@peerbit/trusted-network 6.0.112 → 6.0.114

package/src/v2-authority-entry.ts

@@ -0,0 +1,319 @@
+import { deserialize, serialize } from "@dao-xyz/borsh";
+import { DecryptedThing, verify } from "@peerbit/crypto";
+import { Entry, EntryV0, NO_ENCODING } from "@peerbit/log";
+import { equals } from "uint8arrays";
+import {
+	NetworkDescriptorV2,
+	assertNetworkDescriptorV2,
+	copyUint8ArrayWithLengthV2,
+	exactUint8ArrayByteLengthV2,
+} from "./v2.js";
+
+export type AuthenticatedAuthorityEntryV0V2 = {
+	descriptor: NetworkDescriptorV2;
+	entryBytes: Uint8Array;
+	entry: EntryV0<Uint8Array>;
+	metaBytes: Uint8Array;
+	payloadBytes: Uint8Array;
+	reservedBytes: Uint8Array;
+	hasHash: boolean;
+	directParentCount: number;
+};
+
+export type AuthorityEntryV0ProfileV2 = (
+	entry: AuthenticatedAuthorityEntryV0V2,
+) => void;
+
+type ScannedEntryV0StructureV2 = {
+	metaBytes: Uint8Array;
+	payloadBytes: Uint8Array;
+	signableBytes: Uint8Array;
+	reservedBytes: Uint8Array;
+	hasHash: boolean;
+	directParentCount: number;
+};
+
+class BoundsReaderV2 {
+	private offset = 0;
+	private readonly view: DataView;
+
+	constructor(private readonly bytes: Uint8Array) {
+		this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	}
+
+	get position(): number {
+		return this.offset;
+	}
+
+	get remaining(): number {
+		return this.bytes.byteLength - this.offset;
+	}
+
+	readU8(label: string): number {
+		return this.readExact(1, label)[0]!;
+	}
+
+	readU32(label: string): number {
+		this.requireRemaining(4, label);
+		const value = this.view.getUint32(this.offset, true);
+		this.offset += 4;
+		return value;
+	}
+
+	readBytes(label: string): Uint8Array {
+		return this.readExact(this.readU32(`${label} length`), label);
+	}
+
+	readExact(byteLength: number, label: string): Uint8Array {
+		this.requireRemaining(byteLength, label);
+		const start = this.offset;
+		this.offset += byteLength;
+		return this.bytes.subarray(start, this.offset);
+	}
+
+	expectU8(expected: number, label: string): void {
+		if (this.readU8(label) !== expected) {
+			throw new Error(`Authority EntryV0 has invalid ${label}`);
+		}
+	}
+
+	expectDone(label: string): void {
+		if (this.offset !== this.bytes.byteLength) {
+			throw new Error(`Authority EntryV0 has trailing ${label} bytes`);
+		}
+	}
+
+	private requireRemaining(byteLength: number, label: string): void {
+		if (
+			!Number.isSafeInteger(byteLength) ||
+			byteLength < 0 ||
+			byteLength > this.bytes.byteLength - this.offset
+		) {
+			throw new Error(`Authority EntryV0 has truncated ${label}`);
+		}
+	}
+}
+
+const readPublicWrapperV2 = (
+	reader: BoundsReaderV2,
+	label: string,
+): Uint8Array => {
+	if (
+		reader.readU8(`${label} MaybeEncrypted variant`) !== 0 ||
+		reader.readU8(`${label} DecryptedThing variant`) !== 0
+	) {
+		throw new Error(`Authority EntryV0 ${label} must be public`);
+	}
+	return reader.readBytes(label);
+};
+
+const scanMetaStructureV2 = (metaBytes: Uint8Array): number => {
+	const reader = new BoundsReaderV2(metaBytes);
+	reader.expectU8(0, "metadata variant");
+	reader.expectU8(0, "clock variant");
+	reader.readBytes("clock id");
+	reader.expectU8(0, "timestamp variant");
+	reader.readExact(8, "timestamp wall time");
+	reader.readExact(4, "timestamp logical time");
+	reader.readBytes("gid");
+
+	const directParentCount = reader.readU32("direct-parent count");
+	// Every Borsh string starts with a four-byte length. Reject an impossible
+	// input-backed count before iterating or invoking the generic decoder.
