@peers-app/peers-sdk 0.25.14 → 0.25.16

package/dist/identity/account-email.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCOUNT_EMAIL_UNBIND_PURPOSE = exports.ACCOUNT_EMAIL_STATUS_PURPOSE = exports.ACCOUNT_EMAIL_BIND_PURPOSE = void 0;
+exports.signEmailBind = signEmailBind;
+exports.verifyEmailBind = verifyEmailBind;
+exports.signEmailStatus = signEmailStatus;
+exports.verifyEmailStatus = verifyEmailStatus;
+exports.signEmailUnbind = signEmailUnbind;
+exports.verifyEmailUnbind = verifyEmailUnbind;
+const keys_1 = require("../keys");
+/** Purpose string the current key signs to bind a recovery email. */
+exports.ACCOUNT_EMAIL_BIND_PURPOSE = "peers-account-email-bind";
+/**
+ * Signs a request to bind `email` to `userId` with the key on record.
+ *
+ * @param statement The user, the mailbox, and when the request was made
+ * @param secretKey Secret half of the key on record
+ */
+function signEmailBind(statement, secretKey) {
+    return (0, keys_1.signObjectWithSecretKey)({
+        purpose: exports.ACCOUNT_EMAIL_BIND_PURPOSE,
+        userId: statement.userId,
+        email: statement.email,
+        issuedAt: statement.issuedAt,
+    }, secretKey);
+}
+/**
+ * Checks that `signed` is the record key's signature over a bind statement for this user
+ * and mailbox. A different signer, user, or email is not a bind.
+ */
+function verifyEmailBind(params) {
+    if (params.signed.publicKey !== params.recordPublicKey)
+        return false;
+    try {
+        const contents = (0, keys_1.openSignedObject)(params.signed);
+        return (contents.purpose === exports.ACCOUNT_EMAIL_BIND_PURPOSE &&
+            contents.userId === params.userId &&
+            contents.email === params.email);
+    }
+    catch {
+        return false;
+    }
+}
+/** Purpose string the current key signs to read whether a recovery email is bound. */
+exports.ACCOUNT_EMAIL_STATUS_PURPOSE = "peers-account-email-status";
+/** Signs a request to read the recovery email bound to `userId`. */
+function signEmailStatus(statement, secretKey) {
+    return (0, keys_1.signObjectWithSecretKey)({
+        purpose: exports.ACCOUNT_EMAIL_STATUS_PURPOSE,
+        userId: statement.userId,
+        issuedAt: statement.issuedAt,
+    }, secretKey);
+}
+/** Checks that `signed` is the record key asking for this user's recovery email. */
+function verifyEmailStatus(params) {
+    if (params.signed.publicKey !== params.recordPublicKey)
+        return false;
+    try {
+        const contents = (0, keys_1.openSignedObject)(params.signed);
+        return contents.purpose === exports.ACCOUNT_EMAIL_STATUS_PURPOSE && contents.userId === params.userId;
+    }
+    catch {
+        return false;
+    }
+}
+/** Purpose string the current key signs to remove a recovery email. */
+exports.ACCOUNT_EMAIL_UNBIND_PURPOSE = "peers-account-email-unbind";
+/** Signs a request to remove the recovery email bound to `userId`. */
+function signEmailUnbind(statement, secretKey) {
+    return (0, keys_1.signObjectWithSecretKey)({
+        purpose: exports.ACCOUNT_EMAIL_UNBIND_PURPOSE,
+        userId: statement.userId,
+        issuedAt: statement.issuedAt,
+    }, secretKey);
+}
+/** Checks that `signed` is the record key removing this user's recovery email. */
+function verifyEmailUnbind(params) {
+    if (params.signed.publicKey !== params.recordPublicKey)
+        return false;
+    try {
+        const contents = (0, keys_1.openSignedObject)(params.signed);
+        return contents.purpose === exports.ACCOUNT_EMAIL_UNBIND_PURPOSE && contents.userId === params.userId;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/identity/account-email.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/identity/account-email.test.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const keys_1 = require("../keys");
+const account_email_1 = require("./account-email");
+describe("account email statements", () => {
+    const keys = (0, keys_1.newKeys)();
+    const userId = "00maccountemailstatements";
+    const issuedAt = new Date().toISOString();
