raz-encrypt 2.3.0 → 2.4.0

package/dist/identity.js

@@ -1,9 +1,35 @@
-import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
+import { equalBytes } from "@noble/ciphers/utils.js";
+import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { generateClassicalKeypair } from "./crypto/classical.js";
-import { decryptFromFile, encryptToFile } from "./fileCrypto.js";
-import { generatePqcKemKeypair, generatePqcSignKeypair } from "./crypto/pqc.js";
+import { classicalSign, classicalVerify, generateClassicalKeypair, isValidClassicalKeypairShape } from "./crypto/classical.js";
+import { signCore } from "./crypto/hybrid.js";
+import { decryptFileWithFormat, DecryptionFailedError, encryptToFile, upgradeLegacyFile } from "./fileCrypto.js";
+import { assertAcceptablePassphrase, MIN_PASSPHRASE_LENGTH, normalizePassphrase } from "./passphrase.js";
+import { generatePqcKemKeypair, generatePqcSignKeypair, isValidPqcKemKeypairShape, isValidPqcSignKeypairShape, pqcDecapsulate, pqcEncapsulate, pqcSign, pqcVerify, } from "./crypto/pqc.js";
+function isHex(value) {
+    return typeof value === "string" && value.length % 2 === 0 && /^[0-9a-f]*$/i.test(value);
+}
+function isValidKeypairShape(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    return isHex(v.publicKey) && isHex(v.secretKey);
+}
+/**
+ * Structural shape check for a decrypted identity file's plaintext. In
+ * normal operation AEAD authentication already guarantees this shape, so a
+ * malformed value here would mean a wrong/corrupted ciphertext slipped past
+ * decryption (practically impossible without the passphrase) — this exists
+ * so that case fails closed with DecryptionFailedError instead of crashing
+ * on a missing/non-hex field (found by fuzzing, issue #42).
+ */
+function isValidSerializedIdentityShape(data) {
+    if (typeof data !== "object" || data === null)
+        return false;
+    const d = data;
+    return typeof d.alias === "string" && isValidKeypairShape(d.classical) && isValidKeypairShape(d.pqcSign) && isValidKeypairShape(d.pqcKem);
+}
 function identityFilePath(storageDir) {
     return join(storageDir, "identity.enc.json");
 }
@@ -42,20 +68,28 @@ function deserialize(storageDir, data) {
         },
     };
 }
-export const MIN_PASSPHRASE_LENGTH = 12;
+export { MIN_PASSPHRASE_LENGTH };
 /**
  * Generates a new hybrid classical+post-quantum identity (one ECDSA/ECDH-P384
  * keypair, one ML-DSA-87 signing keypair, one ML-KEM-1024 key-exchange
  * keypair) and persists it encrypted-at-rest under `storageDir`.
  *
- * Requires a passphrase of at least MIN_PASSPHRASE_LENGTH characters — this
- * check only applies here, not to loadIdentity, so an identity created
- * before this check existed can still be loaded with its original passphrase.
+ * The passphrase is normalized to Unicode NFKC, must be at least
+ * MIN_PASSPHRASE_LENGTH characters (counted as code points after
+ * normalization), must not be a single repeated character, and must not be
+ * on a small blocklist of very common passphrases (ADR 0017). These checks
+ * only apply here, not to loadIdentity, so an identity created before they
+ * existed can still be loaded with its original passphrase.
+ *
+ * `options.checkPassphrase`, if supplied, runs after all of the above pass
+ * (ADR 0021) — this is where real breach-corpus checking belongs, not in
+ * this library's own, deliberately small, blocklist.
  */
 export async function createIdentity(options) {
-    if (options.passphrase.length < MIN_PASSPHRASE_LENGTH) {
-        throw new Error(`Passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters long.`);
-    }
+    const passphrase = normalizePassphrase(options.passphrase);
+    assertAcceptablePassphrase(passphrase);
+    if (options.checkPassphrase)
+        await options.checkPassphrase(passphrase);
     const filePath = identityFilePath(options.storageDir);
     if (!options.overwrite && existsSync(filePath)) {
         throw new Error(`An identity already exists at ${filePath}. Pass { overwrite: true } to replace it.`);
@@ -67,14 +101,102 @@ export async function createIdentity(options) {
         pqcSign: generatePqcSignKeypair(),
         pqcKem: generatePqcKemKeypair(),
     };
-    await encryptToFile(filePath, options.passphrase, serialize(identity));
+    await encryptToFile(filePath, passphrase, serialize(identity));
     return identity;
 }
 /** Loads a previously-created identity back from disk. */
 export async function loadIdentity(options) {
-    const data = await decryptFromFile(identityFilePath(options.storageDir), options.passphrase);
+    const filePath = identityFilePath(options.storageDir);
+    const normalized = normalizePassphrase(options.passphrase);
+    // Normalized form first; the raw form only matters for a file written
