@openlfcp/wire 0.1.0 → 0.1.2

package/README.md

@@ -3,7 +3,7 @@
 LFCP-WIRE-01 structures and codecs: deterministic CBOR (`@openlfcp/wire/cbor`), COSE_Sign1, Principal Descriptors, Control Records and chain validation, Data Units, Key Packages, Snapshots, invitations and the wire messages with the session handshake.
 
 ```sh
-npm install @openlfcp/wire@next
+npm install @openlfcp/wire
 ```
 
 ESM only; Node.js 24 or later (browsers and Electron for every package except `@openlfcp/storage-node`).
@@ -12,9 +12,9 @@ ESM only; Node.js 24 or later (browsers and Electron for every package except `@
 
 Part of the OpenLFCP TypeScript SDK, which implements the OpenLFCP MVP 0.1
 subset of [LFCP-WIRE-01](https://github.com/openlfcp/spec/blob/main/wire/LFCP-WIRE-01.md)
-at `mvp-0.1-baseline.8`, not every deferred WIRE-01 feature. It does not
+at `mvp-0.1-baseline.9`, not every deferred WIRE-01 feature. It does not
 claim full LFCP-WIRE-01 conformance. This is the MVP 0.1 release
-(`0.1.0`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
+(`0.1.2`, npm dist-tag `latest`). Until 1.0, minor versions may change APIs.
 
 ## Links
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/wire",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Deterministic CBOR, COSE and LFCP Wire structures and codecs.",
   "keywords": [
     "openlfcp",
@@ -47,7 +47,7 @@
     "tag": "latest"
   },
   "dependencies": {
-    "@openlfcp/core": "^0.1.0",
-    "@openlfcp/crypto": "^0.1.0"
+    "@openlfcp/core": "^0.1.2",
+    "@openlfcp/crypto": "^0.1.2"
   }
 }

package/dist/capability.d.ts

@@ -1,143 +0,0 @@
-import { type ControlRecordId, type DataEpoch, type PrincipalId } from "@openlfcp/core";
-import type { ControlState } from "./chain.js";
-import { type ControlRecord } from "./control.js";
-import type { PrincipalDescriptor } from "./principal.js";
-/**
- * The LFCP capability engine (LFCP-WIRE-01 §17, §18, §20, §19, §25.2).
- *
- * Authority comes only from the validated Control Chain: a Principal ID
- * holds an ability at a Control Head H because of the owner rule or of
- * grants and claims committed through H. There is no server account,
- * user table or hosting identity anywhere in this module, and nothing
- * here takes one.
- *
- * Everything is a pure function of a ControlState (the state at some head
- * H). Evaluating at an older H means using the state at that H (see
- * `stateAt` on a linear chain result), so a later revocation never
- * changes an earlier answer.
- */
-/** §17.1 standard ability codes. */
-export declare const ABILITY: Readonly<{
-    DATA_READ: 1n;
-    DATA_WRITE: 2n;
-    SNAPSHOT_PUBLISH: 3n;
-    CAPABILITY_GRANT: 4n;
-    CAPABILITY_REVOKE: 5n;
-    KEY_DISTRIBUTE: 6n;
-    KEY_ROTATE: 7n;
-    ROUTE_UPDATE: 8n;
-    OWNER_TRANSFER_OFFER: 9n;
-    RESOURCE_TOMBSTONE: 10n;
-    INVITE_CLAIM: 11n;
-}>;
-/** §17.1 names of the standard codes. */
-export declare const ABILITY_NAMES: ReadonlyMap<bigint, string>;
-/**
- * Whether `ability` is a §17.1 standard code. §17.1: "A code that is not in
- * the table above is kept as received and confers nothing", so an unknown
- * code is kept in its record but is never held.