+    const bind = (0, account_email_1.signEmailBind)({ purpose: "peers-account-email-bind", userId, email: "ada@example.com", issuedAt }, keys.secretKey);
+    const status = (0, account_email_1.signEmailStatus)({ purpose: "peers-account-email-status", userId, issuedAt }, keys.secretKey);
+    const unbind = (0, account_email_1.signEmailUnbind)({ purpose: "peers-account-email-unbind", userId, issuedAt }, keys.secretKey);
+    it("accepts each statement for the purpose it was signed for", () => {
+        expect((0, account_email_1.verifyEmailBind)({
+            signed: bind,
+            userId,
+            email: "ada@example.com",
+            recordPublicKey: keys.publicKey,
+        })).toBe(true);
+        expect((0, account_email_1.verifyEmailStatus)({ signed: status, userId, recordPublicKey: keys.publicKey })).toBe(true);
+        expect((0, account_email_1.verifyEmailUnbind)({ signed: unbind, userId, recordPublicKey: keys.publicKey })).toBe(true);
+    });
+    it("does not let a statement signed for one purpose stand in for another", () => {
+        // A captured read request must not be able to remove the mailbox or bind a new one.
+        expect((0, account_email_1.verifyEmailUnbind)({ signed: status, userId, recordPublicKey: keys.publicKey })).toBe(false);
+        expect((0, account_email_1.verifyEmailBind)({
+            signed: status,
+            userId,
+            email: "ada@example.com",
+            recordPublicKey: keys.publicKey,
+        })).toBe(false);
+        expect((0, account_email_1.verifyEmailStatus)({ signed: unbind, userId, recordPublicKey: keys.publicKey })).toBe(false);
+    });
+    it("refuses a statement for another user, another mailbox, or from another key", () => {
+        expect((0, account_email_1.verifyEmailBind)({
+            signed: bind,
+            userId: "00maccountemailotheruser0",
+            email: "ada@example.com",
+            recordPublicKey: keys.publicKey,
+        })).toBe(false);
+        expect((0, account_email_1.verifyEmailBind)({
+            signed: bind,
+            userId,
+            email: "eve@example.com",
+            recordPublicKey: keys.publicKey,
+        })).toBe(false);
+        expect((0, account_email_1.verifyEmailUnbind)({ signed: unbind, userId, recordPublicKey: (0, keys_1.newKeys)().publicKey })).toBe(false);
+    });
+    it("refuses a statement whose contents were changed after signing", () => {
+        const forged = {
+            ...unbind,
+            contents: { ...unbind.contents, userId: "00maccountemailotheruser0" },
+        };
+        expect((0, account_email_1.verifyEmailUnbind)({
+            signed: forged,
+            userId: "00maccountemailotheruser0",
+            recordPublicKey: keys.publicKey,
+        })).toBe(false);
+    });
+});

package/dist/identity/anchor-document.d.ts

@@ -0,0 +1,205 @@
+import { z } from "zod";
+import { type ISignedObject } from "../keys";
+/** Purpose string signed by the previous key when a succession is a rotation. */
+export declare const KEY_SUCCESSION_PURPOSE: "peers-key-succession";
+/** Anchor kinds the runtime knows how to fetch. */
+export declare const ANCHOR_TYPES: readonly ["peers-services", "https"];
+/** One of {@link ANCHOR_TYPES}. */
+export type AnchorType = (typeof ANCHOR_TYPES)[number];
+/** Why a key entry was published. Informational. */
+export declare const ANCHOR_KEY_REASONS: readonly ["rotation", "compromised", "lost"];
+/** One of {@link ANCHOR_KEY_REASONS}. */
+export type AnchorKeyReason = (typeof ANCHOR_KEY_REASONS)[number];
+/** A place that publishes a user's current key. */
+export declare const anchorRefSchema: z.ZodObject<{
+    type: z.ZodEnum<["peers-services", "https"]>;
+    url: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "peers-services" | "https";
+    url: string;
+}, {
+    type: "peers-services" | "https";
+    url: string;
+}>;
+/** A place that publishes a user's current key. */
+export type IAnchorRef = z.infer<typeof anchorRefSchema>;
+/** How many anchors one account may list. */
+export declare const MAX_ANCHORS = 8;
+/**
+ * Checks and orders an anchor list.