+    // before normalization existed under a passphrase NFKC would change.
+    const candidates = normalized === options.passphrase ? [normalized] : [normalized, options.passphrase];
+    const { data, legacy, passphraseIndex } = await decryptFileWithFormat(filePath, candidates);
+    if (!isValidSerializedIdentityShape(data))
+        throw new DecryptionFailedError();
+    if (legacy || passphraseIndex > 0) {
+        // Upgrade a pre-versioned file (and/or re-key one made under an
+        // un-normalized passphrase) to the current format under the normalized
+        // passphrase now that the passphrase is proven correct. Best effort: a
+        // read-only directory or a full disk must not stop the identity from
+        // loading.
+        try {
+            await upgradeLegacyFile(filePath, normalized, data);
+        }
+        catch {
+            // The original file is untouched (see upgradeLegacyFile); try again on the next load.
+        }
+    }
     return deserialize(options.storageDir, data);
 }
+/**
+ * Builds an Identity from a caller-supplied KeyStore instead of a
+ * passphrase-encrypted file — `identity.enc.json` and a passphrase are
+ * never part of the picture. The returned key material's shape (byte
+ * lengths) is validated before trusting it, so a buggy KeyStore fails
+ * clearly here rather than with a cryptic error the first time a signing
+ * call happens to touch the bad bytes. `storageDir` is still required: the
+ * trust store and audit log are a separate concern from where secret keys
+ * live, unaffected by this function.
+ */
+export async function loadIdentityFromKeyStore(options) {
+    const { classical, pqcSign, pqcKem } = await options.keyStore.load();
+    if (!isValidClassicalKeypairShape(classical))
+        throw new Error("KeyStore returned a classical keypair with the wrong byte length(s) for P-384.");
+    if (!isValidPqcSignKeypairShape(pqcSign))
+        throw new Error("KeyStore returned a pqcSign keypair with the wrong byte length(s) for ML-DSA-87.");
+    if (!isValidPqcKemKeypairShape(pqcKem))
+        throw new Error("KeyStore returned a pqcKem keypair with the wrong byte length(s) for ML-KEM-1024.");
+    assertKeypairsMatch(classical, pqcSign, pqcKem);
+    return { alias: options.alias, storageDir: options.storageDir, classical, pqcSign, pqcKem };
+}
+/**
+ * Proves each secret key pairs with its public key by one round trip, once at load (issue #60).
+ * Length checks alone let a KeyStore return A's secret key with B's public key: the identity would
+ * sign with A while publishing B, and peers would see verification failures far from the cause.
+ */
+function assertKeypairsMatch(classical, pqcSignKeys, pqcKemKeys) {
+    const probe = utf8ToBytes("raz-encrypt keypair self-check");
+    let ok;
+    try {
+        ok = classicalVerify(classicalSign(probe, classical.secretKey), probe, classical.publicKey);
+    }
+    catch {
+        ok = false;
+    }
+    if (!ok)
+        throw new Error("KeyStore returned a classical public key that does not match its secret key (P-384).");
+    try {
+        ok = pqcVerify(pqcSign(probe, pqcSignKeys.secretKey), probe, pqcSignKeys.publicKey);
+    }
+    catch {
+        ok = false;
+    }
+    if (!ok)
+        throw new Error("KeyStore returned a pqcSign public key that does not match its secret key (ML-DSA-87).");
+    try {
+        const { cipherText, sharedSecret } = pqcEncapsulate(pqcKemKeys.publicKey);
+        ok = equalBytes(pqcDecapsulate(cipherText, pqcKemKeys.secretKey), sharedSecret);
+    }
+    catch {
+        ok = false;
+    }
+    if (!ok)
+        throw new Error("KeyStore returned a pqcKem public key that does not match its secret key (ML-KEM-1024).");
+}
+/**
+ * Best-effort wipe of the secret key bytes held by `identity`: overwrites
+ * them with zeros so they do not linger in this process's memory after you
+ * are done. The identity is unusable afterwards. Limits: JavaScript gives no
+ * guarantee about copies the engine or GC already made, and the hex strings
+ * produced while saving or loading an identity are immutable and cannot be
+ * wiped. This narrows the exposure window; it is not a secure-erase.
+ */
+export function zeroizeIdentity(identity) {
+    identity.classical.secretKey.fill(0);
+    identity.pqcSign.secretKey.fill(0);
+    identity.pqcKem.secretKey.fill(0);
+}
 /** The shareable public half of an identity — hand this to the other party out of band. */
 export function exportPublicIdentity(identity) {
     return {
@@ -84,4 +206,17 @@ export function exportPublicIdentity(identity) {
         pqcKemPublicKey: bytesToHex(identity.pqcKem.publicKey),
     };
 }
+/**
+ * A self-signed, optionally time-limited version of `exportPublicIdentity`'s
