@adapt-toolkit/mufl 0.8.0

package/mufl_stdlib/config.mufl

@@ -0,0 +1,86 @@
+config script {
+    (
+        $exports->(
+            $libraries->(
+                $continuation->#"continuation.mm",
+                $current_transaction_info->#"current_transaction_info.mm",
+                $identity_proof_document->#"identity_proof_document.mm",
+                $lists->#"lists.mm",
+                $vector->#"vector.mm",
+                $platform_type_id->#"platform_type_id.mm",
+                $transaction_message_decoder->#"transaction_message_decoder.mm",
+                $transaction_queue->#"transaction_queue.mm",
+                $verification->#"verification.mm",
+                $address_document_types->#"cryptography/address_document_types.mm",
+                $address_document->#"cryptography/address_document.mm",
+                $encrypted_channel->#"cryptography/encrypted_channel.mm",
+                $authorizing_document->#"cryptography/authorizing_document.mm",
+                $authorizing_container->#"cryptography/authorizing_container.mm",
+                $key_storage_api->#"cryptography/key_storage_api.mm",
+                $key_storage->#"cryptography/key_storage.mm",
+                $key_utils->#"cryptography/key_utils.mm",
+                $registration_proof->#"cryptography/registration_proof.mm",
+                $attestation_document->#"cryptography/attestation/attestation_document.mm",
+                $container_associated_data->#"cryptography/attestation/container_associated_data.mm",
+                $control_packet_identity_proof_document->#"cryptography/attestation/control_packet_identity_proof_document.mm",
+                $identity_proof_document_impl->#"cryptography/attestation/identity_proof_document_impl.mm",
+                $identity_proof_document_types->#"cryptography/attestation/identity_proof_document_types.mm",
+                $node_description->#"cryptography/attestation/node_description.mm",
+                $platform_dependent_attestation_document->
+                    #"cryptography/attestation/platform_dependent_attestation_document/platform_dependent_attestation_document.mm",
+                $browser_attestation_document->
+                    #"cryptography/attestation/platform_dependent_attestation_document/browser/browser_attestation_document.mm",
+                $native_attestation_document->
+                    #"cryptography/attestation/platform_dependent_attestation_document/native/native_attestation_document.mm",
+                $integration_test_api -> #"integration_test_api.mm",
+                $rslt -> #"rslt.mm",
+                $random -> #"random.mm",
+                $permissions -> #"permissions.mm",
+            ),
+            $applications->(
+                $control_packet->#"control_packet.mu",
+                $peer_container->#"cryptography/peer_container.mu"
+            ),
+        ),
+        $imports->(
+            $libraries->(
+                $__t_wrapper->#"../transactions/__t_wrapper.mm",
+                $transaction->#"../transactions/transaction.mm",
+                $continuation->#"continuation.mm",
+                $current_transaction_info->#"current_transaction_info.mm",
+                $identity_proof_document->#"identity_proof_document.mm",
+                $lists->#"lists.mm",
+                $vector->#"vector.mm",
+                $platform_type_id->#"platform_type_id.mm",
+                $transaction_message_decoder->#"transaction_message_decoder.mm",
+                $transaction_queue->#"transaction_queue.mm",
+                $verification->#"verification.mm",
+                $address_document_types->#"cryptography/address_document_types.mm",
+                $address_document->#"cryptography/address_document.mm",
+                $encrypted_channel->#"cryptography/encrypted_channel.mm",
+                $authorizing_document->#"cryptography/authorizing_document.mm",
+                $authorizing_container->#"cryptography/authorizing_container.mm",
+                $key_storage_api->#"cryptography/key_storage_api.mm",
+                $key_storage->#"cryptography/key_storage.mm",
+                $key_utils->#"cryptography/key_utils.mm",
+                $registration_proof->#"cryptography/registration_proof.mm",
+                $attestation_document->#"cryptography/attestation/attestation_document.mm",
+                $container_associated_data->#"cryptography/attestation/container_associated_data.mm",
+                $control_packet_identity_proof_document->#"cryptography/attestation/control_packet_identity_proof_document.mm",
+                $identity_proof_document_impl->#"cryptography/attestation/identity_proof_document_impl.mm",
+                $identity_proof_document_types->#"cryptography/attestation/identity_proof_document_types.mm",
+                $node_description->#"cryptography/attestation/node_description.mm",
+                $platform_dependent_attestation_document->
+                    #"cryptography/attestation/platform_dependent_attestation_document/platform_dependent_attestation_document.mm",
+                $browser_attestation_document->
+                    #"cryptography/attestation/platform_dependent_attestation_document/browser/browser_attestation_document.mm",
+                $native_attestation_document->
+                    #"cryptography/attestation/platform_dependent_attestation_document/native/native_attestation_document.mm",
+                $rslt -> #"rslt.mm",
+                $random -> #"random.mm",
+                $permissions -> #"permissions.mm"
+            ),
+            $applications->(,)
+        )
+    ).