+ * Duplicates are dropped. An `https` anchor must be an https URL.
+ * A `peers-services` anchor may be http, which is how a local registry is addressed.
+ * An empty list is an opt-out.
+ *
+ * @param input The list a caller wants to publish
+ */
+export declare function normalizeAnchorList(input: unknown): IAnchorRef[];
+/**
+ * Statement the previous key signs so peers can tell rotation from recovery.
+ * `publicKey` is the new key.
+ */
+export declare const keySuccessionStatementSchema: z.ZodObject<{
+    purpose: z.ZodLiteral<"peers-key-succession">;
+    userId: z.ZodEffects<z.ZodString, string, string>;
+    publicKey: z.ZodString;
+    issuedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    publicKey: string;
+    purpose: "peers-key-succession";
+    userId: string;
+    issuedAt: string;
+}, {
+    publicKey: string;
+    purpose: "peers-key-succession";
+    userId: string;
+    issuedAt: string;
+}>;
+/** Statement the previous key signs so peers can tell rotation from recovery. */
+export type IKeySuccessionStatement = z.infer<typeof keySuccessionStatementSchema>;
+/** Previous key's co-signature over a {@link IKeySuccessionStatement}. */
+export declare const anchorAuthorizedBySchema: z.ZodObject<{
+    publicKey: z.ZodString;
+    signature: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    publicKey: string;
+    signature: string;
+}, {
+    publicKey: string;
+    signature: string;
+}>;
+/** Previous key's co-signature over a succession statement. */
+export type IAnchorAuthorizedBy = z.infer<typeof anchorAuthorizedBySchema>;
+/** One key an anchor currently publishes. */
+export declare const anchorKeyEntrySchema: z.ZodObject<{
+    publicKey: z.ZodString;
+    issuedAt: z.ZodString;
+    reason: z.ZodOptional<z.ZodEnum<["rotation", "compromised", "lost"]>>;
+    authorizedBy: z.ZodOptional<z.ZodObject<{
+        publicKey: z.ZodString;
+        signature: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        publicKey: string;
+        signature: string;
+    }, {
+        publicKey: string;
+        signature: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    publicKey: string;
+    issuedAt: string;
+    reason?: "rotation" | "compromised" | "lost" | undefined;
+    authorizedBy?: {
+        publicKey: string;
+        signature: string;
+    } | undefined;
+}, {
+    publicKey: string;
+    issuedAt: string;
+    reason?: "rotation" | "compromised" | "lost" | undefined;
+    authorizedBy?: {
+        publicKey: string;
+        signature: string;
+    } | undefined;
+}>;
+/** One key an anchor currently publishes. */
+export type IAnchorKeyEntry = z.infer<typeof anchorKeyEntrySchema>;
+/** Document served by every anchor, peers-services and self-hosted alike. */
+export declare const anchorDocumentSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    userId: z.ZodEffects<z.ZodString, string, string>;
+    keys: z.ZodArray<z.ZodObject<{
+        publicKey: z.ZodString;
+        issuedAt: z.ZodString;
+        reason: z.ZodOptional<z.ZodEnum<["rotation", "compromised", "lost"]>>;
+        authorizedBy: z.ZodOptional<z.ZodObject<{
+            publicKey: z.ZodString;
+            signature: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            publicKey: string;
+            signature: string;
+        }, {
+            publicKey: string;
+            signature: string;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        publicKey: string;
+        issuedAt: string;
+        reason?: "rotation" | "compromised" | "lost" | undefined;
+        authorizedBy?: {
+            publicKey: string;
+            signature: string;
+        } | undefined;
+    }, {
+        publicKey: string;
+        issuedAt: string;
