@openlfcp/wire 0.1.0-rc.1

package/dist/control.js

@@ -0,0 +1,369 @@
+import { bytesEqual, controlRecordId, dataEpoch, hash32, LfcpError, principalId, resourceId, } from "@openlfcp/core";
+import { cborMap, decodeStrict, encode } from "./cbor/index.js";
+import { parseSignedObject, signObject, verifySignedObject, } from "./cose.js";
+import { checkReceivedUrl, checkWriterUrl, endpointFromCbor, endpointToCbor, } from "./endpoint.js";
+import { Fields } from "./fields.js";
+import { canonicalFrontierFromCbor, canonicalFrontierToCbor } from "./have.js";
+import { CONTROL_TYPE, controlRecordPayloadFromCbor, parseControlRecord, } from "./objects.js";
+import { principalDescriptorFromCbor, principalDescriptorToCbor, } from "./principal.js";
+const CODE = CONTROL_TYPE;
+/**
+ * §14 core types MVP 0.1 implements; the others decode but are not
+ * applied. OWNER_TRANSFER_COMMIT is verified and applied
+ * (MVP-0.1-PROTOCOL-SCOPE §4: "ownership transfer verification is in MVP
+ * 0.1"). A chain containing Coordinator Recovery or Resource Tombstone is
+ * refused (DV1, chain.ts); extensions are kept unapplied.
+ */
+const MVP_SUPPORTED = new Set([
+    "GENESIS",
+    "CAPABILITY_GRANT",
+    "CAPABILITY_REVOKE",
+    "CAPABILITY_CLAIM",
+    "KEY_EPOCH",
+    "ROUTE_UPDATE",
+    "OWNER_TRANSFER_COMMIT",
+]);
+/** Whether MVP 0.1 implements a body type (false for deferred core types and extensions). */
+export const isMvpSupported = (type) => MVP_SUPPORTED.has(type);
+/** The §14 code of a body. */
+export const controlTypeOf = (body) => body.type === "EXTENSION" ? body.code : CODE[body.type];
+const MAX_TEXT_BYTES = 256;
+const TEXT = new globalThis.TextEncoder();
+// ---------------------------------------------------------------------------
+// Decoding (receivers: structure only)
+const id32 = (f, key) => controlRecordId(f.bytes(key, 32));
+function endpoints(f, key) {
+    const list = f.array(key);
+    if (list.length === 0)
+        f.fail(key, "must list at least one endpoint");
+    const decoded = list.map(endpointFromCbor);
+    for (const e of decoded)
+        checkReceivedUrl(e.url);
+    return Object.freeze(decoded);
+}
+/** A Control Coordinator URL: text with a ws or wss scheme (§16). */
+function coordinatorUrl(f, key) {
+    const url = f.text(key);
+    checkReceivedUrl(url);
+    return url;
+}
+/**
+ * The Key Epoch final frontier. §19: "Field 2 is a canonical frontier
+ * (Sections 28.1 and 28.2) [...] A Key Epoch Record whose final frontier is
+ * not canonical MUST be rejected with MALFORMED_MESSAGE."
+ */
+function frontierList(f, key) {
+    return canonicalFrontierFromCbor(f.array(key));
+}
+/**
+ * An ability list (§17.1 codes). §17.1: "An ability list [...] MUST NOT
+ * repeat a code; a record whose list repeats a code is rejected with
+ * MALFORMED_MESSAGE" (INVALID_STRUCTURE here). "A code that is not in the
+ * table above is kept as received and confers nothing" (capability.ts).
+ */
+function abilityList(f, key, nonEmpty) {
+    const list = f.uintArray(key, nonEmpty);
+    if (new Set(list).size !== list.length)
+        f.fail(key, "lists an ability twice");
+    return list;
+}
+/**
+ * Decodes the body of a Control Record of §14 type `type`. Core types 0-8
+ * get their closed-map structure; 9-31 are UNSUPPORTED_VALUE (§14:
+ * INVALID_CONTROL_CHAIN on the wire); 32 and up are kept as opaque
+ * EXTENSION bodies.
