DateKeys-App

Commit Graph

Author	SHA1	Message	Date
dev	97827ae169	Phase 2, step 5a: open capsules, steps 9 to 18, in memory src/lib/dkc/open.ts runs steps 9 to 18 of spec §63 on top of the steps 1 to 8 of inspectWith. It follows capsule.Open of the Go reference, with its checks, codes and texts: - step 9: the access credentials (the .dkk as an object, then its capsule_id and capsule_digest), then the release, never before the round time. Any failure of the source is ERR_RELEASE_UNAVAILABLE alone, keeping its text and its cause (correction 6); - step 10: verifyRelease; - steps 11 to 13: OUTER_TIME_AGE, the structure against access_policy and INNER_ACCESS_AGE; - steps 14 to 18: CONTROL_CBOR, header_binding, I_PAYLOAD, PAYLOAD_AGE and the commit. The three age files open with the Decrypter of age-encryption and identities that apply the rules of Go's agewrap: the tlock identity on ibe.ts, and the access and payload identities on x25519.ts. A failure of age that no identity reports is ERR_INTEGRITY with the fixed reason of its phase, header or STREAM, never the text of age-encryption. The plaintext is decrypted in memory and returned only after step 18. Streaming to OPFS is step 5b. src/lib/dkc/x25519.ts opens one age X25519 stanza at a time, in the order of age's X25519Identity. Step 13 must try every identity on every stanza (spec §36), and age-encryption's Decrypter stops at the first. Its primitives are the ones age-encryption uses: X25519 and HKDF from noble curves and hashes, and ChaCha20-Poly1305 from @noble/ciphers 2.4.0. The author approved declaring that package as a direct dependency on 2026-09-28; it is the copy already installed and bundled. The guards now allow ciphers, and x25519.ts in the noble allowlist. src/lib/dkc/bech32.ts ports age's internal/bech32, with its MIT notice, to read AGE-SECRET-KEY-1 identities. Tests: - vectors.test.ts runs all 65 cases of the mutation corpus through open. Each gives the code and the step of Go, and no case that fails without the network requests a release. This includes the 34 cases of steps 9 to 18 that were skipped, so the suite no longer skips any test. - open.test.ts: - the five official fixtures open to their plaintext, with each credential, with the checks and details of the reference; - the unusable noncritical extensions are reported; - the source failures and the clock; - age failures by phase; - CONTROL_CBOR that does not decode, and a low-order share in INNER_ACCESS_AGE, through an OUTER_TIME_AGE resealed with the FK_TIME of the Go vectors; - the texts of the identities. - x25519.test.ts checks against age-encryption both ways and against the Go-written stanzas of the fixtures, and covers every low-order share. - bech32.test.ts has the vectors of the reference. x25519.ts and bech32.ts are at 100 % coverage, now thresholds. open.ts is at 100 % of lines; the one branch left is the one for an error that is not a DateKeysError. index.ts does not re-export the opening yet. The page imports index.ts, and re-exporting would pull noble into /inspect (58.7 to 84.9 KB gzip) even unused; step 8 will load it on demand. The site does not change. npm run verify is green: 2,490 tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2 weeks ago
dev	a9bdcecc28	Version constants: 0.1.0-dev, implementing spec 0.8.2 - src/lib/dkc/version.ts exports VERSION (0.1.0-dev, which becomes 0.1.0 once phase 2 adds the opening of capsules) and SPEC_VERSION (0.8.2, the tag spec-v0.8.2 of datekeys-go), from index.ts too. - package.json and its lockfile move to 0.1.0-dev. version.test.ts ties VERSION to both and checks it is semantic versioning. It also ties SPEC_VERSION to the spec field of the shared vectors and fixtures. testing/vectors.ts now takes SPEC_VERSION from version.ts, so every vector file is checked against the version the library declares. - The footer of the page shows both, instead of a fixed 0.8.2. - README.md gains a "Versiones" section: the three versions (format, specification, library) and what 0.1.0-dev covers. CHANGELOG.md is new. The Go reference gained datekeys.SpecVersion, datekeys.Version() and `datekeys version` in 5b342d3. npm run verify is green: 2,406 tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2 weeks ago

