@kokuin/store-vault 0.0.0-stage → 0.1.0

package/lib/coordinator-context.js

@@ -0,0 +1,410 @@
+import { withKeyLocks, withStoreTransaction } from '@hozon/db';
+import { getRecordDecisions, recordClaimDigest, recordKeyText, recordPayloadDigest, signRecordOp, verifySignedRecord } from '@kokuin/records';
+import { checkDescriptorDigest, createKeyCache, decodeVaultRecord, encodeVaultRecordPayload, selectWinningBranch, VaultTampered } from '@kokuin/vault';
+import { getVaultStore } from './definition.js';
+import { VaultWriteConflict, vaultDatabases } from './record-context.js';
+import { createVaultRecords, VaultRecordRowError } from './records.js';
+import { settleAll, settledValue } from './settle.js';
+export class VaultNotAuthorized extends Error {
+    constructor(verb){
+        super(`Vault ${verb} authority refused the operation`);
+        this.name = 'VaultNotAuthorized';
+    }
+}
+export class VaultNotFound extends Error {
+    constructor(){
+        super('Vault key, entry or authenticated evidence not found');
+        this.name = 'VaultNotFound';
+    }
+}
+export class VaultRepairPending extends Error {
+    constructor(){
+        super('Vault branch material is unavailable for repair');
+        this.name = 'VaultRepairPending';
+    }
+}
+export class VaultSupersededBranch extends Error {
+    constructor(){
+        super('Entry belongs to a superseded content-key branch');
+        this.name = 'VaultSupersededBranch';
+    }
+}
+export class VaultKeyLocked extends Error {
+    constructor(){
+        super('Vault key requires supplied factors');
+        this.name = 'VaultKeyLocked';
+    }
+}
+export function createCoordinatorContext(params) {
+    if (params.authority === undefined) throw new TypeError('CredentialAuthority is required');
+    const cache = createKeyCache(params.cache);
+    const generations = new Map();
+    const cacheID = (address)=>JSON.stringify([
+            address.ownerDID,
+            address.keyID
+        ]);
+    // One records object per store handle. It holds no per-call state: its adapter reads through the
+    // handle's own database, and lock state lives only on adapters built inside `transaction`.
+    const recordsByStore = new WeakMap();
+    const recordsFor = (store)=>{
+        if (params.mode !== 'replicated') throw new TypeError('Local coordinator has no records path');
+        let records = recordsByStore.get(store);
+        if (records === undefined) {
+            records = createVaultRecords({
+                ...params.records,
+                store,
+                authority: params.authority
+            });
+            recordsByStore.set(store, records);
+        }
+        return records;
+    };
+    const records = params.mode === 'replicated' ? recordsFor(params.store) : undefined;
+    async function authorize(operation, verb, address, store = params.store) {
+        const allowed = await params.authority.authorize({
+            source: 'local',
+            mode: params.mode,
+            operation,
+            verb,
+            owner: address.ownerDID,
+            issuer: params.principal,
+            keyID: address.keyID,
+            entryID: address.entryID,
+            transportContext: address.transportContext,
+            request: address,
+            store: {
+                getKey: (a)=>store.getKey(a),
+                getEntry: (a)=>store.getEntry(a),
+                listKeys: (a)=>store.listKeys(a),
+                listWrappings: (a)=>store.listWrappings(a),
+                listEntries: (a)=>store.listEntries(a)
+            }
+        });
+        if (!allowed) throw new VaultNotAuthorized(verb);
+    }
+    async function key(address, store = params.store) {
+        const row = await store.getKey(address);
+        if (row === undefined) throw new VaultNotFound();
+        return row;
+    }
+    async function signed(type, address, payload, meta, hlc) {
+        if (params.mode !== 'replicated') throw new TypeError('Local writes are unsigned');
+        const bytes = payload === null ? null : encodeVaultRecordPayload(type, payload);
+        const stamp = hlc ?? await params.nextHLC();
+        const claim = {
+            type,
+            id: address.id,
+            owner: address.ownerDID,
+            hlc: stamp,
+            payloadDigest: recordPayloadDigest(bytes),
+            deleted: bytes === null,
+            meta
+        };
+        return {
+            type,
+            id: address.id,
+            owner: address.ownerDID,
+            hlc: stamp,
+            payload: bytes,
+            ...await signRecordOp(params.signer, claim, params.records.opKind)
+        };
