@degenerate/sharedata 0.3.1 → 0.4.0

package/dist/persistence/block-factory-registry.d.ts

@@ -1,4 +1,4 @@
-import { IShareDataInitialCryptoData, PersistedCreationConfig, ShareBlockType, ShareDataProofs } from '@degenerate/generic';
+import { IAuthorizedSigner, IShareDataInitialCryptoData, PersistedCreationConfig, ShareBlockType, ShareDataProofs } from '@degenerate/generic';
 import { ShareData } from '../share-data/share-data';
 /**
  * The inputs a block builder needs to replay construction of a persisted
@@ -10,12 +10,18 @@ import { ShareData } from '../share-data/share-data';
  *   - `initialCrypto` — the client-computed creation crypto, applied to the
  *     in-construction block on the first proof lookup.
  *   - `structuralProofs` — the per-purpose proof bundle, replayed in place of
- *     a live signer so the rebuilt block carries byte-identical proofs.
+ *     a live signer so the rebuilt block carries byte-identical proofs. This
+ *     bundle also contains the delegate registration proofs (keyed by their
+ *     `delegate:<key>:<ids>` purpose).
+ *   - `authorizedSigners` — the delegated-signer grant tuples to re-apply via
+ *     `addAuthorizedSigner`, so the rebuilt block re-derives the same signer
+ *     set (and canonical hash) it had live. Empty for non-delegating blocks.
  */
 export interface ShareBlockBuilderInput {
     creationConfig: PersistedCreationConfig;
     initialCrypto: IShareDataInitialCryptoData;
     structuralProofs: ShareDataProofs;
+    authorizedSigners: IAuthorizedSigner[];
 }
 /**
  * Rebuilds a ShareData of a single block type from its persisted recipe.

package/dist/persistence/block-factory-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"block-factory-registry.d.ts","sourceRoot":"","sources":["../../src/persistence/block-factory-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,2BAA2B,EAC3B,uBAAuB,EACvB,cAAc,EACd,eAAe,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAgBrD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACnC,cAAc,EAAE,uBAAuB,CAAC;IACxC,aAAa,EAAE,2BAA2B,CAAC;IAC3C,gBAAgB,EAAE,eAAe,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,SAAS,CAAC;AAQ7E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAClC,WAAW,cAAc,EACzB,SAAS,iBAAiB,KAC3B,IAEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC7B,WAAW,cAAc,KAC1B,iBAAiB,GAAG,SAAoC,CAAC;AAE5D,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,GAAI,WAAW,cAAc,KAAG,OACtC,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAO,IAE1C,CAAC"}
+{"version":3,"file":"block-factory-registry.d.ts","sourceRoot":"","sources":["../../src/persistence/block-factory-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,cAAc,EACd,eAAe,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAgBrD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,sBAAsB;IACnC,cAAc,EAAE,uBAAuB,CAAC;IACxC,aAAa,EAAE,2BAA2B,CAAC;IAC3C,gBAAgB,EAAE,eAAe,CAAC;IAClC,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;CAC1C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,SAAS,CAAC;AAQ7E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAClC,WAAW,cAAc,EACzB,SAAS,iBAAiB,KAC3B,IAEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAC7B,WAAW,cAAc,KAC1B,iBAAiB,GAAG,SAAoC,CAAC;AAE5D,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,GAAI,WAAW,cAAc,KAAG,OACtC,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAAO,IAE1C,CAAC"}

package/dist/persistence/deserialize-share-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deserialize-share-data.d.ts","sourceRoot":"","sources":["../../src/persistence/deserialize-share-data.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAYrD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,OAAO,KAAG,SAgHxD,CAAC"}
+{"version":3,"file":"deserialize-share-data.d.ts","sourceRoot":"","sources":["../../src/persistence/deserialize-share-data.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAYrD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,OAAO,KAAG,SAqHxD,CAAC"}

