@openlfcp/wire 0.1.0-rc.1

package/dist/capability.js

@@ -0,0 +1,409 @@
+import { bytesEqual, controlRecordId, toHex, } from "@openlfcp/core";
+import { parseOwnerTransferAccept, parseOwnerTransferOffer, } from "./control.js";
+import { objectId, verifySignedObject } from "./cose.js";
+/**
+ * The LFCP capability engine (LFCP-WIRE-01 §17, §18, §20, §19, §25.2).
+ *
+ * Authority comes only from the validated Control Chain: a Principal ID
+ * holds an ability at a Control Head H because of the owner rule or of
+ * grants and claims committed through H. There is no server account,
+ * user table or hosting identity anywhere in this module, and nothing
+ * here takes one.
+ *
+ * Everything is a pure function of a ControlState (the state at some head
+ * H). Evaluating at an older H means using the state at that H (see
+ * `stateAt` on a linear chain result), so a later revocation never
+ * changes an earlier answer.
+ */
+/** §17.1 standard ability codes. */
+export const ABILITY = Object.freeze({
+    DATA_READ: 1n,
+    DATA_WRITE: 2n,
+    SNAPSHOT_PUBLISH: 3n,
+    CAPABILITY_GRANT: 4n,
+    CAPABILITY_REVOKE: 5n,
+    KEY_DISTRIBUTE: 6n,
+    KEY_ROTATE: 7n,
+    ROUTE_UPDATE: 8n,
+    OWNER_TRANSFER_OFFER: 9n,
+    RESOURCE_TOMBSTONE: 10n,
+    INVITE_CLAIM: 11n,
+});
+/** §17.1 names of the standard codes. */
+export const ABILITY_NAMES = new Map([
+    [1n, "data/read"],
+    [2n, "data/write"],
+    [3n, "snapshot/publish"],
+    [4n, "capability/grant"],
+    [5n, "capability/revoke"],
+    [6n, "key/distribute"],
+    [7n, "key/rotate"],
+    [8n, "route/update"],
+    [9n, "owner/transfer-offer"],
+    [10n, "resource/tombstone"],
+    [11n, "invite/claim"],
+]);
+/**
+ * Whether `ability` is a §17.1 standard code. §17.1: "A code that is not in
+ * the table above is kept as received and confers nothing", so an unknown
+ * code is kept in its record but is never held.
+ */
+export const isStandardAbility = (ability) => ABILITY_NAMES.has(ability);
+/**
+ * Whether holding `ability` can mean anything: a standard code other than
+ * 9. §17.1: "9 | owner/transfer-offer (reserved; confers nothing in
+ * WIRE-01)"; §23.1: "Only the current owner creates offers."
+ */
+const confers = (ability) => isStandardAbility(ability) && ability !== ABILITY.OWNER_TRANSFER_OFFER;
+const key = (id) => toHex(id);
+/**
+ * Whether a grant is active at this state. §17.2: "A grant is active while
+ * it has not been revoked and, when it has a parent grant, while that
+ * parent is active. Revoking a grant therefore also deactivates every grant
+ * delegated from it, directly or through further delegations."
+ */
+export function isGrantActive(state, grantId) {
+    const seen = new Set();
+    let grant = state.grants.get(key(grantId));
+    while (grant !== undefined) {
+        if (grant.revokedBy !== null)
+            return false;
+        if (grant.parentGrantId === null)
+            return true;
+        if (seen.has(key(grant.id)))
+            return false;
+        seen.add(key(grant.id));
+        grant = state.grants.get(key(grant.parentGrantId));
+    }
+    return false;
+}
+const isOwner = (state, principal) => bytesEqual(state.owner.principalId, principal);
+/**
+ * Whether an invitation grant's claims are used up. §18.1: "An Invitation
+ * Grant whose claims are used up confers no invite/claim; its other
+ * abilities stay active until it is revoked."
