keri 0.0.0-dev.bf75350 → 0.0.0-dev.e00c3c1

package/dist/controller/encrypt.js

@@ -0,0 +1,120 @@
+const PREFIX = new TextEncoder().encode("KJS1");
+const SALT_LENGTH = 16;
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const PBKDF2_ITERATIONS = 310000;
+async function deriveKey(passphrase, salt) {
+    const encoder = new TextEncoder();
+    const encryptionKey = await crypto.subtle.importKey("raw", encoder.encode(passphrase), "PBKDF2", false, [
+        "deriveBits",
+        "deriveKey",
+    ]);
+    const key = await crypto.subtle.deriveKey({
+        name: "PBKDF2",
+        salt: Uint8Array.from(salt),
+        iterations: PBKDF2_ITERATIONS,
+        hash: "SHA-256",
+    }, encryptionKey, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+    return key;
+}
+function hasV1Prefix(ciphertext) {
+    if (ciphertext.length < PREFIX.length) {
+        return false;
+    }
+    for (let i = 0; i < PREFIX.length; i++) {
+        if (ciphertext[i] !== PREFIX[i]) {
+            return false;
+        }
+    }
+    return true;
+}
+function parseCiphertext(ciphertext) {
+    if (!hasV1Prefix(ciphertext)) {
+        throw new Error("Invalid encrypted payload");
+    }
+    const headerLength = PREFIX.length + SALT_LENGTH + IV_LENGTH;
+    if (ciphertext.length < headerLength + AUTH_TAG_LENGTH) {
+        throw new Error("Invalid encrypted payload");
+    }
+    const saltStart = PREFIX.length;
+    const ivStart = saltStart + SALT_LENGTH;
+    const encryptedStart = ivStart + IV_LENGTH;
+    return {
+        salt: ciphertext.slice(saltStart, ivStart),
+        iv: ciphertext.slice(ivStart, encryptedStart),
+        encrypted: ciphertext.slice(encryptedStart),
+    };
+}
+async function encrypt(data, passphrase) {
+    const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+    const key = await deriveKey(passphrase, salt);
+    const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, Uint8Array.from(data));
+    const result = new Uint8Array(PREFIX.length + salt.byteLength + iv.byteLength + encrypted.byteLength);
+    result.set(PREFIX, 0);
+    result.set(salt, PREFIX.length);
+    result.set(iv, PREFIX.length + salt.byteLength);
+    result.set(new Uint8Array(encrypted), PREFIX.length + salt.byteLength + iv.byteLength);
+    return result;
+}
+async function decrypt(ciphertext, passphrase) {
+    const { salt, iv, encrypted } = parseCiphertext(ciphertext);
+    const key = await deriveKey(passphrase, salt);
+    try {
+        const result = await crypto.subtle.decrypt({ name: "AES-GCM", iv: new Uint8Array(iv) }, key, new Uint8Array(encrypted));
+        return new Uint8Array(result);
+    }
+    catch (err) {
+        throw new Error("Could not decrypt data", {
+            cause: err,
+        });
+    }
+}
+/**
+ * TODO
+ *
+ * This implementation is intentionally minimal for MVP.
+ * It uses PBKDF2 (SHA-256, 310k iterations) + AES-256-GCM with
+ * random salt and IV. This is secure by modern standards, but
+ * not fully hardened.
+ *
+ * Planned improvements for next format version (e.g. "KJS2"):
+ *
+ * 1. KDF Upgrade
+ *    - Replace PBKDF2 with Argon2id (memory-hard).
+ *    - Alternatively support multiple KDFs via encoded KDF identifier.
+ *
+ * 2. Encode KDF Parameters
+ *    - Store iteration count (and memory parameters if Argon2)
+ *      inside ciphertext header for forward compatibility.
+ *
+ * 3. Header Authentication (AAD)
+ *    - Include prefix + salt + IV as AES-GCM additional authenticated data
+ *      to cryptographically bind structure.
+ *
+ * 4. Passphrase Handling
+ *    - Avoid long-term caching of passphrase strings in memory.
+ *    - Prefer short-lived Uint8Array or derived CryptoKey storage.
+ *
+ * 5. Key Separation (if expanded usage)
+ *    - Derive distinct keys for encryption / MAC / wrapping
+ *      using HKDF if additional primitives are added.
+ *
+ * IMPORTANT:
+ * Never change behavior under the "KJS1" prefix.
+ * All security upgrades must use a new version prefix
+ * to preserve backward compatibility.
+ */
+export class PassphraseEncrypter {
+    #passphrase;
+    constructor(passphrase) {
+        this.#passphrase = passphrase;
+    }
+    async encrypt(data) {
+        return await encrypt(data, this.#passphrase);
+    }
+    async decrypt(ciphertext) {
+        return await decrypt(ciphertext, this.#passphrase);
+    }
+}
+//# sourceMappingURL=encrypt.js.map