+    }
+    async function verified(record) {
+        if (params.mode !== 'replicated') throw new TypeError('Local rows have no signed evidence');
+        const op = await verifySignedRecord(record, params.records.opKind, params.records.methods);
+        if (op === null) throw new VaultNotFound();
+        return op;
+    }
+    async function stored(address, store = params.store) {
+        const record = (await recordsFor(store).adapter.get(address))?.copies[0];
+        if (record === undefined) throw new VaultNotFound();
+        return {
+            record,
+            op: await verified(record)
+        };
+    }
+    async function storedMany(addresses, store = params.store) {
+        const decisions = await getRecordDecisions(recordsFor(store).adapter, addresses);
+        return settleAll(addresses.map(async (address)=>{
+            const record = decisions.get(recordKeyText(address))?.copies[0];
+            if (record === undefined) throw new VaultNotFound();
+            return {
+                record,
+                op: await verified(record)
+            };
+        }));
+    }
+    function checkWrapping(row, evidence) {
+        const decoded = decodeVaultRecord(evidence.record, evidence.op.claim.meta);
+        if (decoded.type !== 'vault.wrapping' || decoded.meta.keyID !== row.keyID || decoded.meta.keyVersion !== row.keyVersion || decoded.meta.branchID !== row.provenance || decoded.meta.recipient !== row.recipientDID) throw new VaultTampered('Wrapping projection disagrees with authenticated metadata');
+        checkDescriptorDigest({
+            descriptors: row.descriptors,
+            expectedDescriptorDigest: decoded.payload.descriptorDigest
+        });
+        const equal = (a, b)=>{
+            return a.length === b.length && a.every((v, i)=>v === b[i]);
+        };
+        if (!equal(row.iv, decoded.payload.iv) || !equal(row.wrappedKey, decoded.payload.wrappedKey)) throw new VaultTampered('Wrapping projection disagrees with authenticated ciphertext');
+        return {
+            ...evidence,
+            expectedDescriptorDigest: decoded.payload.descriptorDigest
+        };
+    }
+    async function wrappingEvidences(rows, store = params.store) {
+        if (params.mode === 'local') return [];
+        const evidence = await storedMany(rows.map((row)=>({
+                type: 'vault.wrapping',
+                owner: row.ownerDID,
+                id: row.wrappingID
+            })), store);
+        return rows.map((row, index)=>{
+            const item = evidence[index];
+            if (item === undefined) throw new VaultNotFound();
+            return checkWrapping(row, item);
+        });
+    }
+    async function wrappingEvidence(row, store = params.store) {
+        if (params.mode === 'local') return undefined;
+        const evidence = await stored({
+            type: 'vault.wrapping',
+            owner: row.ownerDID,
+            id: row.wrappingID
+        }, store);
+        return checkWrapping(row, evidence);
+    }
+    async function branches(address, version, store = params.store) {
+        return params.mode === 'local' ? [] : recordsFor(store).listKeyBranches({
+            ...address,
+            keyVersion: version
+        });
+    }
+    async function branch(address, version, store = params.store, specific) {
+        if (params.mode === 'local') return {
+            branchID: '',
+            branchRecordID: '',
+            suite: (await key(address, store)).suite
+        };
+        const rows = await branches(address, version, store);
+        if (rows.length === 0) throw new VaultRepairPending();
+        const winner = selectWinningBranch(rows.map((row)=>row.introducingOp));
+        const branchID = specific ?? `${winner.claim.hlc}:${winner.opHash}`;
+        const proofs = rows.filter((row)=>row.branchID === branchID).map((row)=>row.branchRecordID).sort();
+        if (proofs.length === 0) throw new VaultRepairPending();
+        const adapter = recordsFor(store).adapter;
+        // A projection row that names no matching record is local corruption. `repairFork` rebuilds it.
+        const corrupt = (id, reason)=>{
+            params.records.onCorruptRow?.({
+                type: 'vault.key-branch',
+                id,
+                error: new Error(reason)
+            });
+        };
+        const keys = proofs.map((id)=>({
+                type: 'vault.key-branch',
+                owner: address.ownerDID,
+                id
+            }));
+        // One batched read. A corrupt row fails the whole batch, so then each proof is read alone and
+        // only the corrupt one is reported.
