@sourcey/catalog-verifier 1.0.0

package/dist/modules/authority/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../modules/authority/src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,kBAAkB,EAClB,OAAO,EACP,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EACnB,MAAM,2CAA2C,CAAC;AAOnD,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EAGxC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EAGtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAIxB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAGtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAG5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAiB,KAAK,MAAM,EAAU,MAAM,+BAA+B,CAAC;AAUnF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,gBAAgB,CAgBhF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAEvE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAE7E;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GAAG,iBAAiB,CAwBpB;AAgCD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CASR;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CASR;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,sBAAsB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CASR;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,gBAAgB,GAAG,gBAAgB,EACzC,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CASR;AAED,wBAAgB,+CAA+C,CAC7D,IAAI,EAAE,kCAAkC,EACxC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GACrD,MAAM,CASR;AAED,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,MAAM,GACjB,8BAA8B,CAoDhC;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC7C,YAAY,CAoCd;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,cAAc,CAkCvF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IACL,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GACA;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAwBvD;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,MAAM,GACtB,YAAY,CAmDd;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,eAAe,EAAE,MAAM,GACtB,cAAc,CAoDhB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,GACvB,kBAAkB,CAmDpB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC7C,YAAY,CAoCd"}

package/dist/modules/authority/src/index.js

@@ -0,0 +1,349 @@
+import { createPublicKey, verify } from "node:crypto";
+import { rootSetTransitionCoreSchema, rootSetTransitionSchema, signerRegistryCoreSchema, signerRegistrySchema, } from "../../../contracts/authority/src/index.js";
+import { catalogVerifierIdentityContextCoreSchema, catalogVerifierIdentityContextSchema, } from "../../../contracts/catalog-verifier/src/index.js";
+import { catalogEventCoreSchema, catalogEventSchema, } from "../../../contracts/events/src/index.js";
+import { captureReceiptCoreSchema, captureReceiptSchema, evidenceReviewDecisionCoreSchema, } from "../../../contracts/evidence/src/index.js";
+import { changeCursorCoreSchema, changeCursorSchema, searchCursorCoreSchema, searchCursorSchema, } from "../../../contracts/feed/src/index.js";
+import { releasePublicationCoreSchema, releasePublicationSchema, } from "../../../contracts/release/src/index.js";
+import { canonicalJson, digest } from "../../primitives/src/index.js";
+const REGISTRY_DOMAIN = "sourcey:signer-registry:v1alpha1";
+const CAPTURE_RECEIPT_DOMAIN = "sourcey:capture-receipt:v1alpha1";
+const EVENT_DOMAIN = "sourcey:catalog-event:v1alpha1";
+const RELEASE_DOMAIN = "sourcey:release-publication:v1alpha1";
+const FEED_CURSOR_DOMAIN = "sourcey:change-cursor:v1alpha1";
+const ROOT_TRANSITION_DOMAIN = "sourcey:root-set-transition:v1alpha1";
+const VERIFIER_IDENTITY_CONTEXT_DOMAIN = "sourcey:catalog-verifier-identity-context:v1alpha1";
+export function signaturePurposeForKind(kind) {
+    if (kind === "evidence.bound" ||
+        kind === "evidence.retracted" ||
+        kind === "discrepancy.resolved") {
+        return "catalog-evidence";
+    }
+    if (kind.startsWith("authority."))
+        return "catalog-authority";
+    if (kind === "subject.attested" || kind === "attestation.revoked") {
+        return "catalog-attestation";
+    }
+    if (kind.startsWith("verification."))
+        return "catalog-verification";
+    if (kind.startsWith("freshness."))
+        return "catalog-policy";
+    if (kind.startsWith("dispute."))
