@kubun/credential 0.17.3 → 0.18.0

package/lib/record-types.js

@@ -0,0 +1,865 @@
+import { normalizeDID } from '@kokuin/token';
+import { HLC } from '@kubun/hlc';
+import { CredentialKeyID } from '@kubun/id';
+import { RecordContentRefusalError, recordPayloadDigest, recordPayloadMatches, verifyRecordOp, verifySignedRecord, visibilityRules, visibleTo } from '@kubun/records';
+import { credentialStoreOf, decodeCredentialRecord, encodeCredentialRecordPayload } from '@kubun/store-credential';
+import { fromB64U, toB64U } from '@sozai/codec';
+import { isCanonicalCompactToken } from './canonical-token.js';
+import { digestParts } from './digest.js';
+import { verifyGrantorAuthority } from './grantor-authority.js';
+import { verifyCredentialManifest } from './manifest-token.js';
+/** Thrown when a credential hook runs against a store it cannot reach the indexed tables of. */ export class CredentialRecordHookError extends Error {
+    constructor(message){
+        super(message);
+        this.name = 'CredentialRecordHookError';
+    }
+}
+const KEY = 'credential.key';
+const KEY_BRANCH = 'credential.key-branch';
+const WRAPPING = 'credential.wrapping';
+const WRAPPING_AUTHORITY = 'credential.wrapping-authority';
+const ENTRY = 'credential.entry';
+const MANIFEST = 'credential.manifest';
+const REVOCATION = 'credential.revocation';
+function isCount(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+}
+function isText(value) {
+    return typeof value === 'string' && value !== '';
+}
+function normalizedOrNull(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    try {
+        return normalizeDID(value);
+    } catch  {
+        return null;
+    }
+}
+/** Only these keys, each passing its check; a missing optional key is `undefined`. */ function hasShape(meta, required, optional = {}) {
+    for (const key of Object.keys(meta)){
+        if (!(key in required) && !(key in optional)) {
+            return false;
+        }
+    }
+    for (const [key, check] of Object.entries(required)){
+        if (!(key in meta) || !check(meta[key])) {
+            return false;
+        }
+    }
+    for (const [key, check] of Object.entries(optional)){
+        if (key in meta && !check(meta[key])) {
+            return false;
+        }
+    }
+    return true;
+}
+function isTokenList(value) {
+    return Array.isArray(value) && value.length > 0 && value.every(isText);
+}
+function isDID(value) {
+    return normalizedOrNull(value) !== null;
+}
+function isRecipient(value) {
+    return value === null || isDID(value);
+}
+/** Canonical unpadded base64url of exactly `length` bytes. */ function isBase64Of(value, length) {
+    if (typeof value !== 'string') {
+        return false;
+    }
+    try {
+        const bytes = fromB64U(value);
+        return bytes.length === length && toB64U(bytes) === value;
+    } catch  {
+        return false;
+    }
+}
+/** A record digest or op hash: 32 bytes, as `recordPayloadDigest` spells them. */ function isDigest(value) {
+    return isBase64Of(value, 32);
+}
+/** A credential key id in its one string form. */ function isKeyID(value) {
+    if (typeof value !== 'string') {
+        return false;
+    }
+    try {
+        return CredentialKeyID.fromString(value).toString() === value;
+    } catch  {
+        return false;
+    }
+}
+/** The random half of a key id, as the builder draws it. */ const KEY_UNIQUE_BYTES = 16;
+function isKeyUnique(value) {
+    return isBase64Of(value, KEY_UNIQUE_BYTES);
+}
+/**
+ * Whether `keyID` is the id `owner` mints from `unique`. The id commits to its owner, so no one
+ * can hold another owner's key id as their own, even on a device that has not yet seen it.
+ */ function keyIDNames(keyID, owner, unique) {
+    try {
+        return CredentialKeyID.create(owner, fromB64U(unique)).toString() === keyID;
+    } catch  {
+        return false;
+    }
+}
+const GRANT_ENTRY_PREFIX = 'grant:';
+const GRANT_ENTRY_DOMAIN = 'kubun/credential-grant-entry';
+/**
+ * The id of the entry holding the OAuth grant `name` that `grantDeviceDID` spends for `owner`.
+ * Derived, so the device that may write an entry is a property of the entry's id, whatever
+ * ops a peer has or has not seen for it.
