@adapt-toolkit/mufl 0.8.0

package/mufl_stdlib/cryptography/key_storage.mm

@@ -0,0 +1,391 @@
+library key_storage loads library key_utils { 
+
+    hidden
+    {
+        _read_or_abort is (bin->any) = fn (_: bin) { abort "_read_or_abort primitive is unset in this library." when TRUE. }
+    }
+
+    init = fn (_:($_read_or_abort -> read: (bin->any)))
+    {
+        _read_or_abort -> read.
+    }
+
+    using key_utils. 
+    metadef t_keypair_info: 
+    (
+        $function->t_function, 
+        $container_id->t_container_id,
+        $pubkey->t_publickey, 
+        $seckey->t_secretkey+, 
+        $key_id->t_key_id 
+        // $time_added->time
+    ).
+
+    metadef t_key_storage: t_key_id->>t_keypair_info. 
+    metadef t_key_attribution: t_container_id->>t_key_id->>t_keypair_info. 
+    metadef t_default_keys: t_container_id->>t_function->>t_keypair_info. 
+    metadef t_revoked_keys: t_key_id->>t_keypair_info.
+
+    address_of_key = fn (pubkey: t_publickey) -> t_container_id {
+        RETURN _global_id_of_hash (_value_id ($v -> "adapt/addr/v1", $key -> pubkey)).
+    }
+
+    hidden {
+        m_my_container_id IS t_container_id = _get_container_id(). 
+        m_key_storage IS t_key_storage = (,). 
+        m_key_attribution IS t_key_attribution = (,). 
+        m_default_keys IS t_default_keys = (,). 
+        m_revoked_keys IS t_revoked_keys = (,). 
+        m_is_initialized IS bool = FALSE. 
+        m_max_key_count_by_function = 6. 
+
+        // saves a specific keypair, where private key might be NIL (when the keypair belongs to another party)
+        save_keypair = fn (
+            function: t_function, 
+            container_id: t_container_id, 
+            pubkey: t_publickey, 
+            seckey: t_secretkey+, 
+            def: bool 
+        ) -> nil
+        {
+            key_id = _crypto_get_key_id pubkey. 
+            keypair_info = ( $function->function, $container_id->container_id, $pubkey->pubkey, $seckey->seckey, $key_id->key_id ).
+            abort "Key storage already contains key pair with this key id" WHEN m_key_storage key_id. // TODO: ???
+            m_key_storage key_id -> keypair_info. 
+            m_key_attribution container_id default(,) key_id -> keypair_info. 
+            if def { 
+                m_default_keys container_id default(,) function -> keypair_info. 
+            } 
+        }
+
+        bootstrap_identity = fn (_) -> nil {
+            crypto_scheme = _crypto_default_scheme_id().
+            sign = _crypto_construct_signing_keypair crypto_scheme.
+            addr = address_of_key (sign $public_key).
+            _set_container_id addr.
+            m_my_container_id -> _get_container_id().
+            save_keypair $SIGN m_my_container_id (sign $public_key) (sign $secret_key) TRUE.
+        }
+
+        roll_keys = fn (_) -> nil {
+            crypto_scheme = _crypto_default_scheme_id().
+            encrypt = _crypto_construct_encryption_keypair crypto_scheme.
+            save_keypair $ENCRYPT m_my_container_id (encrypt $public_key) (encrypt $secret_key) TRUE.
+        }
+
+        initialize = fn (_) -> nil {
+            abort "Key storage already initialized" WHEN m_is_initialized.
+            m_is_initialized->TRUE.
+            bootstrap_identity().
+            roll_keys().
+        }
+
+        m_approvals IS hash_code(,) = (,). 
+    }
+
+    is_container_registered = fn (container_id: t_container_id) -> bool
+    {
+        RETURN m_key_attribution container_id != NIL.
+    }
+
+    // This function takes a new set of keys, and provides information on what has changed,
+    // It) -> three lists of changes: 
+    //      those keys that are newly made default
+    //      those keys that are new
+    //      those keys that are newly revoked
+    //          Important: revoked keys are simply those that are not in the set provided. 
+
+    //      error indicates what went wrong, if error is NIL means everything checks out. 
+    //      max number of keys in the new set is 5 keys for each function (DOS protection)
+    analyse_keyset_difference = fn (
+                                        container_id: t_container_id, 
+                                        keys: t_publickey(,), 
+                                        default_keys: t_function->>t_key_id
+                                   ) -> (   
