@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.11

package/src/authorization/model.d.ts

@@ -0,0 +1,112 @@
+import type { AuthSessionSubject, Principal, PrincipalKind } from '../auth.js';
+import type { RequestActor } from '../request-context.js';
+export declare const AUTHORIZATION_AUTHORITY_MODES: readonly ["direct", "delegated", "machine"];
+export type AuthorizationAuthorityMode = (typeof AUTHORIZATION_AUTHORITY_MODES)[number];
+export interface DirectAuthorizationAuthority {
+    mode: 'direct';
+}
+export interface MachineAuthorizationAuthority {
+    machineIdentityId: string;
+    mode: 'machine';
+}
+export interface DelegatedAuthorizationAuthority {
+    delegatedBy: {
+        id: string;
+        type: 'user';
+    };
+    delegationId: string;
+    mode: 'delegated';
+}
+export type AuthorizationAuthority = DelegatedAuthorizationAuthority | DirectAuthorizationAuthority | MachineAuthorizationAuthority;
+export interface AuthorizationPrincipal {
+    /**
+     * Request provenance uses the already shipped RequestActor taxonomy.
+     * `id` is required here because an authorization principal is authenticated.
+     */
+    actor: RequestActor & {
+        id: string;
+    };
+    audience?: string;
+    authority: AuthorizationAuthority;
+    /**
+     * Coarse classification uses the already shipped PrincipalKind union. This
+     * module deliberately does not introduce another role or principal enum.
+     */
+    kind: PrincipalKind;
+    roles: readonly string[];
+    scopes: readonly string[];
+    /**
+     * The allowlisted authenticated subject projection. Raw token claims never
+     * become policy input through this contract.
+     */
+    subject: AuthSessionSubject;
+}
+export interface AuthorizationResource<Type extends string = string, Attributes = Readonly<Record<string, unknown>>> {
+    attributes: Attributes;
+    /**
+     * A Slice-owned safe identifier. Callers should omit it for a collection.
+     */
+    id?: string;
+    type: Type;
+}
+export interface AuthorizationContext<Facts = Readonly<Record<string, unknown>>> {
+    facts: Facts;
+    /**
+     * The decision clock is explicit so policy tests stay deterministic.
+     */
+    now: string;
+    stage: string;
+}
+export interface AuthorizationInput<Action extends string = string, Resource extends AuthorizationResource = AuthorizationResource, Context extends AuthorizationContext = AuthorizationContext, AuthorizationPrincipalType extends AuthorizationPrincipal = AuthorizationPrincipal> {
+    action: Action;
+    context: Context;
+    principal: AuthorizationPrincipalType;
+    resource: Resource;
+}
+export declare const AUTHORIZATION_DENIAL_CATEGORIES: readonly ["authentication-missing", "authentication-invalid", "admission-kind-denied", "admission-role-denied", "admission-scope-denied", "domain-authorization-denied", "delegation-expired", "delegation-revoked", "delegation-out-of-bounds", "delegation-rate-limited", "approval-required", "approval-pending", "approval-expired", "approval-invalid", "authorization-unavailable", "policy-stale", "policy-input-invalid"];
+export type AuthorizationDenialCategory = (typeof AUTHORIZATION_DENIAL_CATEGORIES)[number];
+export interface AuthorizationObligation {
+    kind: string;
+    reference?: string;
+}
+export interface AuthorizationAllowDecision<Obligation extends AuthorizationObligation = AuthorizationObligation> {
+    decision: 'allow';
+    obligations: readonly Obligation[];
+    policyVersion: string;
+}
+export interface AuthorizationDenyDecision {
+    category: AuthorizationDenialCategory;
+    decision: 'deny';
+    obligations: readonly [];
+    policyVersion: string;
+}
+export type AuthorizationDecision<Obligation extends AuthorizationObligation = AuthorizationObligation> = AuthorizationAllowDecision<Obligation> | AuthorizationDenyDecision;
+export interface AuthorizationPolicyAllow<Obligation extends AuthorizationObligation = AuthorizationObligation> {
+    decision: 'allow';
+    obligations?: readonly Obligation[];
+}
+export interface AuthorizationPolicyDeny {
+    decision: 'deny';
+}
+export type AuthorizationPolicyResult<Obligation extends AuthorizationObligation = AuthorizationObligation> = AuthorizationPolicyAllow<Obligation> | AuthorizationPolicyDeny;
+export interface AuthorizationPolicy<Input extends AuthorizationInput = AuthorizationInput, Obligation extends AuthorizationObligation = AuthorizationObligation> {
+    evaluate(input: Input): AuthorizationPolicyResult<Obligation> | Promise<AuthorizationPolicyResult<Obligation>>;
+    version: string;
+}
+export declare function allowAuthorization<Obligation extends AuthorizationObligation = AuthorizationObligation>(policyVersion: string, obligations?: readonly Obligation[]): AuthorizationAllowDecision<Obligation>;
+export declare function denyAuthorization(category: AuthorizationDenialCategory, policyVersion: string): AuthorizationDenyDecision;
+/**
+ * Composes the existing Principal, AuthSessionSubject, and RequestActor
+ * dimensions into the domain-policy principal. Authority mode is explicit;
+ * callers cannot infer delegation or machine authority from an unverified
+ * request field.
+ */
+export declare function composeAuthorizationPrincipal(principal: Principal, authority: AuthorizationAuthority): AuthorizationPrincipal;
+export declare function createDirectAuthorizationPrincipal(principal: Principal): AuthorizationPrincipal;
+/**
+ * Composes an authorization model value only. This helper does not validate a
+ * grant, capability, audience, policy, expiry, revocation, or use limit and
+ * therefore must never authorize a protected effect. Runtime callers obtain a
+ * validated delegated principal from `useDelegation` instead.
+ */
+export declare function composeDelegatedAuthorizationPrincipalModel(principal: AuthorizationPrincipal, input: Omit<DelegatedAuthorizationAuthority, 'mode'>): AuthorizationPrincipal;