+ */ export function credentialGrantEntryID(owner, grantDeviceDID, name) {
+    const parts = [
+        GRANT_ENTRY_DOMAIN,
+        normalizeDID(owner),
+        normalizeDID(grantDeviceDID),
+        name
+    ];
+    return `${GRANT_ENTRY_PREFIX}${digestParts(parts)}`;
+}
+const AUTHORITY = {
+    delegationTokens: isTokenList
+};
+function keyMeta(claim) {
+    const meta = claim.meta;
+    const identity = {
+        keyID: isKeyID,
+        keyUnique: isKeyUnique,
+        version: isCount
+    };
+    const ok = claim.deleted ? hasShape(meta, identity, AUTHORITY) : hasShape(meta, {
+        ...identity,
+        state: (v)=>v === 'active' || v === 'retired'
+    }, AUTHORITY);
+    return ok && meta.keyID === claim.id && keyIDNames(claim.id, claim.owner, meta.keyUnique) ? meta : null;
+}
+function keyBranchMeta(claim) {
+    const ok = hasShape(claim.meta, {
+        keyID: isKeyID,
+        keyVersion: isCount,
+        branchID: isText
+    }, {
+        ...AUTHORITY,
+        repairDigest: isText
+    });
+    return ok ? claim.meta : null;
+}
+function wrappingMeta(claim) {
+    const ok = claim.deleted ? hasShape(claim.meta, {
+        keyID: isKeyID,
+        keyVersion: isCount
+    }, {
+        recipient: isRecipient,
+        ...AUTHORITY
+    }) : hasShape(claim.meta, {
+        keyID: isKeyID,
+        keyVersion: isCount,
+        branchID: isText,
+        branchRecordID: isDigest
+    }, {
+        recipient: isRecipient,
+        ...AUTHORITY
+    });
+    return ok ? claim.meta : null;
+}
+function wrappingAuthorityMeta(claim) {
+    const ok = hasShape(claim.meta, {
+        wrappingID: isText,
+        refreshSeq: isCount,
+        wrappingOpHash: isDigest
+    });
+    return ok && claim.meta.wrappingID === claim.id ? claim.meta : null;
+}
+function entryMeta(claim) {
+    const grant = {
+        grantDeviceDID: isDID,
+        grantName: isText,
+        grantOwnerDID: isDID,
+        ...AUTHORITY
+    };
+    const ok = claim.deleted ? hasShape(claim.meta, {
+        keyID: isKeyID,
+        keyVersion: isCount,
+        contentHLC: isText
+    }, {
+        ...grant,
+        branchID: isText,
+        branchRecordID: isDigest
+    }) : hasShape(claim.meta, {
+        keyID: isKeyID,
+        keyVersion: isCount,
+        contentHLC: isText,
+        branchID: isText,
+        branchRecordID: isDigest
+    }, grant);
+    // A grant names its account, device and provider together.
+    const grantFields = [
+        'grantDeviceDID',
+        'grantName',
+        'grantOwnerDID'
+    ].filter((key)=>key in claim.meta);
+    return ok && 'branchID' in claim.meta === 'branchRecordID' in claim.meta && (grantFields.length === 0 || grantFields.length === 3) ? claim.meta : null;
+}
+/** Content intent precedes key version; an encryption refresh preserves its content stamp. */ function entryOrder(claim) {
+    const meta = entryMeta(claim);
+    const stamp = meta === null ? null : HLC.tryParse(meta.contentHLC);
+    if (stamp == null || HLC.serialize(stamp) !== meta?.contentHLC) {
+        throw new RecordContentRefusalError('credential.entry content stamp is malformed');
+    }
+    const node = Array.from({
+        length: stamp.nodeID.length
+    }, (_, index)=>stamp.nodeID.charCodeAt(index));
+    return [
+        stamp.wallTime,
+        stamp.counter,
+        ...node,
+        -1,
+        meta.keyVersion
+    ];
+}
+function validEntryContentStamp(claim) {
+    const meta = entryMeta(claim);
+    const content = meta === null ? null : HLC.tryParse(meta.contentHLC);
+    const operation = HLC.tryParse(claim.hlc);
+    return content !== null && operation !== null && HLC.serialize(content) === meta?.contentHLC && HLC.serialize(operation) === claim.hlc && HLC.compare(content, operation) <= 0 && /^[0-9]{4}-/.test(meta.contentHLC);
+}
+function manifestMeta(claim) {
+    const ok = hasShape(claim.meta, {
+        recipient: isDID,
+        grantor: isDID,
+        epoch: isCount,
+        sequence: isCount
+    });
+    return ok ? claim.meta : null;
+}
+function revocationMeta(claim) {
+    const ok = hasShape(claim.meta, {
+        keyID: isKeyID,
+        revokedDID: isDID
+    }, AUTHORITY);
+    return ok ? claim.meta : null;
+}
+/** A key version and state as one order: a retirement at a version follows its activation. */ function keyOrder(claim) {
+    const meta = keyMeta(claim);
+    if (meta === null) {
+        throw new RecordContentRefusalError('credential.key meta is malformed');
+    }
+    // A deletion follows both, so a later live op at the same version cannot revive it.