+}

package/mufl_stdlib/continuation.mm

@@ -0,0 +1,51 @@
+library continuation loads library current_transaction_info uses transactions
+{
+    // add timeouts...
+
+    metadef main_function_t: global_id -> transaction::results::type.
+    metadef continuation_function_t: any.
+
+    hidden {
+        continuations is global_id->>any = (,).
+
+        continue_transaction = fn (_:($id->id: global_id, $args->args: any)) {
+            f = continuations id abort "Continuation not found. Id: " + id when is NIL.
+            delete continuations id.
+
+            return f args.
+        }
+    }
+
+    add_continuation = fn (f: continuation_function_t) -> global_id
+    {
+        id = _new_id "Continuation id.".
+        abort "Internal error: Continuation with given id already exists: " + id when continuations id != NIL.
+
+        continuations id -> f.
+
+        return id.
+    }
+     
+    update_continuation = fn id: global_id, f: continuation_function_t
+    {
+        continuations id -> f.
+    }
+
+    fn respond(_:($sender_id -> sender_id: global_id+, $continuation_id -> continuation_id: global_id, $args -> args: any)) -> transaction::action::type
+    {
+        if (sender_id == NIL)
+        {
+            sender_id -> current_transaction_info::get_external_envelope_or_abort() $from. // if sender id is not passed explicitly, extract it from the external envelope
+        }
+        return transaction::action::send sender_id? ($name -> "::continuation::continue_transaction", $targ -> ($id -> continuation_id, $args -> args)).
+    }
+
+    fn set_breakpoint (main_cb: main_function_t, continuation_cb: continuation_function_t) -> transaction::results::type
+    {
+        continuation_id = add_continuation continuation_cb.
+        return main_cb continuation_id.
+    }  
+
+    trn continue_transaction args:($id->global_id, $args->any) = (continue_transaction args).
+
+}

package/mufl_stdlib/control_packet.mu

@@ -0,0 +1,184 @@
+application control_packet loads libraries
+    identity_proof_document,
+    attestation_document,
+    native_attestation_document,
+    browser_attestation_document,
+    address_document,
+    continuation,
+    control_packet_identity_proof_document,
+    key_storage,
+    key_storage_api,
+    transaction_message_decoder,
+    current_transaction_info
+    uses transactions
+{
+
+    control_packet_identity_proof_document::is_control_packet -> TRUE.
+
+
+
+    hidden
+    {
+
+        // Route the injected deserializer through the FILTERED _read_external_or_abort
+        // (ExternalMessageTypeFilter -- rejects D_Code at decode). The grabbed primitive feeds
+        // key_storage::decrypt_message's post-decrypt _read of peer crypto_messages (untrusted
+        // external ingress); binding it to the local name _read_or_abort keeps the injection below
+        // unchanged. Trusted program-load/code-serialization _read stays on the bare _read.
+        _read_or_abort = grab( _read_external_or_abort ).
