qa360 1.0.3 → 1.1.0

package/dist/core/proof/signer.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Ed25519 Signature Operations
+ *
+ * Provides key generation, signing, and verification using Ed25519.
+ * Uses tweetnacl for cryptographic operations.
+ *
+ * @see docs/rfc/proof-bundle-v1.md#5-signature-procedure
+ */
+/**
+ * Ed25519 key pair
+ */
+export interface KeyPair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+/**
+ * Key storage paths
+ */
+export interface KeyPaths {
+    privateKey: string;
+    publicKey: string;
+}
+/**
+ * Get default key storage directory
+ */
+export declare function getKeyDirectory(): string;
+/**
+ * Get key file paths
+ */
+export declare function getKeyPaths(): KeyPaths;
+/**
+ * Generate new Ed25519 key pair
+ *
+ * @returns Key pair (public + secret)
+ */
+export declare function generateKeys(): KeyPair;
+/**
+ * Save key pair to disk
+ *
+ * @param keyPair - Key pair to save
+ * @param paths - Optional custom paths (defaults to ~/.qa360/keys/)
+ */
+export declare function saveKeys(keyPair: KeyPair, paths?: KeyPaths): Promise<void>;
+/**
+ * Load key pair from disk
+ *
+ * @param paths - Optional custom paths (defaults to ~/.qa360/keys/)
+ * @returns Key pair
+ * @throws Error if keys don't exist
+ */
+export declare function loadKeys(paths?: KeyPaths): Promise<KeyPair>;
+/**
+ * Check if keys exist
+ *
+ * @param paths - Optional custom paths
+ * @returns true if both keys exist
+ */
+export declare function keysExist(paths?: KeyPaths): Promise<boolean>;
+/**
+ * Initialize keys (generate if they don't exist)
+ *
+ * @param paths - Optional custom paths
+ * @returns Key pair (existing or newly generated)
+ */
+export declare function initializeKeys(paths?: KeyPaths): Promise<KeyPair>;
+/**
+ * Ensure proof keys exist (generate if missing)
+ *
+ * @param homeDir - QA360 home directory
+ * @returns Result with creation status, paths, and optional keys
+ */
+export declare function ensureProofKeys(homeDir: string): Promise<{
+    created: boolean;
+    paths: {
+        pub: string;
+        priv: string;
+    };
+    keys?: KeyPair;
+}>;
+/**
+ * Compute SHA-256 hash of data
+ *
+ * @param data - Data to hash (UTF-8 string)
+ * @returns SHA-256 hash as Buffer
+ */
+export declare function sha256(data: string): Buffer;
+/**
+ * Sign data with Ed25519
+ *
+ * @param data - Data to sign (canonical JSON string)
+ * @param secretKey - Ed25519 secret key (64 bytes)
+ * @returns Base64-encoded signature (88 chars)
+ */
+export declare function sign(data: string, secretKey: Uint8Array): string;
+/**
+ * Verify Ed25519 signature
+ *
+ * @param data - Original data (canonical JSON string)
+ * @param signatureB64 - Base64-encoded signature
+ * @param publicKey - Ed25519 public key (32 bytes)
+ * @returns true if signature is valid
+ */
+export declare function verify(data: string, signatureB64: string, publicKey: Uint8Array): boolean;
+/**
+ * Sign and verify roundtrip test
+ *
+ * @param data - Test data
+ * @param keyPair - Key pair to test
+ * @returns true if roundtrip succeeds
+ */
+export declare function testRoundtrip(data: string, keyPair: KeyPair): boolean;
+//# sourceMappingURL=signer.d.ts.map

package/dist/core/proof/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../../src/core/proof/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAMtC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAMtC;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhF;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAcjE;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvE;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC,CAgED;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,CAShE;AAED;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAazF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAGrE"}

package/dist/core/proof/signer.js

@@ -0,0 +1,226 @@
+/**
+ * Ed25519 Signature Operations
+ *
+ * Provides key generation, signing, and verification using Ed25519.
