technocore-sdk 0.1.0

package/dist/crypto/encode.js

@@ -0,0 +1,98 @@
+/**
+ * Technocore SDK — Encoding Utilities
+ *
+ * Base64url and base58btc encoding for signatures and DIDs.
+ * Uses @scure/base for base58btc (audited, zero-dependency).
+ */
+import { base58 } from '@scure/base';
+// ─── Base64url ──────────────────────────────────────────────────────────────
+const B64URL_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+/**
+ * Encode bytes to base64url (no padding).
+ * This is the canonical encoding — the last character is determined by the encoder,
+ * and is the only one the server accepts.
+ */
+export function base64urlEncode(bytes) {
+    let result = '';
+    const len = bytes.length;
+    let i = 0;
+    for (; i + 2 < len; i += 3) {
+        const b0 = bytes[i];
+        const b1 = bytes[i + 1];
+        const b2 = bytes[i + 2];
+        result += B64URL_CHARS[(b0 >> 2)];
+        result += B64URL_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];
+        result += B64URL_CHARS[((b1 & 0x0f) << 2) | (b2 >> 6)];
+        result += B64URL_CHARS[b2 & 0x3f];
+    }
+    // Handle remaining bytes
+    if (i < len) {
+        const b0 = bytes[i];
+        result += B64URL_CHARS[b0 >> 2];
+        if (i + 1 < len) {
+            const b1 = bytes[i + 1];
+            result += B64URL_CHARS[((b0 & 0x03) << 4) | (b1 >> 4)];
+            result += B64URL_CHARS[(b1 & 0x0f) << 2];
+        }
+        else {
+            result += B64URL_CHARS[(b0 & 0x03) << 4];
+        }
+    }
+    return result;
+}
+/**
+ * Decode base64url string to bytes (no padding expected).
+ */
+export function base64urlDecode(str) {
+    // Build reverse lookup
+    const lookup = new Uint8Array(128);
+    for (let i = 0; i < B64URL_CHARS.length; i++) {
+        lookup[B64URL_CHARS.charCodeAt(i)] = i;
+    }
+    const len = str.length;
+    const outputLen = Math.floor((len * 3) / 4);
+    const bytes = new Uint8Array(outputLen);
+    let j = 0;
+    for (let i = 0; i < len; i += 4) {
+        const c0 = lookup[str.charCodeAt(i)];
+        const c1 = lookup[str.charCodeAt(i + 1)];
+        const c2 = i + 2 < len ? lookup[str.charCodeAt(i + 2)] : 0;
+        const c3 = i + 3 < len ? lookup[str.charCodeAt(i + 3)] : 0;
+        bytes[j++] = (c0 << 2) | (c1 >> 4);
+        if (i + 2 < len)
+            bytes[j++] = ((c1 & 0x0f) << 4) | (c2 >> 2);
+        if (i + 3 < len)
+            bytes[j++] = ((c2 & 0x03) << 6) | c3;
+    }
+    return bytes.slice(0, j);
+}
+// ─── Base58btc ──────────────────────────────────────────────────────────────
+/**
+ * Encode bytes to base58btc (Bitcoin alphabet).
+ * Used for the multibase portion of did:key identifiers.
+ */
+export function base58btcEncode(bytes) {
+    return base58.encode(bytes);
+}
+/**
+ * Decode base58btc string to bytes.
+ */
+export function base58btcDecode(str) {
+    return base58.decode(str);
+}
+// ─── UTF-8 ──────────────────────────────────────────────────────────────────
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+/**
+ * Encode string to UTF-8 bytes.
+ */
+export function utf8Encode(str) {
+    return textEncoder.encode(str);
+}
+/**
+ * Decode UTF-8 bytes to string.
+ */
+export function utf8Decode(bytes) {
+    return textDecoder.decode(bytes);
+}
+//# sourceMappingURL=encode.js.map