+    const rank = claim.deleted ? 2 : meta.state === 'retired' ? 1 : 0;
+    return [
+        meta.version,
+        rank
+    ];
+}
+// --- shared checks ---
+/**
+ * The live payload of a record, decoded by the store's own codec, or `null` when the bytes are
+ * not the signed ones or not of the type's shape. Checked here rather than left to the store,
+ * whose write would throw and roll back the whole chunk.
+ */ function decodedPayload(record, op) {
+    if (op.claim.deleted || !recordPayloadMatches(record, op.claim)) {
+        return null;
+    }
+    try {
+        return decodeCredentialRecord(record, op.claim.meta);
+    } catch  {
+        return null;
+    }
+}
+function decodedAs(record, op, type) {
+    const decoded = decodedPayload(record, op);
+    return decoded?.type === type ? decoded : null;
+}
+/** The owner of the stored key `keyID`, or `null` when the store holds no verified key record. */ async function storedKeyOwner(store, owner, keyID, methods) {
+    const stored = await store.get({
+        type: KEY,
+        owner,
+        id: keyID
+    });
+    const copy = stored?.copies[0];
+    const op = copy === undefined ? null : await verifySignedRecord(copy, methods);
+    return op?.claim.owner ?? null;
+}
+function keyAtLeast(owner, keyID, keyVersion) {
+    return {
+        type: KEY,
+        owner,
+        id: keyID,
+        satisfiedBy: (key)=>{
+            const meta = keyMeta(key.claim);
+            return key.claim.owner === owner && meta !== null && meta.version >= keyVersion;
+        }
+    };
+}
+function authorityOf(deps) {
+    const self = normalizedOrNull(deps.selfDID);
+    const controllerOf = async (did)=>normalizedOrNull(await deps.resolveController(did));
+    return {
+        methods: deps.methods,
+        async actsFor (issuer, owner, tokens) {
+            if (issuer === owner) return true;
+            if (issuer.startsWith('did:kokuin:')) return false;
+            if (await controllerOf(issuer) === owner) return true;
+            if (owner.startsWith('did:kokuin:')) return false;
+            return tokens !== undefined && await deps.verifyAdministerChain(tokens, owner, issuer);
+        },
+        async isControllerHead (issuer, owner) {
+            return issuer === owner || !issuer.startsWith('did:kokuin:') && await controllerOf(issuer) === owner;
+        },
+        async receives (owner, recipient) {
+            if (self === null) {
+                return false;
+            }
+            if (normalizedOrNull(recipient) === self) {
+                return true;
+            }
+            return self === owner || await controllerOf(self) === owner;
+        }
+    };
+}
+// --- the seven types ---
+function keyType(authority) {
+    return {
+        type: KEY,
+        policy: {
+            kind: 'monotonic',
+            version: keyOrder
+        },
+        dependsOn: [],
+        // Two ops at one version and state are concurrent rotations: both stay proven through
+        // their branch records, and the store keeps the greater `opHash`, the branch readers open.
