@peerbit/trusted-network 6.0.101 → 6.0.103

package/dist/src/v2.d.ts

@@ -0,0 +1,87 @@
+import { PublicSignKey } from "@peerbit/crypto";
+import { Program, type ProgramClient, type ProgramInitializationOptions } from "@peerbit/program";
+/**
+ * Decode-only TrustedNetwork v2 codec scaffold.
+ *
+ * This module is intentionally absent from the package entry point. It pins
+ * the policy wire contract needed by the next slice without exposing a usable
+ * controller, policy engine, resource fence, or encryption path.
+ */
+export declare const TRUSTED_NETWORK_V2_PROTOCOL_VERSION = 2;
+export declare const TRUSTED_NETWORK_V2_POLICY_HASH_SHA256 = 1;
+/**
+ * Profile 1 accepts only an EntryV0 whose normal toSignable() bytes (including
+ * causal metadata) have exactly one successfully verified signature. The
+ * signer's canonical public-key bytes must equal the descriptor authority.
+ */
+export declare const TRUSTED_NETWORK_V2_ENTRY_V0_AUTHORITY_ONLY_SIGNATURE_PROFILE = 1;
+export declare const TRUSTED_NETWORK_V2_NETWORK_ID_DOMAIN = "peerbit/trusted-network/v2/network-id/v1";
+export declare const TRUSTED_NETWORK_V2_POLICY_DIGEST_DOMAIN = "peerbit/trusted-network/v2/policy-body/v1";
+export declare const TrustedNetworkRole: Readonly<{
+    readonly ADMIN: 1;
+    readonly WRITER: 2;
+    readonly READER: 4;
+    readonly REPLICATOR: 8;
+}>;
+export declare const TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS: number;
+export declare class NetworkDescriptorV2 {
+    protocolVersion: number;
+    networkNonce: Uint8Array;
+    policyAuthority: PublicSignKey;
+    genesisPolicyDigest: Uint8Array;
+    policyHashProfile: number;
+    entrySignatureProfile: number;
+    constructor(properties?: {
+        protocolVersion: number;
+        networkNonce: Uint8Array;
+        policyAuthority: PublicSignKey;
+        genesisPolicyDigest: Uint8Array;
+        policyHashProfile: number;
+        entrySignatureProfile: number;
+    });
+}
+export declare class EncryptionKeyCommitmentV2 {
+    profile: number;
+    digest: Uint8Array;
+    constructor(properties?: {
+        profile: number;
+        digest: Uint8Array;
+    });
+}
+export declare class PolicySubjectBindingV2 {
+    signingKey: PublicSignKey;
+    roles: number;
+    encryptionKeyCommitment?: EncryptionKeyCommitmentV2;
+    constructor(properties?: {
+        signingKey: PublicSignKey;
+        roles: number;
+        encryptionKeyCommitment?: EncryptionKeyCommitmentV2;
+    });
+}
+export declare class PolicySnapshotBodyV2 {
+    networkId: Uint8Array;
+    sequence: bigint;
+    previousPolicyDigest: Uint8Array;
+    bindings: PolicySubjectBindingV2[];
+    constructor(properties?: {
+        networkId: Uint8Array;
+        sequence: bigint;
+        previousPolicyDigest: Uint8Array;
+        bindings: PolicySubjectBindingV2[];
+    });
+}
+export declare class TrustedNetworkV2 extends Program<never> {
+    descriptor: NetworkDescriptorV2;
+    constructor(properties?: {
+        descriptor: NetworkDescriptorV2;
+    });
+    beforeOpen(_node: ProgramClient, _options?: ProgramInitializationOptions<never, this>): Promise<never>;
+    open(_args?: never): Promise<never>;
+}
+export declare const assertNetworkDescriptorV2: (descriptor: NetworkDescriptorV2) => void;
+export declare const deriveNetworkIdV2: (descriptor: NetworkDescriptorV2) => Uint8Array;
+export declare const digestPolicySnapshotBodyV2: (body: PolicySnapshotBodyV2) => Uint8Array;
+export declare const assertPolicySnapshotBodyV2: (body: PolicySnapshotBodyV2, descriptor: NetworkDescriptorV2) => void;
+export declare const decodeTrustedNetworkV2: (bytes: Uint8Array) => TrustedNetworkV2;
+export declare const decodePolicySnapshotBodyV2: (bytes: Uint8Array, descriptor: NetworkDescriptorV2) => PolicySnapshotBodyV2;
+//# sourceMappingURL=v2.d.ts.map

package/dist/src/v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.d.ts","sourceRoot":"","sources":["../../src/v2.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAc,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EACN,OAAO,EACP,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,MAAM,kBAAkB,CAAC;AAG1B;;;;;;GAMG;AAEH,eAAO,MAAM,mCAAmC,IAAI,CAAC;AACrD,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,4DAA4D,IAAI,CAAC;AAE9E,eAAO,MAAM,oCAAoC,6CACN,CAAC;AAC5C,eAAO,MAAM,uCAAuC,8CACR,CAAC;AAE7C,eAAO,MAAM,kBAAkB;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,kCAAkC,QAIjB,CAAC;AA+C/B,qBACa,mBAAmB;IAE/B,eAAe,EAAE,MAAM,CAAC;IAGxB,YAAY,EAAE,UAAU,CAAC;IAGzB,eAAe,EAAE,aAAa,CAAC;IAG/B,mBAAmB,EAAE,UAAU,CAAC;IAGhC,iBAAiB,EAAE,MAAM,CAAC;IAG1B,qBAAqB,EAAE,MAAM,CAAC;gBAElB,UAAU,CAAC,EAAE;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,UAAU,CAAC;QACzB,eAAe,EAAE,aAAa,CAAC;QAC/B,mBAAmB,EAAE,UAAU,CAAC;QAChC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,qBAAqB,EAAE,MAAM,CAAC;KAC9B;CAGD;AAED,qBAAa,yBAAyB;IAErC,OAAO,EAAE,MAAM,CAAC;IAGhB,MAAM,EAAE,UAAU,CAAC;gBAEP,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE;CAGhE;AAED,qBAAa,sBAAsB;IAElC,UAAU,EAAE,aAAa,CAAC;IAG1B,KAAK,EAAE,MAAM,CAAC;IAGd,uBAAuB,CAAC,EAAE,yBAAyB,CAAC;gBAExC,UAAU,CAAC,EAAE;QACxB,UAAU,EAAE,aAAa,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,uBAAuB,CAAC,EAAE,yBAAyB,CAAC;KACpD;CAGD;AAED,qBACa,oBAAoB;IAEhC,SAAS,EAAE,UAAU,CAAC;IAGtB,QAAQ,EAAE,MAAM,CAAC;IAGjB,oBAAoB,EAAE,UAAU,CAAC;IAGjC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;gBAEvB,UAAU,CAAC,EAAE;QACxB,SAAS,EAAE,UAAU,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,EAAE,UAAU,CAAC;QACjC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;KACnC;CAGD;AAED,qBACa,gBAAiB,SAAQ,OAAO,CAAC,KAAK,CAAC;IAEnD,UAAU,EAAE,mBAAmB,CAAC;gBAEpB,UAAU,CAAC,EAAE;QAAE,UAAU,EAAE,mBAAmB,CAAA;KAAE;IAK7C,UAAU,CACxB,KAAK,EAAE,aAAa,EACpB,QAAQ,CAAC,EAAE,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,GAClD,OAAO,CAAC,KAAK,CAAC;IAMX,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;CAKzC;AAED,eAAO,MAAM,yBAAyB,GACrC,YAAY,mBAAmB,KAC7B,IAqBF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC7B,YAAY,mBAAmB,KAC7B,UAUF,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACtC,MAAM,oBAAoB,KACxB,UAQF,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACtC,MAAM,oBAAoB,EAC1B,YAAY,mBAAmB,KAC7B,IAiEF,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,OAAO,UAAU,KAAG,gBAK1D,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACtC,OAAO,UAAU,EACjB,YAAY,mBAAmB,KAC7B,oBAKF,CAAC"}