package/dist/controller/encrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../src/controller/encrypt.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAOjC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAgB;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;QACtG,YAAY;QACZ,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,SAAS;KAChB,EACD,aAAa,EACb,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,SAAS,WAAW,CAAC,UAAsB;IACzC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,UAAsB;IAC7C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,GAAG,YAAY,GAAG,eAAe,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,MAAM,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IACxC,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;IAE3C,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC;QAC1C,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC;QAC7C,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,UAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnG,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACtG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAEvF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAsB,EAAE,UAAkB;IAC/D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,EAC3C,GAAG,EACH,IAAI,UAAU,CAAC,SAAS,CAAC,CAC1B,CAAC;QACF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE;YACxC,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,OAAO,mBAAmB;IAC9B,WAAW,CAAS;IAEpB,YAAY,UAAkB;QAC5B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC5B,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAsB;QAClC,OAAO,MAAM,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/core/credential-event.d.ts

@@ -0,0 +1,54 @@
+import { Message } from "../cesr/__main__.ts";
+export interface IssueEventInit {
+    /**
+     * Credential SAID
+     */
+    i: string;
+    /**
+     * Registry SAID
+     */
+    ri: string;
+    dt?: string;
+}
+export type IssueEventBody = {
+    v: string;
+    t: "iss";
+    d: string;
+    /**
+     * Credential SAID
+     */
+    i: string;
+    s: string;
+    /**
+     * Registry SAID
+     */
+    ri: string;
+    dt: string;
+};
+export interface RevokeEventInit {
+    /**
+     * Credential SAID
+     */
+    i: string;
+    /**
+     * Registry SAID
+     */
+    ri: string;
+    /**
+     * Issuance event SAID
+     */
+    p: string;
+    dt?: string;
+}
+export type RevokeEventBody = {
+    v: string;
+    t: "rev";
+    d: string;
+    i: string;
+    s: string;
+    ri: string;
+    p: string;
+    dt: string;
+};
+export declare function issue(args: IssueEventInit): Message<IssueEventBody>;
+export declare function revoke(args: RevokeEventInit): Message<RevokeEventBody>;

package/dist/core/credential-event.js

@@ -0,0 +1,28 @@
+import { Message } from "../cesr/__main__.js";
+import { DUMMY_VERSION, encodeEvent, formatDate } from "./events.js";
+export function issue(args) {
+    const body = encodeEvent({
+        v: DUMMY_VERSION,
+        t: "iss",
+        d: "",
+        i: args.i,
+        s: "0",
+        ri: args.ri,
+        dt: args.dt ?? formatDate(new Date()),
+    }, { labels: ["d"] });
+    return new Message(body);
+}
+export function revoke(args) {
+    const body = encodeEvent({
+        v: DUMMY_VERSION,
+        t: "rev",
+        d: "",
+        i: args.i,
+        s: "1",
+        ri: args.ri,
+        p: args.p,
+        dt: args.dt ?? formatDate(new Date()),
+    }, { labels: ["d"] });
+    return new Message(body);
+}
+//# sourceMappingURL=credential-event.js.map