+        onEqual: ()=>'fork',
+        precheck: (op)=>authority.actsFor(op.issuer, op.claim.owner, keyMeta(op.claim)?.delegationTokens),
+        async authorize (op, ctx) {
+            const meta = keyMeta(op.claim);
+            if (meta === null) {
+                return false;
+            }
+            if (!op.claim.deleted) {
+                const decoded = decodedAs(ctx.record, op, KEY);
+                if (decoded === null || decoded.payload.state !== meta.state) {
+                    return false;
+                }
+            }
+            return await authority.actsFor(op.issuer, op.claim.owner, meta.delegationTokens);
+        },
+        visibleTo: visibilityRules([
+            'ownerDevices',
+            'keyHolder'
+        ]),
+        dependencies: ()=>[]
+    };
+}
+/** Revocation removes every indexed wrapping for that recipient, at every key version. */ export function credentialStoreForHooks(adapter) {
+    const credentials = credentialStoreOf(adapter.adapterForType?.(KEY) ?? adapter);
+    if (credentials === null) throw new CredentialRecordHookError('Credential store unavailable');
+    return credentials;
+}
+async function dropRevokedWrappings(store, owner, keyID) {
+    const credentials = credentialStoreForHooks(store);
+    const revoked = new Set((await credentials.listRevocations(keyID, owner)).map((row)=>normalizedOrNull(row.recipient_did)));
+    for (const wrapping of (await credentials.listWrappings(keyID, undefined, owner))){
+        const recipients = [
+            normalizedOrNull(wrapping.recipient_did),
+            ...wrapping.factors.filter((factor)=>factor.kind === 'did').map((factor)=>normalizedOrNull(factor.params.recipient))
+        ];
+        if (recipients.some((recipient)=>recipient !== null && revoked.has(recipient))) {
+            await credentials.deleteWrapping(wrapping.wrapping_id, owner);
+        }
+    }
+}
+async function wrappingNamesRevokedRecipient(store, owner, keyID, recipient, factors) {
+    const credentials = credentialStoreForHooks(store);
+    const revoked = new Set((await credentials.listRevocations(keyID, owner)).map((row)=>normalizedOrNull(row.recipient_did)));
+    return [
+        normalizedOrNull(recipient),
+        ...factors.filter((factor)=>factor.kind === 'did').map((factor)=>normalizedOrNull(factor.params.recipient))
+    ].some((did)=>did !== null && revoked.has(did));
+}
+function keyBranchType(authority) {
+    return {
+        type: KEY_BRANCH,
+        policy: {
+            kind: 'immutable'
+        },
+        dependsOn: [
+            KEY
+        ],
+        precheck: (op)=>authority.actsFor(op.issuer, op.claim.owner, keyBranchMeta(op.claim)?.delegationTokens),
+        async authorize (op, ctx) {
+            const meta = keyBranchMeta(op.claim);
+            const decoded = decodedAs(ctx.record, op, KEY_BRANCH);
+            if (meta === null || decoded === null) {
+                return false;
+            }
+            const { payload } = decoded;
+            // The branch retains the key op that introduced it, verbatim: it must be a key op of
+            // this owner at this version, and the label must be the one that op mints.
+            const keyOp = isCanonicalCompactToken(payload.opJWT) ? await verifyRecordOp(payload.opJWT, authority.methods) : null;
+            const keyOpMeta = keyOp === null ? null : keyMeta(keyOp.claim);
+            if (keyOp === null || keyOpMeta === null || keyOp.claim.type !== KEY || keyOp.claim.id !== meta.keyID || keyOp.claim.owner !== op.claim.owner || keyOp.claim.deleted || keyOpMeta.version !== meta.keyVersion || keyOp.opHash !== payload.opHash || keyOp.claim.hlc !== payload.hlc || keyOp.issuer !== normalizedOrNull(payload.authorDID) || meta.branchID !== `${payload.hlc}:${payload.opHash}`) {
+                return false;
+            }
+            if (keyOp.claim.payloadDigest !== recordPayloadDigest(encodeCredentialRecordPayload('credential.key', {
+                suite: payload.suite,
+                state: keyOpMeta.state
+            }))) return false;
+            // Immutable records settle a conflict on `opHash`, not on the owner: the owner is the
+            // key's, never the branch op's own claim.
+            if (await storedKeyOwner(ctx.store, op.claim.owner, meta.keyID, authority.methods) !== op.claim.owner) {
+                return false;
+            }
+            return await authority.actsFor(keyOp.issuer, op.claim.owner, keyOpMeta.delegationTokens) && await authority.actsFor(op.issuer, op.claim.owner, meta.delegationTokens);
+        },
+        visibleTo: visibilityRules([
+            'keyHolder'
+        ]),
+        dependencies (_record, op) {
+            const meta = keyBranchMeta(op.claim);
+            return meta === null ? [] : [
+                keyAtLeast(op.claim.owner, meta.keyID, meta.keyVersion)
+            ];
+        }
+    };
+}
+function wrappingType(authority, bindReceiver) {
+    return {
+        type: WRAPPING,
+        policy: {
+            kind: 'lww'
+        },
+        dependsOn: [
+            KEY,
+            KEY_BRANCH
+        ],
+        precheck: (op)=>authority.actsFor(op.issuer, op.claim.owner, wrappingMeta(op.claim)?.delegationTokens),
+        async authorize (op, ctx) {
+            const meta = wrappingMeta(op.claim);
+            if (meta === null) {
+                return false;
+            }
+            const decoded = op.claim.deleted ? null : decodedAs(ctx.record, op, WRAPPING);
+            if (!op.claim.deleted && decoded === null) {
+                return false;
+            }
+            if (decoded !== null && await wrappingNamesRevokedRecipient(ctx.store, op.claim.owner, meta.keyID, meta.recipient, decoded.payload.factors)) {
+                return false;
+            }
+            if (await storedKeyOwner(ctx.store, op.claim.owner, meta.keyID, authority.methods) !== op.claim.owner) {
+                return false;
+            }
+            if (bindReceiver && !await authority.receives(op.claim.owner, meta.recipient)) {
+                return false;
+            }
+            // A delegate carries its administer chain in the op it signs, so the chain cannot be
+            // moved onto another wrapping or claimed by another issuer.
