@noeos/verification-engine 0.0.0

package/dist/esm/records/record-service.js

@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: Apache-2.0
+import { types } from "node:util";
+import { RECORD_EVIDENCE_SCHEMA } from "../domain/evidence.js";
+import { failure, success } from "../domain/operation-result.js";
+import { buildTrustedContentFrame, buildTrustedRecordFrame } from "../framing/frame-builders.js";
+import { hashTrustedFrame } from "../hashing/hash-frame.js";
+import { normalizeRegisteredToBytes } from "../normalization/normalize.js";
+import { createReadonlyByteView } from "../rules/rule-set.js";
+import { DiagnosticCollector } from "../validation/diagnostic-collector.js";
+import { validateAlgorithmId } from "../validation/algorithm-validation.js";
+import { equalDigest, validateDigest } from "../validation/digest-validation.js";
+import { validateContextId, validateProfileId, validateRecordId, } from "../validation/identifier-validation.js";
+import { inspectExactProperties } from "../validation/object-inspection.js";
+import { failureWithCode } from "../validation/result-helpers.js";
+import { validateProfileVersion } from "../validation/version-validation.js";
+export function hashRecord(input, options) {
+    const computed = computeRecord(input, options);
+    if (!computed.ok)
+        return computed;
+    return success(computed.value.evidence, computed.diagnostics);
+}
+export function computeRecord(input, options) {
+    const validated = validateRecordInput(input, options.limits);
+    if (!validated.ok)
+        return validated;
+    const collector = new DiagnosticCollector(options.limits);
+    const hasRules = options.rules?.hasRules() === true;
+    if (hasRules) {
+        addAll(collector, options.rules.evaluate(Object.freeze({
+            phase: "input",
+            input: freezeInputView(validated.value),
+            recordId: validated.value.recordId,
+        }), options.limits));
+    }
+    if (collector.hasErrors())
+        return failure(collector.finish());
+    const profileReference = validateProfileReference(validated.value, options);
+    if (!profileReference.ok)
+        return profileReference;
+    const profile = profileReference.value;
+    if (profile.inputKind === "json" && inputPayloadIsBytes(validated.value.payload)) {
+        collector.addCode("PROFILE_INPUT_KIND_MISMATCH", "input", {
+            recordId: validated.value.recordId,
+        });
+        return failure(collector.finish());
+    }
+    if (profile.inputKind === "bytes" && !inputPayloadIsBytes(validated.value.payload)) {
+        collector.addCode("PROFILE_INPUT_KIND_MISMATCH", "input", {
+            recordId: validated.value.recordId,
+        });
+        return failure(collector.finish());
+    }
+    if (isBuiltinRawProfile(profile) && !hasRules) {
+        return computeBuiltinRawRecord(validated.value, options);
+    }
+    const profileInput = profile.validate(validated.value.payload, options.limits);
+    if (!profileInput.ok)
+        return profileInput;
+    const normalized = normalizeRegisteredToBytes(profile, profileInput.value, options.limits);
+    if (!normalized.ok)
+        return normalized;
+    addAll(collector, normalized.diagnostics);
+    if (hasRules) {
+        addAll(collector, options.rules.evaluate(Object.freeze({
+            phase: "normalization",
+            normalized: createReadonlyByteView(normalized.value.bytes),
+            recordId: validated.value.recordId,
+        }), options.limits));
+    }
+    if (collector.hasErrors())
+        return failure(collector.finish());
+    const contentDigest = hashTrustedFrame(validated.value.algorithm, buildTrustedContentFrame({
+        algorithm: validated.value.algorithm,
+        profileId: validated.value.profile.id,
+        profileVersion: validated.value.profile.version,
+        normalizedBytes: normalized.value.bytes,
+    }, options.limits));
+    if (!contentDigest.ok)
+        return contentDigest;
+    const recordDigest = hashTrustedFrame(validated.value.algorithm, buildTrustedRecordFrame({
+        algorithm: validated.value.algorithm,
+        contextId: validated.value.contextId,
+        recordId: validated.value.recordId,
+        profileId: validated.value.profile.id,
+        profileVersion: validated.value.profile.version,
+        normalizedByteLength: normalized.value.stats.byteLength,
+        contentDigest: contentDigest.value,
+    }, options.limits));
+    if (!recordDigest.ok)
+        return recordDigest;
+    const evidence = freezeRecordEvidence({
+        $schema: RECORD_EVIDENCE_SCHEMA,
+        protocolVersion: 1,
+        contextId: validated.value.contextId,
+        recordId: validated.value.recordId,
+        profile: validated.value.profile,
+        algorithm: validated.value.algorithm,
+        normalizedByteLength: normalized.value.stats.byteLength,
+        contentDigest: contentDigest.value.toHex(),
+        recordDigest: recordDigest.value.toHex(),
+    });
+    if (hasRules) {
+        addAll(collector, options.rules.evaluate(Object.freeze({
+            phase: "record",
+            record: evidence,
+            recordId: evidence.recordId,
+        }), options.limits));
+    }
+    if (collector.hasErrors())
+        return failure(collector.finish());
+    return success(Object.freeze({
+        evidence,
+        contentDigest: contentDigest.value,
+        recordDigest: recordDigest.value,
+    }), collector.finish());
+}
+function computeBuiltinRawRecord(input, options) {
+    if (types.isProxy(input.payload) || !(input.payload instanceof Uint8Array)) {
+        return failureWithCode("INPUT_TYPE_INVALID", "input");