+                                            $new_default_keys->(t_function->>t_publickey), 
+                                            $added_keys->(t_function->>t_key_id->>t_publickey), 
+                                            $known_keys->(t_function->>t_key_id->>t_publickey),
+                                            $new_revoked_keys->(t_function->>t_key_id->>t_publickey), 
+                                            $is_new_container->bool, 
+                                            $container_id->t_container_id
+                                        )
+    {
+        abort "Too many keys" WHEN _count keys > m_max_key_count_by_function * 2.
+
+        return__new_default_keys IS t_function->>t_publickey = (,). 
+        return__added_keys IS t_function->>t_key_id->>t_publickey = (,). 
+        return__known_keys IS t_function->>t_key_id->>t_publickey = (,). 
+        return__new_revoked_keys IS t_function->>t_key_id->>t_publickey = (,). 
+        return__is_new_container IS bool = TRUE. 
+
+        // TODO: ensure that enumerated typed dictionary can be interchangeable with records
+        count_active_keys IS t_function ->> int = ($ENCRYPT->0,$SIGN->0)as(t_function->>int).
+
+        sc keys -- (key -> ) { 
+            key_id = _crypto_get_key_id key. 
+            function = key_utils::key_get_function key. 
+
+            if m_revoked_keys key_id { // key has previously been revoked
+                delete keys key. // remove previously revoked keys from keyset
+            } else {  
+                found IS bool = NIL. 
+                sc m_key_storage -- ( -> keypair_info) = key_id {
+                    abort "Key belongs to a different container than reported" WHEN keypair_info $container_id != container_id. 
+                    return__known_keys function default(,) key_id -> key. 
+                    count_active_keys function -> (count_active_keys function |) + 1. 
+                    found -> TRUE. 
+                } 
+
+                if !found { 
+                    count_active_keys function -> (count_active_keys function |) + 1. 
+                    return__added_keys function default(,) key_id -> key. 
+                } 
+            } 
+        }
+
+        sc count_active_keys -- (function -> count) { 
+            abort "All active keys for "+ function as(str) +" have been revoked" WHEN count == 0. 
+            abort "Too many keys for " + function as(str) WHEN count > m_max_key_count_by_function. 
+        }
+        
+        // is this a known container? 
+        if m_key_attribution container_id != NIL { 
+            return__is_new_container -> FALSE. 
+            // find newly revoked keys for this container 
+            sc m_key_attribution container_id | -- (key_id -> keypair_info) { 
+                if keys (keypair_info $pubkey) == NIL { 
+                    return__new_revoked_keys (keypair_info $function) default(,) key_id -> keypair_info $pubkey. 
+                } 
+            } 
+        }  
+
+        // assert that default keys are present and not revoked
+        sc default_keys -- (function -> key_id) { 
+            abort "Invalid function" WHEN !(($SIGN, $ENCRYPT) function). 
+            key IS t_publickey+ = NIL. 
+            
+            if m_key_storage key_id { 
+                key->m_key_storage key_id $pubkey |. 
+            } elif return__added_keys function { 
+                key->return__added_keys function key_id |. 
+            } 
+
+            abort "Function mismatch" WHEN function != key_utils::key_get_function key?. 
+            abort "Key listed as default but not supplied in the keyset or has been revoked" WHEN keys key? == NIL. 
+            if return__is_new_container || m_default_keys container_id function != key { 
+                return__new_default_keys function -> key. 
+            } 
+        } 
+
+        abort "Missing a default key" WHEN _count return__new_default_keys == 0. 
+
+        res = ($new_default_keys->return__new_default_keys, 
+                $added_keys->(($SIGN -> (,), $ENCRYPT -> (,)) as (t_function->>t_key_id->>t_publickey))'return__added_keys, 
+                $known_keys->return__known_keys, 
+                $new_revoked_keys->return__new_revoked_keys,
+                $is_new_container->return__is_new_container, 
+                $container_id->container_id). 
+
