feat(ans): implement @logicsrc/ans M1 — resolver + offline verifier

M1 of the ANS SDK (docs/ans-sdk.md):

- name: parse/format ans://v<semver>.<agent>.<domain>
- cbor: minimal RFC 8949 codec for the COSE_Sign1 subset
- verify/merkle: RFC 6962 leaf/node hashing, tree build, inclusion-proof
  generation + verification
- verify/es256 + cose: COSE_Sign1 build/parse, Sig_structure, ES256 (WebCrypto)
- verify/rootkeys: kid -> verifier key (JWKS entries; sumdb-note is M2)
- verify: verifyReceipt() + verifyResolution() (signature + inclusion proof +
  name binding), pure and offline
- client: AnsClient resolve/rootKeys/register/status over injectable fetch,
  with a DnsApplier hook for verify-dns

Tests (24) cover name parsing, CBOR round-trips/vectors, RFC 6962 proofs, a full
ES256+Merkle receipt round-trip with positive/negative cases, and the client
against mocked fetch. Wired into the root build script.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-24 14:48:24 +00:00
parent 0ae24719e3
commit 29975b2df7
20 changed files with 1009 additions and 28 deletions

38
package-lock.json generated
View file

@ -1388,6 +1388,10 @@
"resolved": "packages/agentstack",
"link": true
},
"node_modules/@logicsrc/ans": {
"resolved": "packages/ans",
"link": true
},
"node_modules/@logicsrc/cli": {
"resolved": "packages/cli",
"link": true
@ -4495,7 +4499,6 @@
"version": "2.3.2",
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
"integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
"dev": true,
"hasInstallScript": true,
"license": "MIT",
"optional": true,
@ -5165,7 +5168,6 @@
"os": [
"aix"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5182,7 +5184,6 @@
"os": [
"android"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5199,7 +5200,6 @@
"os": [
"android"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5216,7 +5216,6 @@
"os": [
"android"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5233,7 +5232,6 @@
"os": [
"darwin"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5250,7 +5248,6 @@
"os": [
"darwin"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5267,7 +5264,6 @@
"os": [
"freebsd"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5284,7 +5280,6 @@
"os": [
"freebsd"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5301,7 +5296,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5318,7 +5312,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5335,7 +5328,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5352,7 +5344,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5369,7 +5360,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5386,7 +5376,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5403,7 +5392,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5420,7 +5408,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5437,7 +5424,6 @@
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5454,7 +5440,6 @@
"os": [
"netbsd"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5471,7 +5456,6 @@
"os": [
"netbsd"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5488,7 +5472,6 @@
"os": [
"openbsd"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5505,7 +5488,6 @@
"os": [
"openbsd"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5522,7 +5504,6 @@
"os": [
"openharmony"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5539,7 +5520,6 @@
"os": [
"sunos"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5556,7 +5536,6 @@
"os": [
"win32"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5573,7 +5552,6 @@
"os": [
"win32"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -5590,7 +5568,6 @@
"os": [
"win32"
],
"peer": true,
"engines": {
"node": ">=18"
}
@ -6061,6 +6038,13 @@
"vitest": "^4.0.8"
}
},
"packages/ans": {
"name": "@logicsrc/ans",
"version": "0.1.0",
"devDependencies": {
"vitest": "^4.0.8"
}
},
"packages/cli": {
"name": "@logicsrc/cli",
"version": "0.1.0",