package/dist/crypto/encode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encode.js","sourceRoot":"","sources":["../../src/crypto/encode.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,+EAA+E;AAE/E,MAAM,YAAY,GAAG,kEAAkE,CAAC;AAExF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAE,CAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC;QACxD,MAAM,IAAI,YAAY,CAAC,EAAE,GAAG,IAAI,CAAE,CAAC;IACrC,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACZ,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,CAAC,CAAE,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC;YACxD,MAAM,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAE,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,YAAY,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,uBAAuB;IACvB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5D,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;YAAE,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;YAAE,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAE/E,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/crypto/fingerprint.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Technocore SDK — DID Fingerprint
+ *
+ * Convention (not a server feature):
+ * Fingerprint = first 16 lowercase hex characters of SHA-256 of the full did:key string.
+ *
+ * Used for publishing identity notes:
+ *   /kv/did-{shard}/{remaining}
+ * where shard = first 2 chars, remaining = next 14 chars.
+ *
+ * Readers try the sharded path first, then legacy /kv/did/{fingerprint}.
+ */
+/**
+ * Compute the DID fingerprint: first 16 hex chars of SHA-256(did:key string).
+ *
+ * @param did - The full did:key string (e.g., "did:key:z6Mk...")
+ * @returns 16-character lowercase hex string
+ */
+export declare function didFingerprint(did: string): string;
+/**
+ * Get the sharded note path for a DID.
+ *
+ * @param did - The full did:key string
+ * @returns { shard, key, namespace, path } where:
+ *   - shard: first 2 hex chars
+ *   - key: remaining 14 hex chars
+ *   - namespace: `did-${shard}`
+ *   - path: `/kv/did-${shard}/${key}`
+ */
+export declare function didNotePath(did: string): {
+    shard: string;
+    key: string;
+    namespace: string;
+    path: string;
+};
+/**
+ * Get the legacy (unsharded) note path for a DID.
+ *
+ * @param did - The full did:key string
+ * @returns Legacy path `/kv/did/${fingerprint}`
+ */
+export declare function didLegacyNotePath(did: string): string;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/crypto/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../src/crypto/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASlD;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAUA;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD"}

package/dist/crypto/fingerprint.js

@@ -0,0 +1,61 @@
+/**
+ * Technocore SDK — DID Fingerprint
+ *
+ * Convention (not a server feature):
+ * Fingerprint = first 16 lowercase hex characters of SHA-256 of the full did:key string.
+ *
+ * Used for publishing identity notes:
+ *   /kv/did-{shard}/{remaining}
+ * where shard = first 2 chars, remaining = next 14 chars.
+ *
+ * Readers try the sharded path first, then legacy /kv/did/{fingerprint}.
+ */
+import { sha256 } from '@noble/hashes/sha256';
+import { utf8Encode } from './encode.js';
+/**
+ * Compute the DID fingerprint: first 16 hex chars of SHA-256(did:key string).
+ *
+ * @param did - The full did:key string (e.g., "did:key:z6Mk...")
+ * @returns 16-character lowercase hex string
+ */
+export function didFingerprint(did) {
+    const hash = sha256(utf8Encode(did));
+    // Convert first 8 bytes (16 hex chars) to lowercase hex
+    let hex = '';
+    for (let i = 0; i < 8; i++) {
+        hex += (hash[i] >>> 4).toString(16);
+        hex += (hash[i] & 0x0f).toString(16);
+    }
+    return hex;
+}
+/**
+ * Get the sharded note path for a DID.
+ *
+ * @param did - The full did:key string
+ * @returns { shard, key, namespace, path } where:
+ *   - shard: first 2 hex chars
+ *   - key: remaining 14 hex chars
+ *   - namespace: `did-${shard}`
+ *   - path: `/kv/did-${shard}/${key}`
+ */
+export function didNotePath(did) {
+    const fp = didFingerprint(did);
+    const shard = fp.slice(0, 2);
+    const key = fp.slice(2);
+    return {
+        shard,
+        key,
+        namespace: `did-${shard}`,
+        path: `/kv/did-${shard}/${key}`,
+    };
+}
+/**
+ * Get the legacy (unsharded) note path for a DID.
+ *
+ * @param did - The full did:key string
+ * @returns Legacy path `/kv/did/${fingerprint}`
+ */
+export function didLegacyNotePath(did) {
+    return `/kv/did/${didFingerprint(did)}`;
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/crypto/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/crypto/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,wDAAwD;IACxD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IAMrC,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO;QACL,KAAK;QACL,GAAG;QACH,SAAS,EAAE,OAAO,KAAK,EAAE;QACzB,IAAI,EAAE,WAAW,KAAK,IAAI,GAAG,EAAE;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,WAAW,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC"}