+ */
+const claimsExhausted = (g) => g.claimLimit !== null && g.claimsUsed >= g.claimLimit;
+/** Whether grant `g` confers `ability` at this state: it lists it, is active, and (for invite/claim) is not used up. */
+function grantConfers(state, g, ability) {
+    if (!g.abilities.includes(ability) || !isGrantActive(state, g.id))
+        return false;
+    return ability !== ABILITY.INVITE_CLAIM || !claimsExhausted(g);
+}
+/**
+ * Whether `principal` holds `ability` at the head of `state`: the owner
+ * holds every standard ability implicitly (§17.1, no self-grant); anyone
+ * else holds it through an active grant that confers it. Unknown codes and
+ * the reserved ability 9 are held by no one (§17.1, §23.1).
+ */
+export function hasAbility(state, principal, ability) {
+    if (!confers(ability))
+        return false;
+    if (isOwner(state, principal))
+        return true;
+    for (const g of state.grants.values())
+        if (bytesEqual(g.subject, principal) && grantConfers(state, g, ability))
+            return true;
+    return false;
+}
+/** Every standard ability `principal` holds at the head of `state`, ascending. */
+export function abilitiesOf(state, principal) {
+    return [...ABILITY_NAMES.keys()].filter((a) => hasAbility(state, principal, a));
+}
+const ALLOW = Object.freeze({ allowed: true });
+const deny = (reason) => Object.freeze({ allowed: false, reason });
+const badSignature = (reason) => Object.freeze({ allowed: false, reason, code: "INVALID_SIGNATURE" });
+const subset = (list, of) => list.every((a) => of.includes(a));
+/**
+ * §17.3: revoke authority "covers a grant when the revoker issued it, or
+ * when it was delegated, directly or through further delegations, from a
+ * grant the revoker issued. A grant the revoker received is not covered
+ * unless the revoker also issued one of its ancestors."
+ */
+function covers(state, target, revoker) {
+    const seen = new Set();
+    let grant = target;
+    while (grant !== undefined && !seen.has(key(grant.id))) {
+        if (bytesEqual(grant.issuer, revoker))
+            return true;
+        seen.add(key(grant.id));
+        grant = grant.parentGrantId === null ? undefined : state.grants.get(key(grant.parentGrantId));
+    }
+    return false;
+}
+/**
+ * Whether the issuer of `record` had the authority the record needs, at
+ * the state before it (the chain's previous head). Genesis is authorized by
+ * verifyGenesis. Coordinator Recovery and Resource Tombstone records never
+ * get here: the chain refuses them first (DV1).
+ */
+export function authorizeControlRecord(record, state) {
+    const issuer = record.payload.issuer;
+    const body = record.body;
+    switch (body.type) {
+        case "GENESIS":
+            return ALLOW;
+        case "CAPABILITY_GRANT": {
+            // §17.2: "The owner MAY grant any abilities without a parent grant. A
+            // non-owner issuer MUST hold capability/grant and MUST reference a
+            // parent grant." "If parent grant id is present: the parent grant
+            // MUST be active; the issuer MUST be the subject of the parent grant;
+            // every granted ability MUST be included in the parent's delegable
+            // abilities; every delegable ability of the new grant MUST also be
+            // included in the parent's delegable abilities."
+            if (body.parentGrantId !== undefined) {
+                const parent = state.grants.get(key(body.parentGrantId));
+                if (parent === undefined)
+                    return deny("the parent grant does not exist (§17.2)");
+                if (!isGrantActive(state, parent.id))
+                    return deny("the parent grant is not active (§17.2)");
+                if (!bytesEqual(parent.subject, issuer))
+                    return deny("the issuer is not the subject of the parent grant (§17.2)");
+                if (!subset(body.abilities, parent.delegable))
+                    return deny("a granted ability is not delegable under the parent grant (§17.2)");
+                if (!subset(body.delegable, parent.delegable))
+                    return deny("a delegable ability is not delegable under the parent grant (§17.2)");
+            }
+            else if (!isOwner(state, issuer)) {
+                return deny("a non-owner grant must prove its authority through a parent grant (§17.2)");
+            }
+            if (!isOwner(state, issuer) && !hasAbility(state, issuer, ABILITY.CAPABILITY_GRANT))
+                return deny("the issuer does not hold capability/grant (§17.2)");
+            return ALLOW;
+        }
+        case "CAPABILITY_REVOKE": {
+            // §17.3, in order: the target exists, the issuer's authority covers
+            // it, it is not already revoked. Each failure is AUTHORIZATION_FAILED.
