@laceio/sdk 0.1.0 → 0.1.1-canary.1

package/dist/device-readers-BPDz2oqa.js

@@ -0,0 +1,3 @@
+import "./_polyfill-buffer-patch-JcrfT1gU.js";
+import { i as resolveLiveReaders, n as derivesEntry, r as deviceEntryOf, t as assertJoiningDevice } from "./device-readers-CVqmvmLZ.js";
+export { assertJoiningDevice, derivesEntry, deviceEntryOf, resolveLiveReaders };

package/dist/device-readers-CVqmvmLZ.js

@@ -0,0 +1,145 @@
+import { n as HexBytes, t as ByteArray } from "./bytes.vo-CziaOsba.js";
+import { H as isSealableX25519Key } from "./grant-rules-rG1kJq6l.js";
+import { f as DeviceReaderInvalidError } from "./errors-pkQdxW-7.js";
+import { t as decodeDevicePublicKey } from "./envelopes-CfWTR2uy.js";
+import { a as pureCircuits } from "./acc-module-ur8CkBd1.js";
+//#region ../../packages/module/passport-account/src/acc/device-readers.ts
+/**
+* How many use counters of each registered device are tried for its live
+* entry, as far as the use-counter rescan probes a device's own counter.
+*/
+const DEVICE_ENTRY_SCAN_LIMIT = 4096n;
+/**
+* The rolling entries a compressed device key derives in a scope, with
+* the key decoded once for every counter tried, or undefined for a key
+* that is no Jubjub point.
+*/
+const entriesOf = ({ address, epoch }, devicePublicKey) => {
+	const point = decodeDevicePublicKey(devicePublicKey);
+	if (!point) return void 0;
+	const account = { bytes: ByteArray.fromHex(HexBytes(address)) };
+	return (counter) => HexBytes.fromByteArray(pureCircuits.derive_device_entry_with_jubjub(account, point, epoch, counter));
+};
+/**
+* The rolling entry a compressed device key derives at one use counter,
+* as lowercase hex, or undefined for a key that is no Jubjub point.
+*/
+const deviceEntryOf = (scope, devicePublicKey, counter) => entriesOf(scope, devicePublicKey)?.(counter);
+/**
+* Whether a compressed device key derives `entryHex` at any use counter
+* up to {@link DEVICE_ENTRY_SCAN_LIMIT}: whether it is the key of the
+* device holding that entry.
+*/
+const derivesEntry = (scope, devicePublicKey, entryHex) => {
+	const entryAt = entriesOf(scope, devicePublicKey);
+	if (!entryAt) return false;
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT; counter++) if (entryAt(counter) === entryHex) return true;
+	return false;
+};
+/**
+* Holds a joining device's keys to the entry it is enrolled under: its
+* reader key must be one the account seals to, and its device key a
+* Jubjub point whose entry at use counter 0, the counter a fresh device
+* starts from, is the commitment being added, so the account keys are
+* never sealed to a reader paired with another device's key.
+*
+* @throws {@link DeviceReaderInvalidError} when the reader key is not
+* sealable, the device key is no point, or its first entry is not the
+* commitment.
+*/
+const assertJoiningDevice = (scope, reader, commitmentHex) => {
+	if (!isSealableX25519Key(reader.readerPublicKey) || deviceEntryOf(scope, reader.devicePublicKey, 0n) !== commitmentHex.toLowerCase()) throw new DeviceReaderInvalidError();
+};
+/**
+* The live entry of each device key that derives one, by key. Every key
+* is decoded once and the keys are tried in lockstep, one use counter at
+* a time from 0, so each resolves at its lowest live counter. The scan
+* ends at {@link DEVICE_ENTRY_SCAN_LIMIT} or once every `sought` entry
+* is matched: an entry derives from one device key only, so no key still
+* unresolved can derive a sought entry after that.
+*/
+const liveEntries = ({ scope, devicePublicKeys, isLive, sought }) => {