+ * card (ADR 0023/issue #37): the identity signs its own card, so a peer can
+ * verify it wasn't tampered with and — if `options.expiresAt` was set —
+ * reject it once expired, enforcing a cryptoperiod the bare card has no way
+ * to carry (it has no signature at all). `exportPublicIdentity` itself is
+ * unchanged; this is a separate, opt-in function precisely so every
+ * existing caller of the bare card is unaffected. Verify and trust a
+ * received one with `trustSignedCard`, not `trustParty`.
+ */
+export async function exportSignedCard(identity, options = {}) {
+    return signCore(identity, exportPublicIdentity(identity), options);
+}
 //# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAA2C,MAAM,iBAAiB,CAAC;AAyBzH,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;SACpD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;SAClD;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAChD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAwB;IAC/D,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU;QACV,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAChD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SAC9C;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAUxC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+BAA+B,qBAAqB,mBAAmB,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,2CAA2C,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,QAAQ,GAAa;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,wBAAwB,EAAE;QACrC,OAAO,EAAE,sBAAsB,EAAE;QACjC,MAAM,EAAE,qBAAqB,EAAE;KAChC,CAAC;IAEF,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,IAAI,GAAG,MAAM,eAAe,CAAqB,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACjH,OAAO,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5D,gBAAgB,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACxD,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;KACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,4BAA4B,EAAyB,MAAM,uBAAuB,CAAC;AACtJ,OAAO,EAAE,QAAQ,EAAsC,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjH,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,mBAAmB,EAA0B,MAAM,iBAAiB,CAAC;AACjI,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc,EACd,cAAc,EACd,OAAO,EACP,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAyBzB,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,8BAA8B,CAAC,IAAa;IACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5I,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;YACnD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;SACpD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;SAClD;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAChD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAwB;IAC/D,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU;QACV,SAAS,EAAE;YACT,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAC/C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;SAChD;QACD,OAAO,EAAE;YACP,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SAC9C;QACD,MAAM,EAAE;YACN,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAYjC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IACjE,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,2CAA2C,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,QAAQ,GAAa;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,wBAAwB,EAAE;QACrC,OAAO,EAAE,sBAAsB,EAAE;QACjC,MAAM,EAAE,qBAAqB,EAAE;KAChC,CAAC;IAEF,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3D,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,UAAU,GAAG,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,qBAAqB,CAAqB,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChH,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;IAC7E,IAAI,MAAM,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QAClC,gEAAgE;QAChE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,WAAW;QACX,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAwC;IACrF,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAErE,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChJ,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IAC9I,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAE7I,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEhD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,SAA2B,EAAE,WAA2B,EAAE,UAAyB;IAC9G,MAAM,KAAK,GAAG,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC5D,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAEjH,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAEnH,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1E,EAAE,GAAG,UAAU,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,kBAAkB,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;QAC5D,gBAAgB,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QACxD,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAkB,EAAE,UAAuB,EAAE;IAClF,OAAO,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC"}