+            return await authority.actsFor(op.issuer, op.claim.owner, meta.delegationTokens);
+        },
+        // Never `keyHolder` or `sharedWith`: a co-holder must not learn another recipient's wrapping.
+        async visibleTo (record, ctx) {
+            const op = await verifySignedRecord(record, authority.methods);
+            const meta = op === null ? null : wrappingMeta(op.claim);
+            if (op === null || meta === null) return false;
+            const decoded = op.claim.deleted ? null : decodedAs(record, op, WRAPPING);
+            if (decoded !== null && await wrappingNamesRevokedRecipient(ctx.store, op.claim.owner, meta.keyID, meta.recipient, decoded.payload.factors)) {
+                return false;
+            }
+            return await visibleTo(record, [
+                'recipient',
+                'ownerDevices'
+            ], ctx);
+        },
+        dependencies (_record, op) {
+            const meta = wrappingMeta(op.claim);
+            if (meta === null) {
+                return [];
+            }
+            if (op.claim.deleted) {
+                return [
+                    {
+                        type: KEY,
+                        owner: op.claim.owner,
+                        id: meta.keyID
+                    }
+                ];
+            }
+            const { keyID, keyVersion, branchID } = meta;
+            return [
+                keyAtLeast(op.claim.owner, keyID, keyVersion),
+                {
+                    type: KEY_BRANCH,
+                    owner: op.claim.owner,
+                    id: meta.branchRecordID,
+                    // The exact branch the wrapping signed, at this version. Its owner is the key's, as
+                    // the authorizer binds the wrapping's: a mismatch is refused there, not parked here.
+                    satisfiedBy: (branch)=>{
+                        const branchMeta = keyBranchMeta(branch.claim);
+                        return branchMeta !== null && branch.claim.owner === op.claim.owner && !branch.claim.deleted && branchMeta.keyID === keyID && branchMeta.keyVersion === keyVersion && branchMeta.branchID === branchID;
+                    }
+                }
+            ];
+        },
+        async afterApply (record, store) {
+            const op = await verifySignedRecord(record, authority.methods);
+            const meta = op === null ? null : wrappingMeta(op.claim);
+            if (op !== null && meta !== null) {
+                await dropRevokedWrappings(store, op.claim.owner, meta.keyID);
+            }
+        }
+    };
+}
+function wrappingAuthorityType(authority, deps) {
+    return {
+        type: WRAPPING_AUTHORITY,
+        policy: {
+            kind: 'monotonic',
+            version: (claim)=>[
+                    claim.meta.refreshSeq
+                ]
+        },
+        dependsOn: [
+            WRAPPING
+        ],
+        async precheck (op, record) {
+            if (op.claim.owner.startsWith('did:kokuin:') && !await authority.actsFor(op.issuer, op.claim.owner, undefined)) return false;
+            const meta = wrappingAuthorityMeta(op.claim);
+            const decoded = decodedAs(record, op, WRAPPING_AUTHORITY);
+            if (meta === null || decoded === null || !isCanonicalCompactToken(decoded.payload.envelope)) {
+                return false;
+            }
+            const claim = await verifyGrantorAuthority(decoded.payload.envelope);
+            return claim !== null && claim.grantorDID === op.issuer && normalizedOrNull(claim.ownerDID) === op.claim.owner && claim.wrappingOpHash === meta.wrappingOpHash && claim.refreshSeq === meta.refreshSeq && await deps.verifyGrantorEnvelope(decoded.payload.envelope, meta.wrappingOpHash);
+        },
+        async authorize (op, ctx) {
+            if (op.claim.owner.startsWith('did:kokuin:') && !await authority.actsFor(op.issuer, op.claim.owner, undefined)) return false;
+            const meta = wrappingAuthorityMeta(op.claim);
+            const decoded = decodedAs(ctx.record, op, WRAPPING_AUTHORITY);
+            if (meta === null || decoded === null) {
+                return false;
+            }
+            const envelope = decoded.payload.envelope;
+            if (!isCanonicalCompactToken(envelope)) {
+                return false;
+            }
+            // The grantor is whoever signed the wrapping this envelope speaks for.