+	const found = /* @__PURE__ */ new Map();
+	const unmatched = new Set(sought);
+	let unresolved = [...devicePublicKeys].flatMap((key) => {
+		const entryAt = entriesOf(scope, key);
+		return entryAt ? [{
+			key,
+			entryAt
+		}] : [];
+	});
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT && unresolved.length > 0 && unmatched.size > 0; counter++) unresolved = unresolved.filter(({ key, entryAt }) => {
+		const entryHex = entryAt(counter);
+		if (!isLive(entryHex)) return true;
+		found.set(key, {
+			counter,
+			entryHex
+		});
+		unmatched.delete(entryHex);
+		return false;
+	});
+	return found;
+};
+/** Adds `value` to the set `map` holds under `key`. */
+const addTo = (map, key, value) => {
+	map.set(key, (map.get(key) ?? /* @__PURE__ */ new Set()).add(value));
+};
+/**
+* The registered devices that are enrolled now, each with its live entry:
+* every device key is tried at use counters from 0 until it derives an
+* entry the ledger's device set holds, at most
+* {@link DEVICE_ENTRY_SCAN_LIMIT} of them, and the scan stops once every
+* allowed entry and the target are matched, so registrations it has not
+* resolved by then can derive none of them. A registration whose key
+* derives no live entry is left out, as one a device wrote before it was
+* enrolled, one of a removed device, or one planted with a key of
+* nobody's. One device's registration written twice counts once.
+* Registrations whose live entry is not allowed are set apart first, so a
+* removed device's own registrations never weigh on the rest. Among the
+* others, which one is genuine cannot be told apart when they conflict,
+* so none of a conflict is sealed to: a reader key registered for two
+* live devices is left out, and a live device claimed by two reader keys
+* keeps none of them. Every allowed entry left without a reader, that
+* way or for want of any registration, is reported dropped, so the user
+* sees every device that gets no new key and has to be enrolled again.
+*/
+const resolveLiveReaders = ({ scope, registered, isLive, allowed, target }) => {
+	const resolved = /* @__PURE__ */ new Map();
+	const outside = [];
+	const entriesOfReader = /* @__PURE__ */ new Map();
+	const readersOfEntry = /* @__PURE__ */ new Map();
+	const live = liveEntries({
+		scope,
+		devicePublicKeys: new Set(registered.map(({ devicePublicKey }) => devicePublicKey)),
+		isLive,
+		sought: target === void 0 ? allowed : new Set([...allowed, target])
+	});
+	for (const device of registered) {
+		const entry = live.get(device.devicePublicKey);
+		if (!entry) continue;
+		const candidate = {
+			reader: {
+				...device,
+				epoch: scope.epoch,
+				counter: entry.counter
+			},
+			entryHex: entry.entryHex
+		};
+		if (!allowed.has(entry.entryHex)) {
+			outside.push(candidate);
+			continue;
+		}
+		resolved.set(`${device.readerPublicKey}:${entry.entryHex}`, candidate);
+		addTo(entriesOfReader, device.readerPublicKey, entry.entryHex);
+		addTo(readersOfEntry, entry.entryHex, device.readerPublicKey);
+	}
+	const readers = [...resolved.values()].filter(({ reader, entryHex }) => (entriesOfReader.get(reader.readerPublicKey)?.size ?? 0) === 1 && (readersOfEntry.get(entryHex)?.size ?? 0) === 1);
+	const kept = new Set(readers.map(({ entryHex }) => entryHex));
+	return {
+		readers,
+		dropped: [...allowed].filter((entry) => !kept.has(entry)),
+		outside
+	};
+};
+//#endregion
+export { resolveLiveReaders as i, derivesEntry as n, deviceEntryOf as r, assertJoiningDevice as t };