+        key_storage::init ($_read_or_abort -> _read_or_abort ).
+
+        module types
+        {
+            switch_to_debug   = 0.
+            switch_to_release = 1.
+            get_logs          = 2.
+            add_packet        = 3.
+            backup_packet     = 4.
+            remove_packet     = 5.
+        }
+    
+        module policy_validator
+        {
+            metadef packet_info: ($id->global_id).
+
+            hidden
+            {
+                validators is int->>(packet_info->bool) = (,).
+            }
+
+
+            add_validator = fn (type_id: int, validator: (packet_info->bool))
+            {
+                abort "Validator for given action type is already set: " + (_str type_id) when validators type_id != NIL.
+                validators type_id -> validator.
+            }
+
+            get_validator = fn (type_id: int) -> (packet_info->bool)+
+            {
+                return validators type_id.
+            }
+
+            validate = fn (type_id: int, info: packet_info)
+            {
+                validator = get_validator type_id abort "Validator for given action type not found: " + (_str type_id) when is NIL. 
+                return validator info.
+            }
+
+            add_validator types::add_packet fn (_: packet_info) = TRUE.
+            add_validator types::backup_packet fn (_: packet_info) = TRUE.
+            add_validator types::remove_packet fn (_:packet_info) = TRUE.
+            add_validator types::get_logs fn (_: packet_info) = TRUE.
+        }
+
+        module actions
+        {
+
+            hidden
+            {
+                default_action = fn (type_id: int, packet_info: policy_validator::packet_info, args: (str->>any))
+                {
+                    continuation_id = (args $continuation_id) as (global_id+).
+                    continuation_id_local is global_id+ = NIL.
+                    if continuation_id != NIL {
+                        cb = fn (args)
+                        {
+                            return ::transaction::success [
+                                ::transaction::action::send (packet_info $id) ($name->"::continuation::continue_transaction", $targ->($id->continuation_id?, $args->args)) 
+                            ].
+                        }
+                        continuation_id_local -> continuation::add_continuation cb.
+                    }
+                    return transaction::success [
+                        ::transaction::action::return_data ($type->type_id, $data->args'($continuation_id->continuation_id_local)) // override the continuation id with the local value  
+                    ].
+                }
+
+                overloaded_actions is int->>(int->(policy_validator::packet_info)->(str->>any)->any) = (,).
+
+                _add_action = fn (type_id: int, cb: int->policy_validator::packet_info->(str->>any)->any)
+                {
+                    abort "Function for given type of action already exists: " + (_str type_id) when overloaded_actions type_id != NIL.
+                    overloaded_actions type_id -> cb.
+                }
+
+            }
+
+            execute = fn (type_id: int, info: policy_validator::packet_info, args: (str->>any))
+            {
+                abort "Permission denied." when !(policy_validator::validate type_id info).
+
+                action = overloaded_actions type_id.
+                if action == NIL {
+                    action -> default_action.
+                } 
+                
+
+                return action type_id info args.
+            }
+
+        }
+
+
+
+    }
+
+    
+
+    trn switch_to_debug
+    args:($continuation_id->global_id+)
+    {
+        ::current_transaction_info::validate_origin_or_abort (::transaction::envelope::origin::external,).
+        envelope = ::current_transaction_info::get_external_envelope_or_abort().
+        packet_info = ($id -> envelope $from).
+        return actions::execute types::switch_to_debug packet_info args.
+    }
+
+    trn switch_to_release
+    args:($continuation_id->global_id+)
+    {
+        ::current_transaction_info::validate_origin_or_abort (::transaction::envelope::origin::external,).
+        envelope = ::current_transaction_info::get_external_envelope_or_abort().
+        packet_info = ($id -> envelope $from).
+        return actions::execute types::switch_to_release packet_info args.
+    }
+
+    trn get_logs
+    args:($continuation_id->global_id)
+    {
+        ::current_transaction_info::validate_origin_or_abort (::transaction::envelope::origin::external,).