+        return "catalog-dispute";
+    return "catalog-identity";
+}
+export function signerRegistryPreimage(core) {
+    return Buffer.from(`${REGISTRY_DOMAIN}\0${canonicalJson(core)}`, "utf8");
+}
+export function rootSetTransitionPreimage(core) {
+    return Buffer.from(`${ROOT_TRANSITION_DOMAIN}\0${canonicalJson(core)}`, "utf8");
+}
+export function validateRootSetTransition(input) {
+    const transition = rootSetTransitionSchema.parse(input.transition);
+    const { transition_digest: transitionDigest, previous_root_signatures: previousSignatures, next_root_signatures: nextSignatures, ...coreInput } = transition;
+    const core = rootSetTransitionCoreSchema.parse(coreInput);
+    if (digest(core) !== transitionDigest)
+        throw new Error("Root-set transition digest mismatch.");
+    if (core.previous_root_set_digest !== digest(input.previousRootSet) ||
+        core.next_root_set_digest !== digest(input.nextRootSet) ||
+        core.previous_generation !== input.previousRootSet.generation ||
+        core.next_generation !== input.nextRootSet.generation ||
+        core.next_generation !== core.previous_generation + 1 ||
+        core.effective_release_sequence !== input.releaseSequence) {
+        throw new Error("Root-set transition does not bind the exact adjacent trust generations.");
+    }
+    const preimage = rootSetTransitionPreimage(core);
+    assertRootThreshold(input.previousRootSet, previousSignatures, preimage, "previous");
+    assertRootThreshold(input.nextRootSet, nextSignatures, preimage, "next");
+    return transition;
+}
+function assertRootThreshold(roots, signatures, preimage, label) {
+    const keys = new Map(roots.keys.map((key) => [key.key_id, key]));
+    const valid = new Set();
+    for (const signature of signatures) {
+        const key = keys.get(signature.key_id);
+        if (key &&
+            !valid.has(key.key_id) &&
+            verify(null, preimage, createPublicKey(key.public_key_pem), Buffer.from(signature.signature, "base64"))) {
+            valid.add(key.key_id);
+        }
+    }
+    if (valid.size < roots.threshold) {
+        throw new Error(`Root-set transition has ${valid.size} valid ${label} signatures; ${roots.threshold} required.`);
+    }
+}
+export function eventSignaturePreimage(core, eventId, protectedHeader) {
+    return Buffer.from(`${EVENT_DOMAIN}\0${protectedHeader.signature_purpose}\0${canonicalJson({
+        event_id: eventId,
+        event_core_digest: digest(core),
+        protected: protectedHeader,
+    })}`, "utf8");
+}
+export function captureReceiptSignaturePreimage(core, receiptDigest, protectedHeader) {
+    return Buffer.from(`${CAPTURE_RECEIPT_DOMAIN}\0${protectedHeader.signature_purpose}\0${canonicalJson({
+        receipt_digest: receiptDigest,
+        receipt_core_digest: digest(core),
+        protected: protectedHeader,
+    })}`, "utf8");
+}
+export function releasePublicationSignaturePreimage(core, publicationDigest, protectedHeader) {
+    return Buffer.from(`${RELEASE_DOMAIN}\0${protectedHeader.signature_purpose}\0${canonicalJson({
+        publication_digest: publicationDigest,
+        publication_core_digest: digest(core),
+        protected: protectedHeader,
+    })}`, "utf8");
+}
+export function changeCursorSignaturePreimage(core, cursorDigest, protectedHeader) {
+    return Buffer.from(`${FEED_CURSOR_DOMAIN}\0${protectedHeader.signature_purpose}\0${canonicalJson({
+        cursor_digest: cursorDigest,
+        cursor_core_digest: digest(core),
+        protected: protectedHeader,
+    })}`, "utf8");
+}
+export function catalogVerifierIdentityContextSignaturePreimage(core, contextDigest, protectedHeader) {
+    return Buffer.from(`${VERIFIER_IDENTITY_CONTEXT_DOMAIN}\0${protectedHeader.signature_purpose}\0${canonicalJson({
+        context_digest: contextDigest,
+        context_core_digest: digest(core),
+        protected: protectedHeader,
+    })}`, "utf8");
+}
+export function validateCatalogVerifierIdentityContext(input, registry, verifiedAt) {
+    const context = catalogVerifierIdentityContextSchema.parse(input);
+    const { context_digest: contextDigest, protected: protectedSignature, ...coreInput } = context;
+    const core = catalogVerifierIdentityContextCoreSchema.parse(coreInput);
+    if (digest(core) !== contextDigest) {
+        throw new Error("Catalog verifier identity context digest mismatch.");
+    }
+    if (protectedSignature.signature_purpose !== "catalog-identity" ||
+        protectedSignature.signer_registry_digest !== registry.registry_digest) {