+        m_approvals (_value_id res) -> TRUE. 
+        RETURN res. 
+    }
+
+    // This function takes results of analyse_keyset_differences and updates the static structures with the outcome of the analysis
+    update_keyset = fn (
+                        update: (   $new_default_keys->new_default_keys:(t_function->>t_publickey), 
+                                    $added_keys->added_keys:(t_function->>t_key_id->>t_publickey), 
+                                    $known_keys->(t_function->>t_key_id->>t_publickey),
+                                    $new_revoked_keys->new_revoked_keys:(t_function->>t_key_id->>t_publickey), 
+                                    $is_new_container->bool, 
+                                    $container_id->container_id:t_container_id
+                            )
+   ) { 
+        abort "Unapproved modification" WHEN m_approvals (_value_id update) == NIL. 
+
+        delete m_approvals (_value_id update). 
+        sc added_keys -- (function -> ) -- (key_id -> public_key) {
+            key_info = ($function->function, $container_id->container_id, $pubkey->public_key, $seckey->NIL, $key_id->key_id).
+            m_key_storage key_id -> key_info.
+            m_key_attribution container_id default(,) key_id -> key_info. 
+        }
+
+        sc new_default_keys -- (function -> public_key) { 
+            key_info = ($function->function, $container_id->container_id, $pubkey->public_key, $seckey->NIL, $key_id->_crypto_get_key_id public_key).
+            m_default_keys container_id default(,) function -> key_info. 
+        } 
+
+        sc new_revoked_keys -- (_ -> ) -- (key_id -> ) { 
+            keypair_info = m_key_storage key_id |. 
+            delete m_key_storage key_id. 
+            delete m_key_attribution container_id key_id. 
+            m_revoked_keys key_id -> keypair_info. 
+        }
+    }
+    
+    get_keypair_info = fn (key_id: t_key_id) 
+    {
+        RETURN m_key_storage key_id. 
+    }
+
+    default_key = fn (container_id: t_container_id, function: t_function) -> t_publickey+ 
+    {
+        if m_default_keys container_id == NIL { 
+            RETURN NIL. 
+        } else { 
+            RETURN m_default_keys container_id function $pubkey. 
+        } 
+    }
+
+    default_sign = fn (message: hash_code) -> crypto_signature
+    {
+        my_default_keypair_info = m_default_keys m_my_container_id $SIGN |. 
+        key = (my_default_keypair_info $seckey) as( secretkey_sign ). 
+        ret = _crypto_sign_hash message key abort "Failed to sign message" WHEN IS NIL. 
+        RETURN ret. 
+    }
+
+    sign = fn (message: hash_code, key_id: t_key_id) -> crypto_signature 
+    {
+        keypair_info = m_key_storage key_id abort "Keypair) not exist for given key_id" WHEN IS NIL. 
+        key = (keypair_info $seckey) as( secretkey_sign ). 
+        RETURN _crypto_sign_hash message key. 
+    }
+
+    check_signature = fn (message: hash_code, signature: crypto_signature) -> bool 
+    {
+        key_id = _crypto_get_key_id signature. 
+        keypair_info = m_key_storage key_id abort "Key not found for the signature provided" WHEN IS NIL. 
+        abort "Invalid key -- wrong function" WHEN keypair_info $function != $SIGN. 
+        key = (keypair_info $pubkey) SAFE( publickey_sign ). 
+        res = _crypto_verify_hash_signature message signature key abort "Signature verification failed" WHEN IS NIL. 
+        RETURN (res == TRUE).
+    }
+
+    container_id_of_signer = fn (signature: crypto_signature) -> t_container_id {
+        key_id = _crypto_get_key_id signature.
+        keypair_info = m_key_storage key_id abort "Key not found for the signature provided" WHEN IS NIL.
+        RETURN (keypair_info $container_id).
+    }
+
+    check_signature_new_container = fn (message: hash_code, signature: crypto_signature, key_list: t_publickey(,)) -> bool
+    {
+        key_id = _crypto_get_key_id signature.
+        key IS publickey_sign+ = NIL.
+        sc key_list -- (k->) {
+            if _crypto_get_key_id k == key_id {
+                key -> k SAFE(publickey_sign).
+                break.
+            }
+        }
+        abort "Key not found for the signature provided" WHEN key == NIL.
+        res = _crypto_verify_hash_signature message signature key? abort "Signature verifiction failed" WHEN IS NIL.
+        RETURN (res == TRUE).
+    }
+
