qa360 2.1.7 → 2.2.0

package/dist/core/proof/signer.js

@@ -1,226 +0,0 @@
-/**
- * Ed25519 Signature Operations
- *
- * Provides key generation, signing, and verification using Ed25519.
- * Uses tweetnacl for cryptographic operations.
- *
- * @see docs/rfc/proof-bundle-v1.md#5-signature-procedure
- */
-import * as naclModule from 'tweetnacl';
-import { createHash } from 'crypto';
-import { promises as fs } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-// Handle both ESM and CJS imports
-const nacl = naclModule.default || naclModule;
-// Validate tweetnacl import
-if (!nacl?.sign?.keyPair) {
-    throw new Error('tweetnacl not loaded correctly - sign.keyPair is undefined');
-}
-/**
- * Get default key storage directory
- */
-export function getKeyDirectory() {
-    return join(homedir(), '.qa360', 'keys');
-}
-/**
- * Get key file paths
- */
-export function getKeyPaths() {
-    const keyDir = getKeyDirectory();
-    return {
-        privateKey: join(keyDir, 'ed25519.key'),
-        publicKey: join(keyDir, 'ed25519.pub'),
-    };
-}
-/**
- * Generate new Ed25519 key pair
- *
- * @returns Key pair (public + secret)
- */
-export function generateKeys() {
-    const keyPair = nacl.sign.keyPair();
-    return {
-        publicKey: keyPair.publicKey,
-        secretKey: keyPair.secretKey,
-    };
-}
-/**
- * Save key pair to disk
- *
- * @param keyPair - Key pair to save
- * @param paths - Optional custom paths (defaults to ~/.qa360/keys/)
- */
-export async function saveKeys(keyPair, paths) {
-    const keyPaths = paths || getKeyPaths();
-    const keyDir = getKeyDirectory();
-    // Create directory if it doesn't exist
-    await fs.mkdir(keyDir, { recursive: true, mode: 0o700 });
-    // Save private key (chmod 600)
-    await fs.writeFile(keyPaths.privateKey, Buffer.from(keyPair.secretKey).toString('base64'), { mode: 0o600 });
-    // Save public key (chmod 644)
-    await fs.writeFile(keyPaths.publicKey, Buffer.from(keyPair.publicKey).toString('base64'), { mode: 0o644 });
-}
-/**
- * Load key pair from disk
- *
- * @param paths - Optional custom paths (defaults to ~/.qa360/keys/)
- * @returns Key pair
- * @throws Error if keys don't exist
- */
-export async function loadKeys(paths) {
-    const keyPaths = paths || getKeyPaths();
-    try {
-        const privateKeyB64 = await fs.readFile(keyPaths.privateKey, 'utf-8');
-        const publicKeyB64 = await fs.readFile(keyPaths.publicKey, 'utf-8');
-        return {
-            secretKey: new Uint8Array(Buffer.from(privateKeyB64.trim(), 'base64')),
-            publicKey: new Uint8Array(Buffer.from(publicKeyB64.trim(), 'base64')),
-        };
-    }
-    catch (error) {
-        throw new Error(`Failed to load keys: ${error instanceof Error ? error.message : 'Unknown error'}`);
-    }
-}
-/**
- * Check if keys exist
- *
- * @param paths - Optional custom paths
- * @returns true if both keys exist
- */
-export async function keysExist(paths) {
-    const keyPaths = paths || getKeyPaths();
-    try {
-        await fs.access(keyPaths.privateKey);
-        await fs.access(keyPaths.publicKey);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Initialize keys (generate if they don't exist)
- *
- * @param paths - Optional custom paths
- * @returns Key pair (existing or newly generated)
- */
-export async function initializeKeys(paths) {
-    if (await keysExist(paths)) {
-        return loadKeys(paths);
-    }
-    const keyPair = generateKeys();
-    await saveKeys(keyPair, paths);
-    return keyPair;
-}
-/**
- * Ensure proof keys exist (generate if missing)
- *
- * @param homeDir - QA360 home directory
- * @returns Result with creation status, paths, and optional keys
- */
-export async function ensureProofKeys(homeDir) {
-    const keyDir = join(homeDir, 'keys');