+        reason?: "rotation" | "compromised" | "lost" | undefined;
+        authorizedBy?: {
+            publicKey: string;
+            signature: string;
+        } | undefined;
+    }>, "many">;
+    anchors: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["peers-services", "https"]>;
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        type: "peers-services" | "https";
+        url: string;
+    }, {
+        type: "peers-services" | "https";
+        url: string;
+    }>, "many">;
+    updatedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    keys: {
+        publicKey: string;
+        issuedAt: string;
+        reason?: "rotation" | "compromised" | "lost" | undefined;
+        authorizedBy?: {
+            publicKey: string;
+            signature: string;
+        } | undefined;
+    }[];
+    version: 1;
+    userId: string;
+    anchors: {
+        type: "peers-services" | "https";
+        url: string;
+    }[];
+    updatedAt: string;
+}, {
+    keys: {
+        publicKey: string;
+        issuedAt: string;
+        reason?: "rotation" | "compromised" | "lost" | undefined;
+        authorizedBy?: {
+            publicKey: string;
+            signature: string;
+        } | undefined;
+    }[];
+    version: 1;
+    userId: string;
+    anchors: {
+        type: "peers-services" | "https";
+        url: string;
+    }[];
+    updatedAt: string;
+}>;
+/** Document served by every anchor, peers-services and self-hosted alike. */
+export type IAnchorDocument = z.infer<typeof anchorDocumentSchema>;
+/**
+ * Signs a succession statement with the previous key.
+ *
+ * @param statement The new key, the user, and when it was issued
+ * @param previousSecretKey Secret half of the key on record
+ */
+export declare function signSuccession(statement: IKeySuccessionStatement, previousSecretKey: string): ISignedObject<IKeySuccessionStatement>;
+/**
+ * Checks that `authorizedBy` is a signature by `recordPublicKey` over the succession
+ * statement for this key entry. A mismatch, a bad signature, or a different signer
+ * is not a rotation.
+ */
+export declare function verifySuccession(params: {
+    userId: string;
+    recordPublicKey: string;
+    entry: IAnchorKeyEntry;
+}): boolean;

package/dist/identity/anchor-document.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.anchorDocumentSchema = exports.anchorKeyEntrySchema = exports.anchorAuthorizedBySchema = exports.keySuccessionStatementSchema = exports.MAX_ANCHORS = exports.anchorRefSchema = exports.ANCHOR_KEY_REASONS = exports.ANCHOR_TYPES = exports.KEY_SUCCESSION_PURPOSE = void 0;
+exports.normalizeAnchorList = normalizeAnchorList;
+exports.signSuccession = signSuccession;
+exports.verifySuccession = verifySuccession;
+const zod_1 = require("zod");
+const keys_1 = require("../keys");
+const zod_types_1 = require("../types/zod-types");
+/** Purpose string signed by the previous key when a succession is a rotation. */
+exports.KEY_SUCCESSION_PURPOSE = "peers-key-succession";
+/** Anchor kinds the runtime knows how to fetch. */
+exports.ANCHOR_TYPES = ["peers-services", "https"];
+/** Why a key entry was published. Informational. */
+exports.ANCHOR_KEY_REASONS = ["rotation", "compromised", "lost"];
+/** A place that publishes a user's current key. */
+exports.anchorRefSchema = zod_1.z.object({
+    type: zod_1.z.enum(exports.ANCHOR_TYPES),
+    url: zod_1.z.string().url(),
+});
+/** How many anchors one account may list. */
+exports.MAX_ANCHORS = 8;
+/**
+ * Checks and orders an anchor list.
+ * Duplicates are dropped. An `https` anchor must be an https URL.
+ * A `peers-services` anchor may be http, which is how a local registry is addressed.
+ * An empty list is an opt-out.