+    }
+    if (input.payload.length > options.limits.maxPayloadBytes) {
+        return failureWithCode("INPUT_LIMIT_EXCEEDED", "input");
+    }
+    const contentDigest = hashTrustedFrame(input.algorithm, buildTrustedContentFrame({
+        algorithm: input.algorithm,
+        profileId: input.profile.id,
+        profileVersion: input.profile.version,
+        normalizedBytes: input.payload,
+    }, options.limits));
+    if (!contentDigest.ok)
+        return contentDigest;
+    const recordDigest = hashTrustedFrame(input.algorithm, buildTrustedRecordFrame({
+        algorithm: input.algorithm,
+        contextId: input.contextId,
+        recordId: input.recordId,
+        profileId: input.profile.id,
+        profileVersion: input.profile.version,
+        normalizedByteLength: input.payload.length,
+        contentDigest: contentDigest.value,
+    }, options.limits));
+    if (!recordDigest.ok)
+        return recordDigest;
+    const evidence = freezeRecordEvidence({
+        $schema: RECORD_EVIDENCE_SCHEMA,
+        protocolVersion: 1,
+        contextId: input.contextId,
+        recordId: input.recordId,
+        profile: input.profile,
+        algorithm: input.algorithm,
+        normalizedByteLength: input.payload.length,
+        contentDigest: contentDigest.value.toHex(),
+        recordDigest: recordDigest.value.toHex(),
+    });
+    return success(Object.freeze({
+        evidence,
+        contentDigest: contentDigest.value,
+        recordDigest: recordDigest.value,
+    }));
+}
+export function verifyComputedRecord(expected, payload, options) {
+    const computed = computeRecord({
+        contextId: expected.contextId,
+        recordId: expected.recordId,
+        payload,
+        profile: expected.profile,
+        algorithm: expected.algorithm,
+    }, options);
+    if (!computed.ok)
+        return computed;
+    const expectedContent = expected.contentDigest;
+    const expectedRecord = expected.recordDigest;
+    const actualContent = computed.value.evidence.contentDigest;
+    const actualRecord = computed.value.evidence.recordDigest;
+    const collector = new DiagnosticCollector(options.limits);
+    addAll(collector, computed.diagnostics);
+    if (!sameDigest(expectedContent, actualContent, expected.algorithm)) {
+        collector.addCode("CONTENT_DIGEST_MISMATCH", "record", { recordId: expected.recordId });
+    }
+    if (!sameDigest(expectedRecord, actualRecord, expected.algorithm)) {
+        collector.addCode("RECORD_DIGEST_MISMATCH", "record", { recordId: expected.recordId });
+    }
+    if (collector.hasErrors())
+        return failure(collector.finish());
+    return success(computed.value.evidence, collector.finish());
+}
+export function validateRecordInput(value, limits) {
+    const exact = inspectExactProperties(value, [
+        "contextId",
+        "recordId",
+        "payload",
+        "profile",
+        "algorithm",
+    ]);
+    if (exact === undefined)
+        return inputFailure(limits);
+    const [contextIdInput, recordIdInput, payload, profileInput, algorithmInput] = exact;
+    const contextId = validateContextId(contextIdInput);
+    const recordId = validateRecordId(recordIdInput);
+    const profile = validateProfile(profileInput, limits);
+    const algorithm = validateAlgorithmId(algorithmInput);
+    if (!contextId.ok)
+        return contextId;
+    if (!recordId.ok)
+        return recordId;
+    if (!profile.ok)
+        return profile;
+    if (!algorithm.ok)
+        return algorithm;
+    return success(Object.freeze({
+        contextId: contextId.value.value,
+        recordId: recordId.value.value,
+        payload,
+        profile: profile.value,
+        algorithm: algorithm.value,
+    }));
+}
+export function validateProfile(value, limits) {
+    void limits;
+    const exact = inspectExactProperties(value, ["id", "version"]);
+    if (exact === undefined)
+        return inputFailure(limits);
+    const [idInput, versionInput] = exact;
+    const id = validateProfileId(idInput);
+    const version = validateProfileVersion(versionInput);
+    if (!id.ok)
+        return id;
+    if (!version.ok)
+        return version;
+    return success(Object.freeze({ id: id.value.value, version: version.value.value }));
+}
+export function freezeRecordEvidence(value) {
+    return Object.freeze(value);
+}
+function validateProfileReference(input, options) {
+    return options.profiles.resolveValidated(input.profile);
+}
+function inputPayloadIsBytes(value) {
+    return value instanceof Uint8Array;
+}
+function isBuiltinRawProfile(profile) {
+    return profile.id.value === "dev.noeos.raw-bytes";
+}
+function freezeInputView(value) {
+    return Object.freeze({
+        contextId: value.contextId,
+        recordId: value.recordId,
+        profile: Object.freeze({ ...value.profile }),
+        algorithm: value.algorithm,
+    });
+}
+function sameDigest(expected, actual, algorithm) {
+    const left = hexToDigest(expected, algorithm);
+    const right = hexToDigest(actual, algorithm);
+    return left !== undefined && right !== undefined && equalDigest(left, right);
+}
+function hexToDigest(value, algorithm) {
+    const result = validateDigest(value, algorithm);
+    return result.ok ? result.value : undefined;
+}
+function addAll(collector, diagnostics) {
+    if (diagnostics === undefined)
+        return;
+    for (const diagnostic of diagnostics)
+        collector.add(diagnostic);
+}
+function inputFailure(limits) {
+    const collector = new DiagnosticCollector(limits);
+    collector.addCode("INPUT_TYPE_INVALID", "input");
+    return failure(collector.finish());
+}

