@push.rocks/smartsecret 1.1.0 → 1.2.1

package/ts/smartsecret.kernel.protocol.ts

@@ -0,0 +1,657 @@
+import * as plugins from './smartsecret.plugins.js';
+import {
+  SmartSecretKernelStoreError,
+  createSmartSecretKernelStoreError,
+} from './smartsecret.kernel.error.js';
+
+export const smartSecretKernelDefaultTimeoutMs = 5_000;
+export const smartSecretKernelMaximumTimeoutMs = 60_000;
+export const smartSecretKernelMaximumEntryBytes = 1_024;
+export const smartSecretKernelMaximumLegacyBytes = 16 * 1_024;
+export const smartSecretKernelMaximumMessageBytes = 32 * 1_024;
+export const smartSecretKernelLegacyService = 'global.idp.devidp';
+
+const serviceDomain = Buffer.from(
+  '@push.rocks/smartsecret/kernel-service/v1\u0000',
+  'utf8',
+);
+const entryDomain = Buffer.from(
+  '@push.rocks/smartsecret/kernel-entry/v1\u0000',
+  'utf8',
+);
+const mutexDomain = Buffer.from(
+  '@push.rocks/smartsecret/kernel-mutex/v1\u0000',
+  'utf8',
+);
+const canonicalDigestPattern = /^[A-Za-z0-9_-]{43}$/;
+const legacyAccountPattern = /^v1:[a-f0-9]{64}$/;
+
+export type TSmartSecretKernelDomainErrorCode =
+  | 'ENTRY_CORRUPT'
+  | 'INVALID_REQUEST'
+  | 'KERNEL_UNAVAILABLE'
+  | 'MUTATION_OUTCOME_UNKNOWN'
+  | 'ROOT_CONFLICT'
+  | 'SOURCE_CHANGED';
+
+export interface ISmartSecretKernelDomainErrorResult {
+  outcome: 'domainError';
+  code: TSmartSecretKernelDomainErrorCode;
+}
+
+export interface ISmartSecretKernelOperationOptions {
+  timeoutMs?: number;
+  signal?: AbortSignal;
+}
+
+export interface ISmartSecretKernelStoreOptions {
+  service: string;
+}
+
+export interface INormalizedSmartSecretKernelOperationOptions {
+  timeoutMs: number;
+  signal?: AbortSignal;
+}
+
+export interface ISmartSecretKernelGetSuccessAbsent {
+  outcome: 'success';
+  found: false;
+}
+
+export interface ISmartSecretKernelGetSuccessPresent {
+  outcome: 'success';
+  found: true;
+  value: string;
+}
+
+export type TSmartSecretKernelGetResult =
+  | ISmartSecretKernelDomainErrorResult
+  | ISmartSecretKernelGetSuccessAbsent
+  | ISmartSecretKernelGetSuccessPresent;
+
+export interface ISmartSecretKernelMutationSuccess {
+  outcome: 'success';
+}
+
+export type TSmartSecretKernelSetResult =
+  | ISmartSecretKernelDomainErrorResult
+  | ISmartSecretKernelMutationSuccess;
+
+export interface ISmartSecretKernelDeleteSuccess {
+  outcome: 'success';
+  deleted: boolean;
+}
+
+export type TSmartSecretKernelDeleteResult =
+  | ISmartSecretKernelDomainErrorResult
+  | ISmartSecretKernelDeleteSuccess;
+
+export interface ISmartSecretKernelLegacySuccessAbsent {
+  outcome: 'success';
+  found: false;
+}
+
+export interface ISmartSecretKernelLegacySuccessPresent {
+  outcome: 'success';
+  found: true;
+  value: string;
+  sourceSerial: number;
+  sessionRootSerial: number | null;
+  persistentRootSerial: number;
+  foundInSession: boolean;
+  foundInPersistent: boolean;
+  byteLength: number;
+  sha256: string;
+}
+
+export type TSmartSecretKernelLegacyReadResult =
+  | ISmartSecretKernelDomainErrorResult
+  | ISmartSecretKernelLegacySuccessAbsent
+  | ISmartSecretKernelLegacySuccessPresent;
+
+export interface ISmartSecretKernelLegacyDeleteSuccess {
+  outcome: 'success';
+  status: 'deleted' | 'alreadyAbsent';
+}
+
+export type TSmartSecretKernelLegacyDeleteResult =
+  | ISmartSecretKernelDomainErrorResult
+  | ISmartSecretKernelLegacyDeleteSuccess;
+
+export interface ISmartSecretKernelLegacyDeleteParams {
+  account: string;
+  sourceSerial: number;
+  sessionRootSerial: number | null;
+  persistentRootSerial: number;
+  foundInSession: boolean;
+  foundInPersistent: boolean;
+  byteLength: number;
+  sha256: string;
+}
+
+export type TSmartSecretKernelCommands = {
+  getEntry: {
+    params: { description: string };
+    result: TSmartSecretKernelGetResult;
+  };
+  setEntry: {
+    params: { description: string; value: string };
+    result: TSmartSecretKernelSetResult;
+  };
+  deleteEntry: {
+    params: { description: string };
+    result: TSmartSecretKernelDeleteResult;
+  };
+  readDevIdpV1Legacy: {
+    params: { account: string };
+    result: TSmartSecretKernelLegacyReadResult;
+  };
+  deleteDevIdpV1Legacy: {
+    params: ISmartSecretKernelLegacyDeleteParams;
+    result: TSmartSecretKernelLegacyDeleteResult;
+  };