package/dist/persistence/deserialize-share-data.js

@@ -55,6 +55,7 @@ const deserializeShareData = (snapshot) => {
         creationConfig: parsed.creationConfig,
         initialCrypto: parsed.initialCrypto,
         structuralProofs: parsed.structuralProofs,
+        authorizedSigners: parsed.authorizedSigners,
     });
     // Replay the transaction log in recorded order.
     for (const entry of parsed.transactionLog) {
@@ -68,8 +69,12 @@ const deserializeShareData = (snapshot) => {
         // verification, so the proposer-identity gate (the same one
         // addTransaction enforces live) must run on replay too. Checked first
         // so a swapped key fails as a not-authorized error rather than a
-        // signature mismatch.
-        if (entry.proof.publicKey !== block.creationPublicKey) {
+        // signature mismatch. Uses the same widened predicate as the live gate:
+        // the creation key for any function, or a delegate for its granted
+        // function (`entry.proof.purpose` is the function id). The signer set was
+        // re-derived from re-verified registration proofs during construction
+        // above, so an injected grant with no valid proof never reaches here.
+        if (!block.isAuthorizedSigner(entry.proof.publicKey, entry.proof.purpose)) {
             throw new generic_1.ShareDataTransactionNotAuthorizedError(parsed.id, entry.proof.publicKey);
         }
         // Re-verify the transaction proof against the block at its pre-entry

package/dist/persistence/serialize-share-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serialize-share-data.d.ts","sourceRoot":"","sources":["../../src/persistence/serialize-share-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAUrD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,GAC3B,WAAW,cAAc,EACzB,gBAAgB,uBAAuB,EACvC,OAAO,SAAS,EAChB,gBAAgB,oBAAoB,EAAE,KACvC,kBAgCF,CAAC"}
+{"version":3,"file":"serialize-share-data.d.ts","sourceRoot":"","sources":["../../src/persistence/serialize-share-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAUrD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,GAC3B,WAAW,cAAc,EACzB,gBAAgB,uBAAuB,EACvC,OAAO,SAAS,EAChB,gBAAgB,oBAAoB,EAAE,KACvC,kBAoCF,CAAC"}

package/dist/persistence/serialize-share-data.js

@@ -51,6 +51,10 @@ const serializeShareData = (blockType, creationConfig, block, transactionLog) =>
         },
         creationConfig,
         structuralProofs,
+        // The grant tuples re-applied via `addAuthorizedSigner` on replay; the
+        // matching registration proofs are already carried in `structuralProofs`
+        // (keyed by their `delegate:` purpose). Empty for non-delegating blocks.
+        authorizedSigners: block.authorizedSigners,
         transactionLog,
         expectedCurrentState: block.currentState,
         expectedCreationHash: block.creationHash,

package/dist/share-data/helpers/config/default-share-data-string.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-share-data-string.config.d.ts","sourceRoot":"","sources":["../../../../src/share-data/helpers/config/default-share-data-string.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAIvD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,gBAe1C,CAAC"}
+{"version":3,"file":"default-share-data-string.config.d.ts","sourceRoot":"","sources":["../../../../src/share-data/helpers/config/default-share-data-string.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAIvD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,gBAoB1C,CAAC"}

package/dist/share-data/helpers/config/default-share-data-string.config.js

@@ -16,6 +16,11 @@ exports.defaultShareDataStringConfig = [
     { key: 'currentState', process: stringify_1.stringify },
     { key: 'cryptoProofs', process: get_array_string_1.getArrayString },
     { key: 'structuralProofs', process: get_array_string_1.getArrayString },
+    // Folds the delegated authorized-signer set into the signed structure so a
+    // tampered snapshot cannot widen authorization without breaking the hash
+    // chain. `getArrayString([])` returns '', so blocks with no delegates hash
+    // identically to before this field existed — existing proofs stay valid.
+    { key: 'authorizedSigners', process: get_array_string_1.getArrayString },
     { key: 'events', process: get_array_string_1.getArrayString },
     { key: 'functions', process: get_array_string_1.getArrayString },
     { key: 'rules', process: get_array_string_1.getArrayString },