package/dist/crypto/nonce.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Technocore SDK — Nonce Manager
+ *
+ * Manages strictly increasing nonces per (identity, room) pair.
+ *
+ * Requirements from the protocol:
+ * - Nonce must be 1–19 digits
+ * - Must be strictly greater than the last nonce that key used in that room
+ * - A millisecond clock works, but concurrent sends must not collide
+ *
+ * Strategy: monotonic counter based on Date.now(), with an atomic increment
+ * that prevents concurrent collision. Promise.all([send(), send(), send()])
+ * will produce distinct monotonic nonces.
+ */
+export declare class NonceManager {
+    #private;
+    /**
+     * Get the next nonce for a given identity and room.
+     * Thread-safe within a single JS event loop (synchronous increment).
+     *
+     * @param did - The DID of the signing identity
+     * @param room - The room name
+     * @returns Nonce string (1–19 digits, strictly increasing)
+     */
+    next(did: string, room: string): string;
+    /**
+     * Set the last known nonce for a (did, room) pair.
+     * Use this when recovering state from a server response or external source.
+     *
+     * @param did - The DID
+     * @param room - The room name
+     * @param nonce - The last known nonce value
+     */
+    setLastNonce(did: string, room: string, nonce: bigint | number | string): void;
+    /**
+     * Get the last issued nonce for a (did, room) pair, or undefined if none.
+     */
+    getLastNonce(did: string, room: string): bigint | undefined;
+    /**
+     * Clear all tracked nonces.
+     */
+    clear(): void;
+}
+//# sourceMappingURL=nonce.d.ts.map

package/dist/crypto/nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.d.ts","sourceRoot":"","sources":["../../src/crypto/nonce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,qBAAa,YAAY;;IAOvB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAavC;;;;;;;OAOG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI;IAU9E;;OAEG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3D;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/crypto/nonce.js

@@ -0,0 +1,69 @@
+/**
+ * Technocore SDK — Nonce Manager
+ *
+ * Manages strictly increasing nonces per (identity, room) pair.
+ *
+ * Requirements from the protocol:
+ * - Nonce must be 1–19 digits
+ * - Must be strictly greater than the last nonce that key used in that room
+ * - A millisecond clock works, but concurrent sends must not collide
+ *
+ * Strategy: monotonic counter based on Date.now(), with an atomic increment
+ * that prevents concurrent collision. Promise.all([send(), send(), send()])
+ * will produce distinct monotonic nonces.
+ */
+export class NonceManager {
+    /**
+     * Map of "did|room" → last issued nonce (as bigint for safe 19-digit handling).
+     * Using bigint because nonces can be up to 19 digits (past 2^53).
+     */
+    #lastNonce = new Map();
+    /**
+     * Get the next nonce for a given identity and room.
+     * Thread-safe within a single JS event loop (synchronous increment).
+     *
+     * @param did - The DID of the signing identity
+     * @param room - The room name
+     * @returns Nonce string (1–19 digits, strictly increasing)
+     */
+    next(did, room) {
+        const key = `${did}|${room}`;
+        const now = BigInt(Date.now());
+        const last = this.#lastNonce.get(key) ?? 0n;
+        // Take the max of (current time in ms, last nonce + 1)
+        // This ensures monotonicity even under sub-millisecond concurrency
+        const nonce = now > last ? now : last + 1n;
+        this.#lastNonce.set(key, nonce);
+        return nonce.toString();
+    }
+    /**
+     * Set the last known nonce for a (did, room) pair.
+     * Use this when recovering state from a server response or external source.
+     *
+     * @param did - The DID
+     * @param room - The room name
+     * @param nonce - The last known nonce value
+     */
+    setLastNonce(did, room, nonce) {
+        const key = `${did}|${room}`;
+        const n = typeof nonce === 'bigint' ? nonce : BigInt(nonce);
+        const current = this.#lastNonce.get(key) ?? 0n;
+        // Only advance, never regress
+        if (n > current) {
+            this.#lastNonce.set(key, n);
+        }
+    }
+    /**
+     * Get the last issued nonce for a (did, room) pair, or undefined if none.
+     */
+    getLastNonce(did, room) {
+        return this.#lastNonce.get(`${did}|${room}`);
+    }
+    /**
+     * Clear all tracked nonces.
+     */
+    clear() {
+        this.#lastNonce.clear();
+    }
+}
+//# sourceMappingURL=nonce.js.map