+ * Uses tweetnacl for cryptographic operations.
+ *
+ * @see docs/rfc/proof-bundle-v1.md#5-signature-procedure
+ */
+import * as naclModule from 'tweetnacl';
+import { createHash } from 'crypto';
+import { promises as fs } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+// Handle both ESM and CJS imports
+const nacl = naclModule.default || naclModule;
+// Validate tweetnacl import
+if (!nacl?.sign?.keyPair) {
+    throw new Error('tweetnacl not loaded correctly - sign.keyPair is undefined');
+}
+/**
+ * Get default key storage directory
+ */
+export function getKeyDirectory() {
+    return join(homedir(), '.qa360', 'keys');
+}
+/**
+ * Get key file paths
+ */
+export function getKeyPaths() {
+    const keyDir = getKeyDirectory();
+    return {
+        privateKey: join(keyDir, 'ed25519.key'),
+        publicKey: join(keyDir, 'ed25519.pub'),
+    };
+}
+/**
+ * Generate new Ed25519 key pair
+ *
+ * @returns Key pair (public + secret)
+ */
+export function generateKeys() {
+    const keyPair = nacl.sign.keyPair();
+    return {
+        publicKey: keyPair.publicKey,
+        secretKey: keyPair.secretKey,
+    };
+}
+/**
+ * Save key pair to disk
+ *
+ * @param keyPair - Key pair to save
+ * @param paths - Optional custom paths (defaults to ~/.qa360/keys/)
+ */
+export async function saveKeys(keyPair, paths) {
+    const keyPaths = paths || getKeyPaths();
+    const keyDir = getKeyDirectory();
+    // Create directory if it doesn't exist
+    await fs.mkdir(keyDir, { recursive: true, mode: 0o700 });
+    // Save private key (chmod 600)
+    await fs.writeFile(keyPaths.privateKey, Buffer.from(keyPair.secretKey).toString('base64'), { mode: 0o600 });
+    // Save public key (chmod 644)
+    await fs.writeFile(keyPaths.publicKey, Buffer.from(keyPair.publicKey).toString('base64'), { mode: 0o644 });
+}
+/**
+ * Load key pair from disk
+ *
+ * @param paths - Optional custom paths (defaults to ~/.qa360/keys/)
+ * @returns Key pair
+ * @throws Error if keys don't exist
+ */
+export async function loadKeys(paths) {
+    const keyPaths = paths || getKeyPaths();
+    try {
+        const privateKeyB64 = await fs.readFile(keyPaths.privateKey, 'utf-8');
+        const publicKeyB64 = await fs.readFile(keyPaths.publicKey, 'utf-8');
+        return {
+            secretKey: new Uint8Array(Buffer.from(privateKeyB64.trim(), 'base64')),
+            publicKey: new Uint8Array(Buffer.from(publicKeyB64.trim(), 'base64')),
+        };
+    }
+    catch (error) {
+        throw new Error(`Failed to load keys: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+/**
+ * Check if keys exist
+ *
+ * @param paths - Optional custom paths
+ * @returns true if both keys exist
+ */
+export async function keysExist(paths) {
+    const keyPaths = paths || getKeyPaths();
+    try {
+        await fs.access(keyPaths.privateKey);
+        await fs.access(keyPaths.publicKey);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Initialize keys (generate if they don't exist)
+ *
+ * @param paths - Optional custom paths
+ * @returns Key pair (existing or newly generated)
+ */
+export async function initializeKeys(paths) {
+    if (await keysExist(paths)) {
+        return loadKeys(paths);
+    }
+    const keyPair = generateKeys();
+    await saveKeys(keyPair, paths);
+    return keyPair;
+}
+/**
+ * Ensure proof keys exist (generate if missing)
+ *
+ * @param homeDir - QA360 home directory
+ * @returns Result with creation status, paths, and optional keys
+ */
+export async function ensureProofKeys(homeDir) {
+    const keyDir = join(homeDir, 'keys');
+    const paths = {
+        pub: join(keyDir, 'ed25519.pub'),
+        priv: join(keyDir, 'ed25519.key'),