- */
-export declare const isStandardAbility: (ability: bigint) => boolean;
-/** A grant created by a CAPABILITY_GRANT record or by a successful claim (§17.2, §18.1). */
-export interface Grant {
-    /** The ID of the Control Record that created it (§17.2). */
-    readonly id: ControlRecordId;
-    readonly source: "grant" | "claim";
-    readonly issuer: PrincipalId;
-    readonly subject: PrincipalId;
-    readonly abilities: readonly bigint[];
-    readonly delegable: readonly bigint[];
-    readonly parentGrantId: ControlRecordId | null;
-    /** §17.2 claim_limit, for invitation grants; null when absent. */
-    readonly claimLimit: bigint | null;
-    /** Claims consumed so far, counted in linear chain order (§18.1). */
-    readonly claimsUsed: bigint;
-    /** The revoking record, or null while not revoked (§17.3). */
-    readonly revokedBy: ControlRecordId | null;
-}
-/** The capability part of ControlState. */
-export interface CapabilityState {
-    /** Every grant created through this head, by grant ID hex, active or not. */
-    readonly grants: ReadonlyMap<string, Grant>;
-}
-/**
- * Whether a grant is active at this state. §17.2: "A grant is active while
- * it has not been revoked and, when it has a parent grant, while that
- * parent is active. Revoking a grant therefore also deactivates every grant
- * delegated from it, directly or through further delegations."
- */
-export declare function isGrantActive(state: CapabilityState, grantId: Uint8Array): boolean;
-/**
- * Whether `principal` holds `ability` at the head of `state`: the owner
- * holds every standard ability implicitly (§17.1, no self-grant); anyone
- * else holds it through an active grant that confers it. Unknown codes and
- * the reserved ability 9 are held by no one (§17.1, §23.1).
- */
-export declare function hasAbility(state: ControlState, principal: PrincipalId, ability: bigint): boolean;
-/** Every standard ability `principal` holds at the head of `state`, ascending. */
-export declare function abilitiesOf(state: ControlState, principal: PrincipalId): readonly bigint[];
-/**
- * An authorization decision; a refusal names the rule. `code` marks the
- * refusals callers must tell apart: INVITE_CLAIM_EXHAUSTED (§18.1 rule 3,
- * which LFCP-022 reports separately; still AUTHORIZATION_FAILED on the
- * wire) and INVALID_SIGNATURE (§23.3: a transfer offer or acceptance whose
- * signature does not verify, INVALID_SIGNATURE on the wire).
- */
-export type Authorization = {
-    readonly allowed: true;
-} | {
-    readonly allowed: false;
-    readonly reason: string;
-    readonly code?: "INVITE_CLAIM_EXHAUSTED" | "INVALID_SIGNATURE";
-};
-/**
- * Whether the issuer of `record` had the authority the record needs, at
- * the state before it (the chain's previous head). Genesis is authorized by
- * verifyGenesis. Coordinator Recovery and Resource Tombstone records never
- * get here: the chain refuses them first (DV1).
- */
-export declare function authorizeControlRecord(record: ControlRecord, state: ControlState): Authorization;
-/** The capability transitions of an applied record (called by applyRecord). */
-export declare function applyCapabilities(grants: ReadonlyMap<string, Grant>, record: ControlRecord): ReadonlyMap<string, Grant>;
-/**
- * §25.2 Key Package authority at the package's referenced Control Head:
- * the sender must hold key/distribute, and the recipient must hold
- * data/read, "except for an Invitation Principal explicitly authorized by
- * an active invite grant: a recipient that is the subject of an active
- * grant that includes and still confers invite/claim". `epoch` is the
- * package's Data Epoch; whether that epoch is recognized at the head is
- * checked with the epoch rules (LFCP-023, LFCP-024).
- */
-export declare function canDistributeKey(state: ControlState, sender: PrincipalId, recipient: PrincipalId, _epoch: DataEpoch): Authorization;
-/** A verified ownership transfer: the new owner's descriptor, from the offer. */
-export interface VerifiedOwnerTransfer {
-    readonly authorization: Authorization;
-    readonly newOwner?: PrincipalDescriptor;
-}
-/**
- * The §23.3 verifier for an OWNER_TRANSFER_COMMIT, at the state before it.
- * Verification only: there is no transfer UI or flow (deferred from MVP 0.1).
- *
- * §23.3 "A verifier MUST confirm":
- *  1. the offer is signed by the current owner;
- *  2. the offer references the current Control Head;
- *  3. the offer names the accepting Principal;
- *  4. the acceptance is signed by that Principal;
- *  5. the commit itself is signed by that Principal (here: issued by it;
- *     the chain verifies the signature against the issuer);
- *  6. the expected next Control Sequence matches the commit sequence.