+        const read = async ()=>{
+            try {
+                const decisions = await getRecordDecisions(adapter, keys);
+                return keys.map((key)=>decisions.get(recordKeyText(key)) ?? null);
+            } catch (error) {
+                if (!(error instanceof VaultRecordRowError)) throw error;
+            }
+            const each = [];
+            for (const key of keys){
+                try {
+                    each.push(await adapter.get(key));
+                } catch (error) {
+                    if (!(error instanceof VaultRecordRowError)) throw error;
+                    each.push(error);
+                }
+            }
+            return each;
+        };
+        const decisions = await read();
+        // Verify every proof together, then consume the results in proof order, as a sequential
+        // scan would: the first failure reached is the one thrown.
+        const checks = await Promise.allSettled(decisions.map((decision)=>{
+            const record = decision instanceof VaultRecordRowError ? undefined : decision?.copies[0];
+            return record === undefined ? Promise.resolve(null) : verified(record);
+        }));
+        // Read only the projected proof records. Any mismatch fails closed, as a full scan would.
+        for (const [index, id] of proofs.entries()){
+            const decision = decisions[index] ?? null;
+            if (decision instanceof VaultRecordRowError) {
+                params.records.onCorruptRow?.({
+                    type: 'vault.key-branch',
+                    id,
+                    error: decision
+                });
+                continue;
+            }
+            const record = decision?.copies[0];
+            if (record === undefined) {
+                corrupt(id, 'Key-branch projection names a missing record');
+                continue;
+            }
+            // A present record was checked by `verified`, which throws rather than yield null.
+            const op = settledValue(checks[index]);
+            if (op.claim.meta.keyID !== address.keyID || op.claim.meta.keyVersion !== version || op.claim.meta.branchID !== branchID) {
+                corrupt(id, 'Key-branch projection disagrees with its signed record');
+                continue;
+            }
+            const decoded = decodeVaultRecord(record, op.claim.meta);
+            if (decoded.type === 'vault.key-branch') return {
+                branchID,
+                branchRecordID: record.id,
+                suite: decoded.payload.suite
+            };
+            corrupt(id, 'Key-branch projection names a record of another type');
+        }
+        throw new VaultRepairPending();
+    }
+    async function write(store, output, preconditions, call) {
+        const result = await recordsFor(store).write({
+            records: output,
+            preconditions,
+            transportContext: call.transportContext
+        });
+        if (result.rejected.length > 0 || result.parked.length > 0) throw new VaultWriteConflict();
+        const decisions = await getRecordDecisions(recordsFor(store).adapter, output);
+        await settleAll(output.map(async (record)=>{
+            const selected = decisions.get(recordKeyText(record))?.copies[0];
+            if (selected === undefined) throw new VaultWriteConflict();
+            const [selectedOp, expectedOp] = await settleAll([
+                verified(selected),
+                verified(record)
+            ]);
+            if (recordClaimDigest(selectedOp.claim) !== recordClaimDigest(expectedOp.claim)) throw new VaultWriteConflict();
+        }));
+    }
+    async function keyRecords(row, store, unique, consumer) {
+        const previous = unique === undefined ? await stored({
+            type: 'vault.key',
+            owner: row.ownerDID,
+            id: row.keyID
+        }, store) : undefined;
+        const keyUnique = unique ?? previous?.op.claim.meta.keyUnique;
+        if (typeof keyUnique !== 'string') throw new VaultNotFound();
+        const record = await signed('vault.key', {
+            ownerDID: row.ownerDID,
+            id: row.keyID
+        }, {
+            suite: row.suite,
+            state: row.state
+        }, {
+            keyID: row.keyID,
+            keyUnique,
+            version: row.version,
+            state: row.state,
+            consumer: consumer === undefined ? previous?.op.claim.meta.consumer ?? null : consumer
+        });
+        const op = await verified(record);
+        const branchID = `${record.hlc}:${record.opHash}`;
+        const payload = {
+            authorDID: op.issuer,
+            hlc: record.hlc,
+            opJWT: record.opJWT,
+            opHash: record.opHash,
+            suite: row.suite
+        };
+        const branchRecordID = recordPayloadDigest(encodeVaultRecordPayload('vault.key-branch', payload));
+        if (branchRecordID === null) throw new Error('Branch has no payload digest');