+            const storedWrapping = await ctx.store.get({
+                type: WRAPPING,
+                owner: op.claim.owner,
+                id: meta.wrappingID
+            });
+            const wrapping = storedWrapping === null || storedWrapping.copies[0] === undefined ? null : await verifySignedRecord(storedWrapping.copies[0], authority.methods);
+            const wrappingInfo = wrapping === null ? null : wrappingMeta(wrapping.claim);
+            if (wrapping === null || wrappingInfo === null || wrapping.claim.deleted || wrapping.opHash !== meta.wrappingOpHash || wrapping.claim.owner !== op.claim.owner || wrapping.issuer !== op.issuer) {
+                return false;
+            }
+            const claim = await verifyGrantorAuthority(envelope);
+            if (claim === null || claim.grantorDID !== op.issuer || normalizedOrNull(claim.ownerDID) !== op.claim.owner || claim.wrappingOpHash !== meta.wrappingOpHash || claim.refreshSeq !== meta.refreshSeq || normalizedOrNull(claim.recipientDID) === null || normalizedOrNull(claim.recipientDID) !== normalizedOrNull(wrappingInfo.recipient)) {
+                return false;
+            }
+            if (!await authority.receives(op.claim.owner, wrappingInfo.recipient)) {
+                return false;
+            }
+            return await deps.verifyGrantorEnvelope(envelope, meta.wrappingOpHash);
+        },
+        // As its wrapping, once that wrapping is the one the envelope names.
+        async visibleTo (record, ctx) {
+            const op = await verifySignedRecord(record, authority.methods);
+            const meta = op === null ? null : wrappingAuthorityMeta(op.claim);
+            if (op === null || meta === null) {
+                return false;
+            }
+            const storedWrapping = await ctx.store.get({
+                type: WRAPPING,
+                owner: op.claim.owner,
+                id: meta.wrappingID
+            });
+            const wrapping = storedWrapping === null || storedWrapping.copies[0] === undefined ? null : await verifySignedRecord(storedWrapping.copies[0], authority.methods);
+            if (storedWrapping === null || wrapping === null || wrapping.claim.deleted || wrapping.opHash !== meta.wrappingOpHash || wrapping.claim.owner !== op.claim.owner) {
+                return false;
+            }
+            return await visibleTo(storedWrapping.copies[0], [
+                'recipient',
+                'ownerDevices'
+            ], ctx);
+        },
+        dependencies (_record, op) {
+            const meta = wrappingAuthorityMeta(op.claim);
+            if (meta === null) {
+                return [];
+            }
+            return [
+                {
+                    type: WRAPPING,
+                    owner: op.claim.owner,
+                    id: meta.wrappingID,
+                    satisfiedBy: (wrapping)=>!wrapping.claim.deleted && wrapping.opHash === meta.wrappingOpHash && wrapping.claim.owner === op.claim.owner
+                }
+            ];
+        }
+    };
+}
+function entryType(authority) {
+    return {
+        type: ENTRY,
+        policy: {
+            kind: 'monotonic',
+            version: entryOrder
+        },
+        async afterAuthorize (record, adapter) {
+            await credentialStoreForHooks(adapter).retainEntryCandidate(record, authority.methods);
+        },
+        dependsOn: [
+            KEY_BRANCH
+        ],
+        precheck: async (op)=>validEntryContentStamp(op.claim) && await authority.actsFor(op.issuer, op.claim.owner, entryMeta(op.claim)?.delegationTokens),
+        async authorize (op, ctx) {
+            const meta = entryMeta(op.claim);
+            if (meta === null) {
+                return false;
+            }
+            if (!op.claim.deleted && decodedAs(ctx.record, op, ENTRY) === null) {
+                return false;
+            }
+            if (await storedKeyOwner(ctx.store, op.claim.owner, meta.keyID, authority.methods) !== op.claim.owner) {
+                return false;
+            }
+            // The id binds a grant to its device. Live writes come from that device; owner
+            // authority can tombstone the entry during adoption.