Author

SHA1

Message

Date

dev

97827ae169

Phase 2, step 5a: open capsules, steps 9 to 18, in memory

src/lib/dkc/open.ts runs steps 9 to 18 of spec §63 on top of the steps
1 to 8 of inspectWith. It follows capsule.Open of the Go reference, with
its checks, codes and texts:
- step 9: the access credentials (the .dkk as an object, then its
  capsule_id and capsule_digest), then the release, never before the
  round time. Any failure of the source is ERR_RELEASE_UNAVAILABLE
  alone, keeping its text and its cause (correction 6);
- step 10: verifyRelease;
- steps 11 to 13: OUTER_TIME_AGE, the structure against access_policy
  and INNER_ACCESS_AGE;
- steps 14 to 18: CONTROL_CBOR, header_binding, I_PAYLOAD, PAYLOAD_AGE
  and the commit.
The three age files open with the Decrypter of age-encryption and
identities that apply the rules of Go's agewrap: the tlock identity on
ibe.ts, and the access and payload identities on x25519.ts. A failure of
age that no identity reports is ERR_INTEGRITY with the fixed reason of
its phase, header or STREAM, never the text of age-encryption. The
plaintext is decrypted in memory and returned only after step 18.
Streaming to OPFS is step 5b.

src/lib/dkc/x25519.ts opens one age X25519 stanza at a time, in the
order of age's X25519Identity. Step 13 must try every identity on every
stanza (spec §36), and age-encryption's Decrypter stops at the first.
Its primitives are the ones age-encryption uses: X25519 and HKDF from
noble curves and hashes, and ChaCha20-Poly1305 from @noble/ciphers
2.4.0. The author approved declaring that package as a direct
dependency on 2026-09-28; it is the copy already installed and bundled.
The guards now allow ciphers, and x25519.ts in the noble allowlist.
src/lib/dkc/bech32.ts ports age's internal/bech32, with its MIT notice,
to read AGE-SECRET-KEY-1 identities.

Tests:
- vectors.test.ts runs all 65 cases of the mutation corpus through open.
  Each gives the code and the step of Go, and no case that fails without
  the network requests a release. This includes the 34 cases of steps 9
  to 18 that were skipped, so the suite no longer skips any test.
- open.test.ts:
  - the five official fixtures open to their plaintext, with each
    credential, with the checks and details of the reference;
  - the unusable noncritical extensions are reported;
  - the source failures and the clock;
  - age failures by phase;
  - CONTROL_CBOR that does not decode, and a low-order share in
    INNER_ACCESS_AGE, through an OUTER_TIME_AGE resealed with the FK_TIME
    of the Go vectors;
  - the texts of the identities.
- x25519.test.ts checks against age-encryption both ways and against the
  Go-written stanzas of the fixtures, and covers every low-order share.
- bech32.test.ts has the vectors of the reference.
x25519.ts and bech32.ts are at 100 % coverage, now thresholds. open.ts
is at 100 % of lines; the one branch left is the one for an error that
is not a DateKeysError.

index.ts does not re-export the opening yet. The page imports index.ts,
and re-exporting would pull noble into /inspect (58.7 to 84.9 KB gzip)
even unused; step 8 will load it on demand. The site does not change.

npm run verify is green: 2,490 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dev

a9bdcecc28

Version constants: 0.1.0-dev, implementing spec 0.8.2

- src/lib/dkc/version.ts exports VERSION (0.1.0-dev, which becomes
  0.1.0 once phase 2 adds the opening of capsules) and SPEC_VERSION
  (0.8.2, the tag spec-v0.8.2 of datekeys-go), from index.ts too.
- package.json and its lockfile move to 0.1.0-dev. version.test.ts ties
  VERSION to both and checks it is semantic versioning. It also ties
  SPEC_VERSION to the spec field of the shared vectors and fixtures.
  testing/vectors.ts now takes SPEC_VERSION from version.ts, so every
  vector file is checked against the version the library declares.
- The footer of the page shows both, instead of a fixed 0.8.2.
- README.md gains a "Versiones" section: the three versions (format,
  specification, library) and what 0.1.0-dev covers. CHANGELOG.md is
  new.

The Go reference gained datekeys.SpecVersion, datekeys.Version() and
`datekeys version` in 5b342d3.

npm run verify is green: 2,406 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 Commits (b0814ab2605b1b93d18ea8aff9a8cc5e4c9c0588)