package/src/authorization/model.js

@@ -0,0 +1,112 @@
+export const AUTHORIZATION_AUTHORITY_MODES = [
+    'direct',
+    'delegated',
+    'machine',
+];
+export const AUTHORIZATION_DENIAL_CATEGORIES = [
+    'authentication-missing',
+    'authentication-invalid',
+    'admission-kind-denied',
+    'admission-role-denied',
+    'admission-scope-denied',
+    'domain-authorization-denied',
+    'delegation-expired',
+    'delegation-revoked',
+    'delegation-out-of-bounds',
+    'delegation-rate-limited',
+    'approval-required',
+    'approval-pending',
+    'approval-expired',
+    'approval-invalid',
+    'authorization-unavailable',
+    'policy-stale',
+    'policy-input-invalid',
+];
+export function allowAuthorization(policyVersion, obligations = []) {
+    return {
+        decision: 'allow',
+        obligations: [...obligations],
+        policyVersion,
+    };
+}
+export function denyAuthorization(category, policyVersion) {
+    return {
+        category,
+        decision: 'deny',
+        obligations: [],
+        policyVersion,
+    };
+}
+function requiredText(value, label) {
+    const normalized = value.trim();
+    if (!normalized || normalized.length > 256 || /[\r\n]/.test(normalized)) {
+        throw new Error(`[runtime/authorization] ${label} must be a non-empty bounded value.`);
+    }
+    return normalized;
+}
+function cloneSubject(subject) {
+    return Object.assign(Object.assign({}, subject), { id: requiredText(subject.id, 'subject id'), permissions: subject.permissions ? [...subject.permissions] : undefined, roles: subject.roles ? [...subject.roles] : undefined });
+}
+/**
+ * Composes the existing Principal, AuthSessionSubject, and RequestActor
+ * dimensions into the domain-policy principal. Authority mode is explicit;
+ * callers cannot infer delegation or machine authority from an unverified
+ * request field.
+ */
+export function composeAuthorizationPrincipal(principal, authority) {
+    const subject = cloneSubject(principal.session.subject);
+    if (subject.id !== principal.id) {
+        throw new Error('[runtime/authorization] Principal and authenticated subject ids must match.');
+    }
+    if (authority.mode === 'direct' && subject.type !== 'user') {
+        throw new Error('[runtime/authorization] Direct authority requires an authenticated user subject.');
+    }
+    if (authority.mode === 'machine' && subject.type !== 'service') {
+        throw new Error('[runtime/authorization] Machine authority requires an authenticated service subject.');
+    }
+    if (authority.mode === 'delegated') {
+        if (principal.kind !== 'agent') {
+            throw new Error('[runtime/authorization] Delegated authority requires PrincipalKind agent.');
+        }
+        requiredText(authority.delegationId, 'delegation id');
+        requiredText(authority.delegatedBy.id, 'delegating subject id');
+    }
+    const normalizedAuthority = authority.mode === 'machine'
+        ? {
+            machineIdentityId: requiredText(authority.machineIdentityId, 'machine identity id'),
+            mode: 'machine',
+        }
+        : authority.mode === 'delegated'
+            ? {
+                delegatedBy: {
+                    id: requiredText(authority.delegatedBy.id, 'delegating subject id'),
+                    type: 'user',
+                },
+                delegationId: requiredText(authority.delegationId, 'delegation id'),
+                mode: 'delegated',
+            }
+            : { mode: 'direct' };
+    return Object.freeze(Object.assign(Object.assign({ actor: Object.freeze({ id: subject.id, type: subject.type }) }, (principal.audience ? { audience: principal.audience } : {})), { authority: Object.freeze(normalizedAuthority), kind: principal.kind, roles: Object.freeze([...principal.roles]), scopes: Object.freeze([...principal.scopes]), subject: Object.freeze(subject) }));
+}
+export function createDirectAuthorizationPrincipal(principal) {
+    return composeAuthorizationPrincipal(principal, { mode: 'direct' });
+}
+/**
+ * Composes an authorization model value only. This helper does not validate a
+ * grant, capability, audience, policy, expiry, revocation, or use limit and
+ * therefore must never authorize a protected effect. Runtime callers obtain a
+ * validated delegated principal from `useDelegation` instead.
+ */
+export function composeDelegatedAuthorizationPrincipalModel(principal, input) {
+    if (principal.kind !== 'agent') {
+        throw new Error('[runtime/authorization] Delegated authority requires PrincipalKind agent.');
+    }
+    const delegationId = requiredText(input.delegationId, 'delegation id');
+    const delegatedById = requiredText(input.delegatedBy.id, 'delegating subject id');
+    return Object.freeze(Object.assign(Object.assign({}, principal), { authority: Object.freeze({
+            delegatedBy: { id: delegatedById, type: 'user' },
+            delegationId,
+            mode: 'delegated',
+        }) }));
+}
+//# sourceMappingURL=model.js.map