+};
+
+const domainErrorCodes: ReadonlySet<string> = new Set([
+  'ENTRY_CORRUPT',
+  'INVALID_REQUEST',
+  'KERNEL_UNAVAILABLE',
+  'MUTATION_OUTCOME_UNKNOWN',
+  'ROOT_CONFLICT',
+  'SOURCE_CHANGED',
+]);
+
+const isSmartSecretKernelDomainErrorCode = (
+  valueArg: string,
+): valueArg is TSmartSecretKernelDomainErrorCode => domainErrorCodes.has(valueArg);
+
+const requireExactObject = (
+  valueArg: unknown,
+  keysArg: readonly string[],
+  inputArg: boolean,
+): Record<string, unknown> => {
+  const fail = (): never => {
+    throw createSmartSecretKernelStoreError(
+      inputArg ? 'INVALID_ARGUMENT' : 'WORKER_INTEGRITY_FAILED',
+    );
+  };
+  try {
+    if (valueArg === null || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+      return fail();
+    }
+    const prototype = Object.getPrototypeOf(valueArg);
+    if (prototype !== Object.prototype && prototype !== null) {
+      return fail();
+    }
+    const ownKeys = Reflect.ownKeys(valueArg);
+    if (
+      ownKeys.length !== keysArg.length
+      || ownKeys.some((keyArg) => typeof keyArg !== 'string' || !keysArg.includes(keyArg))
+      || keysArg.some((keyArg) => !ownKeys.includes(keyArg))
+    ) {
+      return fail();
+    }
+    const result: Record<string, unknown> = Object.create(null);
+    for (const key of keysArg) {
+      const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+      if (!descriptor?.enumerable || !('value' in descriptor)) {
+        return fail();
+      }
+      result[key] = descriptor.value;
+    }
+    return result;
+  } catch {
+    return fail();
+  }
+};
+
+const requireAllowedInputObject = (
+  valueArg: unknown,
+  allowedKeysArg: readonly string[],
+): Record<string, unknown> => {
+  const fail = (): never => {
+    throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+  };
+  try {
+    if (valueArg === null || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+      return fail();
+    }
+    const prototype = Object.getPrototypeOf(valueArg);
+    if (prototype !== Object.prototype && prototype !== null) {
+      return fail();
+    }
+    const ownKeys = Reflect.ownKeys(valueArg);
+    if (
+      ownKeys.some((keyArg) =>
+        typeof keyArg !== 'string' || !allowedKeysArg.includes(keyArg)
+      )
+    ) {
+      return fail();
+    }
+    const result: Record<string, unknown> = Object.create(null);
+    for (const key of ownKeys) {
+      if (typeof key !== 'string') return fail();
+      const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+      if (!descriptor?.enumerable || !('value' in descriptor)) {
+        return fail();
+      }
+      result[key] = descriptor.value;
+    }
+    return result;
+  } catch (error) {
+    if (error instanceof SmartSecretKernelStoreError) throw error;
+    return fail();
+  }
+};
+
+const requireValidScalarString = (valueArg: unknown): string => {
+  if (typeof valueArg !== 'string') {
+    throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+  }
+  for (let index = 0; index < valueArg.length; index++) {
+    const codeUnit = valueArg.charCodeAt(index);
+    if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+      const next = valueArg.charCodeAt(index + 1);
+      if (index + 1 >= valueArg.length || next < 0xdc00 || next > 0xdfff) {
+        throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+      }
+      index++;
+    } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+      throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+    }
+  }
+  const byteLength = Buffer.byteLength(valueArg, 'utf8');
+  if (byteLength < 1 || byteLength > 1_024) {
+    throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+  }
+  return valueArg;
+};
+
+const lengthPrefix = (lengthArg: number): Buffer => {
+  const prefix = Buffer.alloc(4);
+  prefix.writeUInt32BE(lengthArg, 0);
+  return prefix;
+};
+
+const digestDescription = (
+  prefixArg: string,
+  partsArg: readonly Uint8Array[],
+): string => {
+  const hash = plugins.crypto.createHash('sha256');
+  for (const part of partsArg) hash.update(part);
+  return `${prefixArg}${hash.digest('base64url')}`;
+};
+
+export const normalizeSmartSecretKernelService = (valueArg: unknown): string =>
+  requireValidScalarString(valueArg);
+
+export const normalizeSmartSecretKernelStoreOptions = (