+            const device = normalizedOrNull(meta.grantDeviceDID);
+            const accountOwner = normalizedOrNull(meta.grantOwnerDID);
+            if (device === null || meta.grantName === undefined || accountOwner === null) {
+                if (op.claim.id.startsWith(GRANT_ENTRY_PREFIX)) {
+                    return false;
+                }
+            } else if (op.claim.id !== credentialGrantEntryID(accountOwner, device, meta.grantName) || !op.claim.deleted && op.issuer !== device) {
+                return false;
+            }
+            return await authority.actsFor(op.issuer, op.claim.owner, meta.delegationTokens);
+        },
+        visibleTo: visibilityRules([
+            'keyHolder'
+        ]),
+        dependencies (_record, op) {
+            const meta = entryMeta(op.claim);
+            if (meta === null) {
+                return [];
+            }
+            if (op.claim.deleted) {
+                const dependencies = [
+                    {
+                        type: KEY,
+                        owner: op.claim.owner,
+                        id: meta.keyID,
+                        satisfiedBy: (key)=>{
+                            const keyInfo = keyMeta(key.claim);
+                            return key.claim.owner === op.claim.owner && keyInfo !== null && keyInfo.version >= meta.keyVersion;
+                        }
+                    }
+                ];
+                if (meta.branchID !== undefined && meta.branchRecordID !== undefined) {
+                    dependencies.push({
+                        type: KEY_BRANCH,
+                        owner: op.claim.owner,
+                        id: meta.branchRecordID,
+                        satisfiedBy: (branch)=>{
+                            const branchInfo = keyBranchMeta(branch.claim);
+                            return branchInfo !== null && branch.claim.owner === op.claim.owner && !branch.claim.deleted && branchInfo.keyID === meta.keyID && branchInfo.keyVersion === meta.keyVersion && branchInfo.branchID === meta.branchID;
+                        }
+                    });
+                }
+                return dependencies;
+            }
+            const { keyID, keyVersion, branchID } = meta;
+            return [
+                {
+                    type: KEY_BRANCH,
+                    owner: op.claim.owner,
+                    id: meta.branchRecordID,
+                    satisfiedBy: (branch)=>{
+                        const branchInfo = keyBranchMeta(branch.claim);
+                        return branchInfo !== null && branch.claim.owner === op.claim.owner && !branch.claim.deleted && branchInfo.keyID === keyID && branchInfo.keyVersion === keyVersion && branchInfo.branchID === branchID;
+                    }
+                }
+            ];
+        }
+    };
+}
+function sameManifestKeys(left, right) {
+    return left.length === right.length && left.every((key, index)=>key.keyID === right[index]?.keyID && key.version === right[index]?.version);
+}
+function manifestType(authority) {
+    return {
+        type: MANIFEST,
+        policy: {
+            kind: 'monotonic',
+            version: (claim)=>[
+                    claim.meta.epoch,
+                    claim.meta.sequence
+                ]
+        },
+        dependsOn: [],
+        async authorize (op, ctx) {
+            const meta = manifestMeta(op.claim);
+            const decoded = decodedAs(ctx.record, op, MANIFEST);
+            if (meta === null || decoded === null) {
+                return false;
+            }
+            const grantor = normalizedOrNull(meta.grantor);
+            if (grantor !== op.issuer) {
+                return false;
+            }
+            // The legacy manifest token rides as provenance, and must say what the record says.
+            const { payload } = decoded;
+            const claim = isCanonicalCompactToken(payload.token) ? await verifyCredentialManifest(payload.token, authority.methods) : null;
+            if (claim === null || claim.grantorDID !== op.issuer || normalizedOrNull(claim.ownerDID) !== op.claim.owner || normalizedOrNull(claim.recipientDID) !== normalizedOrNull(meta.recipient) || claim.epoch !== meta.epoch || claim.sequence !== meta.sequence || !sameManifestKeys(claim.keys, payload.keys)) {
+                return false;
+            }
+            if (!await authority.receives(op.claim.owner, meta.recipient)) {
+                return false;
+            }
+            return await authority.actsFor(op.issuer, op.claim.owner, payload.delegationTokens);
+        },
+        visibleTo: visibilityRules([
+            'recipient'
+        ]),
+        dependencies: ()=>[]
+    };
+}
+function revocationType(authority) {
+    return {
+        type: REVOCATION,
+        policy: {
+            kind: 'lww'
+        },
+        dependsOn: [
+            KEY
+        ],
+        precheck: (op)=>authority.isControllerHead(op.issuer, op.claim.owner),
+        async authorize (op, ctx) {
+            const meta = revocationMeta(op.claim);
+            if (meta === null || decodedAs(ctx.record, op, REVOCATION) === null) return false;
+            const stored = await ctx.store.get({
+                type: KEY,
+                owner: op.claim.owner,
+                id: meta.keyID
+            });
+            const key = stored === null || stored.copies[0] === undefined ? null : await verifySignedRecord(stored.copies[0], authority.methods);
+            if (key === null || keyMeta(key.claim) === null || key.claim.owner !== op.claim.owner) return false;
+            return await authority.isControllerHead(op.issuer, op.claim.owner);
+        },
+        visibleTo: visibilityRules([
+            'keyHolder'
+        ]),
+        dependencies (_record, op) {
+            const meta = revocationMeta(op.claim);
+            return meta === null ? [] : [
+                {
+                    type: KEY,
+                    owner: op.claim.owner,
+                    id: meta.keyID
+                }
+            ];
+        },
+        async afterApply (record, store) {
+            const op = await verifySignedRecord(record, authority.methods);
+            const meta = op === null ? null : revocationMeta(op.claim);
+            if (op !== null && meta !== null) await dropRevokedWrappings(store, op.claim.owner, meta.keyID);
+        }
+    };
+}
+/**
+ * The credential record types, in dependency order: how each merges, who may write it, who
+ * may receive it, what it needs first, and what applying it does to the indexed tables.