package/src/authorization/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/model.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ;IACR,WAAW;IACX,SAAS;CACD,CAAC;AAsFX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,wBAAwB;IACxB,wBAAwB;IACxB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,6BAA6B;IAC7B,oBAAoB;IACpB,oBAAoB;IACpB,0BAA0B;IAC1B,yBAAyB;IACzB,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,2BAA2B;IAC3B,cAAc;IACd,sBAAsB;CACd,CAAC;AAwDX,MAAM,UAAU,kBAAkB,CAGhC,aAAqB,EACrB,cAAqC,EAAE;IAEvC,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;QAC7B,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAqC,EACrC,aAAqB;IAErB,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,EAAE;QACf,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,qCAAqC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,OAA2B;IAC/C,uCACK,OAAO,KACV,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,EAC1C,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,EACvE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IACrD;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAoB,EACpB,SAAiC;IAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QACtD,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,mBAAmB,GACvB,SAAS,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,CAAC;YACE,iBAAiB,EAAE,YAAY,CAC7B,SAAS,CAAC,iBAAiB,EAC3B,qBAAqB,CACtB;YACD,IAAI,EAAE,SAAS;SAChB;QACH,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW;YAC9B,CAAC,CAAC;gBACE,WAAW,EAAE;oBACX,EAAE,EAAE,YAAY,CACd,SAAS,CAAC,WAAW,CAAC,EAAE,EACxB,uBAAuB,CACxB;oBACD,IAAI,EAAE,MAAM;iBACb;gBACD,YAAY,EAAE,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC;gBACnE,IAAI,EAAE,WAAW;aAClB;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAE3B,OAAO,MAAM,CAAC,MAAM,+BAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,IACzD,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC/D,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAC7C,IAAI,EAAE,SAAS,CAAC,IAAI,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAC/B,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,SAAoB;IAEpB,OAAO,6BAA6B,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2CAA2C,CACzD,SAAiC,EACjC,KAAoD;IAEpD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,YAAY,CAChC,KAAK,CAAC,WAAW,CAAC,EAAE,EACpB,uBAAuB,CACxB,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,iCACf,SAAS,KACZ,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,MAAe,EAAE;YACzD,YAAY;YACZ,IAAI,EAAE,WAAoB;SAC3B,CAAC,IACF,CAAC;AACL,CAAC"}