+ *
+ * @param input The list a caller wants to publish
+ */
+function normalizeAnchorList(input) {
+    const list = zod_1.z.array(exports.anchorRefSchema).max(exports.MAX_ANCHORS).parse(input);
+    for (const anchor of list) {
+        const url = new URL(anchor.url);
+        if (anchor.type === "https" && url.protocol !== "https:") {
+            throw new Error("Anchor URLs must use https");
+        }
+        if (url.protocol !== "https:" && url.protocol !== "http:") {
+            throw new Error("Anchor URLs must use http or https");
+        }
+    }
+    const seen = new Set();
+    const unique = list.filter((anchor) => {
+        const key = `${anchor.type} ${anchor.url}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    unique.sort((a, b) => `${a.type} ${a.url}`.localeCompare(`${b.type} ${b.url}`));
+    return unique;
+}
+/**
+ * Statement the previous key signs so peers can tell rotation from recovery.
+ * `publicKey` is the new key.
+ */
+exports.keySuccessionStatementSchema = zod_1.z.object({
+    purpose: zod_1.z.literal(exports.KEY_SUCCESSION_PURPOSE),
+    userId: zod_types_1.zodPeerId,
+    publicKey: zod_1.z.string().min(1),
+    issuedAt: zod_1.z.string().min(1),
+});
+/** Previous key's co-signature over a {@link IKeySuccessionStatement}. */
+exports.anchorAuthorizedBySchema = zod_1.z.object({
+    publicKey: zod_1.z.string().min(1),
+    signature: zod_1.z.string().min(1),
+});
+/** One key an anchor currently publishes. */
+exports.anchorKeyEntrySchema = zod_1.z.object({
+    publicKey: zod_1.z.string().min(1),
+    issuedAt: zod_1.z.string().min(1),
+    reason: zod_1.z.enum(exports.ANCHOR_KEY_REASONS).optional(),
+    authorizedBy: exports.anchorAuthorizedBySchema.optional(),
+});
+/** Document served by every anchor, peers-services and self-hosted alike. */
+exports.anchorDocumentSchema = zod_1.z.object({
+    version: zod_1.z.literal(1),
+    userId: zod_types_1.zodPeerId,
+    keys: zod_1.z.array(exports.anchorKeyEntrySchema),
+    anchors: zod_1.z.array(exports.anchorRefSchema),
+    updatedAt: zod_1.z.string().min(1),
+});
+/**
+ * Signs a succession statement with the previous key.
+ *
+ * @param statement The new key, the user, and when it was issued
+ * @param previousSecretKey Secret half of the key on record
+ */
+function signSuccession(statement, previousSecretKey) {
+    const parsed = exports.keySuccessionStatementSchema.parse(statement);
+    return (0, keys_1.signObjectWithSecretKey)(parsed, previousSecretKey);
+}
+/**
+ * Checks that `authorizedBy` is a signature by `recordPublicKey` over the succession
+ * statement for this key entry. A mismatch, a bad signature, or a different signer
+ * is not a rotation.
+ */
+function verifySuccession(params) {
+    const { authorizedBy, publicKey, issuedAt } = params.entry;
+    if (!authorizedBy || authorizedBy.publicKey !== params.recordPublicKey)
+        return false;
+    try {
+        const contents = (0, keys_1.openSignedObject)({
+            contents: {
+                purpose: exports.KEY_SUCCESSION_PURPOSE,
+                userId: params.userId,
+                publicKey,
+                issuedAt,
+            },
+            signature: authorizedBy.signature,
+            publicKey: authorizedBy.publicKey,
+        });
+        const parsed = exports.keySuccessionStatementSchema.safeParse(contents);
+        return (parsed.success && parsed.data.publicKey === publicKey && parsed.data.userId === params.userId);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/identity/anchor-document.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/identity/anchor-document.test.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const anchor_document_1 = require("./anchor-document");
+describe("normalizeAnchorList", () => {
+    it("allows http for peers-services and requires https for a page anchor", () => {
+        const list = (0, anchor_document_1.normalizeAnchorList)([
+            { type: "peers-services", url: "http://127.0.0.1:4000/api/v1/keys/abc" },
+            { type: "https", url: "https://example.com/peers.json" },
+        ]);
+        expect(list.map((anchor) => anchor.url)).toEqual([
+            "https://example.com/peers.json",
+            "http://127.0.0.1:4000/api/v1/keys/abc",
+        ]);
+        expect(() => (0, anchor_document_1.normalizeAnchorList)([{ type: "https", url: "http://example.com/peers.json" }])).toThrow(/https/);
+    });
+});

package/dist/identity/anchor-resolution.d.ts

@@ -0,0 +1,61 @@
+import { type IAnchorDocument, type IAnchorRef } from "./anchor-document";
+/** Whether two anchor lists name the same places, ignoring order. */
+export declare function sameAnchorList(left: IAnchorRef[] | undefined, right: IAnchorRef[] | undefined): boolean;
+/** What the anchors on record say about a proposed replacement list. */
+export type AnchorListDecision = "confirmed" | "pending" | "vetoed";
+/**
+ * Applies the confirmation rule to a new anchor list.