+	if (directParentCount > Math.floor(reader.remaining / 4)) {
+		throw new Error("Authority EntryV0 has impossible direct-parent count");
+	}
+	for (let i = 0; i < directParentCount; i++) {
+		reader.readBytes("direct parent");
+	}
+
+	reader.readU8("entry type");
+	const metaDataOption = reader.readU8("metadata data option");
+	if (metaDataOption === 1) {
+		reader.readBytes("metadata data");
+	} else if (metaDataOption !== 0) {
+		throw new Error("Authority EntryV0 has invalid metadata data option");
+	}
+	reader.expectDone("metadata");
+	return directParentCount;
+};
+
+const scanPayloadStructureV2 = (payloadBytes: Uint8Array): Uint8Array => {
+	const reader = new BoundsReaderV2(payloadBytes);
+	reader.expectU8(0, "payload variant");
+	const data = reader.readBytes("payload data");
+	reader.expectDone("payload");
+	return data;
+};
+
+const scanSignatureStructureV2 = (signatureBytes: Uint8Array): void => {
+	const reader = new BoundsReaderV2(signatureBytes);
+	reader.expectU8(0, "signature variant");
+	reader.readBytes("signature data");
+	const publicKeyVariant = reader.readU8("signature public-key variant");
+	const publicKeyLength =
+		publicKeyVariant === 0 ? 32 : publicKeyVariant === 1 ? 33 : undefined;
+	if (publicKeyLength === undefined) {
+		throw new Error("Authority EntryV0 uses an unsupported signing key");
+	}
+	reader.readExact(publicKeyLength, "signature public key");
+	reader.readU8("signature prehash");
+	reader.expectDone("signature");
+};
+
+const scanEntryV0StructureV2 = (
+	entryBytes: Uint8Array,
+): ScannedEntryV0StructureV2 => {
+	const reader = new BoundsReaderV2(entryBytes);
+	reader.expectU8(0, "entry variant");
+	const metaBytes = readPublicWrapperV2(reader, "metadata");
+	const payloadContainerBytes = readPublicWrapperV2(reader, "payload");
+	const reservedBytes = reader.readExact(4, "reserved bytes");
+	const signablePrefixLength = reader.position;
+	if (reader.readU8("signatures option") !== 1) {
+		throw new Error("Authority EntryV0 must contain exactly one signature");
+	}
+	reader.expectU8(0, "signatures variant");
+	if (reader.readU32("signature count") !== 1) {
+		throw new Error("Authority EntryV0 must contain exactly one signature");
+	}
+	const signatureBytes = readPublicWrapperV2(reader, "signature");
+	const hashOption = reader.readU8("hash option");
+	if (hashOption === 1) {
+		reader.readBytes("hash");
+	} else if (hashOption !== 0) {
+		throw new Error("Authority EntryV0 has invalid hash option");
+	}
+	reader.expectDone("storage");
+
+	const directParentCount = scanMetaStructureV2(metaBytes);
+	const payloadBytes = scanPayloadStructureV2(payloadContainerBytes);
+	scanSignatureStructureV2(signatureBytes);
+	const signableBytes = new Uint8Array(signablePrefixLength + 2);
+	signableBytes.set(entryBytes.subarray(0, signablePrefixLength));
+	return {
+		metaBytes,
+		payloadBytes,
+		signableBytes,
+		reservedBytes,
+		hasHash: hashOption === 1,
+		directParentCount,
+	};
+};
+
+const validateMaximumEntryBytesV2 = (maximumEntryBytes: number): void => {
+	if (!Number.isSafeInteger(maximumEntryBytes) || maximumEntryBytes < 1) {
+		throw new Error("Invalid internal authority EntryV0 byte limit");
+	}
+};
+
+export const captureAuthorityEntryV0BytesV2 = (
+	entryBytes: Uint8Array,
+	maximumEntryBytes: number,
+): Uint8Array => {
+	validateMaximumEntryBytesV2(maximumEntryBytes);
+	let byteLength: number;
+	try {
+		byteLength = exactUint8ArrayByteLengthV2(entryBytes);
+	} catch {
+		throw new Error("Authority entry must use canonical EntryV0 bytes");
+	}
+	if (byteLength < 1 || byteLength > maximumEntryBytes) {
+		throw new Error(
+			`Authority EntryV0 must contain 1-${maximumEntryBytes} bytes`,
+		);
+	}
+	return copyUint8ArrayWithLengthV2(entryBytes, byteLength);
+};
+
+/**
+ * Authenticate one bounded raw EntryV0 authority envelope. This establishes
+ * canonical bytes and the sole public authority signature only. It does not
+ * establish a concrete record profile, policy acceptance, causal ancestry,
+ * freshness, or durability.