package/dist/index.d.ts

@@ -1,10 +1,11 @@
 export { canonicalize, hashDocument } from "./canonicalJson.js";
 export { fingerprint } from "./fingerprint.js";
-export { decryptFrom, encryptFor, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
-export type { Certificate, EncryptedBox, VerifyFailureReason, VerifyResult } from "./crypto/nodeHybrid.js";
-export { createIdentity, exportPublicIdentity, loadIdentity, MIN_PASSPHRASE_LENGTH } from "./identity.js";
-export type { CreateIdentityOptions, Identity, LoadIdentityOptions, PublicCard } from "./identity.js";
-export { readLog, verifyLogIntegrity } from "./store.js";
+export { decryptFrom, DecryptionError, encryptFor, ReplayedBoxError, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
+export type { BoxReplayInfo, Certificate, EncryptedBox, VerifyFailureReason, VerifyResult } from "./crypto/nodeHybrid.js";
+export { createIdentity, exportPublicIdentity, exportSignedCard, loadIdentity, loadIdentityFromKeyStore, MIN_PASSPHRASE_LENGTH, zeroizeIdentity, } from "./identity.js";
+export type { CreateIdentityOptions, Identity, KeyStore, LoadIdentityFromKeyStoreOptions, LoadIdentityOptions, PublicCard } from "./identity.js";
+export type { PassphraseChecker } from "./passphrase.js";
+export { migrateAuditLogToEncrypted, readLog, verifyLogIntegrity } from "./store.js";
 export type { LogEntry, LogIntegrityResult } from "./store.js";
-export { getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, trustParty, untrustParty, } from "./trust.js";
-export type { TrustRecord } from "./trust.js";
+export { applyRevocationNotice, applyRotation, beginRotation, completeRotation, createRevocationNotice, getTrustedParty, getTrustStoreAnchor, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, migrateLegacyTrustStore, migrateTrustStoreToEncrypted, TrustStoreIntegrityError, trustParty, trustSignedCard, untrustFingerprint, untrustParty, verifyTrustStoreAnchor, } from "./trust.js";
+export type { RevocationDocument, RevocationNotice, RotationDocument, RotationStatement, TrustRecord, TrustStoreAnchor } from "./trust.js";

package/dist/index.js

@@ -1,7 +1,7 @@
 export { canonicalize, hashDocument } from "./canonicalJson.js";
 export { fingerprint } from "./fingerprint.js";
-export { decryptFrom, encryptFor, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
-export { createIdentity, exportPublicIdentity, loadIdentity, MIN_PASSPHRASE_LENGTH } from "./identity.js";
-export { readLog, verifyLogIntegrity } from "./store.js";
-export { getTrustedParty, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, trustParty, untrustParty, } from "./trust.js";
+export { decryptFrom, DecryptionError, encryptFor, ReplayedBoxError, sign, UntrustedPartyError, verify } from "./crypto/nodeHybrid.js";
+export { createIdentity, exportPublicIdentity, exportSignedCard, loadIdentity, loadIdentityFromKeyStore, MIN_PASSPHRASE_LENGTH, zeroizeIdentity, } from "./identity.js";
+export { migrateAuditLogToEncrypted, readLog, verifyLogIntegrity } from "./store.js";
+export { applyRevocationNotice, applyRotation, beginRotation, completeRotation, createRevocationNotice, getTrustedParty, getTrustStoreAnchor, getTrustedPartiesByAlias, getTrustRecordsByAlias, listTrustedParties, listTrustRecords, migrateLegacyTrustStore, migrateTrustStoreToEncrypted, TrustStoreIntegrityError, trustParty, trustSignedCard, untrustFingerprint, untrustParty, verifyTrustStoreAnchor, } from "./trust.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1G,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEvI,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErF,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,GACvB,MAAM,YAAY,CAAC"}