+        const proof = await signed('vault.key-branch', {
+            ownerDID: row.ownerDID,
+            id: branchRecordID
+        }, payload, {
+            keyID: row.keyID,
+            keyVersion: row.version,
+            branchID,
+            consumer: consumer ?? previous?.op.claim.meta.consumer ?? null
+        }, record.hlc);
+        return {
+            records: [
+                record,
+                proof
+            ],
+            branchID,
+            branchRecordID
+        };
+    }
+    async function locked(addresses, fn) {
+        const database = vaultDatabases.get(params.store);
+        if (database === undefined) throw new TypeError('Coordinator requires a registered vault store');
+        return withKeyLocks(database.context.provider, 'vault_keys', addresses.map((a)=>[
+                JSON.stringify([
+                    a.ownerDID,
+                    a.keyID
+                ])
+            ]), async (provider)=>{
+            const store = await getVaultStore(provider);
+            const transaction = vaultDatabases.get(store);
+            if (transaction === undefined) throw new TypeError('Transaction-bound vault store is unavailable');
+            return withStoreTransaction(transaction.db, ()=>fn(store));
+        });
+    }
+    async function read(fn) {
+        const database = vaultDatabases.get(params.store);
+        if (database === undefined) throw new TypeError('Coordinator requires a registered vault store');
+        return database.context.provider.withTransaction(async (provider)=>{
+            const store = await getVaultStore(provider);
+            const transaction = vaultDatabases.get(store);
+            if (transaction === undefined) throw new TypeError('Transaction-bound vault store is unavailable');
+            return withStoreTransaction(transaction.db, ()=>fn(store));
+        });
+    }
+    function evict(address) {
+        const id = cacheID(address);
+        generations.set(id, {
+            ownerDID: address.ownerDID,
+            value: (generations.get(id)?.value ?? 0) + 1
+        });
+        cache.evict(id);
+    }
+    function evictAll(ownerDID) {
+        for (const [id, generation] of generations){
+            if (generation.ownerDID !== ownerDID) continue;
+            generation.value += 1;
+            cache.evict(id);
+        }
+    }
+    function generation(address) {
+        const id = cacheID(address);
+        let current = generations.get(id);
+        if (current === undefined) {
+            current = {
+                ownerDID: address.ownerDID,
+                value: 0
+            };
+            generations.set(id, current);
+        }
+        return String(current.value);
+    }
+    return {
+        params,
+        cache,
+        cacheID,
+        records,
+        recordsFor,
+        authorize,
+        key,
+        signed,
+        verified,
+        stored,
+        storedMany,
+        wrappingEvidence,
+        wrappingEvidences,
+        branches,
+        branch,
+        write,
+        keyRecords,
+        locked,
+        read,
+        evict,
+        evictAll,
+        generation
+    };
+}

package/lib/coordinator-entries.d.ts

@@ -0,0 +1,20 @@
+import type { CoordinatorContext } from './coordinator-context.js';
+import type { OpenFunctions } from './coordinator-open.js';
+import type { RecordFunctions } from './coordinator-records.js';
+import type { CoordinatorCall, EntryUpdateParams, EntryWriteParams } from './coordinator-types.js';
+import type { EntryAddress, UpdateEntryResult } from './types.js';
+export type ReKeyEntryParams = EntryAddress & CoordinatorCall & {
+    toKeyID: string;
+    inputs?: EntryUpdateParams['inputs'];
+};
+export type EntryFunctions = {
+    putEntry(request: EntryWriteParams): Promise<EntryAddress>;
+    deleteEntry(request: EntryAddress & CoordinatorCall): Promise<void>;
+    reKeyEntry(request: ReKeyEntryParams): Promise<void>;
+    updateEntry(request: EntryUpdateParams): Promise<void>;
+    updateEntryIfPresent(request: EntryUpdateParams): Promise<'updated' | 'absent'>;
+    updateEntryIfUnchanged(request: EntryUpdateParams & {
+        expectedHLC: string;
+    }): Promise<UpdateEntryResult>;
+};
+export declare function createEntryFunctions(ctx: CoordinatorContext, open: OpenFunctions, records: RecordFunctions): EntryFunctions;

package/lib/coordinator-entries.js

@@ -0,0 +1,258 @@
+import { getSuite } from '@kokuin/vault';
+import { VaultNotFound } from './coordinator-context.js';
+import { VaultWriteConflict } from './record-context.js';
+import { settleAll } from './settle.js';
+const zeroKey = (opened)=>{
+    opened.contentKey.fill(0);
+};
+const zeroBytes = (bytes)=>{
+    bytes.fill(0);
+};
+export function createEntryFunctions(ctx, open, records) {
+    const { params } = ctx;
+    async function save(row, store, call, expectedHLC, consumer) {
+        if (params.mode === 'local') {