+            const target = state.grants.get(key(body.grantId));
+            if (target === undefined)
+                return deny("the revoked grant does not exist (§17.3)");
+            // "The owner may revoke any grant." Otherwise the issuer MUST "possess
+            // capability/revoke authority that covers the target grant".
+            if (!isOwner(state, issuer)) {
+                if (!hasAbility(state, issuer, ABILITY.CAPABILITY_REVOKE))
+                    return deny("the issuer does not hold capability/revoke (§17.3)");
+                if (!covers(state, target, issuer))
+                    return deny("the issuer's capability/revoke authority does not cover the grant (§17.3)");
+            }
+            if (target.revokedBy !== null)
+                return deny("the grant is already revoked (§17.3)");
+            return ALLOW;
+        }
+        case "CAPABILITY_CLAIM": {
+            // §18.1 validation rules 1-5 (rule 6, coordinator serialization, is LFCP-022).
+            const invitation = state.grants.get(key(body.invitationGrantId));
+            if (invitation === undefined)
+                return deny("the invitation grant does not exist (§18.1)");
+            if (!isGrantActive(state, invitation.id))
+                return deny("the invitation grant is not active (§18.1 rule 1)");
+            if (!invitation.abilities.includes(ABILITY.INVITE_CLAIM))
+                return deny("the invitation grant does not grant invite/claim (§18.1 rule 2)");
+            // §18: "Only an invitation grant with a claim_limit can be claimed: one
+            // without claim_limit is not claimable."
+            if (invitation.claimLimit === null)
+                return deny("the invitation grant has no claim_limit and is not claimable (§18)");
+            if (claimsExhausted(invitation))
+                return Object.freeze({
+                    allowed: false,
+                    reason: "the invitation grant has no claims left (§18.1 rule 3)",
+                    code: "INVITE_CLAIM_EXHAUSTED",
+                });
+            if (!bytesEqual(invitation.subject, issuer))
+                return deny("the claim issuer is not the Invitation Principal (§18.1 rule 5)");
+            // Rule 4: a subset of the invitation's abilities, excluding invite/claim
+            // unless the invitation explicitly delegates it. Unknown codes confer
+            // nothing (§17.1), so they request nothing and are not checked.
+            const transferable = invitation.abilities.filter((a) => a !== ABILITY.INVITE_CLAIM || invitation.delegable.includes(ABILITY.INVITE_CLAIM));
+            if (!subset(body.abilities.filter(isStandardAbility), transferable))
+                return deny("the claim requests abilities beyond the invitation grant (§18.1 rule 4)");
+            return ALLOW;
+        }
+        case "KEY_EPOCH":
+            // §19: "The issuer MUST possess key/rotate."
+            return hasAbility(state, issuer, ABILITY.KEY_ROTATE)
+                ? ALLOW
+                : deny("the issuer does not hold key/rotate (§19)");
+        case "OWNER_TRANSFER_COMMIT":
+            return verifyOwnerTransfer(record, state).authorization;
+        case "ROUTE_UPDATE":
+            // §20: "The issuer MUST possess route/update"; "Each Route Update MUST
+            // carry a route version strictly greater than the current one: 0 after
+            // Genesis (Section 15), otherwise the version of the last committed
+            // Route Update." §20 names no code: AUTHORIZATION_FAILED here.
+            if (!hasAbility(state, issuer, ABILITY.ROUTE_UPDATE))
+                return deny("the issuer does not hold route/update (§20)");
+            return body.routeVersion > state.routeVersion
+                ? ALLOW
+                : deny("the route version does not increase (§20)");
+        case "EXTENSION":
+            // §14: "A Control Record of an extension type (32 or above) requires
+            // owner authority: its issuer MUST be the Resource owner at the
+            // record's position in the chain, whether or not the receiver supports
+            // the extension." §14 names no code: AUTHORIZATION_FAILED here.