+ */
+export function controlBodyFromCbor(type, value) {
+    switch (type) {
+        case CONTROL_TYPE.GENESIS: {
+            const f = new Fields(value, "genesis-body", [0, 1, 2, 3, 4]);
+            return Object.freeze({
+                type: "GENESIS",
+                dataProfile: f.text(0),
+                owner: principalDescriptorFromCbor(f.any(1)),
+                dekCommitment: hash32(f.bytes(2, 32)),
+                endpoints: endpoints(f, 3),
+                coordinatorUrl: coordinatorUrl(f, 4),
+            });
+        }
+        case CONTROL_TYPE.CAPABILITY_GRANT: {
+            const f = new Fields(value, "capability-grant-body", [0, 1, 2], [3, 4]);
+            return Object.freeze({
+                type: "CAPABILITY_GRANT",
+                subject: principalDescriptorFromCbor(f.any(0)),
+                abilities: abilityList(f, 1, true),
+                delegable: abilityList(f, 2, false),
+                ...(f.has(3) ? { parentGrantId: id32(f, 3) } : {}),
+                ...(f.has(4) ? { claimLimit: f.uint(4) } : {}),
+            });
+        }
+        case CONTROL_TYPE.CAPABILITY_REVOKE: {
+            const f = new Fields(value, "capability-revoke-body", [0]);
+            return Object.freeze({ type: "CAPABILITY_REVOKE", grantId: id32(f, 0) });
+        }
+        case CONTROL_TYPE.CAPABILITY_CLAIM: {
+            const f = new Fields(value, "capability-claim-body", [0, 1, 2]);
+            return Object.freeze({
+                type: "CAPABILITY_CLAIM",
+                invitationGrantId: id32(f, 0),
+                claimant: principalDescriptorFromCbor(f.any(1)),
+                abilities: abilityList(f, 2, true),
+            });
+        }
+        case CONTROL_TYPE.KEY_EPOCH: {
+            const f = new Fields(value, "key-epoch-body", [0, 1, 2, 3]);
+            return Object.freeze({
+                type: "KEY_EPOCH",
+                epoch: dataEpoch(f.uint(0)),
+                dekCommitment: hash32(f.bytes(1, 32)),
+                finalFrontier: frontierList(f, 2),
+                reason: f.uint(3),
+            });
+        }
+        case CONTROL_TYPE.ROUTE_UPDATE: {
+            const f = new Fields(value, "route-update-body", [0, 1, 2]);
+            return Object.freeze({
+                type: "ROUTE_UPDATE",
+                routeVersion: f.uint(0),
+                endpoints: endpoints(f, 1),
+                coordinatorUrl: coordinatorUrl(f, 2),
+            });
+        }
+        case CONTROL_TYPE.OWNER_TRANSFER_COMMIT: {
+            const f = new Fields(value, "owner-transfer-commit-body", [0, 1]);
+            return Object.freeze({
+                type: "OWNER_TRANSFER_COMMIT",
+                offer: f.bytes(0),
+                accept: f.bytes(1),
+            });
+        }
+        case CONTROL_TYPE.COORDINATOR_RECOVERY: {
+            const f = new Fields(value, "coordinator-recovery-body", [0, 1, 2, 3]);
+            return Object.freeze({
+                type: "COORDINATOR_RECOVERY",
+                routeVersion: f.uint(0),
+                endpoints: endpoints(f, 1),
+                coordinatorUrl: coordinatorUrl(f, 2),
+                reason: f.text(3),
+            });
+        }
+        case CONTROL_TYPE.RESOURCE_TOMBSTONE: {
+            const f = new Fields(value, "resource-tombstone-body", [0], [1]);
+            return Object.freeze({
+                type: "RESOURCE_TOMBSTONE",
+                reason: f.uint(0),
+                ...(f.has(1) ? { note: f.text(1) } : {}),
+            });
+        }
+        default:
+            if (type >= 32n)
+                return Object.freeze({ type: "EXTENSION", code: type, body: value });
+            throw new LfcpError("UNSUPPORTED_VALUE", `Control Record type ${type} is reserved for LFCP core (§14)`);
+    }
+}
+/**
+ * Parses a received Control Record: canonical COSE and the generic
+ * envelope (parseControlRecord), then the typed body. The record ID is
+ * `signed.id`, SHA-256 of the exact received bytes. The signature is not
+ * checked here; see controlRecordSigner and verifyGenesis.