package/dist/esm/rules/rule-set.js

@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: Apache-2.0
+import { failure, success } from "../domain/operation-result.js";
+import { createDiagnostic, DiagnosticCollector, } from "../validation/diagnostic-collector.js";
+import { inspectPlainObject } from "../validation/object-inspection.js";
+import { validateProfileVersion } from "../validation/version-validation.js";
+const ruleIdPattern = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
+const EMPTY_DIAGNOSTICS = Object.freeze([]);
+export class RuleSet {
+    rules;
+    constructor(rules) {
+        this.rules = rules;
+        Object.freeze(this);
+    }
+    static create(value, limits) {
+        if (value === undefined)
+            return success(new RuleSet(Object.freeze([])));
+        if (!Array.isArray(value))
+            return ruleFailure("RULE_VERSION_CONFLICT", limits);
+        const rules = [];
+        const keys = new Set();
+        for (const candidate of value) {
+            const validated = validateRule(candidate, limits);
+            if (!validated.ok)
+                return validated;
+            const key = `${validated.value.id}\u0000${validated.value.version}`;
+            if (keys.has(key))
+                return ruleFailure("RULE_VERSION_CONFLICT", limits);
+            keys.add(key);
+            rules.push(validated.value);
+        }
+        rules.sort((left, right) => compareText(left.id, right.id) || compareText(left.version, right.version));
+        return success(new RuleSet(Object.freeze(rules)));
+    }
+    evaluate(context, limits) {
+        if (this.rules.length === 0)
+            return EMPTY_DIAGNOSTICS;
+        const collector = new DiagnosticCollector(limits);
+        for (const rule of this.rules) {
+            if (!rule.phases.includes(context.phase))
+                continue;
+            try {
+                const findings = rule.evaluate(context);
+                if (!Array.isArray(findings)) {
+                    collector.addCode("RULE_EXECUTION_FAILED", context.phase, failureOptions(context, "RULE_RESULT_INVALID"));
+                    continue;
+                }
+                for (const finding of findings) {
+                    const diagnostic = toDiagnostic(rule, finding, context);
+                    if (diagnostic === undefined) {
+                        collector.addCode("RULE_EXECUTION_FAILED", context.phase, failureOptions(context, "RULE_RESULT_INVALID"));
+                    }
+                    else {
+                        collector.add(diagnostic);
+                    }
+                }
+            }
+            catch {
+                collector.addCode("RULE_EXECUTION_FAILED", context.phase, failureOptions(context, "RULE_EVALUATION_FAILED"));
+            }
+        }
+        return collector.finish();
+    }
+    hasRules() {
+        return this.rules.length !== 0;
+    }
+    toArray() {
+        return this.rules;
+    }
+}
+export function createReadonlyByteView(bytes) {
+    const copy = Uint8Array.from(bytes);
+    return Object.freeze({
+        byteLength: copy.length,
+        copySlice(start, end) {
+            return Uint8Array.from(copy.slice(start, end));
+        },
+    });
+}
+function validateRule(value, limits) {
+    const entries = inspectPlainObject(value);
+    if (entries === undefined)
+        return ruleFailure("RULE_VERSION_CONFLICT", limits);
+    const fields = new Map(entries);
+    if (fields.size !== 5 ||
+        !fields.has("id") ||
+        !fields.has("version") ||
+        !fields.has("phases") ||
+        !fields.has("defaultSeverity") ||
+        !fields.has("evaluate")) {
+        return ruleFailure("RULE_VERSION_CONFLICT", limits);
+    }
+    const id = fields.get("id");
+    const version = fields.get("version");
+    const phases = fields.get("phases");
+    const defaultSeverity = fields.get("defaultSeverity");