+            return isOwner(state, issuer)
+                ? ALLOW
+                : deny("an extension record must be issued by the owner (§14)");
+        case "COORDINATOR_RECOVERY":
+        case "RESOURCE_TOMBSTONE":
+            return deny(`${body.type} is refused in MVP 0.1 (scope §4, DV1)`);
+    }
+}
+/** The capability transitions of an applied record (called by applyRecord). */
+export function applyCapabilities(grants, record) {
+    const body = record.body;
+    const id = controlRecordId(record.signed.id);
+    switch (body.type) {
+        case "CAPABILITY_GRANT": {
+            const next = new Map(grants);
+            next.set(key(id), Object.freeze({
+                id,
+                source: "grant",
+                issuer: record.payload.issuer,
+                subject: body.subject.principalId,
+                abilities: body.abilities,
+                delegable: body.delegable,
+                parentGrantId: body.parentGrantId ?? null,
+                claimLimit: body.claimLimit ?? null,
+                claimsUsed: 0n,
+                revokedBy: null,
+            }));
+            return next;
+        }
+        case "CAPABILITY_REVOKE": {
+            const target = grants.get(key(body.grantId));
+            if (target === undefined)
+                return grants;
+            const next = new Map(grants);
+            next.set(key(target.id), Object.freeze({ ...target, revokedBy: id }));
+            return next;
+        }
+        case "CAPABILITY_CLAIM": {
+            // §18.1: "A successful claim creates a new capability grant to the
+            // claimant [and] consumes one claim from the Invitation Grant." "The
+            // grant a claim creates is identified by the claim record's Control
+            // Record ID. Its subject is the claimant and its abilities are the
+            // claimed abilities; it has no parent grant and an empty delegable
+            // list, so revoking the Invitation Grant later does not revoke it."
+            const invitation = grants.get(key(body.invitationGrantId));
+            const next = new Map(grants);
+            if (invitation !== undefined)
+                next.set(key(invitation.id), Object.freeze({ ...invitation, claimsUsed: invitation.claimsUsed + 1n }));
+            next.set(key(id), Object.freeze({
+                id,
+                source: "claim",
+                issuer: record.payload.issuer,
+                subject: body.claimant.principalId,
+                abilities: body.abilities,
+                delegable: [],
+                parentGrantId: null,
+                claimLimit: null,
+                claimsUsed: 0n,
+                revokedBy: null,
+            }));
+            return next;
+        }
+        default:
+            return grants;
+    }
+}
+/**
+ * §25.2 Key Package authority at the package's referenced Control Head:
+ * the sender must hold key/distribute, and the recipient must hold
+ * data/read, "except for an Invitation Principal explicitly authorized by
+ * an active invite grant: a recipient that is the subject of an active
+ * grant that includes and still confers invite/claim". `epoch` is the
+ * package's Data Epoch; whether that epoch is recognized at the head is
+ * checked with the epoch rules (LFCP-023, LFCP-024).
+ */
+export function canDistributeKey(state, sender, recipient, _epoch) {
+    if (!hasAbility(state, sender, ABILITY.KEY_DISTRIBUTE))
+        return deny("the sender does not hold key/distribute (§25.2)");
+    if (hasAbility(state, recipient, ABILITY.DATA_READ))
+        return ALLOW;
+    if (hasAbility(state, recipient, ABILITY.INVITE_CLAIM))
+        return ALLOW;
+    return deny("the recipient holds neither data/read nor an active invite grant (§25.2)");
+}
+/**
+ * The §23.3 verifier for an OWNER_TRANSFER_COMMIT, at the state before it.
+ * Verification only: there is no transfer UI or flow (deferred from MVP 0.1).
+ *
+ * §23.3 "A verifier MUST confirm":
+ *  1. the offer is signed by the current owner;
+ *  2. the offer references the current Control Head;
+ *  3. the offer names the accepting Principal;
+ *  4. the acceptance is signed by that Principal;
+ *  5. the commit itself is signed by that Principal (here: issued by it;
+ *     the chain verifies the signature against the issuer);
+ *  6. the expected next Control Sequence matches the commit sequence.