package/dist/src/v2.js

@@ -0,0 +1,409 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+import { deserialize, field, fixedArray, option, serialize, variant, vec, } from "@dao-xyz/borsh";
+import { PublicSignKey, sha256Sync } from "@peerbit/crypto";
+import { Program, } from "@peerbit/program";
+import { compare, concat, equals } from "uint8arrays";
+/**
+ * Decode-only TrustedNetwork v2 codec scaffold.
+ *
+ * This module is intentionally absent from the package entry point. It pins
+ * the policy wire contract needed by the next slice without exposing a usable
+ * controller, policy engine, resource fence, or encryption path.
+ */
+export const TRUSTED_NETWORK_V2_PROTOCOL_VERSION = 2;
+export const TRUSTED_NETWORK_V2_POLICY_HASH_SHA256 = 1;
+/**
+ * Profile 1 accepts only an EntryV0 whose normal toSignable() bytes (including
+ * causal metadata) have exactly one successfully verified signature. The
+ * signer's canonical public-key bytes must equal the descriptor authority.
+ */
+export const TRUSTED_NETWORK_V2_ENTRY_V0_AUTHORITY_ONLY_SIGNATURE_PROFILE = 1;
+export const TRUSTED_NETWORK_V2_NETWORK_ID_DOMAIN = "peerbit/trusted-network/v2/network-id/v1";
+export const TRUSTED_NETWORK_V2_POLICY_DIGEST_DOMAIN = "peerbit/trusted-network/v2/policy-body/v1";
+export const TrustedNetworkRole = Object.freeze({
+    ADMIN: 0x01,
+    WRITER: 0x02,
+    READER: 0x04,
+    REPLICATOR: 0x08,
+});
+export const TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS = TrustedNetworkRole.ADMIN |
+    TrustedNetworkRole.WRITER |
+    TrustedNetworkRole.READER |
+    TrustedNetworkRole.REPLICATOR;
+const ZERO_DIGEST = new Uint8Array(32);
+const textEncoder = new TextEncoder();
+const assertByte = (value, label) => {
+    if (!Number.isInteger(value) || value < 0 || value > 0xff) {
+        throw new Error(`${label} must be a u8`);
+    }
+};
+const assertU16 = (value, label) => {
+    if (!Number.isInteger(value) || value < 0 || value > 0xffff) {
+        throw new Error(`${label} must be a u16`);
+    }
+};
+const assertU64 = (value, label) => {
+    if (typeof value !== "bigint" || value < 0n || value > 0xffffffffffffffffn) {
+        throw new Error(`${label} must be a u64`);
+    }
+};
+const assertBytes32 = (value, label) => {
+    if (!(value instanceof Uint8Array) || value.byteLength !== 32) {
+        throw new Error(`${label} must contain exactly 32 bytes`);
+    }
+};
+const lengthPrefix = (value) => {
+    const length = new Uint8Array(4);
+    new DataView(length.buffer).setUint32(0, value.byteLength, true);
+    return concat([length, value]);
+};
+const encodeU16 = (value) => {
+    const bytes = new Uint8Array(2);
+    new DataView(bytes.buffer).setUint16(0, value, true);
+    return bytes;
+};
+const assertCanonicalEncoding = (bytes, value) => {
+    if (!equals(bytes, serialize(value))) {
+        throw new Error("TrustedNetwork v2 encoding is not canonical");
+    }
+};
+let NetworkDescriptorV2 = (() => {
+    let _classDecorators = [variant([2, 0])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _protocolVersion_decorators;
+    let _protocolVersion_initializers = [];
+    let _protocolVersion_extraInitializers = [];
+    let _networkNonce_decorators;
+    let _networkNonce_initializers = [];
+    let _networkNonce_extraInitializers = [];
+    let _policyAuthority_decorators;
+    let _policyAuthority_initializers = [];
+    let _policyAuthority_extraInitializers = [];
+    let _genesisPolicyDigest_decorators;
+    let _genesisPolicyDigest_initializers = [];
+    let _genesisPolicyDigest_extraInitializers = [];
+    let _policyHashProfile_decorators;
+    let _policyHashProfile_initializers = [];
+    let _policyHashProfile_extraInitializers = [];
+    let _entrySignatureProfile_decorators;
+    let _entrySignatureProfile_initializers = [];
+    let _entrySignatureProfile_extraInitializers = [];
+    var NetworkDescriptorV2 = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _protocolVersion_decorators = [field({ type: "u16" })];
+            _networkNonce_decorators = [field({ type: fixedArray("u8", 32) })];
+            _policyAuthority_decorators = [field({ type: PublicSignKey })];
+            _genesisPolicyDigest_decorators = [field({ type: fixedArray("u8", 32) })];
+            _policyHashProfile_decorators = [field({ type: "u8" })];
+            _entrySignatureProfile_decorators = [field({ type: "u8" })];
+            __esDecorate(null, null, _protocolVersion_decorators, { kind: "field", name: "protocolVersion", static: false, private: false, access: { has: obj => "protocolVersion" in obj, get: obj => obj.protocolVersion, set: (obj, value) => { obj.protocolVersion = value; } }, metadata: _metadata }, _protocolVersion_initializers, _protocolVersion_extraInitializers);
+            __esDecorate(null, null, _networkNonce_decorators, { kind: "field", name: "networkNonce", static: false, private: false, access: { has: obj => "networkNonce" in obj, get: obj => obj.networkNonce, set: (obj, value) => { obj.networkNonce = value; } }, metadata: _metadata }, _networkNonce_initializers, _networkNonce_extraInitializers);
+            __esDecorate(null, null, _policyAuthority_decorators, { kind: "field", name: "policyAuthority", static: false, private: false, access: { has: obj => "policyAuthority" in obj, get: obj => obj.policyAuthority, set: (obj, value) => { obj.policyAuthority = value; } }, metadata: _metadata }, _policyAuthority_initializers, _policyAuthority_extraInitializers);
+            __esDecorate(null, null, _genesisPolicyDigest_decorators, { kind: "field", name: "genesisPolicyDigest", static: false, private: false, access: { has: obj => "genesisPolicyDigest" in obj, get: obj => obj.genesisPolicyDigest, set: (obj, value) => { obj.genesisPolicyDigest = value; } }, metadata: _metadata }, _genesisPolicyDigest_initializers, _genesisPolicyDigest_extraInitializers);
