Bump libveritas and resolve with certs

Cargo.toml

@@ -13,11 +13,11 @@ authors = ["Buffrr <contact@buffrr.dev>"]
 
 [workspace.dependencies]
 fabric-resolver = { path = "fabric", version = "0.2.7" }
-libveritas = { version = "0.3.3" }
-libveritas_testutil = { version = "0.3.3" }
+libveritas = { version = "0.4.2" }
+libveritas_testutil = { version = "0.4.2" }
 
-spaces_client = { version = "0.2.1" }
-spaces_protocol = { version = "0.2.1" }
-spaces_nums = { version = "0.2.1" }
-spaces_checkpoint = { version = "0.2.1" }
+spaces_client = { version = "0.3.0" }
+spaces_protocol = { version = "0.3.0" }
+spaces_nums = { version = "0.3.0" }
+spaces_checkpoint = { version = "0.3.0" }
 spacedb = { version = "0.1", features = ["hash-idx"] }

fabric/go/go.mod

@@ -4,7 +4,7 @@ go 1.22
 
 require (
 	github.com/btcsuite/btcd/btcec/v2 v2.3.6
-	github.com/spacesprotocol/libveritas-go v0.3.3
+	github.com/spacesprotocol/libveritas-go v0.4.2
 )
 
 require (

fabric/go/go.sum

@@ -8,5 +8,5 @@ github.com/decred/dcrd/crypto/blake256 v1.0.0 h1:/8DMNYp9SGi5f0w7uCm6d6M4OU2rGFK
 github.com/decred/dcrd/crypto/blake256 v1.0.0/go.mod h1:sQl2p6Y26YV+ZOcSTP6thNdn47hh8kt6rqSlvmrXFAc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 h1:YLtO71vCjJRCBcrPMtQ9nqBsqpA1m5sE92cU+pd5Mcc=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1/go.mod h1:hyedUtir6IdtD/7lIxGeCxkaw7y45JueMRL4DIyJDKs=
-github.com/spacesprotocol/libveritas-go v0.3.3 h1:kLiYBLp9vdsoIEYZHRZ+Eo9uKd02Vi02raYFhFZ97lw=
-github.com/spacesprotocol/libveritas-go v0.3.3/go.mod h1:HXnX2FNL43ueJuedsQwX9GF5jRHYZLqXYfFLWz900H8=
+github.com/spacesprotocol/libveritas-go v0.4.2 h1:7ZFFLWPiCBPiLmHOdsUtvAen6wPF7T1UJMDkFfe9IpA=
+github.com/spacesprotocol/libveritas-go v0.4.2/go.mod h1:HXnX2FNL43ueJuedsQwX9GF5jRHYZLqXYfFLWz900H8=

fabric/js/fabric-core/src/fabric.ts

@@ -29,6 +29,19 @@ export interface ResolveOptions {
   noCache?: boolean;
 }
 
+/** A resolved handle plus its exportable cert chain and parent-space context. */
+export interface ResolvedWithCerts {
+  /** The resolved leaf zone. */
+  zone: FabricZone;
+  /**
+   * Parent-space zones ordered `[parent, grandparent, …, top-level space]`.
+   * Each carries its own commitment/sovereignty (read via `toJson()`).
+   */
+  parents: FabricZone[];
+  /** The full certificate chain in `.spacecert` format. */
+  certs: Uint8Array;
+}
+
 export interface PeerInfo {
   source_ip: string;
   url: string;
@@ -613,6 +626,49 @@ export class Fabric {
     return this.provider.createCertificateChain(handle, allCertBytes);
   }
 