+ * A document whose `anchors` match the proposal confirms. A different list vetoes.
+ * No answer is pending.
+ */
+export declare function resolvePresentedAnchors(params: {
+    userId: string;
+    presented: IAnchorRef[];
+    outcomes: AnchorFetchOutcome[];
+}): AnchorListDecision;
+/**
+ * How long a resolution may be reused before the anchors are fetched again.
+ * Matches the peers-services key document `max-age`.
+ */
+export declare const ANCHOR_CACHE_MS = 60000;
+/** What one anchor fetch returned. Network failure is an abstain, not a veto. */
+export type AnchorFetchOutcome = {
+    outcome: "document";
+    document: IAnchorDocument;
+    maxAgeSeconds?: number;
+} | {
+    outcome: "veto";
+} | {
+    outcome: "abstain";
+};
+/**
+ * Fetches one anchor. Installed by the host. Should not throw; a failure is an abstain.
+ */
+export type AnchorFetcher = (anchor: IAnchorRef, userId: string) => Promise<AnchorFetchOutcome>;
+/** Installs the fetcher {@link import("./key-change").evaluatePresentedKey} uses. */
+export declare function setAnchorFetcher(fetcher: AnchorFetcher | undefined): void;
+/** The installed fetcher, if any. */
+export declare function getAnchorFetcher(): AnchorFetcher | undefined;
+/** Stored resolution state. `confirmed-recovery` waits for the recovery delay. */
+export declare const KEY_RESOLUTION_STATES: readonly ["pending", "vetoed", "confirmed-rotation", "confirmed-recovery"];
+/** One of {@link KEY_RESOLUTION_STATES}. */
+export type KeyResolutionState = (typeof KEY_RESOLUTION_STATES)[number];
+/** Result of applying the confirmation rule to a set of anchor answers. */
+export interface AnchorResolution {
+    state: KeyResolutionState;
+    /** True when a confirming anchor carried the key on record's co-signature. */
+    successionByRecordKey: boolean;
+    /** Cache lifetime, in seconds, taken from the shortest document `max-age` that answered. */
+    cacheSeconds: number;
+}
+/**
+ * Applies the confirmation rule: at least one anchor lists the presented key, and none veto.
+ * A co-signature by the key on record makes it a rotation. Anything else confirmed is a recovery.
+ * No answer is pending. Any veto refuses the presented key.
+ */
+export declare function resolvePresentedKey(params: {
+    userId: string;
+    recordPublicKey: string;
+    presentedPublicKey: string;
+    outcomes: AnchorFetchOutcome[];
+}): AnchorResolution;

package/dist/identity/anchor-resolution.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_RESOLUTION_STATES = exports.ANCHOR_CACHE_MS = void 0;
+exports.sameAnchorList = sameAnchorList;
+exports.resolvePresentedAnchors = resolvePresentedAnchors;
+exports.setAnchorFetcher = setAnchorFetcher;
+exports.getAnchorFetcher = getAnchorFetcher;
+exports.resolvePresentedKey = resolvePresentedKey;
+const anchor_document_1 = require("./anchor-document");
+/** Whether two anchor lists name the same places, ignoring order. */
+function sameAnchorList(left, right) {
+    const a = [...(left ?? [])].sort((x, y) => `${x.type} ${x.url}`.localeCompare(`${y.type} ${y.url}`));
+    const b = [...(right ?? [])].sort((x, y) => `${x.type} ${x.url}`.localeCompare(`${y.type} ${y.url}`));
+    if (a.length !== b.length)
+        return false;
+    return a.every((anchor, index) => anchor.type === b[index].type && anchor.url === b[index].url);
+}
+/**
+ * Applies the confirmation rule to a new anchor list.