+ * Also, from §23.1 and §23.2: the offer and accept are canonical signed
+ * objects of this Resource, and the accept names the exact offer ID (the
+ * §10.6 object ID of the offer bytes). §23.3: "A commit that fails any of
+ * these checks is rejected with AUTHORIZATION_FAILED, except that an offer
+ * or acceptance whose signature does not verify is rejected with
+ * INVALID_SIGNATURE" (the refusal's code).
+ */
+export function verifyOwnerTransfer(record, state) {
+    const body = record.body;
+    if (body.type !== "OWNER_TRANSFER_COMMIT")
+        return { authorization: deny("not an ownership transfer commit") };
+    let offer;
+    let accept;
+    try {
+        offer = parseOwnerTransferOffer(body.offer);
+        accept = parseOwnerTransferAccept(body.accept);
+    }
+    catch {
+        return {
+            authorization: deny("the offer or accept is not a valid signed object (§23.1, §23.2)"),
+        };
+    }
+    const o = offer.payload;
+    const a = accept.payload;
+    if (!bytesEqual(o.resourceId, state.resourceId) || !bytesEqual(a.resourceId, state.resourceId))
+        return { authorization: deny("the offer or accept is for another Resource (§23.1, §23.2)") };
+    const offerSigned = verifySignedObject(offer.signed, state.owner);
+    if (!offerSigned.valid)
+        return {
+            authorization: badSignature(`the offer is not signed by the current owner (${offerSigned.reason}, §23.3 rule 1)`),
+        };
+    if (!bytesEqual(o.controlHead, state.head))
+        return {
+            authorization: deny("the offer does not reference the current Control Head (§23.3 rule 2)"),
+        };
+    if (!bytesEqual(a.newOwner, o.proposedOwner.principalId))
+        return {
+            authorization: deny("the accept is not by the Principal the offer names (§23.3 rule 3)"),
+        };
+    if (!bytesEqual(a.offerId, objectId(offer.signed.bytes)))
+        return { authorization: deny("the accept does not name this offer (§23.2)") };
+    const acceptSigned = verifySignedObject(accept.signed, o.proposedOwner);
+    if (!acceptSigned.valid)
+        return {
+            authorization: badSignature(`the accept is not signed by the new owner (${acceptSigned.reason}, §23.3 rule 4)`),
+        };
+    if (!bytesEqual(record.payload.issuer, o.proposedOwner.principalId))
+        return { authorization: deny("the commit is not issued by the new owner (§23.3 rule 5)") };
+    if (o.expectedControlSeq !== record.payload.controlSeq)
+        return {
+            authorization: deny("the offer's expected Control Sequence is not the commit's (§23.3 rule 6)"),
+        };
+    return { authorization: ALLOW, newOwner: o.proposedOwner };
+}
+/**
+ * The descriptor a transfer commit carries for its own issuer: the offer's
+ * proposed owner (self-certifying, §7), so a new owner never granted
+ * before can still be verified. Undefined for other records.
+ */
+export function transferIssuerDescriptor(record) {
+    if (record.body.type !== "OWNER_TRANSFER_COMMIT")
+        return undefined;
+    try {
+        const proposed = parseOwnerTransferOffer(record.body.offer).payload.proposedOwner;
+        return bytesEqual(proposed.principalId, record.payload.issuer) ? proposed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=capability.js.map

package/dist/cbor/decode.d.ts

@@ -0,0 +1,23 @@
+import { type CborMap, type CborValue } from "./value.js";
+/**
+ * Decodes exactly one deterministic CBOR item (LFCP-WIRE-01 §5.2) and
+ * rejects anything else: indefinite lengths, non-shortest heads, unsorted
+ * or duplicate map keys, tags, floats and other simple values, invalid
+ * UTF-8, truncated input and trailing bytes.