+  valueArg: unknown,
+): ISmartSecretKernelStoreOptions => {
+  const value = requireExactObject(valueArg, ['service'], true);
+  return { service: normalizeSmartSecretKernelService(value.service) };
+};
+
+export const normalizeSmartSecretKernelAccount = (valueArg: unknown): string =>
+  requireValidScalarString(valueArg);
+
+export const normalizeDevIdpV1LegacyAccount = (valueArg: unknown): string => {
+  const account = requireValidScalarString(valueArg);
+  if (!legacyAccountPattern.test(account)) {
+    throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+  }
+  return account;
+};
+
+export const deriveSmartSecretKernelServiceDescription = (serviceArg: string): string => {
+  const service = Buffer.from(normalizeSmartSecretKernelService(serviceArg), 'utf8');
+  return digestDescription('smartsecret-service:v1:', [
+    serviceDomain,
+    lengthPrefix(service.byteLength),
+    service,
+  ]);
+};
+
+export const deriveSmartSecretKernelEntryDescription = (
+  serviceArg: string,
+  accountArg: string,
+): string => {
+  const service = Buffer.from(normalizeSmartSecretKernelService(serviceArg), 'utf8');
+  const account = Buffer.from(normalizeSmartSecretKernelAccount(accountArg), 'utf8');
+  return digestDescription('smartsecret-entry:v1:', [
+    entryDomain,
+    lengthPrefix(service.byteLength),
+    service,
+    lengthPrefix(account.byteLength),
+    account,
+  ]);
+};
+
+export const deriveSmartSecretKernelMutexNamespace = (serviceArg: string): string => {
+  const service = Buffer.from(normalizeSmartSecretKernelService(serviceArg), 'utf8');
+  return digestDescription('smartsecret-kernel:v1:', [
+    mutexDomain,
+    lengthPrefix(service.byteLength),
+    service,
+  ]);
+};
+
+export const deriveDevIdpV1LegacyDescription = (accountArg: string): string =>
+  `keyring:${normalizeDevIdpV1LegacyAccount(accountArg)}@${smartSecretKernelLegacyService}`;
+
+export const normalizeSmartSecretKernelValue = (valueArg: unknown): Uint8Array => {
+  try {
+    if (
+      !(valueArg instanceof Uint8Array)
+      || valueArg.byteLength > smartSecretKernelMaximumEntryBytes
+    ) {
+      throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+    }
+    return new Uint8Array(valueArg);
+  } catch (error) {
+    if (error instanceof SmartSecretKernelStoreError) throw error;
+    throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+  }
+};
+
+export const encodeCanonicalBase64Url = (valueArg: Uint8Array): string => {
+  const value = Buffer.from(valueArg);
+  try {
+    return value.toString('base64url');
+  } finally {
+    value.fill(0);
+  }
+};
+
+const decodeCanonicalBase64Url = (
+  valueArg: unknown,
+  maximumBytesArg: number,
+  minimumBytesArg = 0,
+): Uint8Array => {
+  const maximumEncodedLength = Math.ceil(maximumBytesArg * 4 / 3);
+  if (
+    typeof valueArg !== 'string'
+    || valueArg.length > maximumEncodedLength
+    || valueArg.length % 4 === 1
+    || !/^[A-Za-z0-9_-]*$/.test(valueArg)
+  ) {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  const decoded = Buffer.from(valueArg, 'base64url');
+  if (
+    decoded.byteLength < minimumBytesArg
+    || decoded.byteLength > maximumBytesArg
+    || decoded.toString('base64url') !== valueArg
+  ) {
+    decoded.fill(0);
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  const result = new Uint8Array(decoded);
+  decoded.fill(0);
+  return result;
+};
+
+export const normalizeSmartSecretKernelOperationOptions = (
+  valueArg: ISmartSecretKernelOperationOptions | undefined,
+): INormalizedSmartSecretKernelOperationOptions => {
+  if (valueArg === undefined) return { timeoutMs: smartSecretKernelDefaultTimeoutMs };
+  const options = requireAllowedInputObject(valueArg, ['timeoutMs', 'signal']);
+  const timeoutMs = Object.hasOwn(options, 'timeoutMs')
+    ? options.timeoutMs
+    : smartSecretKernelDefaultTimeoutMs;
+  if (
+    typeof timeoutMs !== 'number'
+    || !Number.isSafeInteger(timeoutMs)
+    || timeoutMs < 1
+    || timeoutMs > smartSecretKernelMaximumTimeoutMs
+  ) {
+    throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+  }
+  if (!Object.hasOwn(options, 'signal')) return { timeoutMs };
+  let signal: AbortSignal;
+  try {
+    if (
+      !(options.signal instanceof AbortSignal)