+        envelope = ::current_transaction_info::get_external_envelope_or_abort().
+        packet_info = ($id -> envelope $from).
+        return actions::execute types::get_logs packet_info args.
+    }
+
+    trn add_packet
+    args:($unit_hash->global_id, $seed_phrase->str, $continuation_id->global_id+)
+    {
+        ::current_transaction_info::validate_origin_or_abort (::transaction::envelope::origin::external,).
+        envelope = ::current_transaction_info::get_external_envelope_or_abort().
+        packet_info = ($id -> envelope $from).
+        return actions::execute types::add_packet packet_info args. 
+    }
+
+    trn backup_packet
+    args:($packet_id->global_id+, $state->hash_code+, $continuation_id->global_id+)
+    {
+        ::current_transaction_info::validate_origin_or_abort (::transaction::envelope::origin::external,).
+        envelope = ::current_transaction_info::get_external_envelope_or_abort().
+        packet_info = ($id -> envelope $from).
+        return actions::execute types::backup_packet packet_info args.
+    }
+
+    trn remove_packet
+    args: ($packet_id->global_id, $continuation_id->global_id+)
+    {
+        ::current_transaction_info::validate_origin_or_abort (::transaction::envelope::origin::external,).
+        envelope = ::current_transaction_info::get_external_envelope_or_abort().
+        packet_info = ($id -> envelope $from).
+        return actions::execute types::remove_packet packet_info args.
+    }
+
+
+
+}

package/mufl_stdlib/cryptography/address_document.mm

@@ -0,0 +1,333 @@
+/* 
+
+** == and != to make sure types make sense. Refuse to compare if type mismatch
+
+type
+1 NIL
+2 TRUE
+3 LittleEndianInteger64 + 8bytes-data
+4 Tiny-string + 8bytes-data-nt
+5 Short-string + 2bytes-length + data-nt
+6 Long-string + 4bytes-length + data-nt
+7 Tiny-binary + 32bytes-data
+8 Short-binary + 2bytes-length + data
+9 Long-binary + 4bytes-length + data
+10 Dictionary + 2bytes-element-count + 4bytes-length + [key, value]*count
+    keys can be any type except dictionary
+11 implementation-specific-type-X + implementation-specific-type-ID + implementation-specific-type-data
+
+*/ 
+
+/* 
+and address document is a record of keys that are attested to belong to a certain container. 
+
+*/ 
+
+library address_document loads libraries address_document_types, key_storage, key_utils, transaction_queue, current_transaction_info uses transactions
+{
+    using key_utils. 
+    using address_document_types.
+
+    /* 
+        When creating a new container
+        1. User creating a new container will supply the information for an authorizing container
+        2. User creating a new container will have priviledges with the authorizing container to register a new container
+        3. Eventually any container will have an address document with authorization from the specified authorizing container
+
+
+    /* 
+    message (container to container): 
+        body
+        originator address document
+        attestation document
+    */ 
+
+    hidden { 
+        m_current_version IS int = 1. 
+        m_authorizing_containers IS t_container_id(,) = (,). 
+        m_ad_signatures IS (t_container_id ->> crypto_signature) = (,).
+        m_max_allowed_number_of_authorizations = 10. 
+        m_valid_versions = (1,). 
+        m_my_address_document IS t_address_document+ = NIL. 
+    }
+
+    process_address_document = fn (ad: t_address_document, no_check_for_authorization: bool) -> nil
+    {
+        ad => (
+            $version -> incoming_version,
+            $identity -> incoming_identity = (
+                $key_list -> incoming_key_list,
+                $default_keys -> incoming_default_key_list,
+                $container_id -> incoming_container_id
+            ),
+            $authorizations -> incoming_authorizations
+        ).
+
+        abort "Invalid address document version" WHEN !(m_valid_versions incoming_version).
+        abort "Container ID cannot match mine" WHEN incoming_container_id == _get_container_id().
+        abort "Too many authorizing signatures" WHEN _count incoming_authorizations > m_max_allowed_number_of_authorizations.