package/dist/crypto/nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.js","sourceRoot":"","sources":["../../src/crypto/nonce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,OAAO,YAAY;IACvB;;;OAGG;IACM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD;;;;;;;OAOG;IACH,IAAI,CAAC,GAAW,EAAE,IAAY;QAC5B,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE5C,uDAAuD;QACvD,mEAAmE;QACnE,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEhC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,KAA+B;QACrE,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/C,8BAA8B;QAC9B,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,GAAW,EAAE,IAAY;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/dist/crypto/sign.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Technocore SDK — Ed25519 Signing
+ *
+ * Uses @noble/ed25519 (audited by Cure53, zero dependencies).
+ *
+ * The signing pipeline:
+ * 1. Apply single-line sweep to text
+ * 2. Build canonical string: <room>|<nonce>|<sweptText>
+ * 3. Encode as UTF-8 bytes
+ * 4. Sign with Ed25519 private key → 64-byte signature
+ * 5. Encode signature as base64url (86 chars, canonical last char)
+ */
+/**
+ * Result of signing a Technocore message.
+ */
+export interface SignResult {
+    /** The text after single-line sweep (what gets stored). */
+    readonly sweptText: string;
+    /** Base64url-encoded signature (86 chars, canonical). */
+    readonly sig: string;
+    /** The nonce used (as string, 1–19 digits). */
+    readonly nonce: string;
+    /** The raw canonical payload that was signed (for debugging/verification). */
+    readonly canonicalPayload: Uint8Array;
+}
+/**
+ * Sign a Technocore room message.
+ *
+ * @param privateKey - 32-byte Ed25519 private key (seed)
+ * @param room - Room name
+ * @param nonce - Nonce string (1–19 digits, must be > last nonce for this key+room)
+ * @param text - Raw message text (sweep will be applied)
+ * @returns SignResult with swept text, signature, nonce, and canonical payload
+ */
+export declare function signMessage(privateKey: Uint8Array, room: string, nonce: string, text: string): Promise<SignResult>;
+/**
+ * Sign a Technocore note write.
+ *
+ * @param privateKey - 32-byte Ed25519 private key (seed)
+ * @param namespace - Note namespace (e.g., "room-owners")
+ * @param key - Note key
+ * @param nonce - Nonce string
+ * @param value - Note value
+ * @returns Base64url-encoded signature
+ */
+export declare function signNote(privateKey: Uint8Array, namespace: string, key: string, nonce: string, value: string): Promise<string>;
+/**
+ * Raw Ed25519 sign — sign arbitrary bytes.
+ * Lower-level API for custom signing needs.
+ */
+export declare function rawSign(privateKey: Uint8Array, message: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/crypto/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/crypto/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAkBH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAC3B,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,UAAU,CAAC,CAErB"}