-    const paths = {
-        pub: join(keyDir, 'ed25519.pub'),
-        priv: join(keyDir, 'ed25519.key'),
-    };
-    // Check if keys already exist
-    try {
-        await fs.access(paths.priv);
-        await fs.access(paths.pub);
-        // Keys exist, validate them
-        const privateKeyB64 = await fs.readFile(paths.priv, 'utf-8');
-        const publicKeyB64 = await fs.readFile(paths.pub, 'utf-8');
-        const secretKey = new Uint8Array(Buffer.from(privateKeyB64.trim(), 'base64'));
-        const publicKey = new Uint8Array(Buffer.from(publicKeyB64.trim(), 'base64'));
-        // Validate key sizes
-        if (publicKey.length !== 32) {
-            throw new Error(`Invalid public key size: ${publicKey.length} (expected 32)`);
-        }
-        if (secretKey.length !== 64) {
-            throw new Error(`Invalid secret key size: ${secretKey.length} (expected 64)`);
-        }
-        return {
-            created: false,
-            paths,
-            keys: { publicKey, secretKey },
-        };
-    }
-    catch {
-        // Keys don't exist or are invalid, generate new ones
-        await fs.mkdir(keyDir, { recursive: true, mode: 0o700 });
-        const keyPair = generateKeys();
-        // Validate generated keys
-        if (!keyPair.publicKey || keyPair.publicKey.length !== 32) {
-            throw new Error('Key generation failed: invalid public key');
-        }
-        if (!keyPair.secretKey || keyPair.secretKey.length !== 64) {
-            throw new Error('Key generation failed: invalid secret key');
-        }
-        // Save keys
-        await fs.writeFile(paths.priv, Buffer.from(keyPair.secretKey).toString('base64'), { mode: 0o600 });
-        await fs.writeFile(paths.pub, Buffer.from(keyPair.publicKey).toString('base64'), { mode: 0o644 });
-        return {
-            created: true,
-            paths,
-            keys: keyPair,
-        };
-    }
-}
-/**
- * Compute SHA-256 hash of data
- *
- * @param data - Data to hash (UTF-8 string)
- * @returns SHA-256 hash as Buffer
- */
-export function sha256(data) {
-    return createHash('sha256').update(data, 'utf-8').digest();
-}
-/**
- * Sign data with Ed25519
- *
- * @param data - Data to sign (canonical JSON string)
- * @param secretKey - Ed25519 secret key (64 bytes)
- * @returns Base64-encoded signature (88 chars)
- */
-export function sign(data, secretKey) {
-    // Hash the data first (sign the hash, not the raw data)
-    const hash = sha256(data);
-    // Sign the hash
-    const signature = nacl.sign.detached(hash, secretKey);
-    // Return base64-encoded signature
-    return Buffer.from(signature).toString('base64');
-}
-/**
- * Verify Ed25519 signature
- *
- * @param data - Original data (canonical JSON string)
- * @param signatureB64 - Base64-encoded signature
- * @param publicKey - Ed25519 public key (32 bytes)
- * @returns true if signature is valid
- */
-export function verify(data, signatureB64, publicKey) {
-    try {
-        // Hash the data
-        const hash = sha256(data);
-        // Decode signature
-        const signature = new Uint8Array(Buffer.from(signatureB64, 'base64'));
-        // Verify signature
-        return nacl.sign.detached.verify(hash, signature, publicKey);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Sign and verify roundtrip test
- *
- * @param data - Test data
- * @param keyPair - Key pair to test
- * @returns true if roundtrip succeeds
- */
-export function testRoundtrip(data, keyPair) {
-    const signature = sign(data, keyPair.secretKey);
-    return verify(data, signature, keyPair.publicKey);
-}

package/dist/core/proof/verifier.d.ts

@@ -1,97 +0,0 @@
-/**
- * Proof Bundle Verification
- *
- * Verifies cryptographic signatures and integrity of proof bundles.