+            __esDecorate(null, null, _policyHashProfile_decorators, { kind: "field", name: "policyHashProfile", static: false, private: false, access: { has: obj => "policyHashProfile" in obj, get: obj => obj.policyHashProfile, set: (obj, value) => { obj.policyHashProfile = value; } }, metadata: _metadata }, _policyHashProfile_initializers, _policyHashProfile_extraInitializers);
+            __esDecorate(null, null, _entrySignatureProfile_decorators, { kind: "field", name: "entrySignatureProfile", static: false, private: false, access: { has: obj => "entrySignatureProfile" in obj, get: obj => obj.entrySignatureProfile, set: (obj, value) => { obj.entrySignatureProfile = value; } }, metadata: _metadata }, _entrySignatureProfile_initializers, _entrySignatureProfile_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            NetworkDescriptorV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        protocolVersion = __runInitializers(this, _protocolVersion_initializers, void 0);
+        networkNonce = (__runInitializers(this, _protocolVersion_extraInitializers), __runInitializers(this, _networkNonce_initializers, void 0));
+        policyAuthority = (__runInitializers(this, _networkNonce_extraInitializers), __runInitializers(this, _policyAuthority_initializers, void 0));
+        genesisPolicyDigest = (__runInitializers(this, _policyAuthority_extraInitializers), __runInitializers(this, _genesisPolicyDigest_initializers, void 0));
+        policyHashProfile = (__runInitializers(this, _genesisPolicyDigest_extraInitializers), __runInitializers(this, _policyHashProfile_initializers, void 0));
+        entrySignatureProfile = (__runInitializers(this, _policyHashProfile_extraInitializers), __runInitializers(this, _entrySignatureProfile_initializers, void 0));
+        constructor(properties) {
+            __runInitializers(this, _entrySignatureProfile_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+    return NetworkDescriptorV2 = _classThis;
+})();
+export { NetworkDescriptorV2 };
+let EncryptionKeyCommitmentV2 = (() => {
+    let _profile_decorators;
+    let _profile_initializers = [];
+    let _profile_extraInitializers = [];
+    let _digest_decorators;
+    let _digest_initializers = [];
+    let _digest_extraInitializers = [];
+    return class EncryptionKeyCommitmentV2 {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _profile_decorators = [field({ type: "u8" })];
+            _digest_decorators = [field({ type: fixedArray("u8", 32) })];
+            __esDecorate(null, null, _profile_decorators, { kind: "field", name: "profile", static: false, private: false, access: { has: obj => "profile" in obj, get: obj => obj.profile, set: (obj, value) => { obj.profile = value; } }, metadata: _metadata }, _profile_initializers, _profile_extraInitializers);
+            __esDecorate(null, null, _digest_decorators, { kind: "field", name: "digest", static: false, private: false, access: { has: obj => "digest" in obj, get: obj => obj.digest, set: (obj, value) => { obj.digest = value; } }, metadata: _metadata }, _digest_initializers, _digest_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        profile = __runInitializers(this, _profile_initializers, void 0);
+        digest = (__runInitializers(this, _profile_extraInitializers), __runInitializers(this, _digest_initializers, void 0));
+        constructor(properties) {
+            __runInitializers(this, _digest_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+})();
+export { EncryptionKeyCommitmentV2 };
+let PolicySubjectBindingV2 = (() => {
+    let _signingKey_decorators;
+    let _signingKey_initializers = [];
+    let _signingKey_extraInitializers = [];
+    let _roles_decorators;
+    let _roles_initializers = [];
+    let _roles_extraInitializers = [];
+    let _encryptionKeyCommitment_decorators;
+    let _encryptionKeyCommitment_initializers = [];
+    let _encryptionKeyCommitment_extraInitializers = [];
+    return class PolicySubjectBindingV2 {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _signingKey_decorators = [field({ type: PublicSignKey })];
+            _roles_decorators = [field({ type: "u8" })];
+            _encryptionKeyCommitment_decorators = [field({ type: option(EncryptionKeyCommitmentV2) })];
+            __esDecorate(null, null, _signingKey_decorators, { kind: "field", name: "signingKey", static: false, private: false, access: { has: obj => "signingKey" in obj, get: obj => obj.signingKey, set: (obj, value) => { obj.signingKey = value; } }, metadata: _metadata }, _signingKey_initializers, _signingKey_extraInitializers);
+            __esDecorate(null, null, _roles_decorators, { kind: "field", name: "roles", static: false, private: false, access: { has: obj => "roles" in obj, get: obj => obj.roles, set: (obj, value) => { obj.roles = value; } }, metadata: _metadata }, _roles_initializers, _roles_extraInitializers);
+            __esDecorate(null, null, _encryptionKeyCommitment_decorators, { kind: "field", name: "encryptionKeyCommitment", static: false, private: false, access: { has: obj => "encryptionKeyCommitment" in obj, get: obj => obj.encryptionKeyCommitment, set: (obj, value) => { obj.encryptionKeyCommitment = value; } }, metadata: _metadata }, _encryptionKeyCommitment_initializers, _encryptionKeyCommitment_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        signingKey = __runInitializers(this, _signingKey_initializers, void 0);
+        roles = (__runInitializers(this, _signingKey_extraInitializers), __runInitializers(this, _roles_initializers, void 0));
+        encryptionKeyCommitment = (__runInitializers(this, _roles_extraInitializers), __runInitializers(this, _encryptionKeyCommitment_initializers, void 0));
+        constructor(properties) {
+            __runInitializers(this, _encryptionKeyCommitment_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+})();
+export { PolicySubjectBindingV2 };
+let PolicySnapshotBodyV2 = (() => {
+    let _classDecorators = [variant([2, 1])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _networkId_decorators;