+ */
+export const authenticateCapturedAuthorityEntryV0V2 = async (
+	capturedEntryBytes: Uint8Array,
+	descriptor: NetworkDescriptorV2,
+	assertProfile?: AuthorityEntryV0ProfileV2,
+): Promise<AuthenticatedAuthorityEntryV0V2> => {
+	assertNetworkDescriptorV2(descriptor);
+	const authorityBytes = serialize(descriptor.policyAuthority);
+	const scanned = scanEntryV0StructureV2(capturedEntryBytes);
+	const capturedDescriptor = deserialize(
+		serialize(descriptor),
+		NetworkDescriptorV2,
+	);
+	assertNetworkDescriptorV2(capturedDescriptor);
+	if (!equals(serialize(capturedDescriptor.policyAuthority), authorityBytes)) {
+		throw new Error("Network descriptor changed during capture");
+	}
+	const entry = deserialize(capturedEntryBytes, Entry);
+	if (!(entry instanceof EntryV0)) {
+		throw new Error("Authority entry must use EntryV0");
+	}
+	if (!equals(capturedEntryBytes, serialize(entry))) {
+		throw new Error("Authority EntryV0 storage is not canonical");
+	}
+	if (!(entry._meta instanceof DecryptedThing)) {
+		throw new Error("Authority EntryV0 metadata must be public");
+	}
+	if (!(entry._payload instanceof DecryptedThing)) {
+		throw new Error("Authority EntryV0 payload must be public");
+	}
+	if (
+		entry._signatures === undefined ||
+		entry._signatures.signatures.length !== 1 ||
+		!(entry._signatures.signatures[0] instanceof DecryptedThing)
+	) {
+		throw new Error("Authority EntryV0 must contain one public signature");
+	}
+
+	entry.init({ encoding: NO_ENCODING });
+	const payload = entry.payload;
+	const signatures = entry.signatures;
+	if (
+		signatures.length !== 1 ||
+		!equals(serialize(signatures[0]!.publicKey), authorityBytes)
+	) {
+		throw new Error("Authority EntryV0 signer is not the policy authority");
+	}
+	if (!equals(scanned.payloadBytes, payload.data)) {
+		throw new Error("Authority EntryV0 payload framing is inconsistent");
+	}
+	const authenticated: AuthenticatedAuthorityEntryV0V2 = {
+		descriptor: capturedDescriptor,
+		entryBytes: capturedEntryBytes,
+		entry,
+		metaBytes: scanned.metaBytes,
+		payloadBytes: payload.data,
+		reservedBytes: scanned.reservedBytes,
+		hasHash: scanned.hasHash,
+		directParentCount: scanned.directParentCount,
+	};
+	assertProfile?.(authenticated);
+
+	let signatureIsValid = false;
+	try {
+		signatureIsValid = await verify(signatures[0]!, scanned.signableBytes);
+	} catch {
+		// Unsupported prehashes and malformed signatures fail closed.
+	}
+	if (!signatureIsValid) {
+		throw new Error("Authority EntryV0 signature is invalid");
+	}
+
+	return authenticated;
+};
+
+export const authenticateAuthorityEntryV0V2 = async (
+	entryBytes: Uint8Array,
+	descriptor: NetworkDescriptorV2,
+	maximumEntryBytes: number,
+	assertProfile?: AuthorityEntryV0ProfileV2,
+): Promise<AuthenticatedAuthorityEntryV0V2> =>
+	authenticateCapturedAuthorityEntryV0V2(
+		captureAuthorityEntryV0BytesV2(entryBytes, maximumEntryBytes),
+		descriptor,
+		assertProfile,
+	);

package/src/v2-policy-engine.ts

@@ -1,7 +1,7 @@
 import { deserialize, serialize } from "@dao-xyz/borsh";
-import { DecryptedThing, PublicSignKey, verify } from "@peerbit/crypto";
-import { Entry, EntryV0, NO_ENCODING } from "@peerbit/log";
+import { PublicSignKey } from "@peerbit/crypto";
 import { compare, equals } from "uint8arrays";
+import { authenticateCapturedAuthorityEntryV0V2 } from "./v2-authority-entry.js";
 import {
 	NetworkDescriptorV2,
 	PolicySnapshotBodyV2,
@@ -304,58 +304,11 @@ const authenticateCapturedPolicySnapshotEntryV2 = async (