- * Also, from §23.1 and §23.2: the offer and accept are canonical signed
- * objects of this Resource, and the accept names the exact offer ID (the
- * §10.6 object ID of the offer bytes). §23.3: "A commit that fails any of
- * these checks is rejected with AUTHORIZATION_FAILED, except that an offer
- * or acceptance whose signature does not verify is rejected with
- * INVALID_SIGNATURE" (the refusal's code).
- */
-export declare function verifyOwnerTransfer(record: ControlRecord, state: ControlState): VerifiedOwnerTransfer;
-/**
- * The descriptor a transfer commit carries for its own issuer: the offer's
- * proposed owner (self-certifying, §7), so a new owner never granted
- * before can still be verified. Undefined for other records.
- */
-export declare function transferIssuerDescriptor(record: ControlRecord): PrincipalDescriptor | undefined;
-//# sourceMappingURL=capability.d.ts.map

package/dist/capability.js

@@ -1,409 +0,0 @@
-import { bytesEqual, controlRecordId, toHex, } from "@openlfcp/core";
-import { parseOwnerTransferAccept, parseOwnerTransferOffer, } from "./control.js";
-import { objectId, verifySignedObject } from "./cose.js";
-/**
- * The LFCP capability engine (LFCP-WIRE-01 §17, §18, §20, §19, §25.2).
- *
- * Authority comes only from the validated Control Chain: a Principal ID
- * holds an ability at a Control Head H because of the owner rule or of
- * grants and claims committed through H. There is no server account,
- * user table or hosting identity anywhere in this module, and nothing
- * here takes one.
- *
- * Everything is a pure function of a ControlState (the state at some head
- * H). Evaluating at an older H means using the state at that H (see
- * `stateAt` on a linear chain result), so a later revocation never
- * changes an earlier answer.
- */
-/** §17.1 standard ability codes. */
-export const ABILITY = Object.freeze({
-    DATA_READ: 1n,
-    DATA_WRITE: 2n,
-    SNAPSHOT_PUBLISH: 3n,
-    CAPABILITY_GRANT: 4n,
-    CAPABILITY_REVOKE: 5n,
-    KEY_DISTRIBUTE: 6n,
-    KEY_ROTATE: 7n,
-    ROUTE_UPDATE: 8n,
-    OWNER_TRANSFER_OFFER: 9n,
-    RESOURCE_TOMBSTONE: 10n,
-    INVITE_CLAIM: 11n,
-});
-/** §17.1 names of the standard codes. */
-export const ABILITY_NAMES = new Map([
-    [1n, "data/read"],
-    [2n, "data/write"],
-    [3n, "snapshot/publish"],
-    [4n, "capability/grant"],
-    [5n, "capability/revoke"],
-    [6n, "key/distribute"],
-    [7n, "key/rotate"],
-    [8n, "route/update"],
-    [9n, "owner/transfer-offer"],
-    [10n, "resource/tombstone"],
-    [11n, "invite/claim"],
-]);
-/**
- * Whether `ability` is a §17.1 standard code. §17.1: "A code that is not in
- * the table above is kept as received and confers nothing", so an unknown
- * code is kept in its record but is never held.
- */
-export const isStandardAbility = (ability) => ABILITY_NAMES.has(ability);
-/**
- * Whether holding `ability` can mean anything: a standard code other than
- * 9. §17.1: "9 | owner/transfer-offer (reserved; confers nothing in
- * WIRE-01)"; §23.1: "Only the current owner creates offers."
- */
-const confers = (ability) => isStandardAbility(ability) && ability !== ABILITY.OWNER_TRANSFER_OFFER;
-const key = (id) => toHex(id);
-/**
- * Whether a grant is active at this state. §17.2: "A grant is active while
- * it has not been revoked and, when it has a parent grant, while that
- * parent is active. Revoking a grant therefore also deactivates every grant
- * delegated from it, directly or through further delegations."
- */
-export function isGrantActive(state, grantId) {
-    const seen = new Set();
-    let grant = state.grants.get(key(grantId));
-    while (grant !== undefined) {
-        if (grant.revokedBy !== null)
-            return false;
-        if (grant.parentGrantId === null)
-            return true;
-        if (seen.has(key(grant.id)))
-            return false;
-        seen.add(key(grant.id));
-        grant = state.grants.get(key(grant.parentGrantId));
-    }
-    return false;
-}
-const isOwner = (state, principal) => bytesEqual(state.owner.principalId, principal);
-/**
- * Whether an invitation grant's claims are used up. §18.1: "An Invitation
- * Grant whose claims are used up confers no invite/claim; its other
- * abilities stay active until it is revoked."