package/src/canonical-json.cjs

@@ -0,0 +1,157 @@
+// @generated from packages/runtime/src/canonical-json.ts by tools/runtime/generate-shared-authorities.mjs
+// Do not edit this artifact directly.
+'use strict';
+Object.defineProperty(exports, '__esModule', { value: true });
+exports.CanonicalJsonError = void 0;
+exports.canonicalJson = canonicalJson;
+exports.canonicalJsonSha256 = canonicalJsonSha256;
+const node_crypto_1 = require('node:crypto');
+class CanonicalJsonError extends Error {
+  path;
+  constructor(path, message) {
+    super(`Canonical JSON ${path} ${message}.`);
+    this.path = path;
+    this.name = 'CanonicalJsonError';
+  }
+}
+exports.CanonicalJsonError = CanonicalJsonError;
+function compareStrings(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function fail(path, message) {
+  throw new CanonicalJsonError(path, message);
+}
+function childPath(path, key) {
+  return `${path}/${key.replace(/~/g, '~0').replace(/\//g, '~1')}`;
+}
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function serialize(value, path, ancestors, depth, options) {
+  if (depth > options.maximumDepth) {
+    fail(path, 'exceeds the maximum nesting depth');
+  }
+  if (value === null) return 'null';
+  if (typeof value === 'string') return JSON.stringify(value);
+  if (typeof value === 'boolean') return value ? 'true' : 'false';
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) fail(path, 'contains a non-finite number');
+    return JSON.stringify(value);
+  }
+  if (typeof value !== 'object') {
+    fail(path, 'contains a non-JSON value');
+  }
+  if (ancestors.has(value)) {
+    fail(path, 'must be acyclic; a cycle was detected');
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      const entries = [];
+      for (let index = 0; index < value.length; index += 1) {
+        if (!hasOwn(value, index)) {
+          fail(`${path}/${index}`, 'contains a sparse array entry');
+        }
+        entries.push(
+          serialize(
+            value[index],
+            `${path}/${index}`,
+            ancestors,
+            depth + 1,
+            options,
+          ),
+        );
+      }
+      const allowedKeys = new Set(['length']);
+      for (let index = 0; index < value.length; index += 1) {
+        allowedKeys.add(String(index));
+      }
+      if (
+        Reflect.ownKeys(value).some(
+          (key) => typeof key !== 'string' || !allowedKeys.has(key),
+        )
+      ) {
+        fail(path, 'contains non-index array properties');
+      }
+      return `[${entries.join(',')}]`;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      fail(path, 'contains a non-plain object');
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.some((key) => typeof key !== 'string')) {
+      fail(path, 'contains symbol properties');
+    }
+    const stringKeys = keys;
+    for (const key of stringKeys) {
+      const descriptor = descriptors[key];
+      if (
+        (options.rejectEmptyKeys && key.length === 0) ||
+        (options.maximumKeyLength !== undefined &&
+          key.length > options.maximumKeyLength) ||
+        (options.rejectControlCharactersInKeys && /[\r\n]/.test(key)) ||