 	canonicalEntryBytes: Uint8Array,
 	descriptor: NetworkDescriptorV2,
 ): Promise<ValidatedPolicySnapshotV2> => {
-	const authenticatedEntry = deserialize(canonicalEntryBytes, Entry);
-	if (!(authenticatedEntry instanceof EntryV0)) {
-		throw new Error("Policy snapshot must use EntryV0");
-	}
-	if (!equals(canonicalEntryBytes, serialize(authenticatedEntry))) {
-		throw new Error("Policy snapshot entry encoding is not canonical");
-	}
-	if (!(authenticatedEntry._meta instanceof DecryptedThing)) {
-		throw new Error("Policy snapshot metadata must be public");
-	}
-	if (!(authenticatedEntry._payload instanceof DecryptedThing)) {
-		throw new Error("Policy snapshot payload must be public");
-	}
-	if (
-		authenticatedEntry._signatures === undefined ||
-		authenticatedEntry._signatures.signatures.length !== 1
-	) {
-		throw new Error("Policy snapshot must contain exactly one signature");
-	}
-	if (
-		!(authenticatedEntry._signatures.signatures[0] instanceof DecryptedThing)
-	) {
-		throw new Error("Policy snapshot signature must be public");
-	}
-	authenticatedEntry.init({ encoding: NO_ENCODING });
-
-	const signatures = await authenticatedEntry.getSignatures();
-	if (signatures.length !== 1) {
-		throw new Error("Policy snapshot must resolve exactly one signature");
-	}
-	const signature = signatures[0]!;
-	if (
-		!equals(
-			serialize(signature.publicKey),
-			serialize(descriptor.policyAuthority),
-		)
-	) {
-		throw new Error("Policy snapshot signer is not the policy authority");
-	}
-	if (!(await verify(signature, authenticatedEntry.getSignableBytes()))) {
-		throw new Error("Policy snapshot authority signature is invalid");
-	}
-
-	const payload = await authenticatedEntry.getPayloadValue();
-	let canonicalPayload: Uint8Array;
-	try {
-		canonicalPayload = copyBytes(payload as Uint8Array);
-	} catch {
-		throw new Error(
-			"Policy snapshot payload must contain canonical body bytes",
-		);
-	}
+	const authenticated = await authenticateCapturedAuthorityEntryV0V2(
+		canonicalEntryBytes,
+		descriptor,
+	);
+	const canonicalPayload = authenticated.payloadBytes;
 	const body = decodePolicySnapshotBodyV2(canonicalPayload, descriptor);
 	const digest = digestPolicySnapshotBodyV2(body);
 	return {

package/src/v2-resource-fence-entry.ts

@@ -0,0 +1,267 @@
+import { serialize } from "@dao-xyz/borsh";
+import {
+	calculateRawCid,
+	cidifyString,
+	codecMap,
+	defaultHasher,
+	stringifyCid,
+} from "@peerbit/blocks-interface";
+import { EntryType, type Meta } from "@peerbit/log";
+import { equals } from "uint8arrays";
+import {
+	type AuthenticatedAuthorityEntryV0V2,
+	authenticateAuthorityEntryV0V2,
+} from "./v2-authority-entry.js";
+import {
+	NetworkDescriptorV2,
+	ResourceFenceV2,
+	TRUSTED_NETWORK_V2_MAX_RESOURCE_FENCE_DIRECT_PARENTS,
+	TRUSTED_NETWORK_V2_MAX_RESOURCE_FENCE_ENTRY_BYTES,
+	TRUSTED_NETWORK_V2_RESOURCE_FENCE_BODY_BYTES,
+	copyUint8ArrayWithLengthV2,
+	decodeResourceFenceV2,
+	exactUint8ArrayByteLengthV2,
+} from "./v2.js";
+
+const RESOURCE_FENCE_AUTHORITY_LIMITS_V2 = Object.freeze({
+	maximumEntryBytes: TRUSTED_NETWORK_V2_MAX_RESOURCE_FENCE_ENTRY_BYTES,
+});
+
+const SECP256K1_SIGNATURE_TEXT_BYTES = 132;
+const SECP256K1_LOW_S_MAX_HEX =
+	"7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0";
+
+const isLowerHexByteV2 = (value: number): boolean =>
+	(value >= 0x30 && value <= 0x39) || (value >= 0x61 && value <= 0x66);
+
+const assertCanonicalSecp256k1SignatureV2 = (signature: Uint8Array): void => {
+	if (
+		signature.byteLength !== SECP256K1_SIGNATURE_TEXT_BYTES ||