+      || Object.getPrototypeOf(options.signal) !== AbortSignal.prototype
+    ) {
+      throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+    }
+    signal = options.signal;
+    void signal.aborted;
+  } catch (error) {
+    if (error instanceof SmartSecretKernelStoreError) throw error;
+    throw createSmartSecretKernelStoreError('INVALID_ARGUMENT');
+  }
+  return { timeoutMs, signal };
+};
+
+const parseDomainError = (
+  valueArg: Record<string, unknown>,
+): ISmartSecretKernelDomainErrorResult | undefined => {
+  if (valueArg.outcome !== 'domainError') return undefined;
+  const result = requireExactObject(valueArg, ['outcome', 'code'], false);
+  if (
+    typeof result.code !== 'string'
+    || !isSmartSecretKernelDomainErrorCode(result.code)
+  ) {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  return {
+    outcome: 'domainError',
+    code: result.code,
+  };
+};
+
+const requireResultObject = (valueArg: unknown): Record<string, unknown> => {
+  try {
+    if (valueArg === null || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+      throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+    }
+    const prototype = Object.getPrototypeOf(valueArg);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg, 'outcome');
+    if (!descriptor?.enumerable || !('value' in descriptor)) {
+      throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+    }
+    const result: Record<string, unknown> = Object.create(null);
+    for (const key of Reflect.ownKeys(valueArg)) {
+      if (typeof key !== 'string') {
+        throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+      }
+      const property = Object.getOwnPropertyDescriptor(valueArg, key);
+      if (!property?.enumerable || !('value' in property)) {
+        throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+      }
+      result[key] = property.value;
+    }
+    return result;
+  } catch (error) {
+    if (error instanceof SmartSecretKernelStoreError) throw error;
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+};
+
+const requirePositiveSerial = (valueArg: unknown): number => {
+  if (
+    typeof valueArg !== 'number'
+    || !Number.isSafeInteger(valueArg)
+    || valueArg < 1
+    || valueArg > 2_147_483_647
+  ) {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  return valueArg;
+};
+
+export const parseSmartSecretKernelGetResult = (
+  valueArg: unknown,
+):
+  | { kind: 'domainError'; domainError: ISmartSecretKernelDomainErrorResult }
+  | { kind: 'success'; found: false }
+  | { kind: 'success'; found: true; value: Uint8Array } => {
+  const value = requireResultObject(valueArg);
+  const domainError = parseDomainError(value);
+  if (domainError) return { kind: 'domainError', domainError };
+  if (value.outcome !== 'success' || typeof value.found !== 'boolean') {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  if (!value.found) {
+    requireExactObject(value, ['outcome', 'found'], false);
+    return { kind: 'success', found: false };
+  }
+  const result = requireExactObject(value, ['outcome', 'found', 'value'], false);
+  return {
+    kind: 'success',
+    found: true,
+    value: decodeCanonicalBase64Url(result.value, smartSecretKernelMaximumEntryBytes),
+  };
+};
+
+export const parseSmartSecretKernelSetResult = (
+  valueArg: unknown,
+):
+  | { kind: 'domainError'; domainError: ISmartSecretKernelDomainErrorResult }
+  | { kind: 'success' } => {
+  const value = requireResultObject(valueArg);
+  const domainError = parseDomainError(value);
+  if (domainError) return { kind: 'domainError', domainError };
+  const result = requireExactObject(value, ['outcome'], false);
+  if (result.outcome !== 'success') {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  return { kind: 'success' };
+};
+
+export const parseSmartSecretKernelDeleteResult = (
+  valueArg: unknown,
+):
+  | { kind: 'domainError'; domainError: ISmartSecretKernelDomainErrorResult }
+  | { kind: 'success'; deleted: boolean } => {
+  const value = requireResultObject(valueArg);
+  const domainError = parseDomainError(value);
+  if (domainError) return { kind: 'domainError', domainError };
+  const result = requireExactObject(value, ['outcome', 'deleted'], false);