+    let _networkId_initializers = [];
+    let _networkId_extraInitializers = [];
+    let _sequence_decorators;
+    let _sequence_initializers = [];
+    let _sequence_extraInitializers = [];
+    let _previousPolicyDigest_decorators;
+    let _previousPolicyDigest_initializers = [];
+    let _previousPolicyDigest_extraInitializers = [];
+    let _bindings_decorators;
+    let _bindings_initializers = [];
+    let _bindings_extraInitializers = [];
+    var PolicySnapshotBodyV2 = class {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _networkId_decorators = [field({ type: fixedArray("u8", 32) })];
+            _sequence_decorators = [field({ type: "u64" })];
+            _previousPolicyDigest_decorators = [field({ type: fixedArray("u8", 32) })];
+            _bindings_decorators = [field({ type: vec(PolicySubjectBindingV2) })];
+            __esDecorate(null, null, _networkId_decorators, { kind: "field", name: "networkId", static: false, private: false, access: { has: obj => "networkId" in obj, get: obj => obj.networkId, set: (obj, value) => { obj.networkId = value; } }, metadata: _metadata }, _networkId_initializers, _networkId_extraInitializers);
+            __esDecorate(null, null, _sequence_decorators, { kind: "field", name: "sequence", static: false, private: false, access: { has: obj => "sequence" in obj, get: obj => obj.sequence, set: (obj, value) => { obj.sequence = value; } }, metadata: _metadata }, _sequence_initializers, _sequence_extraInitializers);
+            __esDecorate(null, null, _previousPolicyDigest_decorators, { kind: "field", name: "previousPolicyDigest", static: false, private: false, access: { has: obj => "previousPolicyDigest" in obj, get: obj => obj.previousPolicyDigest, set: (obj, value) => { obj.previousPolicyDigest = value; } }, metadata: _metadata }, _previousPolicyDigest_initializers, _previousPolicyDigest_extraInitializers);
+            __esDecorate(null, null, _bindings_decorators, { kind: "field", name: "bindings", static: false, private: false, access: { has: obj => "bindings" in obj, get: obj => obj.bindings, set: (obj, value) => { obj.bindings = value; } }, metadata: _metadata }, _bindings_initializers, _bindings_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            PolicySnapshotBodyV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        networkId = __runInitializers(this, _networkId_initializers, void 0);
+        sequence = (__runInitializers(this, _networkId_extraInitializers), __runInitializers(this, _sequence_initializers, void 0));
+        previousPolicyDigest = (__runInitializers(this, _sequence_extraInitializers), __runInitializers(this, _previousPolicyDigest_initializers, void 0));
+        bindings = (__runInitializers(this, _previousPolicyDigest_extraInitializers), __runInitializers(this, _bindings_initializers, void 0));
+        constructor(properties) {
+            __runInitializers(this, _bindings_extraInitializers);
+            if (properties)
+                Object.assign(this, properties);
+        }
+    };
+    return PolicySnapshotBodyV2 = _classThis;
+})();
+export { PolicySnapshotBodyV2 };
+let TrustedNetworkV2 = (() => {
+    let _classDecorators = [variant("trusted_network_v2")];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Program;
+    let _descriptor_decorators;
+    let _descriptor_initializers = [];
+    let _descriptor_extraInitializers = [];
+    var TrustedNetworkV2 = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _descriptor_decorators = [field({ type: NetworkDescriptorV2 })];
+            __esDecorate(null, null, _descriptor_decorators, { kind: "field", name: "descriptor", static: false, private: false, access: { has: obj => "descriptor" in obj, get: obj => obj.descriptor, set: (obj, value) => { obj.descriptor = value; } }, metadata: _metadata }, _descriptor_initializers, _descriptor_extraInitializers);
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            TrustedNetworkV2 = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        descriptor = __runInitializers(this, _descriptor_initializers, void 0);
+        constructor(properties) {
+            super();
+            __runInitializers(this, _descriptor_extraInitializers);
+            if (properties)
+                this.descriptor = properties.descriptor;
+        }
+        async beforeOpen(_node, _options) {
+            throw new Error("TrustedNetwork v2 is a decode-only codec and cannot be activated");
+        }
+        async open(_args) {
+            throw new Error("TrustedNetwork v2 is a decode-only codec and cannot be activated");
+        }
+    };
+    return TrustedNetworkV2 = _classThis;
+})();
+export { TrustedNetworkV2 };
+export const assertNetworkDescriptorV2 = (descriptor) => {
+    assertU16(descriptor.protocolVersion, "protocolVersion");
+    if (descriptor.protocolVersion !== TRUSTED_NETWORK_V2_PROTOCOL_VERSION) {
+        throw new Error("Unsupported TrustedNetwork protocol version");
+    }
+    assertBytes32(descriptor.networkNonce, "networkNonce");
+    if (!(descriptor.policyAuthority instanceof PublicSignKey)) {
+        throw new Error("policyAuthority must be a public signing key");
+    }
+    assertBytes32(descriptor.genesisPolicyDigest, "genesisPolicyDigest");
+    assertByte(descriptor.policyHashProfile, "policyHashProfile");
+    if (descriptor.policyHashProfile !== TRUSTED_NETWORK_V2_POLICY_HASH_SHA256) {
+        throw new Error("Unsupported TrustedNetwork policy hash profile");
+    }
+    assertByte(descriptor.entrySignatureProfile, "entrySignatureProfile");
+    if (descriptor.entrySignatureProfile !==
+        TRUSTED_NETWORK_V2_ENTRY_V0_AUTHORITY_ONLY_SIGNATURE_PROFILE) {
+        throw new Error("Unsupported TrustedNetwork entry signature profile");
+    }
+};
+export const deriveNetworkIdV2 = (descriptor) => {
+    assertNetworkDescriptorV2(descriptor);
+    return sha256Sync(concat([
+        lengthPrefix(textEncoder.encode(TRUSTED_NETWORK_V2_NETWORK_ID_DOMAIN)),
+        encodeU16(descriptor.protocolVersion),
+        descriptor.networkNonce,
+        lengthPrefix(serialize(descriptor.policyAuthority)),