- */
-const claimsExhausted = (g) => g.claimLimit !== null && g.claimsUsed >= g.claimLimit;
-/** Whether grant `g` confers `ability` at this state: it lists it, is active, and (for invite/claim) is not used up. */
-function grantConfers(state, g, ability) {
-    if (!g.abilities.includes(ability) || !isGrantActive(state, g.id))
-        return false;
-    return ability !== ABILITY.INVITE_CLAIM || !claimsExhausted(g);
-}
-/**
- * Whether `principal` holds `ability` at the head of `state`: the owner
- * holds every standard ability implicitly (§17.1, no self-grant); anyone
- * else holds it through an active grant that confers it. Unknown codes and
- * the reserved ability 9 are held by no one (§17.1, §23.1).
- */
-export function hasAbility(state, principal, ability) {
-    if (!confers(ability))
-        return false;
-    if (isOwner(state, principal))
-        return true;
-    for (const g of state.grants.values())
-        if (bytesEqual(g.subject, principal) && grantConfers(state, g, ability))
-            return true;
-    return false;
-}
-/** Every standard ability `principal` holds at the head of `state`, ascending. */
-export function abilitiesOf(state, principal) {
-    return [...ABILITY_NAMES.keys()].filter((a) => hasAbility(state, principal, a));
-}
-const ALLOW = Object.freeze({ allowed: true });
-const deny = (reason) => Object.freeze({ allowed: false, reason });
-const badSignature = (reason) => Object.freeze({ allowed: false, reason, code: "INVALID_SIGNATURE" });
-const subset = (list, of) => list.every((a) => of.includes(a));
-/**
- * §17.3: revoke authority "covers a grant when the revoker issued it, or
- * when it was delegated, directly or through further delegations, from a
- * grant the revoker issued. A grant the revoker received is not covered
- * unless the revoker also issued one of its ancestors."
- */
-function covers(state, target, revoker) {
-    const seen = new Set();
-    let grant = target;
-    while (grant !== undefined && !seen.has(key(grant.id))) {
-        if (bytesEqual(grant.issuer, revoker))
-            return true;
-        seen.add(key(grant.id));
-        grant = grant.parentGrantId === null ? undefined : state.grants.get(key(grant.parentGrantId));
-    }
-    return false;
-}
-/**
- * Whether the issuer of `record` had the authority the record needs, at
- * the state before it (the chain's previous head). Genesis is authorized by
- * verifyGenesis. Coordinator Recovery and Resource Tombstone records never
- * get here: the chain refuses them first (DV1).
- */
-export function authorizeControlRecord(record, state) {
-    const issuer = record.payload.issuer;
-    const body = record.body;
-    switch (body.type) {
-        case "GENESIS":
-            return ALLOW;
-        case "CAPABILITY_GRANT": {
-            // §17.2: "The owner MAY grant any abilities without a parent grant. A
-            // non-owner issuer MUST hold capability/grant and MUST reference a
-            // parent grant." "If parent grant id is present: the parent grant
-            // MUST be active; the issuer MUST be the subject of the parent grant;
-            // every granted ability MUST be included in the parent's delegable
-            // abilities; every delegable ability of the new grant MUST also be
-            // included in the parent's delegable abilities."
-            if (body.parentGrantId !== undefined) {
-                const parent = state.grants.get(key(body.parentGrantId));
-                if (parent === undefined)
-                    return deny("the parent grant does not exist (§17.2)");
-                if (!isGrantActive(state, parent.id))
-                    return deny("the parent grant is not active (§17.2)");
-                if (!bytesEqual(parent.subject, issuer))
-                    return deny("the issuer is not the subject of the parent grant (§17.2)");
-                if (!subset(body.abilities, parent.delegable))
-                    return deny("a granted ability is not delegable under the parent grant (§17.2)");
-                if (!subset(body.delegable, parent.delegable))
-                    return deny("a delegable ability is not delegable under the parent grant (§17.2)");
-            }
-            else if (!isOwner(state, issuer)) {
-                return deny("a non-owner grant must prove its authority through a parent grant (§17.2)");
-            }
-            if (!isOwner(state, issuer) && !hasAbility(state, issuer, ABILITY.CAPABILITY_GRANT))
-                return deny("the issuer does not hold capability/grant (§17.2)");
-            return ALLOW;
-        }
-        case "CAPABILITY_REVOKE": {
-            // §17.3, in order: the target exists, the issuer's authority covers
-            // it, it is not already revoked. Each failure is AUTHORIZATION_FAILED.