+		signature[0] !== 0x30 ||
+		signature[1] !== 0x78
+	) {
+		throw new Error("Authority EntryV0 secp256k1 signature is not canonical");
+	}
+	for (let i = 2; i < signature.byteLength; i++) {
+		if (!isLowerHexByteV2(signature[i]!)) {
+			throw new Error("Authority EntryV0 secp256k1 signature is not canonical");
+		}
+	}
+	if (
+		signature[130] !== 0x31 ||
+		(signature[131] !== 0x62 && signature[131] !== 0x63)
+	) {
+		throw new Error("Authority EntryV0 secp256k1 signature is not canonical");
+	}
+	for (let i = 0; i < SECP256K1_LOW_S_MAX_HEX.length; i++) {
+		const actual = signature[66 + i]!;
+		const maximum = SECP256K1_LOW_S_MAX_HEX.charCodeAt(i);
+		if (actual < maximum) break;
+		if (actual > maximum) {
+			throw new Error("Authority EntryV0 secp256k1 signature is not canonical");
+		}
+	}
+};
+
+const canonicalDirectParentsV2 = (
+	parents: string[],
+): Array<{ cid: string; digest: Uint8Array }> => {
+	const seen = new Set<string>();
+	return parents.map((cid) => {
+		let parsed: ReturnType<typeof cidifyString>;
+		try {
+			parsed = cidifyString(cid);
+		} catch {
+			throw new Error(
+				"Authority EntryV0 direct parents must use canonical CIDv1/raw/sha2-256",
+			);
+		}
+		if (
+			!cid ||
+			parsed.version !== 1 ||
+			parsed.code !== codecMap.raw.code ||
+			parsed.multihash.code !== defaultHasher.code ||
+			parsed.multihash.digest.byteLength !== 32 ||
+			stringifyCid(parsed) !== cid
+		) {
+			throw new Error(
+				"Authority EntryV0 direct parents must use canonical CIDv1/raw/sha2-256",
+			);
+		}
+		if (seen.has(cid)) {
+			throw new Error("Authority EntryV0 direct parents must be unique");
+		}
+		seen.add(cid);
+		return {
+			cid,
+			digest: copyUint8ArrayWithLengthV2(
+				parsed.multihash.digest,
+				parsed.multihash.digest.byteLength,
+			),
+		};
+	});
+};
+
+type ResourceFenceEntryV0ProfileV2 = {
+	meta: Meta;
+	directParents: Array<{ cid: string; digest: Uint8Array }>;
+};
+
+const assertResourceFenceEntryV0ProfileV2 = (
+	authenticated: AuthenticatedAuthorityEntryV0V2,
+): ResourceFenceEntryV0ProfileV2 => {
+	if (authenticated.hasHash) {
+		throw new Error(
+			"Authority EntryV0 has invalid resource hash option: embedded hash",
+		);
+	}
+	if (
+		authenticated.reservedBytes[0] !== 0 ||
+		authenticated.reservedBytes[1] !== 0 ||
+		authenticated.reservedBytes[2] !== 0 ||
+		authenticated.reservedBytes[3] !== 0
+	) {
+		throw new Error("Authority EntryV0 reserved bytes must be zero");
+	}
+	if (
+		authenticated.directParentCount >
+		TRUSTED_NETWORK_V2_MAX_RESOURCE_FENCE_DIRECT_PARENTS
+	) {
+		throw new Error(
+			`Authority EntryV0 may contain at most ${TRUSTED_NETWORK_V2_MAX_RESOURCE_FENCE_DIRECT_PARENTS} direct parents`,
+		);
+	}
+	if (
+		authenticated.payloadBytes.byteLength !==
+		TRUSTED_NETWORK_V2_RESOURCE_FENCE_BODY_BYTES
+	) {
+		throw new Error(
+			`Authority EntryV0 payload must contain exactly ${TRUSTED_NETWORK_V2_RESOURCE_FENCE_BODY_BYTES} bytes`,
+		);
+	}
+
+	const meta = authenticated.entry.meta;
+	if (!equals(authenticated.metaBytes, serialize(meta))) {
+		throw new Error("Authority EntryV0 nested encoding is not canonical");
+	}
+	const authorityBytes = serialize(authenticated.descriptor.policyAuthority);
+	if (meta.type !== EntryType.APPEND) {
+		throw new Error("Authority EntryV0 must be an APPEND entry");
+	}
+	if (meta.next.length !== authenticated.directParentCount) {
+		throw new Error("Authority EntryV0 direct-parent framing is inconsistent");
+	}