+
+        sign_key_id_for_binding = incoming_default_key_list $SIGN.
+        sign_pub_for_binding IS publickey_sign+ = NIL.
+        sc incoming_key_list -- (k->) {
+            if _crypto_get_key_id k == sign_key_id_for_binding {
+                sign_pub_for_binding -> k SAFE(publickey_sign).
+                break.
+            }
+        }
+        abort "SIGN key not found in address document" WHEN sign_pub_for_binding == NIL.
+        abort "Address document: container id does not commit to signing key"
+            WHEN (key_storage::address_of_key sign_pub_for_binding?) != incoming_container_id.
+
+        keyset_difference = key_storage::analyse_keyset_difference incoming_container_id incoming_key_list incoming_default_key_list.
+        is_new_container = keyset_difference $is_new_container.
+
+        // Who is allowed to authorize this keyset? 
+        authorizing_containers = m_authorizing_containers. 
+        if !is_new_container || no_check_for_authorization { 
+            authorizing_containers incoming_container_id -> TRUE.
+        } 
+
+        count_authorizations IS int = 0. 
+        added_signing_keys_unconfirmed IS t_key_id->>t_publickey = keyset_difference $added_keys | $SIGN |. 
+
+        sc incoming_authorizations -- (signature -> ) {
+            key_id = _crypto_get_key_id signature. 
+            if is_new_container {
+                abort "Invalid signature in address document" WHEN key_storage::check_signature_new_container (_value_id incoming_identity) signature incoming_key_list == NIL.
+                count_authorizations->count_authorizations + 1.
+            } else { 
+                signing_container_id = key_storage::get_source_container signature| . // NIL in case of new container. ABORTS 
+                if authorizing_containers signing_container_id? { 
+                    abort "Invalid signature in address document" WHEN key_storage::check_signature (_value_id incoming_identity) signature == NIL. 
+
+                    count_authorizations->count_authorizations + 1. 
+                } 
+            } 
+
+            if added_signing_keys_unconfirmed key_id { 
+                delete added_signing_keys_unconfirmed key_id. 
+            } 
+        } 
+
+        abort "Not all keys being added to the keyset are confirmed via using the key to generate appropriate overall signature" 
+            WHEN _count added_signing_keys_unconfirmed > 0. 
+
+        abort "Container is not authorized by a known authorizing container" WHEN count_authorizations == 0. 
+
+        unpacked_signatures IS t_key_id->>crypto_signature = (,). 
+        sc incoming_authorizations -- (signature -> ) { 
+            unpacked_signatures (_crypto_get_key_id signature) -> signature. 
+        } 
+
+        
+        // Ensure that all new signing keys have associated signatures
+        sc keyset_difference $added_keys $SIGN | -- (key_id -> public_key) { 
+            associated_signature = unpacked_signatures key_id abort "Signing key was added, but associated signature) not exist" WHEN IS NIL. 
+            abort "Signature is invalid for new key added" WHEN _crypto_verify_hash_signature (_value_id incoming_identity) associated_signature? public_key as(publickey_sign) == NIL. 
+        } 
+
+
+        key_storage::update_keyset keyset_difference. 
+    }
+
+    check_signature_by_authorizing_container = fn (hash: hash_code, signature: crypto_signature) -> bool {
+        abort "Signature failed validation." WHEN !(key_storage::check_signature hash signature).
+        cid = key_storage::container_id_of_signer signature.
+        abort "Signer container is not an authorizing container." WHEN !(_has m_authorizing_containers cid).
+        return TRUE.
+    }
+
+    add_authorizing_container = fn (ad: t_address_document) -> nil
+    {
+        process_address_document ad TRUE. 
+        m_authorizing_containers (ad $identity $container_id)->TRUE. 
+    }
+
+    produce_my_address_document = fn (_) -> t_address_document
+    {
+        my_identity = key_storage::get_my_identity(). 
+        signatures IS crypto_signature(,) = (,). 