+    default_encrypt = fn (message: any, recipient_container_id: t_container_id) -> crypto_message 
+    {
+        my_default_keypair_info = m_default_keys m_my_container_id $ENCRYPT |. 
+        her_default_keypair_info = m_default_keys recipient_container_id $ENCRYPT abort "Default key not known for container id provided" WHEN IS NIL. 
+        // TODO: create primitives _write_string and _write_binary
+        message_body = _write message. 
+        my_key = (my_default_keypair_info $seckey) as( secretkey_encrypt ). 
+        her_key = (her_default_keypair_info $pubkey) as( publickey_encrypt ). 
+        res = _crypto_encrypt_message my_key her_key message_body abort "Error encrypting message" WHEN IS NIL. 
+        RETURN res. 
+    }
+
+    decrypt_message = fn (encrypted_message: crypto_message) -> any 
+    {
+        her_key_id = _crypto_get_key_id encrypted_message. 
+        my_key_id = _crypto_get_key_id_target encrypted_message. 
+
+        my_keypair_info = m_key_storage my_key_id abort "Unknown target key for message decryption" WHEN IS NIL. 
+        her_keypair_info = m_key_storage her_key_id abort "Unknown source key for message decryption" WHEN IS NIL. 
+
+        my_key = (my_keypair_info $seckey) as( secretkey_encrypt ). 
+        her_key = (her_keypair_info $pubkey) as( publickey_encrypt ). 
+
+        result_serialized = _crypto_decrypt_message my_key her_key encrypted_message abort "Decryption failed" WHEN IS NIL. 
+        result_string = _read_or_abort result_serialized abort "Unable to deserialize message" WHEN IS NIL. 
+        RETURN result_string. 
+    }
+
+    get_source_container = fn (e: crypto) -> t_container_id+ 
+    {
+        key_id = _crypto_get_key_id e. 
+        if m_key_storage key_id == NIL { 
+            RETURN NIL. 
+        } else { 
+            RETURN m_key_storage key_id $container_id. 
+        } 
+    }
+
+    get_target_container = fn (e: crypto) -> t_container_id+ 
+    {
+        abort "No target container id for crypto element" WHEN _crypto_get_element_kind e != $ENCRYPTED_DATA. 
+        key_id = _crypto_get_key_id_target e as(crypto_message). 
+        if m_key_storage key_id == NIL { 
+            RETURN NIL. 
+        } else { 
+            RETURN m_key_storage key_id $container_id |. 
+        } 
+    }
+
+    get_my_keys = fn (_) -> t_publickey(,)
+    {
+        
+        ret IS t_publickey(,) = (,). 
+
+        sc m_key_attribution m_my_container_id | -- (_ -> keypair_info) {
+            ret << keypair_info $pubkey -> TRUE. 
+        } 
+
+        RETURN ret. 
+    }
+
+    metadef t_container_identity: (
+            $key_list->t_publickey(,), // list of keys active with this container
+            $default_keys->t_function->>t_key_id, // exactly two keys, one for signing, one for encryption, that are the default keys for this container
+            $container_id->t_container_id // id of the container
+        ). 
+
+    get_my_identity = fn (_) -> t_container_identity 
+    { 
+        return__key_list IS t_publickey(,) = (,). 
+
+        sc m_key_attribution m_my_container_id | -- (_ -> keypair_info) { 
+            return__key_list (keypair_info $pubkey) -> TRUE. 
+        } 
+
+        return__default_keys IS t_function->>t_key_id = (,). 
+
+        sc m_default_keys m_my_container_id | -- (function -> keypair_info) { 
+            return__default_keys function -> keypair_info $key_id. 
+        } 
+
+        RETURN ($key_list->return__key_list, $default_keys->return__default_keys, $container_id->m_my_container_id).
+    }
+
+    reseed_identity_from_secret = fn (secret: secretkey_sign) -> nil {
+        m_key_storage -> (,).
+        m_key_attribution -> (,).
+        m_default_keys -> (,).
+        crypto_scheme = _crypto_default_scheme_id().
+        sign = _crypto_signing_keypair_from_secret crypto_scheme secret.
+        addr = address_of_key (sign $public_key).
+        _set_container_id addr.
+        m_my_container_id -> _get_container_id().
+        save_keypair $SIGN m_my_container_id (sign $public_key) (sign $secret_key) TRUE.
+        roll_keys().
+    }
+
+    export_identity_signing_secret = fn (_) -> secretkey_sign {
+        keypair_info = m_default_keys m_my_container_id $SIGN abort "Identity not initialised" WHEN IS NIL.
+        RETURN (keypair_info $seckey) as (secretkey_sign).
+    }
+
+    initialize().
+}
+
+
+// */