+ */
+export function decodeControlRecord(bytes) {
+    const parsed = parseControlRecord(bytes);
+    const body = controlBodyFromCbor(parsed.payload.controlType, parsed.payload.body);
+    return Object.freeze({ ...parsed, body, mvpSupported: isMvpSupported(body.type) });
+}
+/**
+ * The Principal whose key must have signed a Control Record: its issuer
+ * (payload field 4). §13: "the protected-header kid MUST equal field 4,
+ * and a record whose kid is any other Principal is rejected with
+ * INVALID_SIGNATURE." Resolving the issuer to a descriptor (and checking
+ * its authority) is LFCP-020/021.
+ */
+export const controlRecordSigner = (record) => record.payload.issuer;
+/**
+ * Verifies a Genesis record against the owner in its own body (§15:
+ * "MUST be signed by the owner Principal contained in the body"): the
+ * issuer and the kid must be the owner and the signature must verify with
+ * the owner's key. A failure surfaces as INVALID_SIGNATURE.
+ */
+export function verifyGenesis(record) {
+    if (record.body.type !== "GENESIS")
+        return { valid: false, reason: "NOT_GENESIS" };
+    if (!bytesEqual(record.payload.issuer, record.body.owner.principalId))
+        return { valid: false, reason: "ISSUER_NOT_OWNER" };
+    return verifySignedObject(record.signed, record.body.owner);
+}
+// ---------------------------------------------------------------------------
+// Encoding (writers)
+function refuse(why) {
+    throw new LfcpError("INVALID_STRUCTURE", `refusing to write a Control Record: ${why}`);
+}
+function text256(what, s) {
+    if (typeof s !== "string")
+        refuse(`${what} must be text`);
+    if (TEXT.encode(s).length > MAX_TEXT_BYTES)
+        refuse(`${what} must be at most ${MAX_TEXT_BYTES} UTF-8 bytes`);
+    return s;
+}
+function writerEndpoints(list) {
+    if (list.length === 0)
+        refuse("at least one endpoint is required");
+    return list.map(endpointToCbor);
+}
+function writerUrl(url) {
+    checkWriterUrl(url);
+    return url;
+}
+function abilities(list, nonEmpty) {
+    if (nonEmpty && list.length === 0)
+        refuse("the ability list must not be empty");
+    // §17.1: an ability list MUST NOT repeat a code.
+    if (new Set(list).size !== list.length)
+        refuse("an ability is listed twice");
+    return [...list];
+}
+/** The CBOR of a typed body, applying the writer rules. */
+export function controlBodyToCbor(body) {
+    switch (body.type) {
+        case "GENESIS":
+            return cborMap([
+                [0, body.dataProfile],
+                [1, principalDescriptorToCbor(body.owner)],
+                [2, hash32(body.dekCommitment)],
+                [3, writerEndpoints(body.endpoints)],
+                [4, writerUrl(body.coordinatorUrl)],
+            ]);
+        case "CAPABILITY_GRANT":
+            return cborMap([
+                [0, principalDescriptorToCbor(body.subject)],
+                [1, abilities(body.abilities, true)],
+                [2, abilities(body.delegable, false)],
+                ...(body.parentGrantId !== undefined
+                    ? [[3, controlRecordId(body.parentGrantId)]]
+                    : []),
+                ...(body.claimLimit !== undefined ? [[4, body.claimLimit]] : []),
+            ]);
+        case "CAPABILITY_REVOKE":
+            return cborMap([[0, controlRecordId(body.grantId)]]);
+        case "CAPABILITY_CLAIM":
+            return cborMap([
+                [0, controlRecordId(body.invitationGrantId)],
+                [1, principalDescriptorToCbor(body.claimant)],
+                [2, abilities(body.abilities, true)],
+            ]);
+        case "KEY_EPOCH":
+            return cborMap([
+                [0, dataEpoch(body.epoch)],
+                [1, hash32(body.dekCommitment)],
+                [2, canonicalFrontierToCbor(body.finalFrontier)],
+                [3, body.reason],
+            ]);
+        case "ROUTE_UPDATE":
+            return cborMap([
+                [0, body.routeVersion],
+                [1, writerEndpoints(body.endpoints)],
+                [2, writerUrl(body.coordinatorUrl)],
+            ]);
+        case "OWNER_TRANSFER_COMMIT":
+            return cborMap([
+                [0, Uint8Array.from(body.offer)],
+                [1, Uint8Array.from(body.accept)],
+            ]);
+        case "COORDINATOR_RECOVERY":
+            return cborMap([