+	if (!equals(meta.clock.id, authorityBytes)) {
+		throw new Error("Authority EntryV0 clock id is not the policy authority");
+	}
+	const signature = authenticated.entry.signatures[0]!;
+	if (serialize(signature.publicKey)[0] === 1) {
+		assertCanonicalSecp256k1SignatureV2(signature.signature);
+	}
+	return { meta, directParents: canonicalDirectParentsV2(meta.next) };
+};
+
+export type AuthenticatedResourceFenceEntryV2 = Readonly<{
+	entryBytes: Uint8Array;
+	entryCid: string;
+	digest: Uint8Array;
+	body: ResourceFenceV2;
+	gid: string;
+	metaData?: Uint8Array;
+	directParents: ReadonlyArray<Readonly<{ cid: string; digest: Uint8Array }>>;
+}>;
+
+export type AuthenticateResourceFenceEntryV2Properties = Readonly<{
+	entryBytes: Uint8Array;
+	descriptor: NetworkDescriptorV2;
+	expectedResourceId: Uint8Array;
+	expectedGid: string;
+}>;
+
+const captureResourceIdV2 = (resourceId: Uint8Array): Uint8Array => {
+	let byteLength: number;
+	try {
+		byteLength = exactUint8ArrayByteLengthV2(resourceId);
+	} catch {
+		throw new Error("Expected resource id must contain exactly 32 bytes");
+	}
+	if (byteLength !== 32) {
+		throw new Error("Expected resource id must contain exactly 32 bytes");
+	}
+	return copyUint8ArrayWithLengthV2(resourceId, byteLength);
+};
+
+const toResourceFenceTokenV2 = (
+	authenticated: AuthenticatedAuthorityEntryV0V2,
+	body: ResourceFenceV2,
+	entryCid: string,
+	digest: Uint8Array,
+	gid: string,
+	metaData: Uint8Array | undefined,
+	directParents: Array<{ cid: string; digest: Uint8Array }>,
+): AuthenticatedResourceFenceEntryV2 => ({
+	entryBytes: authenticated.entryBytes,
+	entryCid,
+	digest,
+	body,
+	gid,
+	metaData,
+	directParents,
+});
+
+/**
+ * Authenticate a raw resource-fence EntryV0 against immutable resource
+ * context. The returned token does not prove policy acceptance, causal
+ * ancestry, fork freedom, freshness, or durability.
+ */
+export const authenticateResourceFenceEntryV2 = async ({
+	entryBytes,
+	descriptor,
+	expectedResourceId,
+	expectedGid,
+}: AuthenticateResourceFenceEntryV2Properties): Promise<AuthenticatedResourceFenceEntryV2> => {
+	if (typeof expectedGid !== "string") {
+		throw new Error("Expected resource gid must be a string");
+	}
+	const capturedResourceId = captureResourceIdV2(expectedResourceId);
+	let profile: ResourceFenceEntryV0ProfileV2 | undefined;
+	const authenticated = await authenticateAuthorityEntryV0V2(
+		entryBytes,
+		descriptor,
+		RESOURCE_FENCE_AUTHORITY_LIMITS_V2.maximumEntryBytes,
+		(candidate) => {
+			profile = assertResourceFenceEntryV0ProfileV2(candidate);
+		},
+	);
+	if (profile === undefined) {
+		throw new Error("Resource fence EntryV0 profile was not applied");
+	}
+	if (profile.meta.gid !== expectedGid) {
+		throw new Error("Resource fence belongs to another resource log");
+	}
+	const body = decodeResourceFenceV2(
+		authenticated.payloadBytes,
+		authenticated.descriptor,
+	);
+	if (!equals(body.resourceId, capturedResourceId)) {
+		throw new Error("Resource fence belongs to another resource");
+	}
+	const prepared = await calculateRawCid(authenticated.entryBytes);
+	return toResourceFenceTokenV2(
+		authenticated,
+		body,
+		prepared.cid,
+		copyUint8ArrayWithLengthV2(
+			prepared.block.cid.multihash.digest,
+			prepared.block.cid.multihash.digest.byteLength,
+		),
+		profile.meta.gid,
+		profile.meta.data === undefined
+			? undefined
+			: copyUint8ArrayWithLengthV2(
+					profile.meta.data,
+					profile.meta.data.byteLength,
+				),
+		profile.directParents,
+	);
+};