+    };
+    // Check if keys already exist
+    try {
+        await fs.access(paths.priv);
+        await fs.access(paths.pub);
+        // Keys exist, validate them
+        const privateKeyB64 = await fs.readFile(paths.priv, 'utf-8');
+        const publicKeyB64 = await fs.readFile(paths.pub, 'utf-8');
+        const secretKey = new Uint8Array(Buffer.from(privateKeyB64.trim(), 'base64'));
+        const publicKey = new Uint8Array(Buffer.from(publicKeyB64.trim(), 'base64'));
+        // Validate key sizes
+        if (publicKey.length !== 32) {
+            throw new Error(`Invalid public key size: ${publicKey.length} (expected 32)`);
+        }
+        if (secretKey.length !== 64) {
+            throw new Error(`Invalid secret key size: ${secretKey.length} (expected 64)`);
+        }
+        return {
+            created: false,
+            paths,
+            keys: { publicKey, secretKey },
+        };
+    }
+    catch {
+        // Keys don't exist or are invalid, generate new ones
+        await fs.mkdir(keyDir, { recursive: true, mode: 0o700 });
+        const keyPair = generateKeys();
+        // Validate generated keys
+        if (!keyPair.publicKey || keyPair.publicKey.length !== 32) {
+            throw new Error('Key generation failed: invalid public key');
+        }
+        if (!keyPair.secretKey || keyPair.secretKey.length !== 64) {
+            throw new Error('Key generation failed: invalid secret key');
+        }
+        // Save keys
+        await fs.writeFile(paths.priv, Buffer.from(keyPair.secretKey).toString('base64'), { mode: 0o600 });
+        await fs.writeFile(paths.pub, Buffer.from(keyPair.publicKey).toString('base64'), { mode: 0o644 });
+        return {
+            created: true,
+            paths,
+            keys: keyPair,
+        };
+    }
+}
+/**
+ * Compute SHA-256 hash of data
+ *
+ * @param data - Data to hash (UTF-8 string)
+ * @returns SHA-256 hash as Buffer
+ */
+export function sha256(data) {
+    return createHash('sha256').update(data, 'utf-8').digest();
+}
+/**
+ * Sign data with Ed25519
+ *
+ * @param data - Data to sign (canonical JSON string)
+ * @param secretKey - Ed25519 secret key (64 bytes)
+ * @returns Base64-encoded signature (88 chars)
+ */
+export function sign(data, secretKey) {
+    // Hash the data first (sign the hash, not the raw data)
+    const hash = sha256(data);
+    // Sign the hash
+    const signature = nacl.sign.detached(hash, secretKey);
+    // Return base64-encoded signature
+    return Buffer.from(signature).toString('base64');
+}
+/**
+ * Verify Ed25519 signature
+ *
+ * @param data - Original data (canonical JSON string)
+ * @param signatureB64 - Base64-encoded signature
+ * @param publicKey - Ed25519 public key (32 bytes)
+ * @returns true if signature is valid
+ */
+export function verify(data, signatureB64, publicKey) {
+    try {
+        // Hash the data
+        const hash = sha256(data);
+        // Decode signature
+        const signature = new Uint8Array(Buffer.from(signatureB64, 'base64'));
+        // Verify signature
+        return nacl.sign.detached.verify(hash, signature, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Sign and verify roundtrip test
+ *
+ * @param data - Test data
+ * @param keyPair - Key pair to test
+ * @returns true if roundtrip succeeds
+ */
+export function testRoundtrip(data, keyPair) {
+    const signature = sign(data, keyPair.secretKey);
+    return verify(data, signature, keyPair.publicKey);
+}

package/dist/core/proof/verifier.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Proof Bundle Verification
+ *
+ * Verifies cryptographic signatures and integrity of proof bundles.