package/dist/device-readers-DzkDMjPn.cjs

@@ -0,0 +1,7 @@
+require("./chunk-9hOWP6kD.cjs");
+require("./_polyfill-buffer-patch-BycQkEkK.cjs");
+const require_device_readers = require("./device-readers-XMZMfFvZ.cjs");
+exports.assertJoiningDevice = require_device_readers.assertJoiningDevice;
+exports.derivesEntry = require_device_readers.derivesEntry;
+exports.deviceEntryOf = require_device_readers.deviceEntryOf;
+exports.resolveLiveReaders = require_device_readers.resolveLiveReaders;

package/dist/device-readers-XMZMfFvZ.cjs

@@ -0,0 +1,168 @@
+const require_bytes_vo = require("./bytes.vo-hecRu3YZ.cjs");
+const require_grant_rules = require("./grant-rules-fYt80KB1.cjs");
+const require_errors = require("./errors-BA3b8aVu.cjs");
+const require_envelopes = require("./envelopes-BmL7onAK.cjs");
+const require_acc_module = require("./acc-module-NL_8mEHH.cjs");
+//#region ../../packages/module/passport-account/src/acc/device-readers.ts
+/**
+* How many use counters of each registered device are tried for its live
+* entry, as far as the use-counter rescan probes a device's own counter.
+*/
+const DEVICE_ENTRY_SCAN_LIMIT = 4096n;
+/**
+* The rolling entries a compressed device key derives in a scope, with
+* the key decoded once for every counter tried, or undefined for a key
+* that is no Jubjub point.
+*/
+const entriesOf = ({ address, epoch }, devicePublicKey) => {
+	const point = require_envelopes.decodeDevicePublicKey(devicePublicKey);
+	if (!point) return void 0;
+	const account = { bytes: require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(address)) };
+	return (counter) => require_bytes_vo.HexBytes.fromByteArray(require_acc_module.pureCircuits.derive_device_entry_with_jubjub(account, point, epoch, counter));
+};
+/**
+* The rolling entry a compressed device key derives at one use counter,
+* as lowercase hex, or undefined for a key that is no Jubjub point.
+*/
+const deviceEntryOf = (scope, devicePublicKey, counter) => entriesOf(scope, devicePublicKey)?.(counter);
+/**
+* Whether a compressed device key derives `entryHex` at any use counter
+* up to {@link DEVICE_ENTRY_SCAN_LIMIT}: whether it is the key of the
+* device holding that entry.
+*/
+const derivesEntry = (scope, devicePublicKey, entryHex) => {
+	const entryAt = entriesOf(scope, devicePublicKey);
+	if (!entryAt) return false;
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT; counter++) if (entryAt(counter) === entryHex) return true;
+	return false;
+};
+/**
+* Holds a joining device's keys to the entry it is enrolled under: its
+* reader key must be one the account seals to, and its device key a
+* Jubjub point whose entry at use counter 0, the counter a fresh device
+* starts from, is the commitment being added, so the account keys are
+* never sealed to a reader paired with another device's key.
+*
+* @throws {@link DeviceReaderInvalidError} when the reader key is not
+* sealable, the device key is no point, or its first entry is not the
+* commitment.
+*/
+const assertJoiningDevice = (scope, reader, commitmentHex) => {
+	if (!require_grant_rules.isSealableX25519Key(reader.readerPublicKey) || deviceEntryOf(scope, reader.devicePublicKey, 0n) !== commitmentHex.toLowerCase()) throw new require_errors.DeviceReaderInvalidError();
+};
+/**
+* The live entry of each device key that derives one, by key. Every key
+* is decoded once and the keys are tried in lockstep, one use counter at
+* a time from 0, so each resolves at its lowest live counter. The scan
+* ends at {@link DEVICE_ENTRY_SCAN_LIMIT} or once every `sought` entry
+* is matched: an entry derives from one device key only, so no key still
+* unresolved can derive a sought entry after that.
+*/
+const liveEntries = ({ scope, devicePublicKeys, isLive, sought }) => {
+	const found = /* @__PURE__ */ new Map();
+	const unmatched = new Set(sought);