+                [0, body.routeVersion],
+                [1, writerEndpoints(body.endpoints)],
+                [2, writerUrl(body.coordinatorUrl)],
+                [3, text256("the recovery reason", body.reason)],
+            ]);
+        case "RESOURCE_TOMBSTONE":
+            return cborMap([
+                [0, body.reason],
+                ...(body.note !== undefined
+                    ? [[1, text256("the tombstone note", body.note)]]
+                    : []),
+            ]);
+        case "EXTENSION":
+            if (body.code < 32n)
+                refuse("extension types start at 32 (§14)");
+            return body.body;
+    }
+}
+/**
+ * Deterministic CBOR of control-record-payload (§13) for `issuer`. Writer
+ * rules: Genesis is at control_seq 0 with a null link and is issued by the
+ * owner in its body; every other record has control_seq >= 1 and a link
+ * (§13.1). The result is checked with the receiver's decoder too.
+ */
+export function encodeControlRecordPayload(header, issuer, body) {
+    const genesis = body.type === "GENESIS";
+    if (genesis) {
+        if (header.controlSeq !== 0n || header.prevControlId !== null)
+            refuse("Genesis must have control_seq 0 and a null previous record (§13.1)");
+        if (!bytesEqual(issuer, body.owner.principalId))
+            refuse("Genesis must be issued by the owner in its body (§15)");
+    }
+    else if (header.controlSeq < 1n || header.prevControlId === null) {
+        refuse("a non-Genesis record needs control_seq >= 1 and the previous record ID (§13.1)");
+    }
+    const payload = cborMap([
+        [0, header.resourceId],
+        [1, header.controlSeq],
+        [2, header.prevControlId],
+        [3, controlTypeOf(body)],
+        [4, issuer],
+        [5, controlBodyToCbor(body)],
+    ]);
+    const bytes = encode(payload);
+    const check = controlRecordPayloadFromCbor(decodeStrict(bytes));
+    controlBodyFromCbor(check.controlType, check.body);
+    return bytes;
+}
+/**
+ * Signs a Control Record: typed payload -> deterministic CBOR -> canonical
+ * untagged COSE_Sign1 (signObject) -> exact bytes -> SHA-256 = record ID.
+ * The issuer is the signer's Principal (§13: kid = issuer, see
+ * controlRecordSigner).
+ */
+export function signControlRecord(header, body, signer) {
+    const payload = encodeControlRecordPayload(header, signer.descriptor.principalId, body);
+    const signed = signObject(payload, signer);
+    return Object.freeze({ ...signed, recordId: controlRecordId(signed.id) });
+}
+/** owner-transfer-offer-payload (§23.1). */
+export function ownerTransferOfferPayloadFromCbor(value) {
+    const f = new Fields(value, "owner-transfer-offer-payload", [0, 1, 2, 3, 4]);
+    return Object.freeze({
+        resourceId: resourceId(f.bytes(0, 32)),
+        controlHead: id32(f, 1),
+        expectedControlSeq: f.uint(2),
+        proposedOwner: principalDescriptorFromCbor(f.any(3)),
+        nonce: f.bytes(4, 16),
+    });
+}
+/** owner-transfer-accept-payload (§23.2). */
+export function ownerTransferAcceptPayloadFromCbor(value) {
+    const f = new Fields(value, "owner-transfer-accept-payload", [0, 1, 2]);
+    return Object.freeze({
+        resourceId: resourceId(f.bytes(0, 32)),
+        offerId: hash32(f.bytes(1, 32)),
+        newOwner: principalId(f.bytes(2, 32)),
+    });
+}
+/** Parses a received transfer offer (canonical COSE, typed payload). Deferred from MVP 0.1: never applied. */
+export function parseOwnerTransferOffer(bytes) {
+    const signed = parseSignedObject(bytes);
+    return Object.freeze({
+        signed,
+        payload: ownerTransferOfferPayloadFromCbor(decodeStrict(signed.payloadBytes)),
+    });
+}
+/** Parses a received transfer accept (canonical COSE, typed payload). Deferred from MVP 0.1: never applied. */
+export function parseOwnerTransferAccept(bytes) {
+    const signed = parseSignedObject(bytes);
+    return Object.freeze({
+        signed,
+        payload: ownerTransferAcceptPayloadFromCbor(decodeStrict(signed.payloadBytes)),
+    });
+}
+//# sourceMappingURL=control.js.map

package/dist/cose.d.ts

@@ -0,0 +1,81 @@
+import { type Hash32, type PrincipalId } from "@openlfcp/core";
+import { type SigningKeyPair } from "@openlfcp/crypto";
+import { type PrincipalDescriptor } from "./principal.js";
+/**
+ * Canonical LFCP COSE_Sign1 (LFCP-WIRE-01 §10).