package/dist/crypto/sign.js

@@ -0,0 +1,78 @@
+/**
+ * Technocore SDK — Ed25519 Signing
+ *
+ * Uses @noble/ed25519 (audited by Cure53, zero dependencies).
+ *
+ * The signing pipeline:
+ * 1. Apply single-line sweep to text
+ * 2. Build canonical string: <room>|<nonce>|<sweptText>
+ * 3. Encode as UTF-8 bytes
+ * 4. Sign with Ed25519 private key → 64-byte signature
+ * 5. Encode signature as base64url (86 chars, canonical last char)
+ */
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha512';
+import { base64urlEncode } from './encode.js';
+import { sweep } from './sweep.js';
+import { canonicalMessagePayload, canonicalNotePayload } from './canonicalize.js';
+import { SIG_PATTERN } from '../types/index.js';
+import { TechnocoreSignatureError } from '../errors/index.js';
+// Configure noble/ed25519 to use @noble/hashes for SHA-512
+// This is required in environments without Web Crypto (some Node versions, edge runtimes)
+ed.etc.sha512Sync = (...m) => {
+    const h = sha512.create();
+    for (const msg of m)
+        h.update(msg);
+    return h.digest();
+};
+/**
+ * Sign a Technocore room message.
+ *
+ * @param privateKey - 32-byte Ed25519 private key (seed)
+ * @param room - Room name
+ * @param nonce - Nonce string (1–19 digits, must be > last nonce for this key+room)
+ * @param text - Raw message text (sweep will be applied)
+ * @returns SignResult with swept text, signature, nonce, and canonical payload
+ */
+export async function signMessage(privateKey, room, nonce, text) {
+    // Step 1: Apply single-line sweep
+    const sweptText = sweep(text);
+    // Step 2-3: Build canonical payload as UTF-8
+    const payload = canonicalMessagePayload(room, nonce, sweptText);
+    // Step 4: Sign with Ed25519
+    const sigBytes = await ed.signAsync(payload, privateKey);
+    // Step 5: Encode as base64url
+    const sig = base64urlEncode(sigBytes);
+    // Validate the canonical form
+    if (!SIG_PATTERN.test(sig)) {
+        throw new TechnocoreSignatureError(`Generated signature is not canonical: ${sig} (last char must be A, Q, g, or w)`);
+    }
+    return { sweptText, sig, nonce, canonicalPayload: payload };
+}
+/**
+ * Sign a Technocore note write.
+ *
+ * @param privateKey - 32-byte Ed25519 private key (seed)
+ * @param namespace - Note namespace (e.g., "room-owners")
+ * @param key - Note key
+ * @param nonce - Nonce string
+ * @param value - Note value
+ * @returns Base64url-encoded signature
+ */
+export async function signNote(privateKey, namespace, key, nonce, value) {
+    const payload = canonicalNotePayload(namespace, key, nonce, value);
+    const sigBytes = await ed.signAsync(payload, privateKey);
+    const sig = base64urlEncode(sigBytes);
+    if (!SIG_PATTERN.test(sig)) {
+        throw new TechnocoreSignatureError(`Generated note signature is not canonical: ${sig}`);
+    }
+    return sig;
+}
+/**
+ * Raw Ed25519 sign — sign arbitrary bytes.
+ * Lower-level API for custom signing needs.
+ */
+export async function rawSign(privateKey, message) {
+    return ed.signAsync(message, privateKey);
+}
+//# sourceMappingURL=sign.js.map

package/dist/crypto/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/crypto/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,2DAA2D;AAC3D,0FAA0F;AAC1F,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAe,EAAE,EAAE;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AACpB,CAAC,CAAC;AAgBF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAsB,EACtB,IAAY,EACZ,KAAa,EACb,IAAY;IAEZ,kCAAkC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAE9B,6CAA6C;IAC7C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAEhE,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEzD,8BAA8B;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAEtC,8BAA8B;IAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,yCAAyC,GAAG,oCAAoC,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,UAAsB,EACtB,SAAiB,EACjB,GAAW,EACX,KAAa,EACb,KAAa;IAEb,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAEtC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,8CAA8C,GAAG,EAAE,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,UAAsB,EACtB,OAAmB;IAEnB,OAAO,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC"}