-            const target = state.grants.get(key(body.grantId));
-            if (target === undefined)
-                return deny("the revoked grant does not exist (§17.3)");
-            // "The owner may revoke any grant." Otherwise the issuer MUST "possess
-            // capability/revoke authority that covers the target grant".
-            if (!isOwner(state, issuer)) {
-                if (!hasAbility(state, issuer, ABILITY.CAPABILITY_REVOKE))
-                    return deny("the issuer does not hold capability/revoke (§17.3)");
-                if (!covers(state, target, issuer))
-                    return deny("the issuer's capability/revoke authority does not cover the grant (§17.3)");
-            }
-            if (target.revokedBy !== null)
-                return deny("the grant is already revoked (§17.3)");
-            return ALLOW;
-        }
-        case "CAPABILITY_CLAIM": {
-            // §18.1 validation rules 1-5 (rule 6, coordinator serialization, is LFCP-022).
-            const invitation = state.grants.get(key(body.invitationGrantId));
-            if (invitation === undefined)
-                return deny("the invitation grant does not exist (§18.1)");
-            if (!isGrantActive(state, invitation.id))
-                return deny("the invitation grant is not active (§18.1 rule 1)");
-            if (!invitation.abilities.includes(ABILITY.INVITE_CLAIM))
-                return deny("the invitation grant does not grant invite/claim (§18.1 rule 2)");
-            // §18: "Only an invitation grant with a claim_limit can be claimed: one
-            // without claim_limit is not claimable."
-            if (invitation.claimLimit === null)
-                return deny("the invitation grant has no claim_limit and is not claimable (§18)");
-            if (claimsExhausted(invitation))
-                return Object.freeze({
-                    allowed: false,
-                    reason: "the invitation grant has no claims left (§18.1 rule 3)",
-                    code: "INVITE_CLAIM_EXHAUSTED",
-                });
-            if (!bytesEqual(invitation.subject, issuer))
-                return deny("the claim issuer is not the Invitation Principal (§18.1 rule 5)");
-            // Rule 4: a subset of the invitation's abilities, excluding invite/claim
-            // unless the invitation explicitly delegates it. Unknown codes confer
-            // nothing (§17.1), so they request nothing and are not checked.
-            const transferable = invitation.abilities.filter((a) => a !== ABILITY.INVITE_CLAIM || invitation.delegable.includes(ABILITY.INVITE_CLAIM));
-            if (!subset(body.abilities.filter(isStandardAbility), transferable))
-                return deny("the claim requests abilities beyond the invitation grant (§18.1 rule 4)");
-            return ALLOW;
-        }
-        case "KEY_EPOCH":
-            // §19: "The issuer MUST possess key/rotate."
-            return hasAbility(state, issuer, ABILITY.KEY_ROTATE)
-                ? ALLOW
-                : deny("the issuer does not hold key/rotate (§19)");
-        case "OWNER_TRANSFER_COMMIT":
-            return verifyOwnerTransfer(record, state).authorization;
-        case "ROUTE_UPDATE":
-            // §20: "The issuer MUST possess route/update"; "Each Route Update MUST
-            // carry a route version strictly greater than the current one: 0 after
-            // Genesis (Section 15), otherwise the version of the last committed
-            // Route Update." §20 names no code: AUTHORIZATION_FAILED here.
-            if (!hasAbility(state, issuer, ABILITY.ROUTE_UPDATE))
-                return deny("the issuer does not hold route/update (§20)");
-            return body.routeVersion > state.routeVersion
-                ? ALLOW
-                : deny("the route version does not increase (§20)");
-        case "EXTENSION":
-            // §14: "A Control Record of an extension type (32 or above) requires
-            // owner authority: its issuer MUST be the Resource owner at the
-            // record's position in the chain, whether or not the receiver supports
-            // the extension." §14 names no code: AUTHORIZATION_FAILED here.