+    const evaluate = fields.get("evaluate");
+    if (typeof id !== "string" || !ruleIdPattern.test(id) || id.length > 128) {
+        return ruleFailure("RULE_VERSION_CONFLICT", limits);
+    }
+    const validatedVersion = validateProfileVersion(version);
+    if (!validatedVersion.ok || !Array.isArray(phases) || typeof evaluate !== "function") {
+        return ruleFailure("RULE_VERSION_CONFLICT", limits);
+    }
+    if (defaultSeverity !== "error" && defaultSeverity !== "warning" && defaultSeverity !== "info") {
+        return ruleFailure("RULE_VERSION_CONFLICT", limits);
+    }
+    const normalizedPhases = [];
+    for (const phase of phases) {
+        if (!isRulePhase(phase) || normalizedPhases.includes(phase)) {
+            return ruleFailure("RULE_VERSION_CONFLICT", limits);
+        }
+        normalizedPhases.push(phase);
+    }
+    if (normalizedPhases.length === 0)
+        return ruleFailure("RULE_VERSION_CONFLICT", limits);
+    return success(Object.freeze({
+        id,
+        version: validatedVersion.value.value,
+        phases: Object.freeze([...normalizedPhases]),
+        defaultSeverity,
+        evaluate(context) {
+            return Reflect.apply(evaluate, undefined, [context]);
+        },
+    }));
+}
+function toDiagnostic(rule, value, context) {
+    const entries = inspectPlainObject(value);
+    if (entries === undefined)
+        return undefined;
+    const fields = new Map(entries);
+    for (const key of fields.keys()) {
+        if (key !== "messageKey" && key !== "path" && key !== "details" && key !== "severity")
+            return undefined;
+    }
+    const messageKey = fields.get("messageKey");
+    const path = fields.get("path");
+    const details = fields.get("details");
+    const severity = fields.get("severity");
+    if (typeof messageKey !== "string")
+        return undefined;
+    if (path !== undefined && typeof path !== "string")
+        return undefined;
+    if (severity !== undefined &&
+        severity !== "error" &&
+        severity !== "warning" &&
+        severity !== "info") {
+        return undefined;
+    }
+    const ruleDetails = {
+        "rule-id": rule.id,
+        "rule-version": rule.version,
+    };
+    if (details !== undefined) {
+        const detailEntries = inspectPlainObject(details);
+        if (detailEntries === undefined)
+            return undefined;
+        for (const [key, item] of detailEntries) {
+            if (key === "rule-id" || key === "rule-version")
+                return undefined;
+            if (item !== null &&
+                typeof item !== "string" &&
+                typeof item !== "number" &&
+                typeof item !== "boolean") {
+                return undefined;
+            }
+            ruleDetails[key] = item;
+        }
+    }
+    return createDiagnostic("RULE_FAILED", context.phase, {
+        messageKey,
+        details: ruleDetails,
+        severity: severity ?? rule.defaultSeverity,
+        ...optionalDiagnosticFields(context, path),
+    });
+}
+function isRulePhase(value) {
+    return (value === "input" ||
+        value === "normalization" ||
+        value === "record" ||
+        value === "link" ||
+        value === "chain");
+}
+function ruleFailure(code, limits) {
+    void limits;
+    return failure([createDiagnostic(code, "input")]);
+}
+function failureOptions(context, causeCode) {
+    return {
+        causeCode,
+        ...optionalDiagnosticFields(context),
+    };
+}
+function optionalDiagnosticFields(context, path) {
+    return {
+        ...(path === undefined ? {} : { path }),
+        ...(context.recordId === undefined ? {} : { recordId: context.recordId }),
+        ...(context.position === undefined ? {} : { position: context.position }),
+    };
+}
+function compareText(left, right) {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}