+            await store.putEntry(row);
+            return;
+        }
+        const key = await ctx.key(row, store);
+        const [branch, branches] = await settleAll([
+            ctx.branch(key, key.version, store),
+            ctx.branches(key, key.version, store)
+        ]);
+        const record = await records.entry(row, branch, row.hlc, consumer);
+        await ctx.write(store, [
+            record
+        ], {
+            key: {
+                ...key,
+                expectedVersion: key.version,
+                expectedBranches: branches.map((b)=>b.branchID)
+            },
+            entry: {
+                ...row,
+                expectedHLC
+            }
+        }, call);
+    }
+    async function putEntry(request) {
+        await ctx.authorize('putEntry', 'administer', request);
+        return ctx.locked([
+            request
+        ], async (store)=>{
+            const current = await store.getEntry(request);
+            if (current !== undefined) throw new VaultWriteConflict();
+            const [key, opened, hlc] = await settleAll([
+                ctx.key(request, store),
+                open.open(request, store),
+                params.nextHLC()
+            ], [
+                undefined,
+                zeroKey
+            ]);
+            try {
+                const encrypted = getSuite(opened.suite).encryptEntry({
+                    ...request,
+                    runtime: params.runtime,
+                    contentKey: opened.contentKey,
+                    keyVersion: key.version
+                });
+                const row = {
+                    ...request,
+                    keyVersion: key.version,
+                    ...encrypted,
+                    hlc,
+                    provenance: opened.branchID
+                };
+                await save(row, store, request, null, request.consumer ?? null);
+                return {
+                    ownerDID: request.ownerDID,
+                    entryID: request.entryID
+                };
+            } finally{
+                opened.contentKey.fill(0);
+            }
+        });
+    }
+    async function update(request, operation) {
+        await ctx.authorize(operation, 'administer', request);
+        const observed = await params.store.getEntry(request);
+        if (observed === undefined) return 'absent';
+        return ctx.locked([
+            observed
+        ], async (store)=>{
+            const existing = await store.getEntry(request);
+            if (existing === undefined) return 'absent';
+            if (existing.keyID !== observed.keyID) throw new VaultWriteConflict();
+            if (request.expectedHLC !== undefined && existing.hlc !== request.expectedHLC) return 'superseded';
+            await ctx.authorize(operation, 'administer', {
+                ...request,
+                keyID: existing.keyID
+            }, store);
+            const [opened, hlc, info] = await settleAll([
+                open.open({
+                    ...existing,
+                    inputs: request.inputs
+                }, store),
+                params.nextHLC(),
+                records.entryInfo(existing, store)
+            ], [
+                zeroKey
+            ]);
+            try {
+                const row = {
+                    ...existing,
+                    keyVersion: opened.version,
+                    hlc,
+                    provenance: opened.branchID,
+                    ...getSuite(opened.suite).encryptEntry({
+                        ...existing,
+                        keyVersion: opened.version,
+                        runtime: params.runtime,
+                        contentKey: opened.contentKey,
+                        plaintext: request.plaintext
+                    })
+                };
+                await save(row, store, request, existing.hlc, info.consumer);
+                return 'updated';
+            } finally{
+                opened.contentKey.fill(0);
+            }
+        });
+    }
+    async function deleteEntry(request) {
+        await ctx.authorize('deleteEntry', 'administer', request);
+        const observed = await params.store.getEntry(request);
+        if (observed === undefined) return;
+        await ctx.locked([
+            observed
+        ], async (store)=>{
+            const existing = await store.getEntry(request);
+            if (existing === undefined) return;
+            if (existing.keyID !== observed.keyID) throw new VaultWriteConflict();
+            await ctx.authorize('deleteEntry', 'administer', {
+                ...request,
+                keyID: existing.keyID
+            }, store);
+            if (params.mode === 'local') {
+                await store.deleteEntry(request);
+                return;
+            }
+            const keyBranch = async ()=>{
+                const key = await ctx.key(existing, store);
+                return {