+        throw new Error("Catalog verifier identity context uses invalid protected authority.");
+    }
+    const issuer = registry.issuers.find((candidate) => candidate.keys.some((key) => key.key_id === protectedSignature.key_id));
+    const key = issuer?.keys.find((candidate) => candidate.key_id === protectedSignature.key_id);
+    if (!key?.purposes.includes("catalog-identity")) {
+        throw new Error("Catalog verifier identity context signer lacks catalog-identity authority.");
+    }
+    if (context.issued_at < key.valid_from ||
+        (key.valid_until && context.issued_at >= key.valid_until) ||
+        (key.compromised_after_sequence !== undefined &&
+            context.live_parent_release_sequence >= key.compromised_after_sequence)) {
+        throw new Error("Catalog verifier identity context uses an ineligible signing key.");
+    }
+    const verificationInstant = Date.parse(verifiedAt);
+    if (!Number.isFinite(verificationInstant) ||
+        verificationInstant < Date.parse(context.issued_at) ||
+        verificationInstant >= Date.parse(context.expires_at)) {
+        throw new Error("Catalog verifier identity context is outside its signed freshness interval.");
+    }
+    const { signature, ...protectedHeader } = protectedSignature;
+    if (!verify(null, catalogVerifierIdentityContextSignaturePreimage(core, contextDigest, protectedHeader), createPublicKey(key.public_key_pem), Buffer.from(signature, "base64"))) {
+        throw new Error("Catalog verifier identity context has an invalid protected signature.");
+    }
+    return context;
+}
+export function validateSearchCursor(input, registry, context) {
+    const cursor = searchCursorSchema.parse(input);
+    const { cursor_digest: cursorDigest, protected: protectedSignature, ...coreInput } = cursor;
+    const core = searchCursorCoreSchema.parse(coreInput);
+    if (cursorDigest !== digest(core))
+        throw new Error("Search cursor digest mismatch.");
+    if (protectedSignature.signature_purpose !== "catalog-feed" ||
+        protectedSignature.signer_registry_digest !== registry.registry_digest) {
+        throw new Error("Search cursor uses invalid protected authority.");
+    }
+    const issuer = registry.issuers.find((candidate) => candidate.keys.some((key) => key.key_id === protectedSignature.key_id));
+    const key = issuer?.keys.find((candidate) => candidate.key_id === protectedSignature.key_id);
+    if (!key?.purposes.includes("catalog-feed")) {
+        throw new Error("Search cursor signer is not authorized for catalog-feed.");
+    }
+    if (key.compromised_after_sequence !== undefined &&
+        (context === undefined || context.releaseSequence >= key.compromised_after_sequence)) {
+        throw new Error("Search cursor uses a key rejected for this release.");
+    }
+    const { signature, ...protectedHeader } = protectedSignature;
+    if (!verify(null, changeCursorSignaturePreimage(core, cursorDigest, protectedHeader), createPublicKey(key.public_key_pem), Buffer.from(signature, "base64"))) {
+        throw new Error("Search cursor signature is invalid.");
+    }
+    return cursor;
+}
+export function validateSignerRegistry(rootSet, input) {
+    const registry = signerRegistrySchema.parse(input);
+    const { registry_digest: registryDigest, root_signatures: signatures, ...coreInput } = registry;
+    const core = signerRegistryCoreSchema.parse(coreInput);
+    const expectedDigest = digest(core);
+    if (registryDigest !== expectedDigest) {
+        throw new Error(`Signer registry digest mismatch: expected ${expectedDigest}, received ${registryDigest}.`);
+    }
+    const roots = new Map(rootSet.keys.map((key) => [key.key_id, key]));
+    const valid = new Set();
+    const preimage = signerRegistryPreimage(core);
+    for (const signature of signatures) {
+        const root = roots.get(signature.key_id);
+        if (!root || valid.has(root.key_id))
+            continue;
+        if (verify(null, preimage, createPublicKey(root.public_key_pem), Buffer.from(signature.signature, "base64"))) {
+            valid.add(root.key_id);
+        }
+    }
+    if (valid.size < rootSet.threshold) {
+        throw new Error(`Signer registry has ${valid.size} valid root signatures; ${rootSet.threshold} required.`);
+    }
+    return registry;
+}
+/**
+ * Resolve the one registry authority that may issue a purpose-bound object at
+ * an exact instant and release. This is deliberately independent of private
+ * key custody: callers learn only the public issuer/key identity that their
+ * immutable object must name.