+        !descriptor ||
+        descriptor.enumerable !== true ||
+        !hasOwn(descriptor, 'value')
+      ) {
+        fail(childPath(path, key), 'contains a non-data property');
+      }
+    }
+    const serializedKeys = stringKeys.filter(
+      (key) =>
+        !options.omitUndefinedObjectValues ||
+        descriptors[key]?.value !== undefined,
+    );
+    return `{${serializedKeys
+      .sort(compareStrings)
+      .map((key) => {
+        return `${JSON.stringify(key)}:${serialize(descriptors[key]?.value, childPath(path, key), ancestors, depth + 1, options)}`;
+      })
+      .join(',')}}`;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+/**
+ * Serializes strict acyclic JSON with literal UTF-16 key ordering. Arrays keep
+ * their declared order; objects must contain enumerable data properties only.
+ * The CommonJS peer is held to identical behavior by the parity spec.
+ */
+function canonicalJson(value, options = {}) {
+  const maximumDepth = options.maximumDepth ?? 128;
+  if (!Number.isInteger(maximumDepth) || maximumDepth < 1) {
+    throw new CanonicalJsonError(
+      '$options/maximumDepth',
+      'must be a positive integer',
+    );
+  }
+  if (
+    options.maximumKeyLength !== undefined &&
+    (!Number.isInteger(options.maximumKeyLength) ||
+      options.maximumKeyLength < 1)
+  ) {
+    throw new CanonicalJsonError(
+      '$options/maximumKeyLength',
+      'must be a positive integer',
+    );
+  }
+  return serialize(value, '$', new Set(), 0, {
+    maximumDepth,
+    ...(options.maximumKeyLength === undefined
+      ? {}
+      : { maximumKeyLength: options.maximumKeyLength }),
+    omitUndefinedObjectValues: options.omitUndefinedObjectValues === true,
+    rejectControlCharactersInKeys:
+      options.rejectControlCharactersInKeys === true,
+    rejectEmptyKeys: options.rejectEmptyKeys === true,
+  });
+}
+function canonicalJsonSha256(value, options = {}) {
+  return (0, node_crypto_1.createHash)('sha256')
+    .update(canonicalJson(value, options), 'utf8')
+    .digest('hex');
+}
+
+Object.freeze(module.exports);

package/src/canonical-json.d.cts

@@ -0,0 +1,26 @@
+// @generated from packages/runtime/src/canonical-json.ts by tools/runtime/generate-shared-authorities.mjs
+// Do not edit this artifact directly.
+export declare class CanonicalJsonError extends Error {
+  readonly path: string;
+  constructor(path: string, message: string);
+}
+export interface CanonicalJsonOptions {
+  maximumDepth?: number;
+  maximumKeyLength?: number;
+  omitUndefinedObjectValues?: boolean;
+  rejectControlCharactersInKeys?: boolean;
+  rejectEmptyKeys?: boolean;
+}
+/**
+ * Serializes strict acyclic JSON with literal UTF-16 key ordering. Arrays keep
+ * their declared order; objects must contain enumerable data properties only.
+ * The CommonJS peer is held to identical behavior by the parity spec.
+ */
+export declare function canonicalJson(
+  value: unknown,
+  options?: CanonicalJsonOptions,
+): string;
+export declare function canonicalJsonSha256(
+  value: unknown,
+  options?: CanonicalJsonOptions,
+): string;