package/dist/core/credential-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-event.js","sourceRoot":"","sources":["../../src/core/credential-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA8DrE,MAAM,UAAU,KAAK,CAAC,IAAoB;IACxC,MAAM,IAAI,GAAG,WAAW,CACtB;QACE,CAAC,EAAE,aAAa;QAChB,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,EAAE;QACL,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,GAAG;QACN,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;KACtC,EACD,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAClB,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAqB;IAC1C,MAAM,IAAI,GAAG,WAAW,CACtB;QACE,CAAC,EAAE,aAAa;QAChB,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,EAAE;QACL,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,GAAG;QACN,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;KACtC,EACD,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAClB,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/core/credential.d.ts

@@ -0,0 +1,79 @@
+import { Message } from "../cesr/__main__.ts";
+export interface CredentialBodyInit {
+    /**
+     * Salty nonce
+     */
+    u?: string;
+    i: string;
+    ri: string;
+    s: string;
+    a: {
+        i?: string;
+        dt?: string;
+        [key: string]: string | Record<string, unknown> | undefined;
+    };
+    r?: Record<string, unknown>;
+    e?: Record<string, unknown>;
+}
+export interface CredentialSubject {
+    /**
+     * Subject SAID
+     */
+    d: string;
+    /**
+     * Issuee AID
+     */
+    i?: string;
+    /**
+     * Issuance timestamp
+     */
+    dt?: string;
+    [key: string]: string | undefined;
+}
+export interface CredentialRules {
+    /**
+     * Rules SAID
+     */
+    d: string;
+    [key: string]: string | Record<string, unknown> | undefined;
+}
+export interface CredentialEdges {
+    /**
+     * Rules SAID
+     */
+    d: string;
+    [key: string]: string | Record<string, unknown> | undefined;
+}
+export type CredentialBody = {
+    v: string;
+    /**
+     * Credential SAID
+     */
+    d: string;
+    /**
+     * Issuer AID
+     */
+    i: string;
+    /**
+     * Registry AID
+     */
+    ri: string;
+    /**
+     * Schema SAID
+     */
+    s: string;
+    /**
+     * Credential subject (claims)
+     */
+    a: CredentialSubject;
+    /**
+     * Credential rules
+     */
+    r: CredentialRules;
+    /**
+     * Credential edges
+     */
+    e?: CredentialEdges;
+};
+export type Credential = Message<CredentialBody>;
+export declare function createCredential(data: CredentialBodyInit): Credential;

package/dist/core/credential.js

@@ -0,0 +1,25 @@
+import { Message, VersionString } from "../cesr/__main__.js";
+import { encodeEvent } from "./events.js";
+import { saidify } from "./said.js";
+export function createCredential(data) {
+    const body = encodeEvent({
+        v: VersionString.encode({
+            protocol: "ACDC",
+            kind: "JSON",
+            legacy: true,
+        }),
+        d: "#".repeat(44),
+        ...(data.u && { u: data.u }),
+        i: data.i,
+        ri: data.ri,
+        s: data.s,
+        a: saidify({
+            d: "#".repeat(44),
+            ...data.a,
+        }, ["d"]),
+        ...(data.e && { e: saidify({ d: "#".repeat(44), ...data.e }, ["d"]) }),
+        r: saidify({ d: "#".repeat(44), ...data.r }, ["d"]),
+    });
+    return new Message(body);
+}
+//# sourceMappingURL=credential.js.map

package/dist/core/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../src/core/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgGpC,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,MAAM,IAAI,GAAG,WAAW,CAAiB;QACvC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI;SACb,CAAC;QACF,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,OAAO,CACR;YACE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,CAAC,CAAC;SACV,EACD,CAAC,GAAG,CAAC,CACN;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACtE,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;KACpD,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAiB,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/core/digest.d.ts