+  if (result.outcome !== 'success' || typeof result.deleted !== 'boolean') {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  return { kind: 'success', deleted: result.deleted };
+};
+
+export type TParsedSmartSecretKernelLegacyRead =
+  | { kind: 'domainError'; domainError: ISmartSecretKernelDomainErrorResult }
+  | { kind: 'success'; found: false }
+  | {
+      kind: 'success';
+      found: true;
+      value: Uint8Array;
+      receiptParams: ISmartSecretKernelLegacyDeleteParams;
+    };
+
+export const parseSmartSecretKernelLegacyReadResult = (
+  valueArg: unknown,
+  accountArg: string,
+): TParsedSmartSecretKernelLegacyRead => {
+  const account = normalizeDevIdpV1LegacyAccount(accountArg);
+  const value = requireResultObject(valueArg);
+  const domainError = parseDomainError(value);
+  if (domainError) return { kind: 'domainError', domainError };
+  if (value.outcome !== 'success' || typeof value.found !== 'boolean') {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  if (!value.found) {
+    requireExactObject(value, ['outcome', 'found'], false);
+    return { kind: 'success', found: false };
+  }
+  const result = requireExactObject(value, [
+    'outcome',
+    'found',
+    'value',
+    'sourceSerial',
+    'sessionRootSerial',
+    'persistentRootSerial',
+    'foundInSession',
+    'foundInPersistent',
+    'byteLength',
+    'sha256',
+  ], false);
+  const decoded = decodeCanonicalBase64Url(
+    result.value,
+    smartSecretKernelMaximumLegacyBytes,
+    1,
+  );
+  let actualDigest: Buffer | undefined;
+  let claimedDigest: Buffer | undefined;
+  let didSucceed = false;
+  try {
+    if (
+      typeof result.byteLength !== 'number'
+      || !Number.isSafeInteger(result.byteLength)
+      || result.byteLength !== decoded.byteLength
+      || typeof result.foundInSession !== 'boolean'
+      || typeof result.foundInPersistent !== 'boolean'
+      || (!result.foundInSession && !result.foundInPersistent)
+      || typeof result.sha256 !== 'string'
+      || !canonicalDigestPattern.test(result.sha256)
+    ) {
+      throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+    }
+    const sourceSerial = requirePositiveSerial(result.sourceSerial);
+    const persistentRootSerial = requirePositiveSerial(result.persistentRootSerial);
+    const sessionRootSerial = result.sessionRootSerial === null
+      ? null
+      : requirePositiveSerial(result.sessionRootSerial);
+    if (result.foundInSession && sessionRootSerial === null) {
+      throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+    }
+    actualDigest = plugins.crypto.createHash('sha256').update(decoded).digest();
+    claimedDigest = Buffer.from(result.sha256, 'base64url');
+    if (
+      claimedDigest.byteLength !== 32
+      || claimedDigest.toString('base64url') !== result.sha256
+      || !plugins.crypto.timingSafeEqual(actualDigest, claimedDigest)
+    ) {
+      throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+    }
+    const parsed: TParsedSmartSecretKernelLegacyRead = {
+      kind: 'success',
+      found: true,
+      value: decoded,
+      receiptParams: {
+        account,
+        sourceSerial,
+        sessionRootSerial,
+        persistentRootSerial,
+        foundInSession: result.foundInSession,
+        foundInPersistent: result.foundInPersistent,
+        byteLength: result.byteLength,
+        sha256: result.sha256,
+      },
+    };
+    didSucceed = true;
+    return parsed;
+  } finally {
+    actualDigest?.fill(0);
+    claimedDigest?.fill(0);
+    if (!didSucceed) decoded.fill(0);
+  }
+};
+
+export const parseSmartSecretKernelLegacyDeleteResult = (
+  valueArg: unknown,
+):
+  | { kind: 'domainError'; domainError: ISmartSecretKernelDomainErrorResult }
+  | { kind: 'success'; status: 'deleted' | 'alreadyAbsent' } => {
+  const value = requireResultObject(valueArg);
+  const domainError = parseDomainError(value);
+  if (domainError) return { kind: 'domainError', domainError };
+  const result = requireExactObject(value, ['outcome', 'status'], false);
+  if (
+    result.outcome !== 'success'
+    || (result.status !== 'deleted' && result.status !== 'alreadyAbsent')
+  ) {
+    throw createSmartSecretKernelStoreError('WORKER_INTEGRITY_FAILED');
+  }
+  return { kind: 'success', status: result.status };
+};