+ */
+export function resolveActiveSignerAuthority(registry, input) {
+    const instant = Date.parse(input.at);
+    if (!Number.isFinite(instant))
+        throw new Error("Signer authority time is invalid.");
+    if (!Number.isInteger(input.releaseSequence) || input.releaseSequence <= 0) {
+        throw new Error("Signer authority release sequence must be a positive integer.");
+    }
+    const candidates = registry.issuers.flatMap((issuer) => issuer.keys
+        .filter((key) => key.purposes.includes(input.purpose) &&
+        Date.parse(key.valid_from) <= instant &&
+        (key.valid_until === undefined || instant < Date.parse(key.valid_until)) &&
+        (key.compromised_after_sequence === undefined ||
+            input.releaseSequence < key.compromised_after_sequence))
+        .map((key) => ({ issuerId: issuer.issuer_id, keyId: key.key_id })));
+    if (candidates.length !== 1 || !candidates[0]) {
+        throw new Error(`Signer registry must resolve exactly one ${input.purpose} authority at ${input.at}.`);
+    }
+    return candidates[0];
+}
+export function validateProtectedEvent(input, registry, releaseSequence) {
+    const event = catalogEventSchema.parse(input);
+    const { event_id: eventId, protected: protectedSignature, ...coreInput } = event;
+    const core = catalogEventCoreSchema.parse(coreInput);
+    const expectedEventId = digest(core);
+    if (eventId !== expectedEventId) {
+        throw new Error(`Event ID mismatch: expected ${expectedEventId}, received ${eventId}.`);
+    }
+    if (protectedSignature.signer_registry_digest !== registry.registry_digest) {
+        throw new Error(`Event ${eventId} does not use the release-pinned signer registry.`);
+    }
+    const expectedPurpose = signaturePurposeForKind(event.kind);
+    if (protectedSignature.signature_purpose !== expectedPurpose) {
+        throw new Error(`Event ${eventId} uses ${protectedSignature.signature_purpose}; ${expectedPurpose} required.`);
+    }
+    const issuer = registry.issuers.find((candidate) => candidate.issuer_id === event.issuer_id);
+    const key = issuer?.keys.find((candidate) => candidate.key_id === protectedSignature.key_id);
+    if (!issuer || !key) {
+        throw new Error(`Event ${eventId} signer is absent from the pinned registry.`);
+    }
+    if (!key.purposes.includes(expectedPurpose)) {
+        throw new Error(`Event ${eventId} signer is not authorized for ${expectedPurpose}.`);
+    }
+    if (event.occurred_at < key.valid_from ||
+        (key.valid_until && event.occurred_at >= key.valid_until)) {
+        throw new Error(`Event ${eventId} falls outside its signer's validity interval.`);
+    }
+    if (key.compromised_after_sequence !== undefined &&
+        releaseSequence >= key.compromised_after_sequence) {
+        throw new Error(`Event ${eventId} uses a key rejected at this release sequence.`);
+    }
+    const { signature, ...protectedHeader } = protectedSignature;
+    if (!verify(null, eventSignaturePreimage(core, eventId, protectedHeader), createPublicKey(key.public_key_pem), Buffer.from(signature, "base64"))) {
+        throw new Error(`Event ${eventId} has an invalid protected signature.`);
+    }
+    return event;
+}
+export function validateProtectedCaptureReceipt(input, registry, releaseSequence) {
+    const receipt = captureReceiptSchema.parse(input);
+    const { receipt_digest: receiptDigest, protected: protectedSignature, ...coreInput } = receipt;
+    const core = captureReceiptCoreSchema.parse(coreInput);
+    const expectedDigest = digest(core);
+    if (receiptDigest !== expectedDigest) {
+        throw new Error(`Capture receipt digest mismatch: expected ${expectedDigest}, received ${receiptDigest}.`);
+    }
+    const { decision_digest: decisionDigest, ...decisionCore } = receipt.review_decision;
+    if (digest(evidenceReviewDecisionCoreSchema.parse(decisionCore)) !== decisionDigest ||
+        receipt.review_decision.decision !== "approved") {
+        throw new Error(`Capture receipt ${receiptDigest} lacks its exact approved review decision.`);
+    }
+    if (protectedSignature.signature_purpose !== "catalog-capture" ||
+        protectedSignature.signer_registry_digest !== registry.registry_digest) {
+        throw new Error(`Capture receipt ${receiptDigest} uses invalid protected authority.`);
+    }
+    const issuer = registry.issuers.find((candidate) => candidate.issuer_id === receipt.issuer_id);
+    const key = issuer?.keys.find((candidate) => candidate.key_id === protectedSignature.key_id);
+    if (!issuer || !key?.purposes.includes("catalog-capture")) {
