthn.get')
+            return false;
+        if (typeof clientData.challenge !== 'string' || clientData.challenge !== b64url(challenge))
+            return false;
+        if (typeof clientData.origin !== 'string' || !origins.includes(clientData.origin))
+            return false;
+        if (clientData.crossOrigin !== undefined && clientData.crossOrigin !== false)
+            return false;
+        const rpIdHash = new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(rpId)));
+        if (!sameBytes(authenticatorData.subarray(0, 32), rpIdHash))
+            return false;
+        if ((authenticatorData[32] & FLAG_UP) === 0)
+            return false;
+        if ((authenticatorData[32] & FLAG_UV) === 0)
+            return false;
+        const point = fromB64url(publicKey, 65, 65);
+        if (point[0] !== 0x04)
+            return false;
+        const key = await crypto.subtle.importKey('raw', point, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+        const raw = derToRawSignature(fromB64url(signature.signature, 8, MAX_DER_SIGNATURE_BYTES));
+        const clientDataHash = new Uint8Array(await crypto.subtle.digest('SHA-256', clientDataBytes));
+        const signed = new Uint8Array(authenticatorData.length + clientDataHash.length);
+        signed.set(authenticatorData, 0);
+        signed.set(clientDataHash, authenticatorData.length);
+        return await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, raw, signed) === true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=webauthn.js.map