package/dist/share-data/share-data.d.ts

@@ -1,4 +1,4 @@
-import { IShareData, IShareDataEvent, IShareFunction, IShareRuleApplied, IShareRuleEvalutionResult, IShareDataTransactionHistory, IShareDataCryptoProof, EllipticalCurvesSigning, IShareDataInitialCryptoData } from '@degenerate/generic';
+import { IShareData, IShareDataEvent, IShareFunction, IShareRuleApplied, IShareRuleEvalutionResult, IShareDataTransactionHistory, IShareDataCryptoProof, EllipticalCurvesSigning, IShareDataInitialCryptoData, IAuthorizedSigner } from '@degenerate/generic';
 /**
  * This contains the interface for the share data object
  */
@@ -18,6 +18,7 @@ export declare class ShareData {
     private _signingCurve;
     private _lastUpdated;
     private _structuralProofs;
+    private _authorizedSigners;
     /**
      * This is the constructor for the share data object
      * @param id the id of the share data
@@ -90,6 +91,14 @@ export declare class ShareData {
      * This gets the structure proofs for the share data
      */
     get structuralProofs(): IShareDataCryptoProof[];
+    /**
+     * This gets the delegated authorized-signer grants for the share data.
+     * Each grant is a `{ publicKey, functionIds }` pair: a key the owner has
+     * delegated the right to propose transactions for, scoped to those function
+     * ids. The block owner (`creationPublicKey`) is always authorized and is
+     * NOT listed here.
+     */
+    get authorizedSigners(): IAuthorizedSigner[];
     /**
      * This gets the transaction history for the share block
      */
@@ -113,6 +122,49 @@ export declare class ShareData {
      * @param rule the rule to add to the share block
      */
     addRule(rule: IShareRuleApplied, cryptoProof: IShareDataCryptoProof): void;
+    /**
+     * Delegates `signerPublicKey` the right to propose runtime transactions for
+     * the given `functionIds` (and ONLY those — least privilege). Creation-time
+     * only: rejected once the block is locked. The registration is part of the
+     * signed structure, so a delegate cannot be injected into a tampered
+     * snapshot without invalidating the chain.
+     *
+     * Three gates, in order:
+     *   1. Owner-identity: `registrationProof.publicKey === creationPublicKey`.
+     *      ONLY the block owner may delegate — this is the check `addFunction` /
+     *      `addRule` deliberately omit (the HTTP layer supplies it there). It
+     *      must live here because the security of the widened transaction gate
+     *      (see {@link isAuthorizedSigner}) rests on "the allow-list was
+     *      authorized by the owner." It also blocks transitive delegation: a
+     *      delegate's key is never the creation key, so a delegate can never
+     *      register further delegates.
+     *   2. Grant binding: the proof's `purpose` must equal
+     *      `buildDelegatePurpose(signerPublicKey, functionIds)`. The proof signs
+     *      over the PRE-append state (the grant is not yet folded into
+     *      `_authorizedSigners`), so the purpose is the only thing that attests
+     *      to the exact `(key, functionIds)` grant — without this a tampered
+     *      snapshot could widen a delegate's scope without breaking the
+     *      signature.
+     *   3. Structural verification against the current (pre-append) state,
+     *      reusing the same machinery `addFunction` / `addRule` use; folds the
+     *      proof into the hash chain and verifies the owner's signature.
+     *
+     * Throws {@link ShareDataIsLockedError} if locked,
+     * {@link ShareDataDelegationNotAuthorizedError} for a non-owner registrant /
+     * empty grant / mismatched purpose, and
+     * {@link ShareDataStructuralProofFailedError} if the proof does not verify.
+     */
+    addAuthorizedSigner(signerPublicKey: string, functionIds: string[], registrationProof: IShareDataCryptoProof): void;
+    /**
+     * Whether `publicKey` is authorized to propose a transaction for
+     * `functionId` on this block. The block owner (`creationPublicKey`) is
+     * always authorized for every function; a delegated key is authorized only
+     * for the function ids its registration granted. This is the single
+     * predicate behind the proposer-identity gate, called from both the live
+     * mutation path ({@link addTransaction}) and the persistence replay path so
+     * the two cannot drift.
+     */
+    isAuthorizedSigner(publicKey: string, functionId: string): boolean;
     /**
      * Append a pre-validated transaction to the history. Pass `transactionTime`
      * when the caller needs the recorded timestamp to be deterministic — for
@@ -159,12 +211,12 @@ export declare class ShareData {
      *      This binds the proof to *this* function so a proof minted for one
      *      function can't be replayed to drive another even if the proposed
      *      state would satisfy both functions' rules.
-     *   3. The proof's signer must be authorized for this block —
-     *      `proof.publicKey === creationPublicKey`. Signature validity alone
-     *      only proves *someone* signed the transition; this binds the
-     *      *authorized* someone (the block's creation key, the same key the
-     *      HTTP create/delete ACL authorizes against). Without it any valid
-     *      keypair could sign a legal transition.
+     *   3. The proof's signer must be authorized for this block AND this
+     *      function — the creation key for any function, or a delegated key for
+     *      the function ids its registration granted (`isAuthorizedSigner`).
+     *      Signature validity alone only proves *someone* signed the transition;
+     *      this binds the *authorized* someone. Without it any valid keypair
+     *      could sign a legal transition.
      *   4. The proof must verify against the current state AND `proposedData`
      *      (closes the amount-replay hole — see
      *      `verifyTransactionProposalProof`).