package/mufl_stdlib/cryptography/key_storage_api.mm

@@ -0,0 +1,17 @@
+library key_storage_api loads libraries key_storage, current_transaction_info uses transactions 
+{
+    trn readonly default_encrypt 
+    _: (
+        $message -> message: any,
+        $recipient_container_id -> recipient_container_id: global_id
+    ) {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return key_storage::default_encrypt message recipient_container_id.
+    }
+
+    trn readonly decrypt_message encrypted_message: crypto_message { 
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return key_storage::decrypt_message encrypted_message. 
+    }
+
+}

package/mufl_stdlib/cryptography/key_utils.mm

@@ -0,0 +1,20 @@
+library key_utils { 
+    metadef t_key_id: bin.
+    metadef t_secretkey: (secretkey_encrypt || secretkey_sign). 
+    metadef t_publickey: (publickey_encrypt || publickey_sign). 
+    metadef t_function: <$ENCRYPT, $SIGN>. 
+    metadef t_container_id: global_id. 
+
+    key_get_function = fn (key: t_secretkey || t_publickey) -> t_function 
+    {
+        kind = _crypto_get_element_kind key. 
+        if kind == $PUBKEY_SIGN || kind == $SECKEY_SIGN { 
+            return $SIGN. 
+        } elif kind == $PUBKEY_ENCRYPT || kind == $SECKEY_ENCRYPT { 
+            return $ENCRYPT. 
+        } else { 
+            _abort_transaction "Invalid element passed to key_get_function". 
+            return $ENCRYPT. 
+        } 
+    }
+}

package/mufl_stdlib/cryptography/peer_container.mu

@@ -0,0 +1,17 @@
+// container authority protocol 
+application address_document_tester loads libraries address_document, key_storage uses transactions
+{
+    using key_storage. 
+    metadef t_secure_participant_information: 
+            (
+                $authorizing_containers->t_container_identity[], 
+                $authority_token->any, 
+                $supplementary_data->any
+            ). 
+
+    trn initialize_secure_participant
+    arg: t_secure_participant_information
+    {
+        RETURN transaction::success []. 
+    }
+}

package/mufl_stdlib/cryptography/registration_proof.mm

@@ -0,0 +1,40 @@
+library registration_proof loads libraries key_storage, key_utils, current_transaction_info uses transactions {
+
+    payload = fn (nonce: any, cid: key_utils::t_container_id) -> hash_code {
+        RETURN _value_id ($v -> "adapt/broker-reg/v1", $nonce -> nonce, $cid -> cid).
+    }
+
+    create = fn (nonce: any) -> ($sign_pub -> any, $signature -> crypto_signature) {
+        my_cid   = _get_container_id().
+        sign_pub = key_storage::default_key my_cid $SIGN.
+        sig      = key_storage::default_sign (payload nonce my_cid).
+        RETURN ($sign_pub -> sign_pub?, $signature -> sig).
+    }
+
+    verify = fn (
+        proof: ($sign_pub -> any, $signature -> crypto_signature),
+        nonce: any,
+        claimed_cid: key_utils::t_container_id ) -> bool
+    {
+        sign_pub = (proof $sign_pub) SAFE(publickey_sign).
+        abort "Registration: container id does not commit to signing key"
+            WHEN (key_storage::address_of_key sign_pub) != claimed_cid.
+        abort "Registration: possession signature invalid"
+            WHEN (_crypto_verify_hash_signature (payload nonce claimed_cid) (proof $signature) sign_pub) == NIL.
+        RETURN TRUE.
+    }
+
+    trn readonly create _:($nonce -> nonce: any) {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return create nonce.
+    }
+
+    trn readonly verify
+    _:( $registration_proof -> proof: ($sign_pub -> any, $signature -> crypto_signature),
+        $nonce -> nonce: any,
+        $cid   -> claimed_cid: key_utils::t_container_id )
+    {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return verify proof nonce claimed_cid.
+    }
+}