package/dist/esm/schemas.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export { SCHEMA_ASSETS } from "./contracts/schema-assets.js";

package/dist/esm/validation/algorithm-validation.js

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: Apache-2.0
+import { success } from "../domain/operation-result.js";
+import { failureWithCode } from "./result-helpers.js";
+export function validateAlgorithmId(value) {
+    if (value === "sha-256" || value === "sha-384" || value === "sha-512") {
+        return success(value);
+    }
+    return failureWithCode("ALGORITHM_UNKNOWN", "input");
+}

package/dist/esm/validation/diagnostic-collector.js

@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: Apache-2.0
+import { DIAGNOSTIC_CODES } from "../contracts/generated.js";
+import { DIAGNOSTIC_SCHEMA } from "../domain/diagnostic.js";
+import { isDataPropertyDescriptor } from "./object-inspection.js";
+export function createDiagnostic(code, phase, options = {}) {
+    const metadata = DIAGNOSTIC_CODES.find((entry) => entry.code === code);
+    if (metadata === undefined) {
+        throw new Error(`Unknown generated diagnostic code: ${code}`);
+    }
+    const details = options.details === undefined ? undefined : tryCopyDetails(options.details);
+    const path = safePath(options.path);
+    const recordId = safeString(options.recordId, /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u, 128);
+    const causeCode = safeString(options.causeCode, /^[A-Z][A-Z0-9_]{1,127}$/u, 128);
+    const position = safePosition(options.position);
+    const diagnostic = {
+        $schema: DIAGNOSTIC_SCHEMA,
+        code,
+        severity: code === "RULE_FAILED" && options.severity !== undefined
+            ? options.severity
+            : metadata.severity,
+        phase,
+        messageKey: safeString(options.messageKey, /^[a-z][a-z0-9.-]{0,127}$/u, 128) ??
+            code.toLowerCase().replaceAll("_", "."),
+        ...(path === undefined ? {} : { path }),
+        ...(recordId === undefined ? {} : { recordId }),
+        ...(position === undefined ? {} : { position }),
+        ...(details === undefined ? {} : { details }),
+        ...(causeCode === undefined ? {} : { causeCode }),
+    };
+    return Object.freeze(diagnostic);
+}
+function tryCopyDetails(value) {
+    try {
+        return copyDetails(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function safeString(value, pattern, maxLength) {
+    return typeof value === "string" && value.length <= maxLength && pattern.test(value)
+        ? value
+        : undefined;
+}
+function safePath(value) {
+    if (typeof value !== "string" || value.length > 512) {
+        return undefined;
+    }
+    if (value === "" || /^[a-z][a-z0-9.-]{0,127}$/u.test(value)) {
+        return value;
+    }
+    if (!value.startsWith("/")) {
+        return undefined;
+    }
+    const segments = value.split("/");
+    return segments.slice(1).every(isJsonPointerSegment) ? value : undefined;
+}
+function isJsonPointerSegment(segment) {
+    if (segment.length === 0) {
+        return false;
+    }
+    for (let index = 0; index < segment.length; index += 1) {
+        const character = segment[index];
+        if (character === "~") {
+            const escape = segment[index + 1];
+            if (escape !== "0" && escape !== "1") {
+                return false;
+            }
+            index += 1;
+            continue;
+        }
+        if (character === undefined || !/[A-Za-z0-9._~-]/u.test(character)) {
+            return false;
+        }
+    }
+    return true;
+}
+function safePosition(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
+function copyDetails(value) {
+    const keys = Object.keys(value);
+    if (Object.getOwnPropertySymbols(value).length !== 0 || keys.length > 32) {
+        throw new Error("invalid diagnostic details");
+    }
+    const output = {};
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!/^[a-z][a-z0-9.-]{0,63}$/u.test(key) ||
+            descriptor === undefined ||
+            !isDataPropertyDescriptor(descriptor)) {
+            throw new Error("invalid diagnostic details");
+        }
+        const detail = descriptor.value;
+        if (detail !== null &&
+            typeof detail !== "boolean" &&
+            (typeof detail !== "number" || !Number.isFinite(detail)) &&
+            (typeof detail !== "string" || detail.length > 256)) {
+            throw new Error("invalid diagnostic details");
+        }
+        Object.defineProperty(output, key, {
+            configurable: false,
+            enumerable: true,
+            value: detail,
+            writable: false,
+        });
+    }
+    return Object.freeze(output);
+}
+export class DiagnosticCollector {
+    limits;
+    entries = [];
+    truncated = false;
+    constructor(limits) {
+        this.limits = limits;
+    }
+    add(diagnostic) {
+        if (this.entries.length < this.limits.maxDiagnostics) {
+            this.entries.push(diagnostic);
+            return;
+        }
+        if (!this.truncated) {
+            this.truncated = true;
+            this.entries[this.entries.length - 1] = createDiagnostic("DIAGNOSTIC_LIMIT_REACHED", "output");
+        }
+    }
+    addCode(code, phase, options) {
+        this.add(createDiagnostic(code, phase, options));
+    }
+    hasErrors() {
+        return this.entries.some(({ severity }) => severity === "error");
+    }
+    finish() {
+        if (this.entries.length === 0)
+            return Object.freeze([]);
+        const sorted = [...this.entries].sort(compareDiagnostics);
+        return Object.freeze(sorted);
+    }
+}
+function compareDiagnostics(left, right) {
+    const leftPosition = left.position ?? Number.MAX_SAFE_INTEGER;
+    const rightPosition = right.position ?? Number.MAX_SAFE_INTEGER;
+    return (leftPosition - rightPosition ||
+        compareText(left.phase, right.phase) ||
+        compareText(left.code, right.code) ||
+        compareText(left.path ?? "", right.path ?? ""));
+}
+function compareText(left, right) {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}