package/dist/share-data/share-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share-data.d.ts","sourceRoot":"","sources":["../../src/share-data/share-data.ts"],"names":[],"mappings":"AACA,OAAO,EACH,UAAU,EACV,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAG5B,qBAAqB,EAErB,uBAAuB,EACvB,2BAA2B,EAK9B,MAAM,qBAAqB,CAAC;AAI7B;;GAEG;AACH,qBAAa,SAAS;IAClB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAsD;IACxE,OAAO,CAAC,mBAAmB,CAAiC;IAC5D,OAAO,CAAC,OAAO,CAAoB;IAEnC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,iBAAiB,CAA0B;IAEnD;;;;OAIG;gBAEC,EAAE,EAAE,MAAM,EACV,iBAAiB,EAAE,MAAM,EACzB,YAAY,GAAE,uBAA4D;IAmB9E;;;;;OAKG;IACH,gBAAgB,CAAC,iBAAiB,EAAE,2BAA2B,GAAG,IAAI;IAiBtE;;OAEG;IAIH;;;OAGG;IAIH;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,qBAAqB,EAAE,CAE1C;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,eAAe,EAAE,CAE9B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EAAE,CAEnE;IAED;;OAEG;IACH,IAAI,EAAE,IAAI,MAAM,CAEf;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,MAAM,CAExB;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAE/B;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,uBAAuB,CAE1C;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,qBAAqB,EAAE,CAE9C;IACD;;OAEG;IACH,IAAI,kBAAkB,IAAI,4BAA4B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,CAEpB;IAMD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAItC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,qBAAqB,GAAG,IAAI;IAa9G;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,qBAAqB,GAAI,IAAI;IAa3E;;;;;;;;;;;;;OAaG;IACH,8BAA8B,CAC1B,YAAY,EAAE,UAAU,EACxB,eAAe,EAAE,yBAAyB,EAC1C,mBAAmB,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EACtE,eAAe,GAAE,MAAmB,EACpC,KAAK,CAAC,EAAE,qBAAqB,GAC9B,IAAI;IAwBP;;;;;;;;;;;;OAYG;IACH,0BAA0B,CACtB,YAAY,EAAE,UAAU,EACxB,mBAAmB,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,GACvE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAI/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,cAAc,CACV,YAAY,EAAE,UAAU,EACxB,mBAAmB,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EACtE,KAAK,EAAE,qBAAqB,GAC7B;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IA4B/C;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS;IAgB/D;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAIlD;;;;;OAKG;IACH,qBAAqB,CACjB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,GAAE,uBAA4C,GACpD,IAAI;IAIP;;;;;;;OAOG;IACH,sBAAsB,CAClB,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,UAAU,EACxB,KAAK,GAAE,uBAA4C,GACpD,IAAI;IAQP;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAUtD;;OAEG;IACH,UAAU,IAAI,IAAI;CAQrB"}