+	let unresolved = [...devicePublicKeys].flatMap((key) => {
+		const entryAt = entriesOf(scope, key);
+		return entryAt ? [{
+			key,
+			entryAt
+		}] : [];
+	});
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT && unresolved.length > 0 && unmatched.size > 0; counter++) unresolved = unresolved.filter(({ key, entryAt }) => {
+		const entryHex = entryAt(counter);
+		if (!isLive(entryHex)) return true;
+		found.set(key, {
+			counter,
+			entryHex
+		});
+		unmatched.delete(entryHex);
+		return false;
+	});
+	return found;
+};
+/** Adds `value` to the set `map` holds under `key`. */
+const addTo = (map, key, value) => {
+	map.set(key, (map.get(key) ?? /* @__PURE__ */ new Set()).add(value));
+};
+/**
+* The registered devices that are enrolled now, each with its live entry:
+* every device key is tried at use counters from 0 until it derives an
+* entry the ledger's device set holds, at most
+* {@link DEVICE_ENTRY_SCAN_LIMIT} of them, and the scan stops once every
+* allowed entry and the target are matched, so registrations it has not
+* resolved by then can derive none of them. A registration whose key
+* derives no live entry is left out, as one a device wrote before it was
+* enrolled, one of a removed device, or one planted with a key of
+* nobody's. One device's registration written twice counts once.
+* Registrations whose live entry is not allowed are set apart first, so a
+* removed device's own registrations never weigh on the rest. Among the
+* others, which one is genuine cannot be told apart when they conflict,
+* so none of a conflict is sealed to: a reader key registered for two
+* live devices is left out, and a live device claimed by two reader keys
+* keeps none of them. Every allowed entry left without a reader, that
+* way or for want of any registration, is reported dropped, so the user
+* sees every device that gets no new key and has to be enrolled again.
+*/
+const resolveLiveReaders = ({ scope, registered, isLive, allowed, target }) => {
+	const resolved = /* @__PURE__ */ new Map();
+	const outside = [];
+	const entriesOfReader = /* @__PURE__ */ new Map();
+	const readersOfEntry = /* @__PURE__ */ new Map();
+	const live = liveEntries({
+		scope,
+		devicePublicKeys: new Set(registered.map(({ devicePublicKey }) => devicePublicKey)),
+		isLive,
+		sought: target === void 0 ? allowed : new Set([...allowed, target])
+	});
+	for (const device of registered) {
+		const entry = live.get(device.devicePublicKey);
+		if (!entry) continue;
+		const candidate = {
+			reader: {
+				...device,
+				epoch: scope.epoch,
+				counter: entry.counter
+			},
+			entryHex: entry.entryHex
+		};
+		if (!allowed.has(entry.entryHex)) {
+			outside.push(candidate);
+			continue;
+		}
+		resolved.set(`${device.readerPublicKey}:${entry.entryHex}`, candidate);
+		addTo(entriesOfReader, device.readerPublicKey, entry.entryHex);
+		addTo(readersOfEntry, entry.entryHex, device.readerPublicKey);
+	}
+	const readers = [...resolved.values()].filter(({ reader, entryHex }) => (entriesOfReader.get(reader.readerPublicKey)?.size ?? 0) === 1 && (readersOfEntry.get(entryHex)?.size ?? 0) === 1);
+	const kept = new Set(readers.map(({ entryHex }) => entryHex));
+	return {
+		readers,
+		dropped: [...allowed].filter((entry) => !kept.has(entry)),
+		outside
+	};
+};
+//#endregion
+Object.defineProperty(exports, "assertJoiningDevice", {
+	enumerable: true,
+	get: function() {
+		return assertJoiningDevice;
+	}
+});
+Object.defineProperty(exports, "derivesEntry", {
+	enumerable: true,
+	get: function() {
+		return derivesEntry;
+	}
+});
+Object.defineProperty(exports, "deviceEntryOf", {
+	enumerable: true,
+	get: function() {
+		return deviceEntryOf;
+	}
+});
+Object.defineProperty(exports, "resolveLiveReaders", {
+	enumerable: true,
+	get: function() {
+		return resolveLiveReaders;
+	}
+});