package/dist/esm/validation/digest-validation.js

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Apache-2.0
+import { Digest } from "../domain/digest.js";
+import { success } from "../domain/operation-result.js";
+import { failureWithCode } from "./result-helpers.js";
+import { validateAlgorithmId } from "./algorithm-validation.js";
+const digestLengths = Object.freeze({
+    "sha-256": 32,
+    "sha-384": 48,
+    "sha-512": 64,
+});
+export function digestLength(algorithm) {
+    return digestLengths[algorithm];
+}
+export function validateDigest(value, algorithm) {
+    const algorithmResult = validateAlgorithmId(algorithm);
+    if (!algorithmResult.ok)
+        return algorithmResult;
+    if (typeof value !== "string" || !/^(?:[0-9a-f]{2})+$/u.test(value)) {
+        return failureWithCode("DIGEST_ENCODING_INVALID", "input");
+    }
+    const expectedLength = digestLength(algorithmResult.value) * 2;
+    if (value.length !== expectedLength) {
+        return failureWithCode("DIGEST_LENGTH_INVALID", "input");
+    }
+    const bytes = new Uint8Array(expectedLength / 2);
+    for (let index = 0; index < bytes.length; index += 1) {
+        bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+    }
+    return success(Digest.fromValidated(algorithmResult.value, bytes));
+}
+export function equalDigest(left, right) {
+    if (left.algorithm !== right.algorithm)
+        return false;
+    const leftBytes = left.toBytes();
+    const rightBytes = right.toBytes();
+    const leftView = new DataView(leftBytes.buffer, leftBytes.byteOffset, leftBytes.byteLength);
+    const rightView = new DataView(rightBytes.buffer, rightBytes.byteOffset, rightBytes.byteLength);
+    let difference = 0;
+    for (let index = 0; index < leftBytes.length; index += 1) {
+        difference |= leftView.getUint8(index) ^ rightView.getUint8(index);
+    }
+    return difference === 0;
+}