+ */
+export declare function decodeStrict(bytes: Uint8Array): CborValue;
+/**
+ * The §5.2 receiver check: `bytes` decode strictly and re-encode to exactly
+ * the same bytes. Signature and object-ID checks still use the received
+ * bytes; this only decides whether they are the deterministic encoding.
+ */
+/**
+ * Strict decode plus the §5.2 re-encode comparison (N7): the bytes must be
+ * well-formed (CBOR_* errors from `decodeStrict` otherwise) and exactly the
+ * deterministic encoding of their value (CBOR_NON_CANONICAL otherwise). The
+ * re-encoding is only compared, never returned.
+ */
+export declare function decodeDeterministic(bytes: Uint8Array): CborValue;
+export declare function isDeterministic(bytes: Uint8Array): boolean;
+export type { CborMap };
+//# sourceMappingURL=decode.d.ts.map

package/dist/cbor/decode.js

@@ -0,0 +1,163 @@
+import { bytesEqual, LfcpError } from "@openlfcp/core";
+import { compareEncodedKeys, encode } from "./encode.js";
+import { strictUtf8Decoder } from "./text.js";
+import { cborMap, MAX_DEPTH } from "./value.js";
+const MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
+const asInteger = (v) => (v <= MAX_SAFE && v >= -MAX_SAFE ? Number(v) : v);
+class Reader {
+    bytes;
+    pos = 0;
+    constructor(bytes) {
+        this.bytes = bytes;
+    }
+    need(n) {
+        if (BigInt(this.pos) + BigInt(n) > BigInt(this.bytes.length))
+            throw new LfcpError("CBOR_TRUNCATED", "input ends inside an item");
+        return Number(n);
+    }
+    byte() {
+        this.need(1);
+        return this.bytes[this.pos++];
+    }
+    take(n) {
+        this.need(n);
+        const out = this.bytes.slice(this.pos, this.pos + n);
+        this.pos += n;
+        return out;
+    }
+    /** Reads an argument and enforces the shortest form (§5.2 rule 1). */
+    argument(ai) {
+        if (ai < 24)
+            return BigInt(ai);
+        if (ai === 31)
+            throw new LfcpError("CBOR_INDEFINITE_LENGTH", "indefinite lengths are not allowed (§5.2 rule 2)");
+        if (ai > 27)
+            throw new LfcpError("CBOR_UNSUPPORTED_TYPE", "reserved additional information value");
+        const size = 1 << (ai - 24);
+        let v = 0n;
+        for (const b of this.take(size))
+            v = (v << 8n) | BigInt(b);
+        const floor = [24n, 0x100n, 0x10000n, 0x100000000n][ai - 24];
+        if (v < floor)
+            throw new LfcpError("CBOR_NON_CANONICAL", "integer or length not in its shortest form");
+        return v;
+    }
+}
+function readKey(r, depth) {
+    const v = readValue(r, depth);
+    if (typeof v === "number" ||
+        typeof v === "bigint" ||
+        typeof v === "string" ||
+        v instanceof Uint8Array)
+        return v;
+    throw new LfcpError("CBOR_UNSUPPORTED_TYPE", "map keys must be integers, text or byte strings");
+}
+function readValue(r, depth) {
+    if (depth > MAX_DEPTH)
+        throw new LfcpError("CBOR_TOO_DEEP", `nesting deeper than ${MAX_DEPTH}`);
+    const ib = r.byte();
+    const major = ib >> 5;
+    const ai = ib & 0x1f;
+    switch (major) {
+        case 0:
+            return asInteger(r.argument(ai));
+        case 1:
+            return asInteger(-1n - r.argument(ai));
+        case 2:
+            return r.take(r.need(r.argument(ai)));
+        case 3: {
+            const raw = r.take(r.need(r.argument(ai)));
+            try {
+                return strictUtf8Decoder.decode(raw);
+            }
+            catch {
+                throw new LfcpError("CBOR_INVALID_UTF8", "text string is not well-formed UTF-8");
+            }
+        }
+        case 4: {
+            const count = r.argument(ai);
+            r.need(count); // every item takes at least one byte
+            const items = [];
+            for (let i = 0n; i < count; i += 1n)
+                items.push(readValue(r, depth + 1));