package/dist/dist-B00GN41m.js

@@ -0,0 +1,141 @@
+import { t as __commonJSMin } from "./chunk-D6g4UhsZ.js";
+//#region ../../node_modules/bech32/dist/index.js
+var require_dist = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.bech32m = exports.bech32 = void 0;
+	const ALPHABET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l";
+	const ALPHABET_MAP = {};
+	for (let z = 0; z < 32; z++) {
+		const x = ALPHABET.charAt(z);
+		ALPHABET_MAP[x] = z;
+	}
+	function polymodStep(pre) {
+		const b = pre >> 25;
+		return (pre & 33554431) << 5 ^ -(b >> 0 & 1) & 996825010 ^ -(b >> 1 & 1) & 642813549 ^ -(b >> 2 & 1) & 513874426 ^ -(b >> 3 & 1) & 1027748829 ^ -(b >> 4 & 1) & 705979059;
+	}
+	function prefixChk(prefix) {
+		let chk = 1;
+		for (let i = 0; i < prefix.length; ++i) {
+			const c = prefix.charCodeAt(i);
+			if (c < 33 || c > 126) return "Invalid prefix (" + prefix + ")";
+			chk = polymodStep(chk) ^ c >> 5;
+		}
+		chk = polymodStep(chk);
+		for (let i = 0; i < prefix.length; ++i) {
+			const v = prefix.charCodeAt(i);
+			chk = polymodStep(chk) ^ v & 31;
+		}
+		return chk;
+	}
+	function convert(data, inBits, outBits, pad) {
+		let value = 0;
+		let bits = 0;
+		const maxV = (1 << outBits) - 1;
+		const result = [];
+		for (let i = 0; i < data.length; ++i) {
+			value = value << inBits | data[i];
+			bits += inBits;
+			while (bits >= outBits) {
+				bits -= outBits;
+				result.push(value >> bits & maxV);
+			}
+		}
+		if (pad) {
+			if (bits > 0) result.push(value << outBits - bits & maxV);
+		} else {
+			if (bits >= inBits) return "Excess padding";
+			if (value << outBits - bits & maxV) return "Non-zero padding";
+		}
+		return result;
+	}
+	function toWords(bytes) {
+		return convert(bytes, 8, 5, true);
+	}
+	function fromWordsUnsafe(words) {
+		const res = convert(words, 5, 8, false);
+		if (Array.isArray(res)) return res;
+	}
+	function fromWords(words) {
+		const res = convert(words, 5, 8, false);
+		if (Array.isArray(res)) return res;
+		throw new Error(res);
+	}
+	function getLibraryFromEncoding(encoding) {
+		let ENCODING_CONST;
+		if (encoding === "bech32") ENCODING_CONST = 1;
+		else ENCODING_CONST = 734539939;
+		function encode(prefix, words, LIMIT) {
+			LIMIT = LIMIT || 90;
+			if (prefix.length + 7 + words.length > LIMIT) throw new TypeError("Exceeds length limit");
+			prefix = prefix.toLowerCase();
+			let chk = prefixChk(prefix);
+			if (typeof chk === "string") throw new Error(chk);
+			let result = prefix + "1";
+			for (let i = 0; i < words.length; ++i) {
+				const x = words[i];
+				if (x >> 5 !== 0) throw new Error("Non 5-bit word");
+				chk = polymodStep(chk) ^ x;
+				result += ALPHABET.charAt(x);
+			}
+			for (let i = 0; i < 6; ++i) chk = polymodStep(chk);
+			chk ^= ENCODING_CONST;
+			for (let i = 0; i < 6; ++i) {
+				const v = chk >> (5 - i) * 5 & 31;
+				result += ALPHABET.charAt(v);
+			}
+			return result;
+		}
+		function __decode(str, LIMIT) {
+			LIMIT = LIMIT || 90;
+			if (str.length < 8) return str + " too short";
+			if (str.length > LIMIT) return "Exceeds length limit";
+			const lowered = str.toLowerCase();
+			const uppered = str.toUpperCase();
+			if (str !== lowered && str !== uppered) return "Mixed-case string " + str;
+			str = lowered;
+			const split = str.lastIndexOf("1");
+			if (split === -1) return "No separator character for " + str;
+			if (split === 0) return "Missing prefix for " + str;
+			const prefix = str.slice(0, split);
+			const wordChars = str.slice(split + 1);
+			if (wordChars.length < 6) return "Data too short";
+			let chk = prefixChk(prefix);
+			if (typeof chk === "string") return chk;
+			const words = [];
+			for (let i = 0; i < wordChars.length; ++i) {
+				const c = wordChars.charAt(i);
+				const v = ALPHABET_MAP[c];
+				if (v === void 0) return "Unknown character " + c;
+				chk = polymodStep(chk) ^ v;
+				if (i + 6 >= wordChars.length) continue;
+				words.push(v);
+			}
+			if (chk !== ENCODING_CONST) return "Invalid checksum for " + str;
+			return {
+				prefix,
+				words
+			};
+		}
+		function decodeUnsafe(str, LIMIT) {
+			const res = __decode(str, LIMIT);
+			if (typeof res === "object") return res;
+		}
+		function decode(str, LIMIT) {
+			const res = __decode(str, LIMIT);
+			if (typeof res === "object") return res;
+			throw new Error(res);
+		}
+		return {
+			decodeUnsafe,
+			decode,
+			encode,
+			toWords,
+			fromWordsUnsafe,
+			fromWords
+		};
+	}
+	exports.bech32 = getLibraryFromEncoding("bech32");
+	exports.bech32m = getLibraryFromEncoding("bech32m");
+}));
+//#endregion
+export { require_dist as t };