package/dist/passphrase.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Passphrase handling shared by every place a passphrase becomes key
+ * material (ADR 0017).
+ *
+ * Normalization: the same visible passphrase can be encoded as different
+ * Unicode code point sequences (composed vs decomposed accents, full-width
+ * digits, ...) depending on the keyboard, OS or app that typed it, which
+ * would derive different keys. Passphrases are normalized to NFKC before
+ * the KDF so what the user sees is what unlocks. For pure-ASCII passphrases
+ * NFKC is the identity, so nothing changes for them.
+ */
+export declare function normalizePassphrase(passphrase: string): string;
+export declare const MIN_PASSPHRASE_LENGTH = 12;
+/**
+ * A caller-supplied passphrase check, run by createIdentity AFTER the
+ * built-in checks (length, repeated-character, the small blocklist above)
+ * pass. Receives the already-normalized passphrase. Throw (synchronously or
+ * via a rejected promise) to reject it with your own message — e.g. because
+ * it's found in a real breach corpus, or scores poorly under a strength
+ * estimator. This is the actual fix for NIST SP 800-63B's breach-check
+ * expectation (ADR 0021): the built-in blocklist above is deliberately not
+ * grown to try to meet that bar itself, and this library adds no built-in
+ * network-calling checker (e.g. an HIBP lookup) of its own.
+ */
+export type PassphraseChecker = (normalized: string) => void | Promise<void>;
+/** Throws if `passphrase` (already normalized) is unacceptable for a NEW identity. Loading an existing identity never calls this. */
+export declare function assertAcceptablePassphrase(normalized: string): void;

package/dist/passphrase.js

@@ -0,0 +1,69 @@
+/**
+ * Passphrase handling shared by every place a passphrase becomes key
+ * material (ADR 0017).
+ *
+ * Normalization: the same visible passphrase can be encoded as different
+ * Unicode code point sequences (composed vs decomposed accents, full-width
+ * digits, ...) depending on the keyboard, OS or app that typed it, which
+ * would derive different keys. Passphrases are normalized to NFKC before
+ * the KDF so what the user sees is what unlocks. For pure-ASCII passphrases
+ * NFKC is the identity, so nothing changes for them.
+ */
+export function normalizePassphrase(passphrase) {
+    return passphrase.normalize("NFKC");
+}
+export const MIN_PASSPHRASE_LENGTH = 12;
+/**
+ * A deliberately small blocklist of the passphrases that fit a 12-character
+ * minimum and appear at the top of every breach list. NIST SP 800-63B asks
+ * verifiers to compare against known-compromised values; a few dozen entries
+ * cannot do that job, so treat this as a floor, not a strength meter. Apps
+ * that care should run a real estimator (e.g. zxcvbn) before calling
+ * createIdentity.
+ */
+const COMMON_PASSPHRASES = new Set([
+    "passwordpassword",
+    "password1234",
+    "password12345",
+    "password123456",
+    "passw0rd1234",
+    "123456789012",
+    "1234567890123",
+    "12345678901234",
+    "123456123456",
+    "1234512345",
+    "111111111111",
+    "000000000000",
+    "qwertyuiopas",
+    "qwertyuiop12",
+    "qwertyuiop123",
+    "qwertyqwerty",
+    "asdfghjklqwe",
+    "zxcvbnmasdfg",
+    "abcdefghijkl",
+    "abcdefghijklm",
+    "abcabcabcabc",
+    "iloveyouiloveyou",
+    "letmeinletmein",
+    "welcome12345",
+    "welcome123456",
+    "administrator",
+    "changemechangeme",
+    "trustno1trustno1",
+    "monkeymonkey",
+    "footballfootball",
+]);
+/** Throws if `passphrase` (already normalized) is unacceptable for a NEW identity. Loading an existing identity never calls this. */
+export function assertAcceptablePassphrase(normalized) {
+    const codePoints = [...normalized];
+    if (codePoints.length < MIN_PASSPHRASE_LENGTH) {
+        throw new Error(`Passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters long.`);
+    }
+    if (new Set(codePoints).size === 1) {
+        throw new Error("Passphrase must not be a single repeated character.");
+    }
+    if (COMMON_PASSPHRASES.has(normalized.toLowerCase().replace(/\s+/g, ""))) {
+        throw new Error("Passphrase is on the list of very common passphrases; choose something less guessable.");
+    }
+}
+//# sourceMappingURL=passphrase.js.map