- *
- * @see docs/rfc/proof-bundle-v1.md#6-verification-procedure
- */
-import type { ProofBundle, Artifact } from './bundle.js';
-/**
- * Verification result
- */
-export interface VerificationResult {
-    valid: boolean;
-    code: VerificationCode;
-    message: string;
-    details?: VerificationDetails;
-}
-/**
- * Verification error codes (matches RFC)
- */
-export declare enum VerificationCode {
-    PROOF_OK = 0,
-    PROOF_INVALID_SIG = 1,
-    PROOF_INVALID_SCHEMA = 2,
-    PROOF_ARTIFACT_MISMATCH = 3,
-    PROOF_MISSING_KEY = 4,
-    PROOF_MALFORMED = 5
-}
-/**
- * Verification details
- */
-export interface VerificationDetails {
-    signerId?: string;
-    hash?: string;
-    artifactsVerified?: number;
-    artifactsTotal?: number;
-    trustScore?: number;
-    runId?: string;
-    startedAt?: string;
-    finishedAt?: string;
-}
-/**
- * Artifact verification options
- */
-export interface ArtifactVerificationOptions {
-    basePath?: string;
-    skipMissing?: boolean;
-}
-/**
- * Verify proof bundle signature
- *
- * @param bundle - Proof bundle to verify
- * @param publicKey - Optional public key (loads from ~/.qa360/keys if not provided)
- * @returns Verification result
- */
-export declare function verifyProofBundle(bundle: ProofBundle, publicKey?: Uint8Array): Promise<VerificationResult>;
-/**
- * Verify artifact integrity
- *
- * @param artifact - Artifact metadata
- * @param filePath - Path to artifact file
- * @returns true if hash matches
- */
-export declare function verifyArtifact(artifact: Artifact, filePath: string): Promise<boolean>;
-/**
- * Verify all artifacts in proof bundle
- *
- * @param bundle - Proof bundle
- * @param options - Verification options
- * @returns Verification result with artifact details
- */
-export declare function verifyArtifacts(bundle: ProofBundle, options?: ArtifactVerificationOptions): Promise<VerificationResult>;
-/**
- * Verify proof bundle and artifacts (complete verification)
- *
- * @param bundle - Proof bundle
- * @param options - Artifact verification options
- * @param publicKey - Optional public key
- * @returns Complete verification result
- */
-export declare function verifyComplete(bundle: ProofBundle, options?: ArtifactVerificationOptions, publicKey?: Uint8Array): Promise<VerificationResult>;
-/**
- * Load and verify proof bundle from file
- *
- * @param filePath - Path to proof bundle JSON file
- * @param options - Artifact verification options
- * @param publicKey - Optional public key
- * @returns Verification result
- */
-export declare function verifyProofFile(filePath: string, options?: ArtifactVerificationOptions, publicKey?: Uint8Array): Promise<VerificationResult>;
-/**
- * Verify Phase3 proof format (simplified)
- *
- * @param filePath - Path to Phase3 proof JSON
- * @returns Verification result
- */
-export declare function verifyPhase3Proof(filePath: string): Promise<VerificationResult>;

package/dist/core/proof/verifier.js

@@ -1,308 +0,0 @@
-/**
- * Proof Bundle Verification
- *
- * Verifies cryptographic signatures and integrity of proof bundles.
- *
- * @see docs/rfc/proof-bundle-v1.md#6-verification-procedure
- */
-import { promises as fs } from 'fs';
-import { createHash } from 'crypto';
-import { canonicalizeForSigning } from './canonicalize.js';
-import { verify, loadKeys } from './signer.js';
-import { validateProofBundle } from './schema.js';
-/**
- * Verification error codes (matches RFC)
- */
-export var VerificationCode;
-(function (VerificationCode) {
-    VerificationCode[VerificationCode["PROOF_OK"] = 0] = "PROOF_OK";
-    VerificationCode[VerificationCode["PROOF_INVALID_SIG"] = 1] = "PROOF_INVALID_SIG";
-    VerificationCode[VerificationCode["PROOF_INVALID_SCHEMA"] = 2] = "PROOF_INVALID_SCHEMA";
-    VerificationCode[VerificationCode["PROOF_ARTIFACT_MISMATCH"] = 3] = "PROOF_ARTIFACT_MISMATCH";
-    VerificationCode[VerificationCode["PROOF_MISSING_KEY"] = 4] = "PROOF_MISSING_KEY";
-    VerificationCode[VerificationCode["PROOF_MALFORMED"] = 5] = "PROOF_MALFORMED";
-})(VerificationCode || (VerificationCode = {}));
-/**
- * Verify proof bundle signature
- *
- * @param bundle - Proof bundle to verify
- * @param publicKey - Optional public key (loads from ~/.qa360/keys if not provided)
- * @returns Verification result
- */
-export async function verifyProofBundle(bundle, publicKey) {
-    // Step 1: Validate JSON structure
-    try {
-        JSON.stringify(bundle);
-    }
-    catch {
-        return {
-            valid: false,
-            code: VerificationCode.PROOF_MALFORMED,