+            return items;
+        }
+        case 5: {
+            const count = r.argument(ai);
+            r.need(count * 2n);
+            const entries = [];
+            const seen = new Set();
+            let previous = null;
+            for (let i = 0n; i < count; i += 1n) {
+                const start = r.pos;
+                const key = readKey(r, depth + 1);
+                const keyBytes = r.bytes.subarray(start, r.pos);
+                const id = Array.from(keyBytes, (b) => b.toString(16).padStart(2, "0")).join("");
+                if (seen.has(id))
+                    throw new LfcpError("CBOR_DUPLICATE_KEY", "map contains a duplicate key");
+                if (previous && compareEncodedKeys(previous, keyBytes) > 0) {
+                    throw new LfcpError("CBOR_NON_CANONICAL", "map keys are not in deterministic order (§5.2 rule 4)");
+                }
+                seen.add(id);
+                previous = keyBytes;
+                entries.push([key, readValue(r, depth + 1)]);
+            }
+            return cborMap(entries);
+        }
+        case 6:
+            throw new LfcpError("CBOR_UNSUPPORTED_TYPE", "CBOR tags are not used by LFCP (§5.2 rule 6)");
+        default:
+            if (ai === 20)
+                return false;
+            if (ai === 21)
+                return true;
+            if (ai === 22)
+                return null;
+            if (ai === 31)
+                throw new LfcpError("CBOR_INDEFINITE_LENGTH", "unexpected break code");
+            throw new LfcpError("CBOR_UNSUPPORTED_TYPE", "floats, undefined and other simple values are not used by LFCP");
+    }
+}
+/**
+ * Decodes exactly one deterministic CBOR item (LFCP-WIRE-01 §5.2) and
+ * rejects anything else: indefinite lengths, non-shortest heads, unsorted
+ * or duplicate map keys, tags, floats and other simple values, invalid
+ * UTF-8, truncated input and trailing bytes.
+ */
+export function decodeStrict(bytes) {
+    const r = new Reader(bytes);
+    const value = readValue(r, 0);
+    if (r.pos !== bytes.length)
+        throw new LfcpError("CBOR_TRAILING_BYTES", "bytes remain after the top-level item");
+    return value;
+}
+/**
+ * The §5.2 receiver check: `bytes` decode strictly and re-encode to exactly
+ * the same bytes. Signature and object-ID checks still use the received
+ * bytes; this only decides whether they are the deterministic encoding.
+ */
+/**
+ * Strict decode plus the §5.2 re-encode comparison (N7): the bytes must be
+ * well-formed (CBOR_* errors from `decodeStrict` otherwise) and exactly the
+ * deterministic encoding of their value (CBOR_NON_CANONICAL otherwise). The
+ * re-encoding is only compared, never returned.
+ */
+export function decodeDeterministic(bytes) {
+    const value = decodeStrict(bytes);
+    if (!bytesEqual(encode(value), bytes))
+        throw new LfcpError("CBOR_NON_CANONICAL", "the bytes are not the deterministic encoding");
+    return value;
+}
+export function isDeterministic(bytes) {
+    let value;
+    try {
+        value = decodeStrict(bytes);
+    }
+    catch (e) {
+        if (e instanceof LfcpError)
+            return false;
+        throw e;
+    }
+    return bytesEqual(encode(value), bytes);
+}
+//# sourceMappingURL=decode.js.map

package/dist/cbor/encode.d.ts

@@ -0,0 +1,10 @@
+import { type CborValue } from "./value.js";
+/** Byte order of encoded map keys (§5.2 rule 4): shorter encodings first, then bytewise. */
+export declare function compareEncodedKeys(a: Uint8Array, b: Uint8Array): number;
+/**
+ * Deterministic CBOR encoding (LFCP-WIRE-01 §5.2): shortest heads,
+ * definite lengths, map keys sorted by encoded length then bytewise,
+ * duplicate keys rejected, array order kept, no tags.
+ */
+export declare function encode(value: CborValue): Uint8Array;
+//# sourceMappingURL=encode.d.ts.map