+ *
+ * Every authorizer decodes a live payload with the store's codec after checking it against the
+ * signed digest, binds the record to the owner of the key it belongs to, and accepts only an
+ * issuer that acts for that owner. None decrypts or unwraps anything.
+ */ export function credentialRecordTypes(deps) {
+    const authority = authorityOf(deps);
+    const types = [
+        keyType(authority),
+        keyBranchType(authority),
+        wrappingType(authority, true),
+        wrappingAuthorityType(authority, deps),
+        entryType(authority),
+        manifestType(authority),
+        revocationType(authority)
+    ];
+    return new Map(types.map((definition)=>[
+            definition.type,
+            {
+                ...definition,
+                async lockKeys (incoming, stored) {
+                    const keys = new Set();
+                    for (const record of [
+                        incoming,
+                        ...stored?.copies ?? []
+                    ]){
+                        if (record === null) continue;
+                        const op = await verifySignedRecord(record, deps.methods);
+                        if (op === null) continue;
+                        const keyID = record.type === KEY ? record.id : op.claim.meta.keyID;
+                        if (typeof keyID === 'string' && keyID !== '') keys.add(keyID);
+                    }
+                    return [
+                        ...keys
+                    ].map((key)=>({
+                            type: definition.type,
+                            key
+                        }));
+                }
+            }
+        ]));
+}
+/**
+ * The record types that prove a requester holds a key: wrappings only. A revocation also names
+ * a key and a recipient, and must never pass for a holding.
+ */ export function credentialHolderTypes(types) {
+    const wrapping = types.get(WRAPPING);
+    return new Map(wrapping === undefined ? [] : [
+        [
+            WRAPPING,
+            wrapping
+        ]
+    ]);
+}
+/**
+ * The responder's current version of a key, for `VisibilityContext.currentKeyVersion`: the
+ * stored key record of that id, when it is live and belongs to `owner`.
+ */ export function credentialKeyVersionReader(store, methods) {
+    return async (owner, keyID)=>{
+        const stored = await store.get({
+            type: KEY,
+            owner,
+            id: keyID
+        });
+        const op = stored === null || stored.copies[0] === undefined ? null : await verifySignedRecord(stored.copies[0], methods);
+        const meta = op === null ? null : keyMeta(op.claim);
+        return op === null || meta === null || op.claim.deleted || op.claim.owner !== owner ? null : meta.version;
+    };
+}
+/**
+ * The authorizer a responder runs on a holder proof, for `VisibilityContext.authorizeProof`:
+ * the wrapping authorizer apply runs, reading `store`, without the receiver binding — a proof
+ * is the requester's wrapping, never addressed to the responder. Anything but a wrapping, or
+ * a record whose op does not verify, is refused.
+ */ export function credentialProofAuthorizer(deps, store) {
+    const wrapping = wrappingType(authorityOf(deps), false);
+    return async (record, stored)=>{
+        if (record.type !== WRAPPING) {
+            return false;
+        }
+        const op = await verifySignedRecord(record, deps.methods);
+        if (op === null) {
+            return false;
+        }
+        const ctx = {
+            record,
+            stored,
+            store,
+            resolveController: deps.resolveController,
+            verifyCapability: deps.verifyAdministerChain
+        };
+        return await wrapping.authorize(op, ctx);
+    };
+}