+ * A document whose `anchors` match the proposal confirms. A different list vetoes.
+ * No answer is pending.
+ */
+function resolvePresentedAnchors(params) {
+    let confirms = 0;
+    let vetoes = 0;
+    for (const outcome of params.outcomes) {
+        if (outcome.outcome === "abstain")
+            continue;
+        if (outcome.outcome === "veto") {
+            vetoes++;
+            continue;
+        }
+        if (outcome.document.userId !== params.userId ||
+            !sameAnchorList(outcome.document.anchors, params.presented)) {
+            vetoes++;
+            continue;
+        }
+        confirms++;
+    }
+    if (vetoes > 0)
+        return "vetoed";
+    if (confirms === 0)
+        return "pending";
+    return "confirmed";
+}
+/**
+ * How long a resolution may be reused before the anchors are fetched again.
+ * Matches the peers-services key document `max-age`.
+ */
+exports.ANCHOR_CACHE_MS = 60_000;
+let anchorFetcher;
+/** Installs the fetcher {@link import("./key-change").evaluatePresentedKey} uses. */
+function setAnchorFetcher(fetcher) {
+    anchorFetcher = fetcher;
+}
+/** The installed fetcher, if any. */
+function getAnchorFetcher() {
+    return anchorFetcher;
+}
+/** Stored resolution state. `confirmed-recovery` waits for the recovery delay. */
+exports.KEY_RESOLUTION_STATES = [
+    "pending",
+    "vetoed",
+    "confirmed-rotation",
+    "confirmed-recovery",
+];
+/**
+ * Applies the confirmation rule: at least one anchor lists the presented key, and none veto.
+ * A co-signature by the key on record makes it a rotation. Anything else confirmed is a recovery.
+ * No answer is pending. Any veto refuses the presented key.
+ */
+function resolvePresentedKey(params) {
+    let confirms = 0;
+    let vetoes = 0;
+    let succession = false;
+    let cacheSeconds = exports.ANCHOR_CACHE_MS / 1000;
+    for (const outcome of params.outcomes) {
+        if (outcome.outcome === "abstain")
+            continue;
+        if (outcome.outcome === "veto") {
+            vetoes++;
+            continue;
+        }
+        if (typeof outcome.maxAgeSeconds === "number" && outcome.maxAgeSeconds >= 0) {
+            cacheSeconds = Math.min(cacheSeconds, outcome.maxAgeSeconds);
+        }
+        const document = outcome.document;
+        if (document.userId !== params.userId) {
+            vetoes++;
+            continue;
+        }
+        const entry = document.keys.find((key) => key.publicKey === params.presentedPublicKey);
+        if (!entry) {
+            vetoes++;
+            continue;
+        }
+        confirms++;
+        if ((0, anchor_document_1.verifySuccession)({
+            userId: params.userId,
+            recordPublicKey: params.recordPublicKey,
+            entry,
+        })) {
+            succession = true;
+        }
+    }
+    if (vetoes > 0) {
+        return { state: "vetoed", successionByRecordKey: false, cacheSeconds };
+    }
+    if (confirms === 0) {
+        return { state: "pending", successionByRecordKey: false, cacheSeconds };
+    }
+    return {
+        state: succession ? "confirmed-rotation" : "confirmed-recovery",
+        successionByRecordKey: succession,
+        cacheSeconds,
+    };
+}

package/dist/identity/anchor-resolution.test.d.ts

@@ -0,0 +1 @@
+export {};