-            message: 'Malformed JSON structure',
-        };
-    }
-    // Step 2: Extract signature
-    const signatureB64 = bundle.signature;
-    if (!signatureB64) {
-        return {
-            valid: false,
-            code: VerificationCode.PROOF_INVALID_SIG,
-            message: 'Missing signature field',
-        };
-    }
-    // Step 3: Validate schema
-    const schemaValidation = validateProofBundle(bundle);
-    if (!schemaValidation.valid) {
-        return {
-            valid: false,
-            code: VerificationCode.PROOF_INVALID_SCHEMA,
-            message: `Schema validation failed: ${schemaValidation.errors?.join(', ')}`,
-        };
-    }
-    // Step 4: Load public key if not provided
-    let pubKey = publicKey;
-    if (!pubKey) {
-        try {
-            const keyPair = await loadKeys();
-            pubKey = keyPair.publicKey;
-        }
-        catch (error) {
-            return {
-                valid: false,
-                code: VerificationCode.PROOF_MISSING_KEY,
-                message: `Public key not found: ${error instanceof Error ? error.message : 'Unknown error'}`,
-            };
-        }
-    }
-    // Step 5: Re-canonicalize (without signature)
-    const canonical = canonicalizeForSigning(bundle);
-    // Step 6: Compute hash for verification details
-    const hash = createHash('sha256').update(canonical, 'utf-8').digest('hex');
-    // Step 7: Verify signature
-    const signatureValid = verify(canonical, signatureB64, pubKey);
-    if (!signatureValid) {
-        return {
-            valid: false,
-            code: VerificationCode.PROOF_INVALID_SIG,
-            message: 'Invalid signature',
-            details: {
-                signerId: bundle.signing.signerId,
-                hash: `sha256-${hash}`,
-            },
-        };
-    }
-    // Step 8: Success
-    return {
-        valid: true,
-        code: VerificationCode.PROOF_OK,
-        message: 'Proof verified successfully',
-        details: {
-            signerId: bundle.signing.signerId,
-            hash: `sha256-${hash}`,
-            artifactsTotal: bundle.artifacts.length,
-            trustScore: bundle.results.trustScore,
-            runId: bundle.run.id,
-            startedAt: bundle.run.startedAt,
-            finishedAt: bundle.run.finishedAt,
-        },
-    };
-}
-/**
- * Verify artifact integrity
- *
- * @param artifact - Artifact metadata
- * @param filePath - Path to artifact file
- * @returns true if hash matches
- */
-export async function verifyArtifact(artifact, filePath) {
-    try {
-        const content = await fs.readFile(filePath);
-        const hash = createHash('sha256').update(content).digest('hex');
-        const expectedHash = artifact.sha256.replace('sha256-', '');
-        return hash === expectedHash;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Verify all artifacts in proof bundle
- *
- * @param bundle - Proof bundle
- * @param options - Verification options
- * @returns Verification result with artifact details
- */
-export async function verifyArtifacts(bundle, options = {}) {
-    const { basePath = '.', skipMissing = false } = options;
-    let verified = 0;
-    const total = bundle.artifacts.length;
-    for (const artifact of bundle.artifacts) {
-        const filePath = artifact.path
-            ? `${basePath}/${artifact.path}`
-            : `${basePath}/${artifact.name}`;
-        try {
-            const valid = await verifyArtifact(artifact, filePath);
-            if (valid) {
-                verified++;
-            }
-            else if (!skipMissing) {
-                return {
-                    valid: false,
-                    code: VerificationCode.PROOF_ARTIFACT_MISMATCH,
-                    message: `Artifact hash mismatch: ${artifact.name}`,
-                    details: {
-                        artifactsVerified: verified,
-                        artifactsTotal: total,
-                    },
-                };
-            }
-        }
-        catch {
-            if (!skipMissing) {
-                return {
-                    valid: false,
-                    code: VerificationCode.PROOF_ARTIFACT_MISMATCH,
-                    message: `Artifact not found: ${artifact.name}`,
-                    details: {
-                        artifactsVerified: verified,
-                        artifactsTotal: total,
-                    },
-                };
-            }
-        }
-    }
-    return {
-        valid: true,
-        code: VerificationCode.PROOF_OK,
-        message: `All artifacts verified (${verified}/${total})`,