+{"version":3,"file":"share-data.d.ts","sourceRoot":"","sources":["../../src/share-data/share-data.ts"],"names":[],"mappings":"AACA,OAAO,EACH,UAAU,EACV,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAG5B,qBAAqB,EAErB,uBAAuB,EACvB,2BAA2B,EAK3B,iBAAiB,EAGpB,MAAM,qBAAqB,CAAC;AAI7B;;GAEG;AACH,qBAAa,SAAS;IAClB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAAsD;IACxE,OAAO,CAAC,mBAAmB,CAAiC;IAC5D,OAAO,CAAC,OAAO,CAAoB;IAEnC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,kBAAkB,CAAsB;IAEhD;;;;OAIG;gBAEC,EAAE,EAAE,MAAM,EACV,iBAAiB,EAAE,MAAM,EACzB,YAAY,GAAE,uBAA4D;IAoB9E;;;;;OAKG;IACH,gBAAgB,CAAC,iBAAiB,EAAE,2BAA2B,GAAG,IAAI;IAiBtE;;OAEG;IAIH;;;OAGG;IAIH;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,qBAAqB,EAAE,CAE1C;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,eAAe,EAAE,CAE9B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EAAE,CAEnE;IAED;;OAEG;IACH,IAAI,EAAE,IAAI,MAAM,CAEf;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,MAAM,CAExB;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,iBAAiB,EAAE,CAE/B;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,uBAAuB,CAE1C;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,qBAAqB,EAAE,CAE9C;IAED;;;;;;OAMG;IACH,IAAI,iBAAiB,IAAI,iBAAiB,EAAE,CAE3C;IACD;;OAEG;IACH,IAAI,kBAAkB,IAAI,4BAA4B,EAAE,CAEvD;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,CAEpB;IAMD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAItC;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,qBAAqB,GAAG,IAAI;IAa9G;;;OAGG;IACH,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,qBAAqB,GAAI,IAAI;IAY3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,mBAAmB,CACf,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,qBAAqB,GACzC,IAAI;IA4BP;;;;;;;;OAQG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IASlE;;;;;;;;;;;;;OAaG;IACH,8BAA8B,CAC1B,YAAY,EAAE,UAAU,EACxB,eAAe,EAAE,yBAAyB,EAC1C,mBAAmB,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EACtE,eAAe,GAAE,MAAmB,EACpC,KAAK,CAAC,EAAE,qBAAqB,GAC9B,IAAI;IAwBP;;;;;;;;;;;;OAYG;IACH,0BAA0B,CACtB,YAAY,EAAE,UAAU,EACxB,mBAAmB,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,GACvE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAI/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,cAAc,CACV,YAAY,EAAE,UAAU,EACxB,mBAAmB,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,CAAC,EACtE,KAAK,EAAE,qBAAqB,GAC7B;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;IAgC/C;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;;;OAIG;IACH,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS;IAgB/D;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAIlD;;;;;OAKG;IACH,qBAAqB,CACjB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,GAAE,uBAA4C,GACpD,IAAI;IAIP;;;;;;;OAOG;IACH,sBAAsB,CAClB,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,UAAU,EACxB,KAAK,GAAE,uBAA4C,GACpD,IAAI;IAQP;;;OAGG;IACH,kBAAkB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAUtD;;OAEG;IACH,UAAU,IAAI,IAAI;CAQrB"}