+        hash = _value_id my_identity. 
+
+        sc my_identity $key_list -- (key -> ) ?? key_get_function key == $SIGN { 
+            sig = key_storage::sign hash (_crypto_get_key_id key). 
+            signatures sig -> TRUE. 
+        } 
+
+        m_my_address_document -> ($version->m_current_version, $identity->my_identity, $authorizations->signatures).
+        RETURN m_my_address_document?.
+    }
+
+    get_my_address_document = fn (_) -> t_address_document
+    {
+        if !m_my_address_document {
+            produce_my_address_document().
+        }
+        RETURN m_my_address_document?.
+    }
+
+
+    trn register_container
+    _:($ad -> ad: t_address_document) {
+        process_address_document ad NIL.
+        RETURN transaction::success [].
+    }
+
+    trn produce_address_document
+    _ {
+        produce_my_address_document().
+        RETURN transaction::success [].
+    }
+
+    trn get_address_document
+    _ {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        RETURN transaction::success [
+            transaction::action::return_data get_my_address_document()
+        ].
+    }
+
+    trn save_ad_signature
+    _:($authorizing_container_id -> cid: global_id, $signature -> signature: crypto_signature) {
+        abort "Authorizing container not recognized." WHEN (m_authorizing_containers cid == NIL).
+        m_ad_signatures cid -> signature.
+        RETURN transaction::success [].
+    }
+
+    hidden {
+        module handshake {
+            check_ad_signature = fn (_:($ad->ad: t_address_document, $signature->signature: crypto_signature)) {
+                hash = _value_id ad.
+                res IS bool = FALSE.
+                // check whether container signed the ad is authorizing container
+                sc m_authorizing_containers -- (auth -> ) {
+                    if (key_storage::get_source_container signature == auth) {
+                        res -> TRUE.
+                        break.
+                    }
+                }
+                abort "Address document signed by unrcognized container." WHEN !res.
+                abort "Invalid signature." WHEN (key_storage::check_signature hash signature == NIL).
+                process_address_document ad NIL.
+            }
+
+            send_ad_and_signatures = fn (cid: global_id, isinit: bool) -> transaction::action::type[] {
+                trn_name = "::address_document::handshake".
+                if !isinit { trn_name -> trn_name + "_final". }
+                auth_cid IS global_id+ = NIL.
+                sc m_authorizing_containers -- (cid -> ) { 
+                    auth_cid -> cid. 
+                    break. 
+                } 
+                abort "There is no authorizing container." WHEN auth_cid == NIL.
+                actions IS transaction::action::type[] = [].
+                sc m_ad_signatures -- ( -> signature) {
+                    trn_nested = ($name->trn_name, $targ->($ad->m_my_address_document?, $signature->signature)).
+                    tn = ($name->"::authorizing_container::resend_encrypted", $targ->($trn->trn_nested, $target_container_id->cid)).
+                    encrypted_trn = transaction::encrypt ($cid->auth_cid?, $trn->tn, $isemsignature->TRUE).
+                    actions (_count actions|) -> (transaction::action::send auth_cid? encrypted_trn). 
+                }
+                RETURN actions.
+            }
+        }
+    }
+
+
+    trn register_authorizing_container
+    _: ($ad -> ad: t_address_document) {
+        if m_my_address_document == NIL {
+            produce_my_address_document().
+        }
+        // add authorizing container
+        add_authorizing_container ad.
+        // send request to this container to sign address document
+        cid = (ad $identity $container_id) SAFE(global_id).
+        encrypted_trn = transaction::encrypt ($cid -> cid, $trn -> ($name -> "::authorizing_container::sign_ad", $targ -> ($ad -> m_my_address_document?)), $isemsignature -> TRUE).
+        RETURN transaction::success [transaction::action::send cid encrypted_trn].
+    }
+
+    handshake_init = fn (_:($target_container_id -> cid: global_id)) -> transaction::action::type[] = (handshake::send_ad_and_signatures cid TRUE).
