AbsoluteJS

@absolutejs/vulnerabilities-witness

@absolutejs/vulnerabilities-witnessv0.7.10betaPlatform & Infra

Independent durable transparency witness with rollback, equivocation, key-rotation, and HTTP service primitives for AbsoluteJS vulnerability evidence.

#Installation

BASH
bun add @absolutejs/vulnerabilities-witness

#Capabilities

Overview

The witness consumes @absolutejs/secrets@^0.9.2, whose Agency integration is host-owned and externalized. It never embeds a second Secrets or Agency runtime.

Independent transparency witnessing for AbsoluteJS vulnerability evidence. The package verifies the complete signed evidence-key transparency log before issuing an Ed25519 checkpoint receipt. Durable stores reject a lower log size as rollback and reject two different heads observed for the same authenticated subject and log size as equivocation.

The HTTP service has three routes:

Show 6 more

POST /v1/checkpoints authenticates a bearer token, verifies the submitted

transparency log, and returns { checkpoint, registry }.

GET /v1/keys publishes the witness key registry and cross-signed rotation

chain.

GET /health returns service liveness.

The signing identity contains a private key and belongs in a durable secret broker, not PostgreSQL or source control. service.rotate() stores the new secret state before activating it and publishes the cross-signed transition in the registry. service.maintain() performs the same rotation only after the configured maximum key age. In a multi-replica service, the supplied secret-store integration must serialize rotations.

Standalone service

The included absolute-vulnerability-witness executable uses PostgreSQL for observations and accepts these deployment secrets:

DATABASE_URL

EVIDENCE_WITNESS_ORIGIN

Show 10 more

EVIDENCE_WITNESS_SIGNING_STATE_JSON

EVIDENCE_WITNESS_TOKENS_JSON, an object mapping stable subjects to bearer

tokens

EVIDENCE_WITNESS_SECRETS_PATH, the durable encrypted secret file

EVIDENCE_WITNESS_SECRETS_PASSPHRASE, the master passphrase kept outside the

file

EVIDENCE_WITNESS_KEY_MAX_AGE_MS, defaulting to 90 days

EVIDENCE_WITNESS_MAINTENANCE_INTERVAL_MS, defaulting to one hour

EVIDENCE_WITNESS_TLS_CERT_FILE and EVIDENCE_WITNESS_TLS_KEY_FILE, an

optional pair enabling native TLS for deployments without a terminating proxy

Outcomes

What you can build

Build on the supported package contract

Use @absolutejs/vulnerabilities-witness through its supported public entry points.

Hardening checklist

Production guidance

Make every external boundary explicitPin the deployed @absolutejs/vulnerabilities-witness version, replace example or memory-backed dependencies with durable implementations, bound external calls, protect credentials, and emit enough evidence to retry or recover safely.

Follow in order

Troubleshooting path

1
Trace from the first failed boundary
Reproduce the smallest canonical @absolutejs/vulnerabilities-witness example, confirm the supported entry point and version in the API explorer, then inspect the first boundary that did not produce its documented result.

#@absolutejs/vulnerabilities-witness quick start

Partial snippet

# @absolutejs/vulnerabilities-witness

TS
import {
  EVIDENCE_WITNESS_REQUEST_CONTRACT,
  createEvidenceWitnessHttpHandler,
  createEvidenceWitnessService,
  createEvidenceWitnessSigningState,
} from "@absolutejs/vulnerabilities-witness";
import {
  createPostgresEvidenceWitnessStore,
  ensurePostgresEvidenceWitnessSchema,
} from "@absolutejs/vulnerabilities-witness/postgres";

const signingState = createEvidenceWitnessSigningState();
await ensurePostgresEvidenceWitnessSchema(sql);

const service = createEvidenceWitnessService({
  loadSigningState,
  origin: "https://witness.example",
  signingState,
  store: createPostgresEvidenceWitnessStore(sql),
  storeSigningState,
});

const fetch = createEvidenceWitnessHttpHandler({
  authenticate: async (token) => subjectsByToken.get(token) ?? null,
  service,
});

Bun.serve({ fetch, port: 3000 });

#Public entry points

Supported entry points declared by this package manifest.

Package entry point declared in package.json.

@absolutejs/vulnerabilities-witness@absolutejs/vulnerabilities-witness/postgres@absolutejs/vulnerabilities-witness/manifest@absolutejs/vulnerabilities-witness/manifest.json

#Package commands

Scripts declared by this package manifest.

bun run buildrm -rf dist && bun build --root src src/index.ts src/postgres.ts src/server.ts src/backupCli.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @absolutejs/secrets --external @absolutejs/vulnerabilities --external @sinclair/typebox && tsc -p tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run format && bun run typecheck && bun run test && bun run verify-package && bun run build
bun run formatprettier --write "./**/*.{ts,json,md}"
bun run testbun test
bun run typechecktsc --noEmit