+ *
+ * Every persistent LFCP signed object is the untagged array
+ * [protected, {}, payload, signature]:
+ *
+ * - protected: a bstr holding exactly the deterministic map {1: -8, 4: kid},
+ *   where kid is the signer's 32-byte Principal ID (§10.1);
+ * - unprotected: the empty map (§10.2);
+ * - payload: a present bstr with the deterministic CBOR of the LFCP structure (§10.3);
+ * - signature: 64-byte Ed25519 over Sig_structure ["Signature1", protected, h'', payload] (§10.4, §10.5).
+ *
+ * The object ID is SHA-256 of the exact object bytes (§10.6).
+ *
+ * Signing (`signObject`) and checking received bytes (`parseSignedObject`,
+ * `verifySignedObject`) are separate. A parsed object keeps the exact
+ * received bytes, and nothing here ever re-encodes them into a "fixed" object.
+ *
+ * Errors and their wire mapping (ADR 0001):
+ * - COSE_MALFORMED and CBOR_* (tags, shape, non-deterministic bytes) → MALFORMED_MESSAGE;
+ * - a failed `verifySignedObject` (wrong kid or bad signature) → INVALID_SIGNATURE.
+ */
+/** COSE algorithm identifier for EdDSA (RFC 9053); the only one LFCP-WIRE-01 allows. */
+export declare const COSE_ALG_EDDSA = -8;
+/** A signer: the Ed25519 key pair and the Principal Descriptor it belongs to. */
+export interface Signer {
+    readonly key: SigningKeyPair;
+    readonly descriptor: PrincipalDescriptor;
+}
+/** A newly signed object: its exact bytes and its object ID. */
+export interface SignedBytes {
+    readonly bytes: Uint8Array;
+    readonly id: Hash32;
+}
+/** A received signed object. `bytes` are exactly the received bytes; `id` is their SHA-256. */
+export interface SignedObject {
+    readonly bytes: Uint8Array;
+    readonly protectedBytes: Uint8Array;
+    readonly payloadBytes: Uint8Array;
+    readonly signature: Uint8Array;
+    readonly kid: PrincipalId;
+    readonly alg: typeof COSE_ALG_EDDSA;
+    readonly id: Hash32;
+}
+export type VerifyResult = {
+    readonly valid: true;
+} | {
+    readonly valid: false;
+    readonly reason: "KID_MISMATCH" | "BAD_SIGNATURE";
+};
+/** Deterministic CBOR of ["Signature1", protected, h'', payload] (§10.5), from the exact header and payload bytes. */
+export declare function sigStructureBytes(protectedBytes: Uint8Array, payloadBytes: Uint8Array): Uint8Array;
+/** Object ID: SHA-256 of the exact signed-object bytes (§10.6). */
+export declare function objectId(signedObjectBytes: Uint8Array): Hash32;
+/**
+ * Signs deterministic payload bytes into a new canonical LFCP COSE_Sign1.
+ * The payload is used exactly as given (never decoded and re-encoded); bytes
+ * that are not deterministic CBOR are refused.
+ */
+export declare function signObject(payloadBytes: Uint8Array, signer: Signer): SignedBytes;
+/**
+ * Parses received signed-object bytes without verifying the signature. It
+ * checks the canonical shape and that the object, its protected header and
+ * its payload are each deterministic CBOR (§5.2), and keeps every byte
+ * string exactly as received.