package/mufl_stdlib/current_transaction_info.mm

@@ -0,0 +1,78 @@
+library current_transaction_info loads library transaction
+{
+    hidden
+    {
+        get_current = fn (_) -> transaction::envelope::type 
+        {
+            ret = transaction::get_current() abort "Current transaction is not set." when is NIL.
+            return ret?.
+        }
+
+        origin_is_external = fn (_) = (transaction::get_origin() == transaction::envelope::origin::external).
+        origin_is_user = fn (_) = (transaction::get_origin() == transaction::envelope::origin::user).
+        origin_is_local = fn (_) = (transaction::get_origin() == transaction::envelope::origin::local).
+
+    }
+
+    // return true if at least one of the given origins mathces the actual origin
+    validate_origin = fn (allowed_origins: transaction::envelope::origin::type(,)) -> bool {
+        sc allowed_origins -- (origin -> ) {
+            if (origin == transaction::envelope::origin::external && origin_is_external()) ||
+               (origin == transaction::envelope::origin::local && origin_is_local()) ||
+               (origin == transaction::envelope::origin::user && origin_is_user()) {
+               return TRUE.
+            }
+        }
+        return FALSE.
+    }
+
+    validate_origin_or_abort = fn (allowed_origins: ?validate_origin/reducer) {
+        abort "Unexpected transaction origin." when not validate_origin allowed_origins.
+    }
+
+    fn get_origin(_) -> transaction::envelope::origin::type {
+        return (transaction::get_origin())?.
+    }
+
+    get_user_envelope = fn (_) -> transaction::envelope::user::type+ {
+        if origin_is_user() {
+            return (get_current()) as transaction::envelope::user::type.
+        }
+        return NIL.
+    }
+
+    get_user_envelope_or_abort = fn (_) -> transaction::envelope::user::type {
+        ret = get_user_envelope() abort "Invalid transaction origin. Expected: user" when is NIL.
+        return ret?.
+    }
+
+    get_local_envelope = fn (_) -> transaction::envelope::local::type+ {
+        if origin_is_local() {
+            return (get_current()) as transaction::envelope::local::type.
+        }
+        return NIL.
+    }
+
+    get_local_envelope_or_abort = fn (_) -> transaction::envelope::local::type {
+        ret = get_local_envelope() abort "Invalid transaction origin. Expected: local" when is NIL.
+        return ret?.
+    }
+
+    get_external_envelope = fn (_) -> transaction::envelope::external::type+ {
+        if origin_is_external() {
+            return (get_current()) as transaction::envelope::external::type.
+        }
+        return NIL.
+    }
+
+    get_external_envelope_or_abort = fn (_) -> transaction::envelope::external::type {
+        ret = get_external_envelope() abort "Invalid transaction origin. Expected: external" when is NIL.
+        return ret?.
+    }
+
+    is_signed = transaction::is_signed.
+
+    is_encrypted = transaction::is_encrypted.
+
+    get_transaction_time = transaction::get_transaction_time.
+}

package/mufl_stdlib/identity_proof_document.mm

@@ -0,0 +1,21 @@
+library identity_proof_document loads libraries identity_proof_document_impl, current_transaction_info uses transactions {
+    create = identity_proof_document_impl::create.
+    validate = identity_proof_document_impl::validate.
+    validate_signature = identity_proof_document_impl::validate_signature.
+    authorize_signature = identity_proof_document_impl::authorize_signature.
+
+    
+    trn readonly create _ {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return create ().
+    }
+
+    trn readonly validate 
+    _:(
+        $ip_document -> ip_document: identity_proof_document_impl::t_identity_proof_document,
+        $timestamp -> timestamp: time )
+    {
+        current_transaction_info::validate_origin (transaction::envelope::origin::user,).
+        return validate ip_document timestamp.
+    }
+}

package/mufl_stdlib/integration_test_api.mm

@@ -0,0 +1,39 @@
+library integration_test_api
+{
+    hidden
+    {
+        prefix = "##grep##".
+        print = fn (arg)
+        {
+            _print prefix arg.
+            return _print. 
+        }
+    }
+
+    stop_enclave = fn (_)
+    {
+        print "ready_to_stop_enclave".
+    }
+
+    start_enclave = fn (_)
+    {
+        print "ready_to_start_enclave".
+    }
+
+    exit = fn (exit_code: int)
+    {
+        print "exit:" exit_code. 
+    }
+
+    custom_message = fn (arg)
+    {
+        print arg.
+    }
+
+    diff_ignore_message = fn (arg)
+    {
+        print "IGNORE_DIFF " arg.
+        return _print.
+    }
+
+}