-            return isOwner(state, issuer)
-                ? ALLOW
-                : deny("an extension record must be issued by the owner (§14)");
-        case "COORDINATOR_RECOVERY":
-        case "RESOURCE_TOMBSTONE":
-            return deny(`${body.type} is refused in MVP 0.1 (scope §4, DV1)`);
-    }
-}
-/** The capability transitions of an applied record (called by applyRecord). */
-export function applyCapabilities(grants, record) {
-    const body = record.body;
-    const id = controlRecordId(record.signed.id);
-    switch (body.type) {
-        case "CAPABILITY_GRANT": {
-            const next = new Map(grants);
-            next.set(key(id), Object.freeze({
-                id,
-                source: "grant",
-                issuer: record.payload.issuer,
-                subject: body.subject.principalId,
-                abilities: body.abilities,
-                delegable: body.delegable,
-                parentGrantId: body.parentGrantId ?? null,
-                claimLimit: body.claimLimit ?? null,
-                claimsUsed: 0n,
-                revokedBy: null,
-            }));
-            return next;
-        }
-        case "CAPABILITY_REVOKE": {
-            const target = grants.get(key(body.grantId));
-            if (target === undefined)
-                return grants;
-            const next = new Map(grants);
-            next.set(key(target.id), Object.freeze({ ...target, revokedBy: id }));
-            return next;
-        }
-        case "CAPABILITY_CLAIM": {
-            // §18.1: "A successful claim creates a new capability grant to the
-            // claimant [and] consumes one claim from the Invitation Grant." "The
-            // grant a claim creates is identified by the claim record's Control
-            // Record ID. Its subject is the claimant and its abilities are the
-            // claimed abilities; it has no parent grant and an empty delegable
-            // list, so revoking the Invitation Grant later does not revoke it."
-            const invitation = grants.get(key(body.invitationGrantId));
-            const next = new Map(grants);
-            if (invitation !== undefined)
-                next.set(key(invitation.id), Object.freeze({ ...invitation, claimsUsed: invitation.claimsUsed + 1n }));
-            next.set(key(id), Object.freeze({
-                id,
-                source: "claim",
-                issuer: record.payload.issuer,
-                subject: body.claimant.principalId,
-                abilities: body.abilities,
-                delegable: [],
-                parentGrantId: null,
-                claimLimit: null,
-                claimsUsed: 0n,
-                revokedBy: null,
-            }));
-            return next;
-        }
-        default:
-            return grants;
-    }
-}
-/**
- * §25.2 Key Package authority at the package's referenced Control Head:
- * the sender must hold key/distribute, and the recipient must hold
- * data/read, "except for an Invitation Principal explicitly authorized by
- * an active invite grant: a recipient that is the subject of an active
- * grant that includes and still confers invite/claim". `epoch` is the
- * package's Data Epoch; whether that epoch is recognized at the head is
- * checked with the epoch rules (LFCP-023, LFCP-024).
- */
-export function canDistributeKey(state, sender, recipient, _epoch) {
-    if (!hasAbility(state, sender, ABILITY.KEY_DISTRIBUTE))
-        return deny("the sender does not hold key/distribute (§25.2)");
-    if (hasAbility(state, recipient, ABILITY.DATA_READ))
-        return ALLOW;
-    if (hasAbility(state, recipient, ABILITY.INVITE_CLAIM))
-        return ALLOW;
-    return deny("the recipient holds neither data/read nor an active invite grant (§25.2)");
-}
-/**
- * The §23.3 verifier for an OWNER_TRANSFER_COMMIT, at the state before it.
- * Verification only: there is no transfer UI or flow (deferred from MVP 0.1).
- *
- * §23.3 "A verifier MUST confirm":
- *  1. the offer is signed by the current owner;
- *  2. the offer references the current Control Head;
- *  3. the offer names the accepting Principal;
- *  4. the acceptance is signed by that Principal;
- *  5. the commit itself is signed by that Principal (here: issued by it;
- *     the chain verifies the signature against the issuer);
- *  6. the expected next Control Sequence matches the commit sequence.
- * Also, from §23.1 and §23.2: the offer and accept are canonical signed
- * objects of this Resource, and the accept names the exact offer ID (the
- * §10.6 object ID of the offer bytes). §23.3: "A commit that fails any of
- * these checks is rejected with AUTHORIZATION_FAILED, except that an offer
- * or acceptance whose signature does not verify is rejected with
- * INVALID_SIGNATURE" (the refusal's code).