+
+    /**
+        1. Register callback, that initializes a handshake after the ad signature from authorizer received
+        2. Register callback, that should be called after handshake 
+     */
+    on_handshake_final = fn (target_cid: global_id, actions_creator_cb: transaction_queue::t_actions_creator_func) -> transaction::action::type[] {
+        transaction_queue::add "::address_document::handshake_final" actions_creator_cb.
+
+        init_handshake_callback = fn (_) -> transaction::action::type[] = (handshake_init ($target_container_id -> target_cid)).
+
+        // if ad signature already saved, we can send handshake to another container right away
+        if (_count m_ad_signatures|) == 0 { 
+            transaction_queue::add "::address_document::save_ad_signature" init_handshake_callback.
+        } else {
+            RETURN init_handshake_callback().
+        }
+
+        RETURN [].
+    }
+
+    trn handshake_init
+    arg:($target_container_id->global_id) {
+        RETURN transaction::success (handshake_init arg).
+    }
+
+
+    trn handshake
+    arg:($ad->ad: t_address_document, $signature->crypto_signature) {
+        handshake_callback = fn (_) -> transaction::action::type[] {
+            handshake::check_ad_signature arg.
+            cid = ad $identity $container_id.
+            RETURN (handshake::send_ad_and_signatures cid NIL).
+
+        }
+        if (_count m_ad_signatures|) == 0 {
+            transaction_queue::add "::address_document::save_ad_signature" handshake_callback.
+        } else {
+            RETURN transaction::success (handshake_callback()).
+        }
+
+        RETURN transaction::success []. 
+    }
+
+    trn handshake_final
+    arg:($ad->t_address_document, $signature->crypto_signature) {
+        handshake::check_ad_signature arg.
+        RETURN transaction::success [].
+    }
+
+}
+
+/* THINKING ABOUT CONTAINER AUTHORIZATION PROTOCOL 
+
+Authorization/identification API
+Role: 
+    Container creator -- user or upper container ("root")
+    Authorization protocol: 
+        Possibility 1: authorizing container (implement now)
+        Possibility 2: authorizing token -- NOT YET
+    Counterparty container
+
+API: 
+    API for peer container
+        Root->Container: For newly created container, creator introduces or changes authorizing container {AddressDocument of authorizing container}
+        Container->AuthorizingContainer: please sign my keys {My AddressAddressDocyment -> My addressDocument signed by AuthorizingContainer}
+        Container->Container: Here is my AddressDocument
+        RollKeys: Introduce a new keypair and creates the new addressdocument
+        RevokeKey: Revokes and old key and creates the new addressdocument
+    API for authorizing container
+        For authorizing container, and authorized user introduced newly created container {AddressDocument of container}
+        SignMyKey
+        RollMyKeys
+
+Participants: Container, Dispatcher
+Container is being launched and needs to generate an address document signed/authorized by Dispatcher. 
+User->Container: register Dispatcher's authorizing container information at launch of Container
+                 set the authorization token, as per what the Dispatcher requires
+                 ( 
+                     Authorization token could be a proof of ownership of a blockchain address, or a cookie that the dispatcher has generated
+                 )
+Container->Dispatcher: self-signed address document plus the authorization token
+Dispatcher->Container: authorized address document
+*/ 

package/mufl_stdlib/cryptography/address_document_types.mm

@@ -0,0 +1,16 @@
+library address_document_types loads library key_utils
+{
+    using key_utils.
+    metadef t_address_document: 
+    ( 
+        $version->int, // version of the address document
+        $identity -> t_container_identity: // specifies the identity of the container
+        (
+            $key_list->t_publickey(,), // list of keys active with this container
+            $default_keys->t_function->>t_key_id, // exactly two keys, one for signing, one for encryption, that are the default keys for this container
+            $container_id->t_container_id // id of the container
+            /* $code_id->hash_code */ 
+        ), 
+        $authorizations -> crypto_signature(,)
+    ).
+}