-        details: {
-            artifactsVerified: verified,
-            artifactsTotal: total,
-        },
-    };
-}
-/**
- * Verify proof bundle and artifacts (complete verification)
- *
- * @param bundle - Proof bundle
- * @param options - Artifact verification options
- * @param publicKey - Optional public key
- * @returns Complete verification result
- */
-export async function verifyComplete(bundle, options = {}, publicKey) {
-    // Step 1: Verify signature
-    const sigResult = await verifyProofBundle(bundle, publicKey);
-    if (!sigResult.valid) {
-        return sigResult;
-    }
-    // Step 2: Verify artifacts (if any)
-    if (bundle.artifacts.length > 0) {
-        const artifactResult = await verifyArtifacts(bundle, options);
-        if (!artifactResult.valid) {
-            return artifactResult;
-        }
-        // Merge details
-        return {
-            ...sigResult,
-            details: {
-                ...sigResult.details,
-                ...artifactResult.details,
-            },
-        };
-    }
-    return sigResult;
-}
-/**
- * Load and verify proof bundle from file
- *
- * @param filePath - Path to proof bundle JSON file
- * @param options - Artifact verification options
- * @param publicKey - Optional public key
- * @returns Verification result
- */
-export async function verifyProofFile(filePath, options = {}, publicKey) {
-    try {
-        const content = await fs.readFile(filePath, 'utf-8');
-        const bundle = JSON.parse(content);
-        return verifyComplete(bundle, options, publicKey);
-    }
-    catch (error) {
-        return {
-            valid: false,
-            code: VerificationCode.PROOF_MALFORMED,
-            message: `Failed to load proof: ${error instanceof Error ? error.message : 'Unknown error'}`,
-        };
-    }
-}
-/**
- * Verify Phase3 proof format (simplified)
- *
- * @param filePath - Path to Phase3 proof JSON
- * @returns Verification result
- */
-export async function verifyPhase3Proof(filePath) {
-    try {
-        const content = await fs.readFile(filePath, 'utf-8');
-        const proof = JSON.parse(content);
-        // Check if it's Phase3 format
-        if (!proof.version || !proof.signature || !proof.runId) {
-            return {
-                valid: false,
-                code: VerificationCode.PROOF_MALFORMED,
-                message: 'Not a valid Phase3 proof format',
-            };
-        }
-        // Extract signature info
-        const { signature, ...payload } = proof;
-        if (signature.algorithm === 'none' || !signature.publicKey) {
-            return {
-                valid: false,
-                code: VerificationCode.PROOF_INVALID_SIG,
-                message: 'Proof is unsigned',
-            };
-        }
-        // Decode public key from proof
-        const publicKey = new Uint8Array(Buffer.from(signature.publicKey, 'base64'));
-        // Canonicalize payload (same way it was signed)
-        const { canonicalize } = await import('./canonicalize.js');
-        const canonical = canonicalize(payload) + '\n';
-        // Compute hash for details
-        const hash = createHash('sha256').update(canonical, 'utf-8').digest();
-        // Verify signature
-        const isValid = verify(canonical, signature.value, publicKey);
-        if (!isValid) {
-            return {
-                valid: false,
-                code: VerificationCode.PROOF_INVALID_SIG,
-                message: 'Invalid signature - proof may have been tampered with',
-                details: {
-                    runId: proof.runId,
-                    trustScore: proof.execution?.trustScore,
-                },
-            };
-        }
-        // Success
-        return {
-            valid: true,
-            code: VerificationCode.PROOF_OK,
-            message: 'Proof verified successfully',
-            details: {
-                signerId: 'local@qa360',
-                hash: `sha256-${hash.toString('hex').substring(0, 16)}...`,
-                runId: proof.runId,
-                trustScore: proof.execution?.trustScore,
-                startedAt: proof.timestamp,
-                finishedAt: proof.timestamp,
-                artifactsTotal: 0,
-                artifactsVerified: 0,
-            },
-        };
-    }
-    catch (error) {
-        return {
-            valid: false,
-            code: VerificationCode.PROOF_MALFORMED,
-            message: `Failed to verify proof: ${error instanceof Error ? error.message : 'Unknown error'}`,
-        };
-    }
-}