package/src/canonical-json.d.ts

@@ -0,0 +1,18 @@
+export declare class CanonicalJsonError extends Error {
+    readonly path: string;
+    constructor(path: string, message: string);
+}
+export interface CanonicalJsonOptions {
+    maximumDepth?: number;
+    maximumKeyLength?: number;
+    omitUndefinedObjectValues?: boolean;
+    rejectControlCharactersInKeys?: boolean;
+    rejectEmptyKeys?: boolean;
+}
+/**
+ * Serializes strict acyclic JSON with literal UTF-16 key ordering. Arrays keep
+ * their declared order; objects must contain enumerable data properties only.
+ * The CommonJS peer is held to identical behavior by the parity spec.
+ */
+export declare function canonicalJson(value: unknown, options?: CanonicalJsonOptions): string;
+export declare function canonicalJsonSha256(value: unknown, options?: CanonicalJsonOptions): string;

package/src/canonical-json.js

@@ -0,0 +1,125 @@
+import { createHash } from 'node:crypto';
+export class CanonicalJsonError extends Error {
+    constructor(path, message) {
+        super(`Canonical JSON ${path} ${message}.`);
+        this.path = path;
+        this.name = 'CanonicalJsonError';
+    }
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function fail(path, message) {
+    throw new CanonicalJsonError(path, message);
+}
+function childPath(path, key) {
+    return `${path}/${key.replace(/~/g, '~0').replace(/\//g, '~1')}`;
+}
+function hasOwn(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+function serialize(value, path, ancestors, depth, options) {
+    if (depth > options.maximumDepth) {
+        fail(path, 'exceeds the maximum nesting depth');
+    }
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            fail(path, 'contains a non-finite number');
+        return JSON.stringify(value);
+    }
+    if (typeof value !== 'object') {
+        fail(path, 'contains a non-JSON value');
+    }
+    if (ancestors.has(value)) {
+        fail(path, 'must be acyclic; a cycle was detected');
+    }
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const entries = [];
+            for (let index = 0; index < value.length; index += 1) {
+                if (!hasOwn(value, index)) {
+                    fail(`${path}/${index}`, 'contains a sparse array entry');
+                }
+                entries.push(serialize(value[index], `${path}/${index}`, ancestors, depth + 1, options));
+            }
+            const allowedKeys = new Set(['length']);
+            for (let index = 0; index < value.length; index += 1) {
+                allowedKeys.add(String(index));
+            }
+            if (Reflect.ownKeys(value).some((key) => typeof key !== 'string' || !allowedKeys.has(key))) {
+                fail(path, 'contains non-index array properties');
+            }
+            return `[${entries.join(',')}]`;
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            fail(path, 'contains a non-plain object');
+        }
+        const descriptors = Object.getOwnPropertyDescriptors(value);
+        const keys = Reflect.ownKeys(descriptors);
+        if (keys.some((key) => typeof key !== 'string')) {
+            fail(path, 'contains symbol properties');
+        }
+        const stringKeys = keys;
+        for (const key of stringKeys) {
+            const descriptor = descriptors[key];
+            if ((options.rejectEmptyKeys && key.length === 0) ||
+                (options.maximumKeyLength !== undefined &&
+                    key.length > options.maximumKeyLength) ||
+                (options.rejectControlCharactersInKeys && /[\r\n]/.test(key)) ||
+                !descriptor ||
+                descriptor.enumerable !== true ||
+                !hasOwn(descriptor, 'value')) {
+                fail(childPath(path, key), 'contains a non-data property');
+            }
+        }
+        const serializedKeys = stringKeys.filter((key) => {
+            var _a;
+            return !options.omitUndefinedObjectValues ||
+                ((_a = descriptors[key]) === null || _a === void 0 ? void 0 : _a.value) !== undefined;
+        });
+        return `{${serializedKeys
+            .sort(compareStrings)
+            .map((key) => {
+            var _a;
+            return `${JSON.stringify(key)}:${serialize((_a = descriptors[key]) === null || _a === void 0 ? void 0 : _a.value, childPath(path, key), ancestors, depth + 1, options)}`;
+        })
+            .join(',')}}`;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+/**
+ * Serializes strict acyclic JSON with literal UTF-16 key ordering. Arrays keep
+ * their declared order; objects must contain enumerable data properties only.
+ * The CommonJS peer is held to identical behavior by the parity spec.
+ */
+export function canonicalJson(value, options = {}) {
+    var _a;
+    const maximumDepth = (_a = options.maximumDepth) !== null && _a !== void 0 ? _a : 128;
+    if (!Number.isInteger(maximumDepth) || maximumDepth < 1) {
+        throw new CanonicalJsonError('$options/maximumDepth', 'must be a positive integer');
+    }
+    if (options.maximumKeyLength !== undefined &&
+        (!Number.isInteger(options.maximumKeyLength) ||
+            options.maximumKeyLength < 1)) {
+        throw new CanonicalJsonError('$options/maximumKeyLength', 'must be a positive integer');
+    }
+    return serialize(value, '$', new Set(), 0, Object.assign(Object.assign({ maximumDepth }, (options.maximumKeyLength === undefined
+        ? {}
+        : { maximumKeyLength: options.maximumKeyLength })), { omitUndefinedObjectValues: options.omitUndefinedObjectValues === true, rejectControlCharactersInKeys: options.rejectControlCharactersInKeys === true, rejectEmptyKeys: options.rejectEmptyKeys === true }));
+}
+export function canonicalJsonSha256(value, options = {}) {
+    return createHash('sha256')
+        .update(canonicalJson(value, options), 'utf8')
+        .digest('hex');
+}
+//# sourceMappingURL=canonical-json.js.map