+    ]));
+};
+export const digestPolicySnapshotBodyV2 = (body) => {
+    const bytes = serialize(body);
+    return sha256Sync(concat([
+        lengthPrefix(textEncoder.encode(TRUSTED_NETWORK_V2_POLICY_DIGEST_DOMAIN)),
+        lengthPrefix(bytes),
+    ]));
+};
+export const assertPolicySnapshotBodyV2 = (body, descriptor) => {
+    assertNetworkDescriptorV2(descriptor);
+    assertBytes32(body.networkId, "networkId");
+    if (!equals(body.networkId, deriveNetworkIdV2(descriptor))) {
+        throw new Error("Policy snapshot belongs to another network");
+    }
+    assertU64(body.sequence, "sequence");
+    assertBytes32(body.previousPolicyDigest, "previousPolicyDigest");
+    if (body.sequence === 0n) {
+        if (!equals(body.previousPolicyDigest, ZERO_DIGEST)) {
+            throw new Error("Genesis policy must use the zero previous digest");
+        }
+    }
+    else if (equals(body.previousPolicyDigest, ZERO_DIGEST)) {
+        throw new Error("A non-genesis policy must name its previous digest");
+    }
+    if (!Array.isArray(body.bindings) || body.bindings.length === 0) {
+        throw new Error("Policy snapshot must contain bindings");
+    }
+    let previousKeyBytes;
+    let authorityBinding;
+    for (const binding of body.bindings) {
+        if (!(binding.signingKey instanceof PublicSignKey)) {
+            throw new Error("Policy subject must be a public signing key");
+        }
+        const keyBytes = serialize(binding.signingKey);
+        if (previousKeyBytes !== undefined &&
+            compare(previousKeyBytes, keyBytes) >= 0) {
+            throw new Error("Policy bindings must be sorted and unique");
+        }
+        previousKeyBytes = keyBytes;
+        assertByte(binding.roles, "roles");
+        if (binding.roles === 0) {
+            throw new Error("Policy bindings with no roles are not canonical");
+        }
+        if ((binding.roles & ~TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS) !== 0) {
+            throw new Error("Policy binding contains unknown role bits");
+        }
+        if (binding.encryptionKeyCommitment !== undefined) {
+            throw new Error("TrustedNetwork v2 encryption commitments are not supported yet");
+        }
+        if (binding.signingKey.equals(descriptor.policyAuthority)) {
+            authorityBinding = binding;
+        }
+        else if ((binding.roles & TrustedNetworkRole.ADMIN) !== 0) {
+            throw new Error("Only the policy authority may hold ADMIN");
+        }
+    }
+    if (authorityBinding === undefined ||
+        (authorityBinding.roles & TrustedNetworkRole.ADMIN) === 0) {
+        throw new Error("Policy authority must hold ADMIN");
+    }
+    if (body.sequence === 0n &&
+        !equals(digestPolicySnapshotBodyV2(body), descriptor.genesisPolicyDigest)) {
+        throw new Error("Genesis policy digest does not match the descriptor");
+    }
+};
+export const decodeTrustedNetworkV2 = (bytes) => {
+    const network = deserialize(bytes, TrustedNetworkV2);
+    assertCanonicalEncoding(bytes, network);
+    assertNetworkDescriptorV2(network.descriptor);
+    return network;
+};
+export const decodePolicySnapshotBodyV2 = (bytes, descriptor) => {
+    const body = deserialize(bytes, PolicySnapshotBodyV2);
+    assertCanonicalEncoding(bytes, body);
+    assertPolicySnapshotBodyV2(body, descriptor);
+    return body;
+};
+//# sourceMappingURL=v2.js.map

package/dist/src/v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.js","sourceRoot":"","sources":["../../src/v2.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EACN,WAAW,EACX,KAAK,EACL,UAAU,EACV,MAAM,EACN,SAAS,EACT,OAAO,EACP,GAAG,GACH,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EACN,OAAO,GAGP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AACrD,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,oCAAoC,GAChD,0CAA0C,CAAC;AAC5C,MAAM,CAAC,MAAM,uCAAuC,GACnD,2CAA2C,CAAC;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,IAAI;CACP,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,kCAAkC,GAC9C,kBAAkB,CAAC,KAAK;IACxB,kBAAkB,CAAC,MAAM;IACzB,kBAAkB,CAAC,MAAM;IACzB,kBAAkB,CAAC,UAAU,CAAC;AAE/B,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AACvC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IAC1C,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE;IACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;IAC3C,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAQ,EAAE;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,mBAAmB,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;IAC3C,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAE,KAAa,EAAQ,EAAE;IAChE,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IAC3D,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAc,EAAE;IACtD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAc,EAAE;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,KAAiB,EAAE,KAAc,EAAQ,EAAE;IAC3E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;AACF,CAAC,CAAC;IAGW,mBAAmB;4BAD/B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;2CAEd,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;wCAGtB,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;2CAGrC,KAAK,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;+CAG9B,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;6CAGrC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;iDAGrB,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAdtB,+LAAA,eAAe,6BAAf,eAAe,yGAAS;YAGxB,sLAAA,YAAY,6BAAZ,YAAY,mGAAa;YAGzB,+LAAA,eAAe,6BAAf,eAAe,yGAAgB;YAG/B,2MAAA,mBAAmB,6BAAnB,mBAAmB,iHAAa;YAGhC,qMAAA,iBAAiB,6BAAjB,iBAAiB,6GAAS;YAG1B,iNAAA,qBAAqB,6BAArB,qBAAqB,qHAAS;YAjB/B,6KA6BC;;;YA7BY,uDAAmB;;QAE/B,eAAe,kEAAS;QAGxB,YAAY,8HAAa;QAGzB,eAAe,8HAAgB;QAG/B,mBAAmB,qIAAa;QAGhC,iBAAiB,uIAAS;QAG1B,qBAAqB,yIAAS;QAE9B,YAAY,UAOX;;YACA,IAAI,UAAU;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;SAChD;;;;SA5BW,mBAAmB;IA+BnB,yBAAyB;;;;;;;iBAAzB,yBAAyB;;;mCACpC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;kCAGrB,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YAFtC,uKAAA,OAAO,6BAAP,OAAO,yFAAS;YAGhB,oKAAA,MAAM,6BAAN,MAAM,uFAAa;;;QAHnB,OAAO,0DAAS;QAGhB,MAAM,gHAAa;QAEnB,YAAY,UAAoD;;YAC/D,IAAI,UAAU;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;SAChD;;;SATW,yBAAyB;IAYzB,sBAAsB;;;;;;;;;;iBAAtB,sBAAsB;;;sCACjC,KAAK,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;iCAG9B,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;mDAGrB,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC;YALnD,gLAAA,UAAU,6BAAV,UAAU,+FAAgB;YAG1B,iKAAA,KAAK,6BAAL,KAAK,qFAAS;YAGd,uNAAA,uBAAuB,6BAAvB,uBAAuB,yHAA6B;;;QANpD,UAAU,6DAAgB;QAG1B,KAAK,kHAAS;QAGd,uBAAuB,+HAA6B;QAEpD,YAAY,UAIX;;YACA,IAAI,UAAU;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;SAChD;;;SAhBW,sBAAsB;IAoBtB,oBAAoB;4BADhC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;qCAEd,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;oCAGrC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;gDAGtB,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;oCAGrC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAR7C,6KAAA,SAAS,6BAAT,SAAS,6FAAa;YAGtB,0KAAA,QAAQ,6BAAR,QAAQ,2FAAS;YAGjB,8MAAA,oBAAoB,6BAApB,oBAAoB,mHAAa;YAGjC,0KAAA,QAAQ,6BAAR,QAAQ,2FAA2B;YAXpC,6KAqBC;;;YArBY,uDAAoB;;QAEhC,SAAS,4DAAa;QAGtB,QAAQ,oHAAS;QAGjB,oBAAoB,+HAAa;QAGjC,QAAQ,+HAA2B;QAEnC,YAAY,UAKX;;YACA,IAAI,UAAU;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;SAChD;;;;SApBW,oBAAoB;IAwBpB,gBAAgB;4BAD5B,OAAO,CAAC,oBAAoB,CAAC;;;;sBACQ,OAAO;;;;gCAAf,SAAQ,WAAc;;;;sCAClD,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;YACrC,gLAAA,UAAU,6BAAV,UAAU,+FAAsB;YAFjC,6KAuBC;;;YAvBY,uDAAgB;;QAE5B,UAAU,6DAAsB;QAEhC,YAAY,UAAgD;YAC3D,KAAK,EAAE,CAAC;;YACR,IAAI,UAAU;gBAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;SACxD;QAEQ,KAAK,CAAC,UAAU,CACxB,KAAoB,EACpB,QAAoD;YAEpD,MAAM,IAAI,KAAK,CACd,kEAAkE,CAClE,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAa;YACvB,MAAM,IAAI,KAAK,CACd,kEAAkE,CAClE,CAAC;QACH,CAAC;;;;SAtBW,gBAAgB;AAyB7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACxC,UAA+B,EACxB,EAAE;IACT,SAAS,CAAC,UAAU,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,eAAe,KAAK,mCAAmC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IACD,aAAa,CAAC,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,YAAY,aAAa,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjE,CAAC;IACD,aAAa,CAAC,UAAU,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IACrE,UAAU,CAAC,UAAU,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,iBAAiB,KAAK,qCAAqC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,UAAU,CAAC,UAAU,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IACtE,IACC,UAAU,CAAC,qBAAqB;QAChC,4DAA4D,EAC3D,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAChC,UAA+B,EAClB,EAAE;IACf,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,UAAU,CAChB,MAAM,CAAC;QACN,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACtE,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC;QACrC,UAAU,CAAC,YAAY;QACvB,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;KACnD,CAAC,CACF,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,IAA0B,EACb,EAAE;IACf,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,UAAU,CAChB,MAAM,CAAC;QACN,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACzE,YAAY,CAAC,KAAK,CAAC;KACnB,CAAC,CACF,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,IAA0B,EAC1B,UAA+B,EACxB,EAAE;IACT,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACtC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/D,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrC,aAAa,CAAC,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,gBAAwC,CAAC;IAC7C,IAAI,gBAAoD,CAAC;IACzD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,YAAY,aAAa,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,IACC,gBAAgB,KAAK,SAAS;YAC9B,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,EACvC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9D,CAAC;QACD,gBAAgB,GAAG,QAAQ,CAAC;QAE5B,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,kCAAkC,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,gEAAgE,CAChE,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,gBAAgB,GAAG,OAAO,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IACD,IACC,gBAAgB,KAAK,SAAS;QAC9B,CAAC,gBAAgB,CAAC,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EACxD,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrD,CAAC;IACD,IACC,IAAI,CAAC,QAAQ,KAAK,EAAE;QACpB,CAAC,MAAM,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,mBAAmB,CAAC,EACxE,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAiB,EAAoB,EAAE;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACrD,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,yBAAyB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,KAAiB,EACjB,UAA+B,EACR,EAAE;IACzB,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACtD,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,0BAA0B,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACb,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peerbit/trusted-network",
-  "version": "6.0.101",
+  "version": "6.0.103",
   "description": "Access controller that operates on a DB",
   "sideEffects": false,
   "type": "module",
@@ -56,15 +56,15 @@
     "@libp2p/interface": "^3.2.5",
     "uint8arrays": "^5.1.0",
     "@peerbit/crypto": "3.1.6",
-    "@peerbit/log": "6.2.24",
-    "@peerbit/document": "15.0.15",
-    "@peerbit/program": "6.0.55",
-    "@peerbit/shared-log": "16.0.14"
+    "@peerbit/document": "15.0.16",
+    "@peerbit/log": "6.2.25",
+    "@peerbit/program": "6.0.56",
+    "@peerbit/shared-log": "16.0.15"
   },
   "devDependencies": {
     "ethers": "^6.17.0",
-    "@peerbit/test-utils": "3.1.34",
-    "@peerbit/time": "3.0.1"
+    "@peerbit/time": "3.0.1",
+    "@peerbit/test-utils": "3.1.35"
   },
   "repository": {
     "type": "git",

package/src/v2.ts

@@ -0,0 +1,348 @@
+import {
+	deserialize,
+	field,
+	fixedArray,
+	option,
+	serialize,
+	variant,
+	vec,
+} from "@dao-xyz/borsh";
+import { PublicSignKey, sha256Sync } from "@peerbit/crypto";
+import {
+	Program,
+	type ProgramClient,
+	type ProgramInitializationOptions,
+} from "@peerbit/program";
+import { compare, concat, equals } from "uint8arrays";
+
+/**
+ * Decode-only TrustedNetwork v2 codec scaffold.