+  /**
+   * Resolve a handle and export its cert chain in one pass, also surfacing each
+   * parent space's zone (commitment/finality). Returns null if not found.
+   */
+  async resolveWithCerts(
+    handle: string,
+    opts?: ResolveOptions,
+  ): Promise<ResolvedWithCerts | null> {
+    const lookup = this.provider.createLookup([handle]);
+    const allZones: FabricZone[] = [];
+    const allCertBytes: Uint8Array[] = [];
+
+    let prevBatch: string[] = [];
+    let batch = lookup.start();
+    while (batch.length > 0) {
+      if (arraysEqual(batch, prevBatch)) break;
+      // hints=false so the exported certs carry their receipts.
+      const verified = await this.resolveFlat(batch, false, opts);
+      allCertBytes.push(...verified.certificates());
+      const zones = verified.zones();
+      prevBatch = batch;
+      batch = lookup.advance(zones);
+      allZones.push(...zones);
+    }
+
+    const expanded = lookup.expandZones(allZones);
+    const leaf = expanded.find((z) => z.handle === handle);
+    if (!leaf) return null;
+
+    // Space roots (canonical starts with @ or #) other than the leaf, resolved
+    // root→leaf; reverse for parent-first ordering.
+    const leafCanonical = leaf.toJson().canonical;
+    const parents = expanded
+      .filter((z) => {
+        const c = z.toJson().canonical;
+        return (c.startsWith("@") || c.startsWith("#")) && c !== leafCanonical;
+      })
+      .reverse();
+
+    const certs = this.provider.createCertificateChain(handle, allCertBytes);
+    return { zone: leaf, parents, certs };
+  }
+
   /** Resolve a flat list of non-dotted handles in a single relay query. */
   private async resolveFlat(
     handles: string[],

fabric/js/fabric-core/src/index.ts

@@ -2,6 +2,7 @@ export { Fabric, FabricError, parseScanUri } from "./fabric.js";
 export type {
   FabricOptions,
   ResolveOptions,
+  ResolvedWithCerts,
   PeerInfo,
   VerificationBadge,
   ScanParams,

fabric/js/fabric-react-native/package.json

@@ -23,7 +23,7 @@
   },
   "dependencies": {
     "@spacesprotocol/fabric-core": "*",
-    "@spacesprotocol/react-native-libveritas": "^0.3.3",
+    "@spacesprotocol/react-native-libveritas": "^0.4.2",
     "uniffi-bindgen-react-native": "0.29.3-1"
   },
   "devDependencies": {

fabric/js/fabric-react-native/src/index.ts

@@ -37,6 +37,7 @@ export {
 export type {
   FabricZone,
   ResolveOptions,
+  ResolvedWithCerts,
   PeerInfo,
   HintsResponse,
   SpaceHint,

fabric/js/fabric-web/package.json

@@ -27,7 +27,7 @@
   "dependencies": {
     "@noble/curves": "^1.8.0",
     "@spacesprotocol/fabric-core": "*",
-    "@spacesprotocol/libveritas": "^0.3.3"
+    "@spacesprotocol/libveritas": "^0.4.2"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",

fabric/js/fabric-web/src/index.ts

@@ -60,6 +60,7 @@ export {
 export type {
   FabricZone,
   ResolveOptions,
+  ResolvedWithCerts,
   PeerInfo,
   HintsResponse,
   SpaceHint,

fabric/kotlin/build.gradle.kts

@@ -19,9 +19,9 @@ dependencies {
     // compileOnly — consumers provide the right variant at runtime:
     //   Android: org.spacesprotocol:libveritas (AAR)
     //   JVM:     org.spacesprotocol:libveritas-jvm (JAR)
-    compileOnly("org.spacesprotocol:libveritas-jvm:0.3.3")
+    compileOnly("org.spacesprotocol:libveritas-jvm:0.4.2")
     // CLI needs it at runtime
-    runtimeOnly("org.spacesprotocol:libveritas-jvm:0.3.3")
+    runtimeOnly("org.spacesprotocol:libveritas-jvm:0.4.2")
 
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.3")
     compileOnly("fr.acinq.secp256k1:secp256k1-kmp:0.17.3")

fabric/python/pyproject.toml

@@ -3,7 +3,7 @@ name = "fabric-resolver"
 version = "0.1.0"
 description = "Python client for the certrelay fabric network"
 requires-python = ">=3.10"
-dependencies = ["libveritas>=0.3.3"]
+dependencies = ["libveritas>=0.4.2"]
 
 [project.optional-dependencies]
 signing = ["coincurve"]

fabric/rust/src/anchor.rs

@@ -47,8 +47,7 @@ mod tests {
     // Newest-first: entries[0].height = 6480 (tip), entries[59] = 4356 (oldest).
     const REAL: &str = include_str!("testdata/anchors_newest_first.json");
     // The X-Anchor-Root header the same relay served with this body.
-    const SERVED_ROOT: &str =
-        "7f20135af5fea06ac6a38303ea887428a614186979a41abde64e03ea6780375e";
+    const SERVED_ROOT: &str = "7f20135af5fea06ac6a38303ea887428a614186979a41abde64e03ea6780375e";
 
     #[test]
     fn tip_is_first_not_last_and_order_is_canonical() {