package/dist/crypto/sweep.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Technocore SDK — Single-Line Sweep
+ *
+ * The server replaces every character in Unicode general categories
+ * Cc, Cf, Cs, Co, Zl, and Zp with a space before storage, then trims the ends.
+ *
+ * This is NOT Unicode normalization (NFC/NFD). The server never normalizes —
+ * it stores the code points you send. NFC and NFD of one word are two different
+ * messages.
+ *
+ * Sign the text AFTER the sweep — the bytes that get stored — so the record
+ * can be re-verified later.
+ */
+/**
+ * Apply the Technocore single-line sweep to text.
+ *
+ * Replaces all characters in Unicode categories Cc, Cf, Cs, Co, Zl, Zp
+ * with a space, then trims both ends.
+ *
+ * @param text - Raw input text
+ * @returns Swept text (single-line, ready for signing)
+ */
+export declare function sweep(text: string): string;
+//# sourceMappingURL=sweep.d.ts.map

package/dist/crypto/sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep.d.ts","sourceRoot":"","sources":["../../src/crypto/sweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAiBH;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1C"}

package/dist/crypto/sweep.js

@@ -0,0 +1,40 @@
+/**
+ * Technocore SDK — Single-Line Sweep
+ *
+ * The server replaces every character in Unicode general categories
+ * Cc, Cf, Cs, Co, Zl, and Zp with a space before storage, then trims the ends.
+ *
+ * This is NOT Unicode normalization (NFC/NFD). The server never normalizes —
+ * it stores the code points you send. NFC and NFD of one word are two different
+ * messages.
+ *
+ * Sign the text AFTER the sweep — the bytes that get stored — so the record
+ * can be re-verified later.
+ */
+/**
+ * Regex matching characters the server replaces with space.
+ *
+ * Categories:
+ * - Cc: C0/C1 controls (U+0000–U+001F, U+007F–U+009F) — includes \n, \r, \t
+ * - Cf: Format characters (zero-width joiners, bidi overrides, Unicode tag block)
+ * - Cs: Lone surrogates (U+D800–U+DFFF)
+ * - Co: Private use (U+E000–U+F8FF, U+F0000–U+FFFFD, U+100000–U+10FFFD)
+ * - Zl: Line separator (U+2028)
+ * - Zp: Paragraph separator (U+2029)
+ *
+ * Uses Unicode property escapes (ES2018+).
+ */
+const SWEEP_PATTERN = /[\p{Cc}\p{Cf}\p{Cs}\p{Co}\p{Zl}\p{Zp}]/gu;
+/**
+ * Apply the Technocore single-line sweep to text.
+ *
+ * Replaces all characters in Unicode categories Cc, Cf, Cs, Co, Zl, Zp
+ * with a space, then trims both ends.
+ *
+ * @param text - Raw input text
+ * @returns Swept text (single-line, ready for signing)
+ */
+export function sweep(text) {
+    return text.replace(SWEEP_PATTERN, ' ').trim();
+}
+//# sourceMappingURL=sweep.js.map

package/dist/crypto/sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep.js","sourceRoot":"","sources":["../../src/crypto/sweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAAG,0CAA0C,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC"}

package/dist/crypto/verify.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Technocore SDK — Ed25519 Verification
+ *
+ * Verifies signed Technocore messages offline — no network access required
+ * when the message contains enough information (room, nonce, text, sig, DID).
+ *
+ * Distinguishes:
+ * - syntactically valid DID
+ * - valid signature format
+ * - cryptographically valid signature
+ * These are different concepts. Never say "verified" when only the DID format is valid.
+ */
+import type { TechnocoreMessage, VerificationResult } from '../types/index.js';
+/**
+ * Verify a signed Technocore message.
+ *
+ * @param room - The room the message belongs to
+ * @param message - The message object (must have `from`, `nonce`, `sig`, `text`)
+ * @returns Structured VerificationResult — never throws for invalid messages
+ */
+export declare function verifyMessage(room: string, message: TechnocoreMessage): Promise<VerificationResult>;
+/**
+ * Raw Ed25519 verify — verify arbitrary bytes against a signature and public key.
+ * Lower-level API.
+ */
+export declare function rawVerify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/crypto/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/crypto/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CA+F7B;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,OAAO,CAAC,CAElB"}