@@ -0,0 +1 @@
+export declare function digest(input: string): string;

package/dist/core/digest.js

@@ -0,0 +1,7 @@
+import { blake3 } from "@noble/hashes/blake3.js";
+import { cesr } from "../cesr/__main__.js";
+export function digest(input) {
+    const digest = cesr.crypto.blake3_256(blake3.create({ dkLen: 32 }).update(new TextEncoder().encode(input)).digest());
+    return digest.text();
+}
+//# sourceMappingURL=digest.js.map

package/dist/core/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../src/core/digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3C,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC"}

package/dist/core/endpoint-discovery.d.ts

@@ -0,0 +1,20 @@
+import type { Message } from "../cesr/__main__.ts";
+import type { ReplyEventBody } from "./routed-event.ts";
+export interface EndRoleRecord extends Record<string, unknown> {
+    cid: string;
+    role: string;
+    eid: string;
+}
+export interface LocationRecord extends Record<string, unknown> {
+    eid: string;
+    scheme: string;
+    url: string;
+}
+export interface Endpoint {
+    aid: string;
+    url: string;
+    scheme: string;
+    role: string;
+}
+export declare function resolveEndRole(replies: Iterable<Message<ReplyEventBody>>, cid: string, role: string): EndRoleRecord | null;
+export declare function resolveLocation(replies: Iterable<Message<ReplyEventBody>>, eid: string): LocationRecord | null;

package/dist/core/endpoint-discovery.js

@@ -0,0 +1,60 @@
+export function resolveEndRole(replies, cid, role) {
+    // TODO: Needs verify against a Key Event Log
+    // TODO: Needs to handle /end/role/cut
+    let selected = null;
+    for (const message of replies) {
+        if (message.body.t !== "rpy" || message.body.r !== "/end/role/add") {
+            continue;
+        }
+        const record = message.body.a;
+        if (typeof record !== "object" ||
+            record === null ||
+            !("eid" in record) ||
+            typeof record.eid !== "string" ||
+            !("cid" in record) ||
+            typeof record.cid !== "string" ||
+            !("role" in record) ||
+            typeof record.role !== "string") {
+            continue;
+        }
+        if (record.cid === cid && record.role === role) {
+            selected = {
+                cid: record.cid,
+                role: record.role,
+                eid: record.eid,
+            };
+        }
+    }
+    return selected;
+}
+export function resolveLocation(replies, eid) {
+    // TODO: Needs verify against a Key Event Log
+    for (const message of replies) {
+        if (message.body.t !== "rpy" || message.body.r !== "/loc/scheme") {
+            continue;
+        }
+        const record = message.body.a;
+        if (typeof record !== "object" ||
+            record === null ||
+            !("eid" in record) ||
+            typeof record.eid !== "string" ||
+            !("scheme" in record) ||
+            typeof record.scheme !== "string" ||
+            !("url" in record) ||
+            typeof record.url !== "string") {
+            continue;
+        }
+        if (!["http", "https"].includes(record.scheme)) {
+            continue;
+        }
+        if (record.eid === eid) {
+            return {
+                eid: record.eid,
+                scheme: record.scheme,
+                url: record.url,
+            };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=endpoint-discovery.js.map

package/dist/core/endpoint-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-discovery.js","sourceRoot":"","sources":["../../src/core/endpoint-discovery.ts"],"names":[],"mappings":"AAsBA,MAAM,UAAU,cAAc,CAC5B,OAA0C,EAC1C,GAAW,EACX,IAAY;IAEZ,6CAA6C;IAC7C,sCAAsC;IACtC,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAE1C,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9B,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;YACnB,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAC/B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/C,QAAQ,GAAG;gBACT,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA0C,EAAE,GAAW;IACrF,6CAA6C;IAC7C,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YACjE,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9B,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;YACrB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/events.d.ts