package/dist/share-data/share-data.js

@@ -30,6 +30,7 @@ class ShareData {
         this._cryptoProofs = [];
         this._signingCurve = signingCurve;
         this._structuralProofs = [];
+        this._authorizedSigners = [];
     }
     /**
      * This initializes the cryptographic properties of the share data
@@ -139,6 +140,16 @@ class ShareData {
     get structuralProofs() {
         return this._structuralProofs;
     }
+    /**
+     * This gets the delegated authorized-signer grants for the share data.
+     * Each grant is a `{ publicKey, functionIds }` pair: a key the owner has
+     * delegated the right to propose transactions for, scoped to those function
+     * ids. The block owner (`creationPublicKey`) is always authorized and is
+     * NOT listed here.
+     */
+    get authorizedSigners() {
+        return this._authorizedSigners;
+    }
     /**
      * This gets the transaction history for the share block
      */
@@ -189,6 +200,78 @@ class ShareData {
         this._structuralProofs.push(cryptoProof);
         this._rules.push(rule);
     }
+    /**
+     * Delegates `signerPublicKey` the right to propose runtime transactions for
+     * the given `functionIds` (and ONLY those — least privilege). Creation-time
+     * only: rejected once the block is locked. The registration is part of the
+     * signed structure, so a delegate cannot be injected into a tampered
+     * snapshot without invalidating the chain.
+     *
+     * Three gates, in order:
+     *   1. Owner-identity: `registrationProof.publicKey === creationPublicKey`.
+     *      ONLY the block owner may delegate — this is the check `addFunction` /
+     *      `addRule` deliberately omit (the HTTP layer supplies it there). It
+     *      must live here because the security of the widened transaction gate
+     *      (see {@link isAuthorizedSigner}) rests on "the allow-list was
+     *      authorized by the owner." It also blocks transitive delegation: a
+     *      delegate's key is never the creation key, so a delegate can never
+     *      register further delegates.
+     *   2. Grant binding: the proof's `purpose` must equal
+     *      `buildDelegatePurpose(signerPublicKey, functionIds)`. The proof signs
+     *      over the PRE-append state (the grant is not yet folded into
+     *      `_authorizedSigners`), so the purpose is the only thing that attests
+     *      to the exact `(key, functionIds)` grant — without this a tampered
+     *      snapshot could widen a delegate's scope without breaking the
+     *      signature.
+     *   3. Structural verification against the current (pre-append) state,
+     *      reusing the same machinery `addFunction` / `addRule` use; folds the
+     *      proof into the hash chain and verifies the owner's signature.
+     *
+     * Throws {@link ShareDataIsLockedError} if locked,
+     * {@link ShareDataDelegationNotAuthorizedError} for a non-owner registrant /
+     * empty grant / mismatched purpose, and
+     * {@link ShareDataStructuralProofFailedError} if the proof does not verify.
+     */
+    addAuthorizedSigner(signerPublicKey, functionIds, registrationProof) {
+        if (this._isLocked) {
+            throw new generic_1.ShareDataIsLockedError(this._id, generic_1.ShareDataTypes.AUTHORIZATION);
+        }
+        // Gate 1: owner-identity. Only the creation key may delegate.
+        if (registrationProof.publicKey !== this._creationPublicKey) {
+            throw new generic_1.ShareDataDelegationNotAuthorizedError(this._id, registrationProof.publicKey);
+        }
+        // Normalize so the purpose, the stored grant, and the canonical hash all
+        // agree byte-for-byte on live-create and on replay.
+        const normalizedFunctionIds = Array.from(new Set(functionIds.map((id) => id.trim()).filter((id) => id.length > 0))).sort();
+        if (normalizedFunctionIds.length === 0) {
+            throw new generic_1.ShareDataDelegationNotAuthorizedError(this._id, registrationProof.publicKey);
+        }
+        // Gate 2: the proof must bind this exact (key, functionIds) grant.
+        const expectedPurpose = (0, generic_1.buildDelegatePurpose)(signerPublicKey, normalizedFunctionIds);
+        if (registrationProof.purpose !== expectedPurpose) {
+            throw new generic_1.ShareDataDelegationNotAuthorizedError(this._id, registrationProof.publicKey);
+        }
+        // Gate 3: structural verification (pre-append, mirroring addFunction).