+        throw new Error(`Capture receipt ${receiptDigest} signer lacks catalog-capture authority.`);
+    }
+    if (receipt.issued_at < key.valid_from ||
+        (key.valid_until && receipt.issued_at >= key.valid_until)) {
+        throw new Error(`Capture receipt ${receiptDigest} falls outside signer validity.`);
+    }
+    if (key.compromised_after_sequence !== undefined &&
+        releaseSequence >= key.compromised_after_sequence) {
+        throw new Error(`Capture receipt ${receiptDigest} uses a rejected key.`);
+    }
+    const { signature, ...protectedHeader } = protectedSignature;
+    if (!verify(null, captureReceiptSignaturePreimage(core, receiptDigest, protectedHeader), createPublicKey(key.public_key_pem), Buffer.from(signature, "base64"))) {
+        throw new Error(`Capture receipt ${receiptDigest} has an invalid protected signature.`);
+    }
+    return receipt;
+}
+export function validateReleasePublication(input, registry) {
+    const publication = releasePublicationSchema.parse(input);
+    const { publication_digest: publicationDigest, protected: protectedSignature, ...coreInput } = publication;
+    const core = releasePublicationCoreSchema.parse(coreInput);
+    const expectedDigest = digest(core);
+    if (publicationDigest !== expectedDigest) {
+        throw new Error(`Publication digest mismatch: expected ${expectedDigest}, received ${publicationDigest}.`);
+    }
+    if (protectedSignature.signature_purpose !== "catalog-release") {
+        throw new Error("Release publication requires a catalog-release signature.");
+    }
+    if (protectedSignature.signer_registry_digest !== registry.registry_digest) {
+        throw new Error("Release publication does not use the bundle-pinned signer registry.");
+    }
+    const issuer = registry.issuers.find((candidate) => candidate.keys.some((key) => key.key_id === protectedSignature.key_id));
+    const key = issuer?.keys.find((candidate) => candidate.key_id === protectedSignature.key_id);
+    if (!issuer || !key?.purposes.includes("catalog-release")) {
+        throw new Error("Release publication signer is not authorized for catalog-release.");
+    }
+    if (publication.published_at < key.valid_from ||
+        (key.valid_until && publication.published_at >= key.valid_until)) {
+        throw new Error("Release publication falls outside its signer's validity interval.");
+    }
+    if (key.compromised_after_sequence !== undefined &&
+        publication.release_sequence >= key.compromised_after_sequence) {
+        throw new Error("Release publication uses a key rejected at this release sequence.");
+    }
+    const { signature, ...protectedHeader } = protectedSignature;
+    if (!verify(null, releasePublicationSignaturePreimage(core, publicationDigest, protectedHeader), createPublicKey(key.public_key_pem), Buffer.from(signature, "base64"))) {
+        throw new Error("Release publication has an invalid protected signature.");
+    }
+    return publication;
+}
+export function validateChangeCursor(input, registry, context) {
+    const cursor = changeCursorSchema.parse(input);
+    const { cursor_digest: cursorDigest, protected: protectedSignature, ...coreInput } = cursor;
+    const core = changeCursorCoreSchema.parse(coreInput);
+    if (cursorDigest !== digest(core))
+        throw new Error("Change cursor digest mismatch.");
+    if (protectedSignature.signature_purpose !== "catalog-feed" ||
+        protectedSignature.signer_registry_digest !== registry.registry_digest) {
+        throw new Error("Change cursor uses invalid protected authority.");
+    }
+    const issuer = registry.issuers.find((candidate) => candidate.keys.some((key) => key.key_id === protectedSignature.key_id));
+    const key = issuer?.keys.find((candidate) => candidate.key_id === protectedSignature.key_id);
+    if (!key?.purposes.includes("catalog-feed")) {
+        throw new Error("Change cursor signer is not authorized for catalog-feed.");
+    }
+    if (key.compromised_after_sequence !== undefined &&
+        (context === undefined || context.releaseSequence >= key.compromised_after_sequence)) {
+        throw new Error("Change cursor uses a key rejected for this release.");
+    }
+    const { signature, ...protectedHeader } = protectedSignature;
+    if (!verify(null, changeCursorSignaturePreimage(core, cursorDigest, protectedHeader), createPublicKey(key.public_key_pem), Buffer.from(signature, "base64"))) {
+        throw new Error("Change cursor signature is invalid.");
+    }
+    return cursor;
+}