+ *
+ * This module is intentionally absent from the package entry point. It pins
+ * the policy wire contract needed by the next slice without exposing a usable
+ * controller, policy engine, resource fence, or encryption path.
+ */
+
+export const TRUSTED_NETWORK_V2_PROTOCOL_VERSION = 2;
+export const TRUSTED_NETWORK_V2_POLICY_HASH_SHA256 = 1;
+
+/**
+ * Profile 1 accepts only an EntryV0 whose normal toSignable() bytes (including
+ * causal metadata) have exactly one successfully verified signature. The
+ * signer's canonical public-key bytes must equal the descriptor authority.
+ */
+export const TRUSTED_NETWORK_V2_ENTRY_V0_AUTHORITY_ONLY_SIGNATURE_PROFILE = 1;
+
+export const TRUSTED_NETWORK_V2_NETWORK_ID_DOMAIN =
+	"peerbit/trusted-network/v2/network-id/v1";
+export const TRUSTED_NETWORK_V2_POLICY_DIGEST_DOMAIN =
+	"peerbit/trusted-network/v2/policy-body/v1";
+
+export const TrustedNetworkRole = Object.freeze({
+	ADMIN: 0x01,
+	WRITER: 0x02,
+	READER: 0x04,
+	REPLICATOR: 0x08,
+} as const);
+
+export const TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS =
+	TrustedNetworkRole.ADMIN |
+	TrustedNetworkRole.WRITER |
+	TrustedNetworkRole.READER |
+	TrustedNetworkRole.REPLICATOR;
+
+const ZERO_DIGEST = new Uint8Array(32);
+const textEncoder = new TextEncoder();
+
+const assertByte = (value: number, label: string): void => {
+	if (!Number.isInteger(value) || value < 0 || value > 0xff) {
+		throw new Error(`${label} must be a u8`);
+	}
+};
+
+const assertU16 = (value: number, label: string): void => {
+	if (!Number.isInteger(value) || value < 0 || value > 0xffff) {
+		throw new Error(`${label} must be a u16`);
+	}
+};
+
+const assertU64 = (value: bigint, label: string): void => {
+	if (typeof value !== "bigint" || value < 0n || value > 0xffffffffffffffffn) {
+		throw new Error(`${label} must be a u64`);
+	}
+};
+
+const assertBytes32 = (value: Uint8Array, label: string): void => {
+	if (!(value instanceof Uint8Array) || value.byteLength !== 32) {
+		throw new Error(`${label} must contain exactly 32 bytes`);
+	}
+};
+
+const lengthPrefix = (value: Uint8Array): Uint8Array => {
+	const length = new Uint8Array(4);
+	new DataView(length.buffer).setUint32(0, value.byteLength, true);
+	return concat([length, value]);
+};
+
+const encodeU16 = (value: number): Uint8Array => {
+	const bytes = new Uint8Array(2);
+	new DataView(bytes.buffer).setUint16(0, value, true);
+	return bytes;
+};
+
+const assertCanonicalEncoding = (bytes: Uint8Array, value: unknown): void => {
+	if (!equals(bytes, serialize(value))) {
+		throw new Error("TrustedNetwork v2 encoding is not canonical");
+	}
+};
+
+@variant([2, 0])
+export class NetworkDescriptorV2 {
+	@field({ type: "u16" })
+	protocolVersion: number;
+
+	@field({ type: fixedArray("u8", 32) })
+	networkNonce: Uint8Array;
+
+	@field({ type: PublicSignKey })
+	policyAuthority: PublicSignKey;
+
+	@field({ type: fixedArray("u8", 32) })
+	genesisPolicyDigest: Uint8Array;
+
+	@field({ type: "u8" })
+	policyHashProfile: number;
+
+	@field({ type: "u8" })
+	entrySignatureProfile: number;
+
+	constructor(properties?: {
+		protocolVersion: number;
+		networkNonce: Uint8Array;
+		policyAuthority: PublicSignKey;
+		genesisPolicyDigest: Uint8Array;
+		policyHashProfile: number;
+		entrySignatureProfile: number;
+	}) {
+		if (properties) Object.assign(this, properties);
+	}
+}
+
+export class EncryptionKeyCommitmentV2 {
+	@field({ type: "u8" })
+	profile: number;
+
+	@field({ type: fixedArray("u8", 32) })
+	digest: Uint8Array;
+
+	constructor(properties?: { profile: number; digest: Uint8Array }) {
+		if (properties) Object.assign(this, properties);
+	}
+}
+
+export class PolicySubjectBindingV2 {
+	@field({ type: PublicSignKey })
+	signingKey: PublicSignKey;
+
+	@field({ type: "u8" })
+	roles: number;
+
+	@field({ type: option(EncryptionKeyCommitmentV2) })
+	encryptionKeyCommitment?: EncryptionKeyCommitmentV2;
+
+	constructor(properties?: {
+		signingKey: PublicSignKey;
+		roles: number;
+		encryptionKeyCommitment?: EncryptionKeyCommitmentV2;
+	}) {
+		if (properties) Object.assign(this, properties);
+	}
+}
+
+@variant([2, 1])
+export class PolicySnapshotBodyV2 {
+	@field({ type: fixedArray("u8", 32) })
+	networkId: Uint8Array;
+
+	@field({ type: "u64" })
+	sequence: bigint;
+
+	@field({ type: fixedArray("u8", 32) })
+	previousPolicyDigest: Uint8Array;
+
+	@field({ type: vec(PolicySubjectBindingV2) })
+	bindings: PolicySubjectBindingV2[];
+
+	constructor(properties?: {
+		networkId: Uint8Array;
+		sequence: bigint;
+		previousPolicyDigest: Uint8Array;
+		bindings: PolicySubjectBindingV2[];
+	}) {
+		if (properties) Object.assign(this, properties);
+	}
+}
+
+@variant("trusted_network_v2")
+export class TrustedNetworkV2 extends Program<never> {
+	@field({ type: NetworkDescriptorV2 })
+	descriptor: NetworkDescriptorV2;
+
+	constructor(properties?: { descriptor: NetworkDescriptorV2 }) {
+		super();
+		if (properties) this.descriptor = properties.descriptor;
+	}
+
+	override async beforeOpen(
+		_node: ProgramClient,
+		_options?: ProgramInitializationOptions<never, this>,