@@ -0,0 +1,12 @@
+export declare const DUMMY_VERSION: string;
+export declare function formatDate(date: Date): string;
+export declare function randomNonce(): string;
+interface EncodeEventArgs {
+    labels?: string[];
+    protocol?: string;
+    legacy?: boolean;
+}
+export declare function encodeEvent<T extends Record<string, unknown>>(data: T, args?: EncodeEventArgs): T & {
+    v: string;
+};
+export {};

package/dist/core/events.js

@@ -0,0 +1,25 @@
+import { Matter, Message, VersionString } from "../cesr/__main__.js";
+import { saidify } from "./said.js";
+export const DUMMY_VERSION = VersionString.encode({ protocol: "KERI", legacy: true, kind: "JSON" });
+export function formatDate(date) {
+    return date.toISOString().replace("Z", "000+00:00");
+}
+export function randomNonce() {
+    return Matter.from(Matter.Code.Salt_128, crypto.getRandomValues(new Uint8Array(16))).text();
+}
+export function encodeEvent(data, args = {}) {
+    const labels = args.labels ?? ["d"];
+    for (const label of labels) {
+        if (!(label in data)) {
+            throw new Error(`Input missing label '${label}'`);
+        }
+        data[label] = "#".repeat(44);
+    }
+    const message = new Message({
+        v: VersionString.encode({ protocol: args.protocol ?? "KERI", legacy: args.legacy ?? true, kind: "JSON" }),
+        ...data,
+    });
+    const result = saidify(message.body, labels);
+    return result;
+}
+//# sourceMappingURL=events.js.map

package/dist/core/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/core/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAEpG,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9F,CAAC;AAQD,MAAM,UAAU,WAAW,CAAoC,IAAO,EAAE,OAAwB,EAAE;IAChG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC;QACpD,CAAC;QAEA,IAAgC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACzG,GAAG,IAAI;KACR,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/kawa.d.ts

@@ -0,0 +1,17 @@
+import { Message } from "../cesr/__main__.ts";
+import type { KeyEventBody } from "./key-event.ts";
+export interface WitnessEndpoint {
+    aid: string;
+    url: string;
+}
+/**
+ * KERI Algorithm for Witness Agreement (KAWA).
+ *
+ * Collects receipts from all witnesses, then distributes those receipts back
+ * to all witnesses. The event must already have controller signatures attached.
+ *
+ * @param event Pre-signed key event (ControllerIdxSigs already on attachments)
+ * @param endpoints Pre-resolved endpoints for each witness
+ * @returns Indexed witness signatures (wigs)
+ */
+export declare function submitToWitnesses(event: Message<KeyEventBody>, endpoints: WitnessEndpoint[], fetch?: typeof globalThis.fetch): Promise<string[]>;