+ */
+export declare function parseSignedObject(bytes: Uint8Array): SignedObject;
+/**
+ * Verifies a parsed object against the Principal expected to have signed
+ * it. The kid must name that Principal, and the Ed25519 signature must
+ * verify over the Sig_structure of the exact received header and payload.
+ *
+ * Which Principal is expected (the Data Unit actor, the owner, the
+ * coordinator, ...) is decided by the object-specific rules in higher
+ * layers, not here. A failure surfaces on the wire as INVALID_SIGNATURE.
+ */
+export declare function verifySignedObject(object: SignedObject, expectedSigner: PrincipalDescriptor): VerifyResult;
+//# sourceMappingURL=cose.d.ts.map

package/dist/cose.js

@@ -0,0 +1,133 @@
+import { bytesEqual, hash32, LfcpError, principalId, } from "@openlfcp/core";
+import { sha256, verifyEd25519 } from "@openlfcp/crypto";
+import { cborMap, decodeDeterministic, encode, isCborMap, isDeterministic, } from "./cbor/index.js";
+import { derivePrincipalId } from "./principal.js";
+/**
+ * Canonical LFCP COSE_Sign1 (LFCP-WIRE-01 §10).
+ *
+ * Every persistent LFCP signed object is the untagged array
+ * [protected, {}, payload, signature]:
+ *
+ * - protected: a bstr holding exactly the deterministic map {1: -8, 4: kid},
+ *   where kid is the signer's 32-byte Principal ID (§10.1);
+ * - unprotected: the empty map (§10.2);
+ * - payload: a present bstr with the deterministic CBOR of the LFCP structure (§10.3);
+ * - signature: 64-byte Ed25519 over Sig_structure ["Signature1", protected, h'', payload] (§10.4, §10.5).
+ *
+ * The object ID is SHA-256 of the exact object bytes (§10.6).
+ *
+ * Signing (`signObject`) and checking received bytes (`parseSignedObject`,
+ * `verifySignedObject`) are separate. A parsed object keeps the exact
+ * received bytes, and nothing here ever re-encodes them into a "fixed" object.
+ *
+ * Errors and their wire mapping (ADR 0001):
+ * - COSE_MALFORMED and CBOR_* (tags, shape, non-deterministic bytes) → MALFORMED_MESSAGE;
+ * - a failed `verifySignedObject` (wrong kid or bad signature) → INVALID_SIGNATURE.
+ */
+/** COSE algorithm identifier for EdDSA (RFC 9053); the only one LFCP-WIRE-01 allows. */
+export const COSE_ALG_EDDSA = -8;
+const HEADER_ALG = 1;
+const HEADER_KID = 4;
+const SIGNATURE_LENGTH = 64;
+const EMPTY = new Uint8Array(0);
+/** Deterministic CBOR of ["Signature1", protected, h'', payload] (§10.5), from the exact header and payload bytes. */
+export function sigStructureBytes(protectedBytes, payloadBytes) {
+    return encode(["Signature1", protectedBytes, EMPTY, payloadBytes]);
+}
+/** Object ID: SHA-256 of the exact signed-object bytes (§10.6). */
+export function objectId(signedObjectBytes) {
+    return hash32(sha256(signedObjectBytes));
+}
+function protectedHeaderBytes(kid) {
+    return encode(cborMap([
+        [HEADER_ALG, COSE_ALG_EDDSA],
+        [HEADER_KID, kid],
+    ]));
+}
+/**
+ * Signs deterministic payload bytes into a new canonical LFCP COSE_Sign1.
+ * The payload is used exactly as given (never decoded and re-encoded); bytes
+ * that are not deterministic CBOR are refused.