package/dist/passphrase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passphrase.js","sourceRoot":"","sources":["../src/passphrase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,kBAAkB;CACnB,CAAC,CAAC;AAeH,qIAAqI;AACrI,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IACnC,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,+BAA+B,qBAAqB,mBAAmB,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC"}

package/dist/store.d.ts

@@ -1,28 +1,65 @@
 import type { Identity } from "./identity.js";
 export interface LogEntry {
-    action: "sign" | "verify" | "encrypt" | "decrypt";
+    action: "sign" | "verify" | "encrypt" | "decrypt" | "trust" | "untrust" | "rotate" | "revoke";
     documentHash?: string;
     counterpartAlias?: string;
     result?: string;
     at: string;
 }
+/**
+ * Constant-time MAC comparison (ADR 0009/0019's chain and head MACs are both
+ * HMAC-SHA384, so 96 lowercase hex chars). `candidate` is untrusted on-disk
+ * data of unknown shape: a non-string, wrong-length, or non-hex value is
+ * reported as a mismatch, never thrown, matching verifyKeyConfirmation's
+ * contract in crypto/hybrid.ts.
+ *
+ * Exported (ADR 0026) so the timing-safety test can exercise this exact
+ * compare in isolation, without the file I/O its only internal callers do.
+ */
+export declare function macEquals(candidate: unknown, expected: string): boolean;
 /**
  * Appends one entry to the local, append-only audit log (public metadata
- * only — no secrets). Each entry is chained to the previous one's hash
- * (see verifyLogIntegrity) so tampering or deleting past entries is
- * detectable, not just theoretically append-only.
+ * only — no secrets). Each entry is chained to the previous one's MAC
+ * (see verifyLogIntegrity), keyed from identity's own secret material
+ * (ADR 0009) so tampering or deleting past entries is detectable by anyone
+ * EXCEPT someone who also holds that secret — not just theoretically
+ * append-only, and not forgeable by file-write access alone.
  */
 export declare function appendLogEntry(identity: Identity, entry: Omit<LogEntry, "at">): Promise<void>;
+/** Transparently decrypts any v2 (encrypted, issue #43) entries alongside plaintext v1 ones. */
 export declare function readLog(identity: Identity): Promise<LogEntry[]>;
 export type LogIntegrityResult = {
     intact: true;
 } | {
     intact: false;
+    /** First entry whose chain link failed; for the reasons below, the number of entries actually present. */
     brokenAtIndex: number;
+    /** Absent for an edited or deleted entry inside the chain. "truncated": entries at the end were removed. "head-missing" / "head-invalid": the head record that would show this is gone or not authentic. */
+    reason?: "truncated" | "head-missing" | "head-invalid";
 };
 /**
- * Walks the hash chain and reports whether it's intact. If an entry was
+ * Walks the MAC chain and reports whether it's intact. If an entry was
  * edited or deleted, `brokenAtIndex` is the (0-based) index of the first
- * entry whose chain link no longer matches.
+ * entry whose chain link no longer matches. Recomputing a matching MAC
+ * requires identity's own secret material (see computeMac/deriveAuditLogKey)
+ * — this is what makes forging the chain require more than filesystem
+ * write access (ADR 0009). It also checks the authenticated head record
+ * (ADR 0019), so deleting the most recent entries is reported too, with
+ * `reason: "truncated"`.
+ *
+ * Not detectable: replacing BOTH log.jsonl and log.head.json with an older,
+ * consistent pair, or deleting both files outright. Keep an off-box copy of
+ * the head if that matters to you.
  */
 export declare function verifyLogIntegrity(identity: Identity): Promise<LogIntegrityResult>;
+/**
+ * One-time, explicit opt-in (issue #43/ADR 0027) to encrypt the audit log's
+ * entry content, so filesystem access alone no longer reveals what actions
+ * this identity has performed. Re-encrypts every existing entry in one pass
+ * (there is no mixed-format file afterwards) and marks the head record so
+ * every later `appendLogEntry` call encrypts just the one entry it writes —
+ * never the whole log again. A no-op if the log is already encrypted.
+ * Throws if the log fails its integrity check first: there is nothing safe
+ * to migrate if the chain can't be trusted.
+ */
+export declare function migrateAuditLogToEncrypted(identity: Identity): Promise<void>;