package/dist/core/kawa.js

@@ -0,0 +1,87 @@
+import { cesr, Indexer, Matter, Message, parse } from "../cesr/__main__.js";
+import { MailboxClient } from "./mailbox-client.js";
+import { verifyOrThrow } from "./verify.js";
+class WitnessClient {
+    #url;
+    #fetch;
+    constructor(url, fetch) {
+        this.#url = url;
+        this.#fetch = fetch ?? globalThis.fetch;
+    }
+    async receipt(event) {
+        const url = new URL("/receipts", this.#url);
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            throw new Error(`Invalid protocol: ${url}`);
+        }
+        const fetchResponse = await this.#fetch(url, {
+            method: "POST",
+            body: JSON.stringify(event.body),
+            headers: {
+                "Content-Type": "application/cesr+json",
+                "CESR-ATTACHMENT": event.attachments.text(),
+            },
+        });
+        if (!fetchResponse.ok || !fetchResponse.body) {
+            throw new Error(`Failed to submit event to witness: ${fetchResponse.status} ${fetchResponse.statusText}`);
+        }
+        for await (const incoming of parse(fetchResponse.body)) {
+            if (incoming.body.t === "rct" && incoming.body.d === event.body.d) {
+                for (const couple of incoming.attachments.NonTransReceiptCouples) {
+                    const sig = Indexer.convert(Matter.parse(couple.sig), 0).text();
+                    verifyOrThrow(event.raw, {
+                        keys: [couple.prefix],
+                        sigs: [sig],
+                        threshold: "1",
+                    });
+                }
+                return incoming;
+            }
+        }
+        throw new Error(`No receipt returned from ${this.#url}`);
+    }
+}
+/**
+ * KERI Algorithm for Witness Agreement (KAWA).
+ *
+ * Collects receipts from all witnesses, then distributes those receipts back
+ * to all witnesses. The event must already have controller signatures attached.
+ *
+ * @param event Pre-signed key event (ControllerIdxSigs already on attachments)
+ * @param endpoints Pre-resolved endpoints for each witness
+ * @returns Indexed witness signatures (wigs)
+ */
+export async function submitToWitnesses(event, endpoints, fetch) {
+    // TODO: implement the spec's round-robin approach where receipts collected from
+    // earlier witnesses are forwarded to later ones in the same pass, reducing total
+    // network exchanges from N+(N×(N-1)) to at most 2×N.
+    const receipts = {};
+    const wigs = new Set();
+    const wits = endpoints.map((e) => e.aid);
+    for (const endpoint of endpoints) {
+        const client = new WitnessClient(endpoint.url, fetch);
+        const response = await client.receipt(event);
+        if (response.attachments.NonTransReceiptCouples.length > 0) {
+            const receiptCouple = response.attachments.NonTransReceiptCouples[0];
+            const witnessIndex = wits.indexOf(receiptCouple.prefix);
+            if (witnessIndex !== -1) {
+                const signature = Matter.parse(receiptCouple.sig);
+                wigs.add(cesr.index(signature, witnessIndex).text());
+            }
+        }
+        receipts[endpoint.aid] = response;
+    }
+    for (const endpoint of endpoints) {
+        const client = new MailboxClient({ id: endpoint.aid, url: endpoint.url, fetch });
+        for (const [other, receipt] of Object.entries(receipts)) {
+            if (other === endpoint.aid) {
+                continue;
+            }
+            const message = new Message(receipt.body, {
+                NonTransReceiptCouples: receipt.attachments.NonTransReceiptCouples,
+            });
+            await client.sendMessage(message);
+        }
+    }
+    return Array.from(wigs);
+}
+//# sourceMappingURL=kawa.js.map

package/dist/core/kawa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kawa.js","sourceRoot":"","sources":["../../src/core/kawa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,MAAM,aAAa;IACjB,IAAI,CAAS;IACb,MAAM,CAA0B;IAEhC,YAAY,GAAW,EAAE,KAA+B;QACtD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAA4B;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YAChC,OAAO,EAAE;gBACP,cAAc,EAAE,uBAAuB;gBACvC,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE;aAC5C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;oBACjE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAChE,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE;wBACvB,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;wBACrB,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,SAAS,EAAE,GAAG;qBACf,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,QAAwB,CAAC;YAClC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA4B,EAC5B,SAA4B,EAC5B,KAA+B;IAE/B,gFAAgF;IAChF,iFAAiF;IACjF,qDAAqD;IACrD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,QAAQ,CAAC,WAAW,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YACrE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAExD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,IAAI,KAAK,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;gBACxC,sBAAsB,EAAE,OAAO,CAAC,WAAW,CAAC,sBAAsB;aACnE,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/core/key-event-log.d.ts

@@ -0,0 +1,13 @@
+import { Message } from "../cesr/__main__.ts";
+import type { InceptEventBody, InteractEventBody, KeyEventBody, KeyState, RotateEventBody } from "./key-event.ts";
+export type { InceptEventBody as InceptEvent, InteractEventBody as InteractEvent, KeyState, RotateEventBody as RotateEvent, };
+export declare class KeyEventLog {
+    #private;
+    private constructor();
+    static empty(): KeyEventLog;
+    static from(events: Iterable<Message<KeyEventBody>>): KeyEventLog;
+    static parse(stream: AsyncIterable<Uint8Array>): Promise<KeyEventLog>;
+    get state(): KeyState;
+    get events(): Message<KeyEventBody>[];
+    append(message: Message<KeyEventBody>): KeyEventLog;
+}