- */
-export function verifyOwnerTransfer(record, state) {
-    const body = record.body;
-    if (body.type !== "OWNER_TRANSFER_COMMIT")
-        return { authorization: deny("not an ownership transfer commit") };
-    let offer;
-    let accept;
-    try {
-        offer = parseOwnerTransferOffer(body.offer);
-        accept = parseOwnerTransferAccept(body.accept);
-    }
-    catch {
-        return {
-            authorization: deny("the offer or accept is not a valid signed object (§23.1, §23.2)"),
-        };
-    }
-    const o = offer.payload;
-    const a = accept.payload;
-    if (!bytesEqual(o.resourceId, state.resourceId) || !bytesEqual(a.resourceId, state.resourceId))
-        return { authorization: deny("the offer or accept is for another Resource (§23.1, §23.2)") };
-    const offerSigned = verifySignedObject(offer.signed, state.owner);
-    if (!offerSigned.valid)
-        return {
-            authorization: badSignature(`the offer is not signed by the current owner (${offerSigned.reason}, §23.3 rule 1)`),
-        };
-    if (!bytesEqual(o.controlHead, state.head))
-        return {
-            authorization: deny("the offer does not reference the current Control Head (§23.3 rule 2)"),
-        };
-    if (!bytesEqual(a.newOwner, o.proposedOwner.principalId))
-        return {
-            authorization: deny("the accept is not by the Principal the offer names (§23.3 rule 3)"),
-        };
-    if (!bytesEqual(a.offerId, objectId(offer.signed.bytes)))
-        return { authorization: deny("the accept does not name this offer (§23.2)") };
-    const acceptSigned = verifySignedObject(accept.signed, o.proposedOwner);
-    if (!acceptSigned.valid)
-        return {
-            authorization: badSignature(`the accept is not signed by the new owner (${acceptSigned.reason}, §23.3 rule 4)`),
-        };
-    if (!bytesEqual(record.payload.issuer, o.proposedOwner.principalId))
-        return { authorization: deny("the commit is not issued by the new owner (§23.3 rule 5)") };
-    if (o.expectedControlSeq !== record.payload.controlSeq)
-        return {
-            authorization: deny("the offer's expected Control Sequence is not the commit's (§23.3 rule 6)"),
-        };
-    return { authorization: ALLOW, newOwner: o.proposedOwner };
-}
-/**
- * The descriptor a transfer commit carries for its own issuer: the offer's
- * proposed owner (self-certifying, §7), so a new owner never granted
- * before can still be verified. Undefined for other records.
- */
-export function transferIssuerDescriptor(record) {
-    if (record.body.type !== "OWNER_TRANSFER_COMMIT")
-        return undefined;
-    try {
-        const proposed = parseOwnerTransferOffer(record.body.offer).payload.proposedOwner;
-        return bytesEqual(proposed.principalId, record.payload.issuer) ? proposed : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=capability.js.map

package/dist/cbor/decode.d.ts

@@ -1,23 +0,0 @@
-import { type CborMap, type CborValue } from "./value.js";
-/**
- * Decodes exactly one deterministic CBOR item (LFCP-WIRE-01 §5.2) and
- * rejects anything else: indefinite lengths, non-shortest heads, unsorted
- * or duplicate map keys, tags, floats and other simple values, invalid
- * UTF-8, truncated input and trailing bytes.
- */
-export declare function decodeStrict(bytes: Uint8Array): CborValue;
-/**
- * The §5.2 receiver check: `bytes` decode strictly and re-encode to exactly
- * the same bytes. Signature and object-ID checks still use the received
- * bytes; this only decides whether they are the deterministic encoding.
- */
-/**
- * Strict decode plus the §5.2 re-encode comparison (N7): the bytes must be
- * well-formed (CBOR_* errors from `decodeStrict` otherwise) and exactly the
- * deterministic encoding of their value (CBOR_NON_CANONICAL otherwise). The
- * re-encoding is only compared, never returned.
- */
-export declare function decodeDeterministic(bytes: Uint8Array): CborValue;
-export declare function isDeterministic(bytes: Uint8Array): boolean;
-export type { CborMap };
-//# sourceMappingURL=decode.d.ts.map