+ */
+export function signObject(payloadBytes, signer) {
+    const { key, descriptor } = signer;
+    if (!bytesEqual(key.publicKey, descriptor.ed25519PublicKey)) {
+        throw new LfcpError("COSE_SIGNER_MISMATCH", "the signing key does not match the descriptor's Ed25519 public key");
+    }
+    if (!bytesEqual(derivePrincipalId(descriptor.ed25519PublicKey, descriptor.x25519PublicKey), descriptor.principalId)) {
+        throw new LfcpError("PRINCIPAL_ID_MISMATCH", "the descriptor's Principal ID does not match its public keys");
+    }
+    if (!(payloadBytes instanceof Uint8Array) || !isDeterministic(payloadBytes)) {
+        throw new LfcpError("CBOR_NON_CANONICAL", "the payload is not deterministic CBOR (§10.3)");
+    }
+    const protectedBytes = protectedHeaderBytes(descriptor.principalId);
+    const signature = key.sign(sigStructureBytes(protectedBytes, payloadBytes));
+    const bytes = encode([protectedBytes, cborMap([]), payloadBytes, signature]);
+    return Object.freeze({ bytes, id: objectId(bytes) });
+}
+function malformed(why) {
+    throw new LfcpError("COSE_MALFORMED", `not a canonical LFCP COSE_Sign1: ${why}`);
+}
+/**
+ * Parses received signed-object bytes without verifying the signature. It
+ * checks the canonical shape and that the object, its protected header and
+ * its payload are each deterministic CBOR (§5.2), and keeps every byte
+ * string exactly as received.
+ */
+export function parseSignedObject(bytes) {
+    if (bytes.length > 0 && bytes[0] >> 5 === 6)
+        malformed("tagged objects are not allowed (§10)");
+    const value = decodeDeterministic(bytes);
+    if (!Array.isArray(value) || value.length !== 4)
+        malformed("not a four-element array");
+    const [protectedBytes, unprotected, payloadBytes, signature] = value;
+    if (!(protectedBytes instanceof Uint8Array))
+        malformed("protected header is not a byte string");
+    const header = decodeDeterministic(protectedBytes);
+    if (!isCborMap(header) || header.entries.length !== 2)
+        malformed("protected header must be exactly {1: -8, 4: kid}");
+    const fields = new Map(header.entries);
+    if (fields.get(HEADER_ALG) !== COSE_ALG_EDDSA)
+        malformed("alg must be -8 (EdDSA)");
+    const kid = fields.get(HEADER_KID);
+    if (!(kid instanceof Uint8Array) || kid.length !== 32)
+        malformed("kid must be a 32-byte Principal ID");
+    if (!isCborMap(unprotected) || unprotected.entries.length !== 0)
+        malformed("unprotected header must be the empty map");
+    if (!(payloadBytes instanceof Uint8Array))
+        malformed("payload must be a present byte string (no detached payload)");
+    decodeDeterministic(payloadBytes);
+    if (!(signature instanceof Uint8Array) || signature.length !== SIGNATURE_LENGTH) {
+        malformed(`signature must be ${SIGNATURE_LENGTH} bytes`);
+    }
+    const exact = Uint8Array.from(bytes);
+    return Object.freeze({
+        bytes: exact,
+        protectedBytes,
+        payloadBytes,
+        signature,
+        kid: principalId(kid),
+        alg: COSE_ALG_EDDSA,
+        id: objectId(exact),
+    });
+}
+/**
+ * Verifies a parsed object against the Principal expected to have signed
+ * it. The kid must name that Principal, and the Ed25519 signature must
+ * verify over the Sig_structure of the exact received header and payload.
+ *
+ * Which Principal is expected (the Data Unit actor, the owner, the
+ * coordinator, ...) is decided by the object-specific rules in higher
+ * layers, not here. A failure surfaces on the wire as INVALID_SIGNATURE.
+ */
+export function verifySignedObject(object, expectedSigner) {
+    const expectedId = derivePrincipalId(expectedSigner.ed25519PublicKey, expectedSigner.x25519PublicKey);
+    if (!bytesEqual(object.kid, expectedSigner.principalId) || !bytesEqual(object.kid, expectedId)) {
+        return { valid: false, reason: "KID_MISMATCH" };
+    }
+    const message = sigStructureBytes(object.protectedBytes, object.payloadBytes);
+    return verifyEd25519(expectedSigner.ed25519PublicKey, message, object.signature)
+        ? { valid: true }
+        : { valid: false, reason: "BAD_SIGNATURE" };
+}
+//# sourceMappingURL=cose.js.map