+	): Promise<never> {
+		throw new Error(
+			"TrustedNetwork v2 is a decode-only codec and cannot be activated",
+		);
+	}
+
+	async open(_args?: never): Promise<never> {
+		throw new Error(
+			"TrustedNetwork v2 is a decode-only codec and cannot be activated",
+		);
+	}
+}
+
+export const assertNetworkDescriptorV2 = (
+	descriptor: NetworkDescriptorV2,
+): void => {
+	assertU16(descriptor.protocolVersion, "protocolVersion");
+	if (descriptor.protocolVersion !== TRUSTED_NETWORK_V2_PROTOCOL_VERSION) {
+		throw new Error("Unsupported TrustedNetwork protocol version");
+	}
+	assertBytes32(descriptor.networkNonce, "networkNonce");
+	if (!(descriptor.policyAuthority instanceof PublicSignKey)) {
+		throw new Error("policyAuthority must be a public signing key");
+	}
+	assertBytes32(descriptor.genesisPolicyDigest, "genesisPolicyDigest");
+	assertByte(descriptor.policyHashProfile, "policyHashProfile");
+	if (descriptor.policyHashProfile !== TRUSTED_NETWORK_V2_POLICY_HASH_SHA256) {
+		throw new Error("Unsupported TrustedNetwork policy hash profile");
+	}
+	assertByte(descriptor.entrySignatureProfile, "entrySignatureProfile");
+	if (
+		descriptor.entrySignatureProfile !==
+		TRUSTED_NETWORK_V2_ENTRY_V0_AUTHORITY_ONLY_SIGNATURE_PROFILE
+	) {
+		throw new Error("Unsupported TrustedNetwork entry signature profile");
+	}
+};
+
+export const deriveNetworkIdV2 = (
+	descriptor: NetworkDescriptorV2,
+): Uint8Array => {
+	assertNetworkDescriptorV2(descriptor);
+	return sha256Sync(
+		concat([
+			lengthPrefix(textEncoder.encode(TRUSTED_NETWORK_V2_NETWORK_ID_DOMAIN)),
+			encodeU16(descriptor.protocolVersion),
+			descriptor.networkNonce,
+			lengthPrefix(serialize(descriptor.policyAuthority)),
+		]),
+	);
+};
+
+export const digestPolicySnapshotBodyV2 = (
+	body: PolicySnapshotBodyV2,
+): Uint8Array => {
+	const bytes = serialize(body);
+	return sha256Sync(
+		concat([
+			lengthPrefix(textEncoder.encode(TRUSTED_NETWORK_V2_POLICY_DIGEST_DOMAIN)),
+			lengthPrefix(bytes),
+		]),
+	);
+};
+
+export const assertPolicySnapshotBodyV2 = (
+	body: PolicySnapshotBodyV2,
+	descriptor: NetworkDescriptorV2,
+): void => {
+	assertNetworkDescriptorV2(descriptor);
+	assertBytes32(body.networkId, "networkId");
+	if (!equals(body.networkId, deriveNetworkIdV2(descriptor))) {
+		throw new Error("Policy snapshot belongs to another network");
+	}
+	assertU64(body.sequence, "sequence");
+	assertBytes32(body.previousPolicyDigest, "previousPolicyDigest");
+	if (body.sequence === 0n) {
+		if (!equals(body.previousPolicyDigest, ZERO_DIGEST)) {
+			throw new Error("Genesis policy must use the zero previous digest");
+		}
+	} else if (equals(body.previousPolicyDigest, ZERO_DIGEST)) {
+		throw new Error("A non-genesis policy must name its previous digest");
+	}
+	if (!Array.isArray(body.bindings) || body.bindings.length === 0) {
+		throw new Error("Policy snapshot must contain bindings");
+	}
+
+	let previousKeyBytes: Uint8Array | undefined;
+	let authorityBinding: PolicySubjectBindingV2 | undefined;
+	for (const binding of body.bindings) {
+		if (!(binding.signingKey instanceof PublicSignKey)) {
+			throw new Error("Policy subject must be a public signing key");
+		}
+		const keyBytes = serialize(binding.signingKey);
+		if (
+			previousKeyBytes !== undefined &&
+			compare(previousKeyBytes, keyBytes) >= 0
+		) {
+			throw new Error("Policy bindings must be sorted and unique");
+		}
+		previousKeyBytes = keyBytes;
+
+		assertByte(binding.roles, "roles");
+		if (binding.roles === 0) {
+			throw new Error("Policy bindings with no roles are not canonical");
+		}
+		if ((binding.roles & ~TRUSTED_NETWORK_V2_KNOWN_ROLE_BITS) !== 0) {
+			throw new Error("Policy binding contains unknown role bits");
+		}
+		if (binding.encryptionKeyCommitment !== undefined) {
+			throw new Error(
+				"TrustedNetwork v2 encryption commitments are not supported yet",
+			);
+		}
+
+		if (binding.signingKey.equals(descriptor.policyAuthority)) {
+			authorityBinding = binding;
+		} else if ((binding.roles & TrustedNetworkRole.ADMIN) !== 0) {
+			throw new Error("Only the policy authority may hold ADMIN");
+		}
+	}
+	if (
+		authorityBinding === undefined ||
+		(authorityBinding.roles & TrustedNetworkRole.ADMIN) === 0
+	) {
+		throw new Error("Policy authority must hold ADMIN");
+	}
+	if (
+		body.sequence === 0n &&
+		!equals(digestPolicySnapshotBodyV2(body), descriptor.genesisPolicyDigest)
+	) {
+		throw new Error("Genesis policy digest does not match the descriptor");
+	}
+};
+
+export const decodeTrustedNetworkV2 = (bytes: Uint8Array): TrustedNetworkV2 => {
+	const network = deserialize(bytes, TrustedNetworkV2);
+	assertCanonicalEncoding(bytes, network);
+	assertNetworkDescriptorV2(network.descriptor);
+	return network;
+};
+
+export const decodePolicySnapshotBodyV2 = (
+	bytes: Uint8Array,
+	descriptor: NetworkDescriptorV2,
+): PolicySnapshotBodyV2 => {
+	const body = deserialize(bytes, PolicySnapshotBodyV2);
+	assertCanonicalEncoding(bytes, body);
+	assertPolicySnapshotBodyV2(body, descriptor);
+	return body;
+};