package/src/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../../packages/runtime/src/canonical-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YACW,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,kBAAkB,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;QAHnC,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAkBD,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe;IACzC,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAW;IAC1C,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,GAAgB;IAC7C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,IAAY,EACZ,SAAsB,EACtB,KAAa,EACb,OAAqC;IAErC,IAAI,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC;IACtD,CAAC;IAED,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,+BAA+B,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,CAAC,IAAI,CACV,SAAS,CACP,KAAK,CAAC,KAAK,CAAC,EACZ,GAAG,IAAI,IAAI,KAAK,EAAE,EAClB,SAAS,EACT,KAAK,GAAG,CAAC,EACT,OAAO,CACR,CACF,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACrD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,CAAC;YACD,IACE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CACzB,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAC1D,EACD,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,UAAU,GAAG,IAAgB,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,IACE,CAAC,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;gBAC7C,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACrC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;gBACxC,CAAC,OAAO,CAAC,6BAA6B,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7D,CAAC,UAAU;gBACX,UAAU,CAAC,UAAU,KAAK,IAAI;gBAC9B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,EAC5B,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,EAAE;;YACN,OAAA,CAAC,OAAO,CAAC,yBAAyB;gBAClC,CAAA,MAAA,WAAW,CAAC,GAAG,CAAC,0CAAE,KAAK,MAAK,SAAS,CAAA;SAAA,CACxC,CAAC;QACF,OAAO,IAAI,cAAc;aACtB,IAAI,CAAC,cAAc,CAAC;aACpB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;YACX,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CACxC,MAAA,WAAW,CAAC,GAAG,CAAC,0CAAE,KAAK,EACvB,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,EACpB,SAAS,EACT,KAAK,GAAG,CAAC,EACT,OAAO,CACR,EAAE,CAAC;QACN,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,UAAgC,EAAE;;IAElC,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,GAAG,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC1C,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,2BAA2B,EAC3B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,gCACvC,YAAY,IACT,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACxC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,KACnD,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,KAAK,IAAI,EACrE,6BAA6B,EAC3B,OAAO,CAAC,6BAA6B,KAAK,IAAI,EAChD,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,IAAI,IACjD,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,UAAgC,EAAE;IAElC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}