+ *
+ * @see docs/rfc/proof-bundle-v1.md#6-verification-procedure
+ */
+import type { ProofBundle, Artifact } from './bundle.js';
+/**
+ * Verification result
+ */
+export interface VerificationResult {
+    valid: boolean;
+    code: VerificationCode;
+    message: string;
+    details?: VerificationDetails;
+}
+/**
+ * Verification error codes (matches RFC)
+ */
+export declare enum VerificationCode {
+    PROOF_OK = 0,
+    PROOF_INVALID_SIG = 1,
+    PROOF_INVALID_SCHEMA = 2,
+    PROOF_ARTIFACT_MISMATCH = 3,
+    PROOF_MISSING_KEY = 4,
+    PROOF_MALFORMED = 5
+}
+/**
+ * Verification details
+ */
+export interface VerificationDetails {
+    signerId?: string;
+    hash?: string;
+    artifactsVerified?: number;
+    artifactsTotal?: number;
+    trustScore?: number;
+    runId?: string;
+    startedAt?: string;
+    finishedAt?: string;
+}
+/**
+ * Artifact verification options
+ */
+export interface ArtifactVerificationOptions {
+    basePath?: string;
+    skipMissing?: boolean;
+}
+/**
+ * Verify proof bundle signature
+ *
+ * @param bundle - Proof bundle to verify
+ * @param publicKey - Optional public key (loads from ~/.qa360/keys if not provided)
+ * @returns Verification result
+ */
+export declare function verifyProofBundle(bundle: ProofBundle, publicKey?: Uint8Array): Promise<VerificationResult>;
+/**
+ * Verify artifact integrity
+ *
+ * @param artifact - Artifact metadata
+ * @param filePath - Path to artifact file
+ * @returns true if hash matches
+ */
+export declare function verifyArtifact(artifact: Artifact, filePath: string): Promise<boolean>;
+/**
+ * Verify all artifacts in proof bundle
+ *
+ * @param bundle - Proof bundle
+ * @param options - Verification options
+ * @returns Verification result with artifact details
+ */
+export declare function verifyArtifacts(bundle: ProofBundle, options?: ArtifactVerificationOptions): Promise<VerificationResult>;
+/**
+ * Verify proof bundle and artifacts (complete verification)
+ *
+ * @param bundle - Proof bundle
+ * @param options - Artifact verification options
+ * @param publicKey - Optional public key
+ * @returns Complete verification result
+ */
+export declare function verifyComplete(bundle: ProofBundle, options?: ArtifactVerificationOptions, publicKey?: Uint8Array): Promise<VerificationResult>;
+/**
+ * Load and verify proof bundle from file
+ *
+ * @param filePath - Path to proof bundle JSON file
+ * @param options - Artifact verification options
+ * @param publicKey - Optional public key
+ * @returns Verification result
+ */
+export declare function verifyProofFile(filePath: string, options?: ArtifactVerificationOptions, publicKey?: Uint8Array): Promise<VerificationResult>;
+/**
+ * Verify Phase3 proof format (simplified)
+ *
+ * @param filePath - Path to Phase3 proof JSON
+ * @returns Verification result
+ */
+export declare function verifyPhase3Proof(filePath: string): Promise<VerificationResult>;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/core/proof/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/core/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;GAEG;AACH,oBAAY,gBAAgB;IAC1B,QAAQ,IAAI;IACZ,iBAAiB,IAAI;IACrB,oBAAoB,IAAI;IACxB,uBAAuB,IAAI;IAC3B,iBAAiB,IAAI;IACrB,eAAe,IAAI;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAmF7B;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS3F;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,kBAAkB,CAAC,CAkD7B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,2BAAgC,EACzC,SAAS,CAAC,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAyB7B;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,2BAAgC,EACzC,SAAS,CAAC,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAY7B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmErF"}