+        this.verifyStructuralProof(registrationProof);
+        this._structuralProofs.push(registrationProof);
+        this._authorizedSigners.push({ publicKey: signerPublicKey, functionIds: normalizedFunctionIds });
+    }
+    /**
+     * Whether `publicKey` is authorized to propose a transaction for
+     * `functionId` on this block. The block owner (`creationPublicKey`) is
+     * always authorized for every function; a delegated key is authorized only
+     * for the function ids its registration granted. This is the single
+     * predicate behind the proposer-identity gate, called from both the live
+     * mutation path ({@link addTransaction}) and the persistence replay path so
+     * the two cannot drift.
+     */
+    isAuthorizedSigner(publicKey, functionId) {
+        if (publicKey === this._creationPublicKey) {
+            return true;
+        }
+        const grant = this._authorizedSigners.find((s) => s.publicKey === publicKey);
+        return grant !== undefined && grant.functionIds.includes(functionId);
+    }
     /**
      * Append a pre-validated transaction to the history. Pass `transactionTime`
      * when the caller needs the recorded timestamp to be deterministic — for
@@ -254,12 +337,12 @@ class ShareData {
      *      This binds the proof to *this* function so a proof minted for one
      *      function can't be replayed to drive another even if the proposed
      *      state would satisfy both functions' rules.
-     *   3. The proof's signer must be authorized for this block —
-     *      `proof.publicKey === creationPublicKey`. Signature validity alone
-     *      only proves *someone* signed the transition; this binds the
-     *      *authorized* someone (the block's creation key, the same key the
-     *      HTTP create/delete ACL authorizes against). Without it any valid
-     *      keypair could sign a legal transition.
+     *   3. The proof's signer must be authorized for this block AND this
+     *      function — the creation key for any function, or a delegated key for
+     *      the function ids its registration granted (`isAuthorizedSigner`).
+     *      Signature validity alone only proves *someone* signed the transition;
+     *      this binds the *authorized* someone. Without it any valid keypair
+     *      could sign a legal transition.
      *   4. The proof must verify against the current state AND `proposedData`
      *      (closes the amount-replay hole — see
      *      `verifyTransactionProposalProof`).
@@ -289,10 +372,14 @@ class ShareData {
         if (proof.purpose !== functionId) {
             throw new generic_1.ShareDataTransactionProofFailedError(this._id);
         }
-        // Gate 3: bind the proposer identity. Only the block's creation key may
-        // authorize runtime mutations. Checked before the (more expensive)
-        // signature verification so an unauthorized signer fails fast.
-        if (proof.publicKey !== this._creationPublicKey) {
+        // Gate 3: bind the proposer identity. The block's creation key may
+        // authorize any function; a delegated key may authorize only the
+        // function ids it was granted (see addAuthorizedSigner / isAuthorizedSigner).
+        // `functionId` equals `proof.purpose` here (enforced by Gate 2), so the
+        // scope check is against the function the proof is bound to. Checked
+        // before the (more expensive) signature verification so an unauthorized
+        // signer fails fast.
+        if (!this.isAuthorizedSigner(proof.publicKey, functionId)) {
             throw new generic_1.ShareDataTransactionNotAuthorizedError(this._id, proof.publicKey);
         }
         // Gate 4: proof binds current state + proposed state + chain position.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@degenerate/sharedata",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "This contains the ShareData Adaptive Framework Ecosystem (SAFE) network core code",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -49,10 +49,10 @@
     "url": "https://github.com/syncrude/safe/issues"
   },
   "homepage": "https://github.com/syncrude/safe#readme",
-  "gitHead": "c33ed2f06679f5bd76c2eccf7054212c1820a014",
+  "gitHead": "9453d9ab785e03fd01eb5b408ed0e3ca22baefd5",
   "dependencies": {
-    "@degenerate/generic": "^0.3.0",
-    "@degenerate/rules": "^0.3.0",
+    "@degenerate/generic": "^0.4.0",
+    "@degenerate/rules": "^0.4.0",
     "zod": "^4.4.3"
   },
   "engines": {