+                    key,
+                    branch: await ctx.branch(existing, key.version, store)
+                };
+            };
+            const [{ key, branch }, info, hlc] = await settleAll([
+                keyBranch(),
+                records.entryInfo(existing, store),
+                params.nextHLC()
+            ]);
+            const row = {
+                ...existing,
+                hlc,
+                keyVersion: key.version
+            };
+            const record = await records.entry(row, branch, row.hlc, info.consumer, true);
+            await ctx.write(store, [
+                record
+            ], {
+                key: {
+                    ...key,
+                    expectedVersion: key.version
+                },
+                entry: {
+                    ...request,
+                    expectedHLC: existing.hlc
+                }
+            }, request);
+        });
+    }
+    async function reKeyEntry(request) {
+        await ctx.authorize('reKeyEntry', 'administer', request);
+        const observed = await params.store.getEntry(request);
+        if (observed === undefined) throw new VaultNotFound();
+        const target = {
+            ownerDID: request.ownerDID,
+            keyID: request.toKeyID
+        };
+        await settleAll([
+            ctx.authorize('reKeyEntry', 'administer', {
+                ...request,
+                keyID: observed.keyID
+            }),
+            ctx.authorize('reKeyEntry', 'administer', {
+                ...request,
+                keyID: target.keyID
+            })
+        ]);
+        await ctx.locked([
+            observed,
+            target
+        ], async (store)=>{
+            const existing = await store.getEntry(request);
+            if (existing === undefined || existing.keyID !== observed.keyID || existing.hlc !== observed.hlc) throw new VaultWriteConflict();
+            const decrypting = open.decrypt(existing, {
+                ...existing,
+                inputs: request.inputs
+            }, store);
+            // A rejected source PIN must not also spend an attempt on the target key's throttle.
+            const opening = request.inputs?.pin === undefined ? open.open({
+                ...target,
+                inputs: request.inputs
+            }, store) : decrypting.then(()=>open.open({
+                    ...target,
+                    inputs: request.inputs
+                }, store));
+            const [plaintext, opened, info, hlc] = await settleAll([
+                decrypting,
+                opening,
+                records.entryInfo(existing, store),
+                params.nextHLC()
+            ], [
+                zeroBytes,
+                zeroKey
+            ]);
+            try {
+                const row = {
+                    ...existing,
+                    ...target,
+                    keyVersion: opened.version,
+                    hlc,
+                    provenance: opened.branchID,
+                    ...getSuite(opened.suite).encryptEntry({
+                        ...target,
+                        keyVersion: opened.version,
+                        entryID: existing.entryID,
+                        contentKey: opened.contentKey,
+                        runtime: params.runtime,
+                        plaintext
+                    })
+                };
+                if (params.mode === 'local') await store.moveEntry(row);
+                else await save(row, store, request, existing.hlc, info.consumer);
+            } finally{
+                opened.contentKey.fill(0);
+                plaintext.fill(0);
+            }
+        });
+    }
+    return {
+        putEntry,
+        deleteEntry,
+        reKeyEntry,
+        async updateEntry (request) {
+            if (await update(request, 'updateEntry') !== 'updated') throw new VaultNotFound();
+        },
+        async updateEntryIfPresent (request) {
+            const result = await update(request, 'updateEntryIfPresent');
+            if (result === 'superseded') throw new VaultWriteConflict();
+            return result;
+        },
+        updateEntryIfUnchanged: (request)=>{
+            return update(request, 'updateEntryIfUnchanged');
+        }
+    };
+}

package/lib/coordinator-open.d.ts

@@ -0,0 +1,9 @@
+import type { CoordinatorContext } from './coordinator-context.js';
+import type { OpenedKey, OpenKeyParams } from './coordinator-types.js';
+import type { EntryRow, VaultStoreAPI } from './types.js';
+export type OpenFunctions = {
+    open(address: OpenKeyParams, store?: VaultStoreAPI, specific?: string): Promise<OpenedKey>;
+    decrypt(row: EntryRow | undefined, address: OpenKeyParams, store?: VaultStoreAPI, specific?: boolean): Promise<Uint8Array>;
+    revoked(address: OpenKeyParams, store: VaultStoreAPI): Promise<boolean>;
+};
+export declare function createOpenFunctions(ctx: CoordinatorContext): OpenFunctions;