+//# sourceMappingURL=index.js.map

package/dist/modules/authority/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../modules/authority/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAUtD,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAGL,wCAAwC,EACxC,oCAAoC,GACrC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAIL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGL,wBAAwB,EACxB,oBAAoB,EACpB,gCAAgC,GACjC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAGL,sBAAsB,EACtB,kBAAkB,EAGlB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAGL,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,aAAa,EAAe,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAEnF,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAC3D,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,YAAY,GAAG,gCAAgC,CAAC;AACtD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAC5D,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AACtE,MAAM,gCAAgC,GAAG,oDAAoD,CAAC;AAE9F,MAAM,UAAU,uBAAuB,CAAC,IAAsB;IAC5D,IACE,IAAI,KAAK,gBAAgB;QACzB,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,sBAAsB,EAC/B,CAAC;QACD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC9D,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAClE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC1D,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,KAAK,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAA2B;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,sBAAsB,KAAK,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,EACJ,iBAAiB,EAAE,gBAAgB,EACnC,wBAAwB,EAAE,kBAAkB,EAC5C,oBAAoB,EAAE,cAAc,EACpC,GAAG,SAAS,EACb,GAAG,UAAU,CAAC;IACf,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC/F,IACE,IAAI,CAAC,wBAAwB,KAAK,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;QAC/D,IAAI,CAAC,oBAAoB,KAAK,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QACvD,IAAI,CAAC,mBAAmB,KAAK,KAAK,CAAC,eAAe,CAAC,UAAU;QAC7D,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,WAAW,CAAC,UAAU;QACrD,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,mBAAmB,GAAG,CAAC;QACrD,IAAI,CAAC,0BAA0B,KAAK,KAAK,CAAC,eAAe,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,mBAAmB,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrF,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAc,EACd,UAA8E,EAC9E,QAAgB,EAChB,KAAa;IAEb,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IACE,GAAG;YACH,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YACtB,MAAM,CACJ,IAAI,EACJ,QAAQ,EACR,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAC3C,EACD,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,IAAI,UAAU,KAAK,gBAAgB,KAAK,CAAC,SAAS,YAAY,CAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAsB,EACtB,OAAe,EACf,eAAsD;IAEtD,OAAO,MAAM,CAAC,IAAI,CAChB,GAAG,YAAY,KAAK,eAAe,CAAC,iBAAiB,KAAK,aAAa,CAAC;QACtE,QAAQ,EAAE,OAAO;QACjB,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC;QAC/B,SAAS,EAAE,eAAe;KAC3B,CAAC,EAAE,EACJ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAAwB,EACxB,aAAqB,EACrB,eAAsD;IAEtD,OAAO,MAAM,CAAC,IAAI,CAChB,GAAG,sBAAsB,KAAK,eAAe,CAAC,iBAAiB,KAAK,aAAa,CAAC;QAChF,cAAc,EAAE,aAAa;QAC7B,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC;QACjC,SAAS,EAAE,eAAe;KAC3B,CAAC,EAAE,EACJ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,IAA4B,EAC5B,iBAAyB,EACzB,eAAsD;IAEtD,OAAO,MAAM,CAAC,IAAI,CAChB,GAAG,cAAc,KAAK,eAAe,CAAC,iBAAiB,KAAK,aAAa,CAAC;QACxE,kBAAkB,EAAE,iBAAiB;QACrC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,eAAe;KAC3B,CAAC,EAAE,EACJ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAyC,EACzC,YAAoB,EACpB,eAAsD;IAEtD,OAAO,MAAM,CAAC,IAAI,CAChB,GAAG,kBAAkB,KAAK,eAAe,CAAC,iBAAiB,KAAK,aAAa,CAAC;QAC5E,aAAa,EAAE,YAAY;QAC3B,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC;QAChC,SAAS,EAAE,eAAe;KAC3B,CAAC,EAAE,EACJ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+CAA+C,CAC7D,IAAwC,EACxC,aAAqB,EACrB,eAAsD;IAEtD,OAAO,MAAM,CAAC,IAAI,CAChB,GAAG,gCAAgC,KAAK,eAAe,CAAC,iBAAiB,KAAK,aAAa,CAAC;QAC1F,cAAc,EAAE,aAAa;QAC7B,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC;QACjC,SAAS,EAAE,eAAe;KAC3B,CAAC,EAAE,EACJ,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAAc,EACd,QAAwB,EACxB,UAAkB;IAElB,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC;IAC/F,MAAM,IAAI,GAAG,wCAAwC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IACE,kBAAkB,CAAC,iBAAiB,KAAK,kBAAkB;QAC3D,kBAAkB,CAAC,sBAAsB,KAAK,QAAQ,CAAC,eAAe,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CACvE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IACE,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU;QAClC,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW,CAAC;QACzD,CAAC,GAAG,CAAC,0BAA0B,KAAK,SAAS;YAC3C,OAAO,CAAC,4BAA4B,IAAI,GAAG,CAAC,0BAA0B,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACrC,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACnD,mBAAmB,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC;IAC7D,IACE,CAAC,MAAM,CACL,IAAI,EACJ,+CAA+C,CAC7C,IAAI,EACJ,aAAuB,EACvB,eAAe,CAChB,EACD,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,QAAwB,EACxB,OAA8C;IAE9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,CAAC;IAC5F,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrF,IACE,kBAAkB,CAAC,iBAAiB,KAAK,cAAc;QACvD,kBAAkB,CAAC,sBAAsB,KAAK,QAAQ,CAAC,eAAe,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CACvE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IACE,GAAG,CAAC,0BAA0B,KAAK,SAAS;QAC5C,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,0BAA0B,CAAC,EACpF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC;IAC7D,IACE,CAAC,MAAM,CACL,IAAI,EACJ,6BAA6B,CAAC,IAAI,EAAE,YAAsB,EAAE,eAAe,CAAC,EAC5E,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB,EAAE,KAAc;IACrE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC;IAChG,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,cAAc,KAAK,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,6CAA6C,cAAc,cAAc,cAAc,GAAG,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAC9C,IACE,MAAM,CACJ,IAAI,EACJ,QAAQ,EACR,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,EACpC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,CAC3C,EACD,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,CAAC,IAAI,2BAA2B,OAAO,CAAC,SAAS,YAAY,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAwB,EACxB,KAIC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,CAAC,IAAI;SACR,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO;QACrC,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxE,CAAC,GAAG,CAAC,0BAA0B,KAAK,SAAS;YAC3C,KAAK,CAAC,eAAe,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAC5D;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CACrE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,EAAE,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,QAAwB,EACxB,eAAuB;IAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC;IACjF,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,eAAe,cAAc,OAAO,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,kBAAkB,CAAC,sBAAsB,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,mDAAmD,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,eAAe,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,kBAAkB,CAAC,iBAAiB,KAAK,eAAe,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,SAAS,kBAAkB,CAAC,iBAAiB,KAAK,eAAe,YAAY,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,6CAA6C,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,iCAAiC,eAAe,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,IACE,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU;QAClC,CAAC,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,gDAAgD,CAAC,CAAC;IACpF,CAAC;IACD,IACE,GAAG,CAAC,0BAA0B,KAAK,SAAS;QAC5C,eAAe,IAAI,GAAG,CAAC,0BAA0B,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,gDAAgD,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC;IAC7D,IACE,CAAC,MAAM,CACL,IAAI,EACJ,sBAAsB,CAAC,IAAI,EAAE,OAAiB,EAAE,eAAe,CAAC,EAChE,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAc,EACd,QAAwB,EACxB,eAAuB;IAEvB,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC;IAC/F,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,6CAA6C,cAAc,cAAc,aAAa,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IACrF,IACE,MAAM,CAAC,gCAAgC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,cAAc;QAC/E,OAAO,CAAC,eAAe,CAAC,QAAQ,KAAK,UAAU,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,4CAA4C,CAAC,CAAC;IAChG,CAAC;IACD,IACE,kBAAkB,CAAC,iBAAiB,KAAK,iBAAiB;QAC1D,kBAAkB,CAAC,sBAAsB,KAAK,QAAQ,CAAC,eAAe,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,oCAAoC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,0CAA0C,CAAC,CAAC;IAC9F,CAAC;IACD,IACE,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,UAAU;QAClC,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,iCAAiC,CAAC,CAAC;IACrF,CAAC;IACD,IACE,GAAG,CAAC,0BAA0B,KAAK,SAAS;QAC5C,eAAe,IAAI,GAAG,CAAC,0BAA0B,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,uBAAuB,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC;IAC7D,IACE,CAAC,MAAM,CACL,IAAI,EACJ,+BAA+B,CAAC,IAAI,EAAE,aAAuB,EAAE,eAAe,CAAC,EAC/E,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,sCAAsC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAc,EACd,QAAwB;IAExB,MAAM,WAAW,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,EACJ,kBAAkB,EAAE,iBAAiB,EACrC,SAAS,EAAE,kBAAkB,EAC7B,GAAG,SAAS,EACb,GAAG,WAAW,CAAC;IAChB,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,iBAAiB,KAAK,cAAc,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,yCAAyC,cAAc,cAAc,iBAAiB,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,kBAAkB,CAAC,sBAAsB,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CACvE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IACE,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,UAAU;QACzC,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,YAAY,IAAI,GAAG,CAAC,WAAW,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IACE,GAAG,CAAC,0BAA0B,KAAK,SAAS;QAC5C,WAAW,CAAC,gBAAgB,IAAI,GAAG,CAAC,0BAA0B,EAC9D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC;IAC7D,IACE,CAAC,MAAM,CACL,IAAI,EACJ,mCAAmC,CAAC,IAAI,EAAE,iBAA2B,EAAE,eAAe,CAAC,EACvF,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,QAAwB,EACxB,OAA8C;IAE9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,CAAC;IAC5F,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrF,IACE,kBAAkB,CAAC,iBAAiB,KAAK,cAAc;QACvD,kBAAkB,CAAC,sBAAsB,KAAK,QAAQ,CAAC,eAAe,EACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CACvE,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IACE,GAAG,CAAC,0BAA0B,KAAK,SAAS;QAC5C,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,0BAA0B,CAAC,EACpF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,GAAG,kBAAkB,CAAC;IAC7D,IACE,CAAC,MAAM,CACL,IAAI,EACJ,6BAA6B,CAAC,IAAI,EAAE,YAAsB,EAAE,eAAe,CAAC,EAC5E,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/authority-state/src/index.d.ts

@@ -0,0 +1,43 @@
+import type { CatalogEvent } from "../../../contracts/events/src/index.js";
+import type { EntityRevision } from "../../../contracts/revisions/src/index.js";
+import { type Digest } from "../../primitives/src/index.js";
+export interface ActiveAuthorityClaim {
+    readonly authorityClaimId: string;
+    readonly entityId: string;
+    readonly authorizedIssuerId: string;
+    readonly controlledDomain: string;
+    readonly validUntil: string;
+    readonly eventIds: readonly Digest[];
+}
+export interface AuthorityState {
+    readonly activeClaims: ReadonlyMap<string, ActiveAuthorityClaim>;
+    readonly activeAttestations: readonly CatalogEvent[];
+}
+export interface EntityIdentityAuthorityClosure {
+    readonly canonical_entity_resolutions: Readonly<Record<string, string>>;
+    readonly split_relationships: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * The canonical domain used when opening a new authority claim. A claim is
+ * bound to the Entity revision, so this comes from its domain contract rather
+ * than from a presentation URL that may use `www` or another site hostname.
+ */
+export declare function currentEntityPrimaryDomain(revision: EntityRevision): string;
+/**
+ * Exact current hostnames that can support authority for an Entity revision.
+ * The primary domain is canonical. The recorded site hostname is retained as
+ * an authority domain only when it is the primary domain or one of its
+ * subdomains; this admits an exact official `www` proof without treating an
+ * arbitrary or cross-domain link as vendor authority.
+ */
+export declare function entityClaimAuthorityDomains(revision: EntityRevision): readonly string[];
+export declare function entityAcceptsClaimAuthorityDomain(revision: EntityRevision, domain: string): boolean;
+export declare function deriveAuthorityState(events: readonly CatalogEvent[]): AuthorityState;
+/** A connected Entity identity lineage may carry only one live claim authority. */
+export declare function assertEntityIdentityAuthorityClosure(input: {
+    readonly activeClaims: ReadonlyMap<string, {
+        readonly entityId: string;
+    }>;
+    readonly identities: EntityIdentityAuthorityClosure;
+}): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/authority-state/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../modules/authority-state/src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,EAA2B,KAAK,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAErF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACjE,QAAQ,CAAC,kBAAkB,EAAE,SAAS,YAAY,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxE,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAC3E;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAY3E;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,MAAM,EAAE,CAMvF;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAET;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,cAAc,CA0HpF;AAED,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,QAAQ,CAAC,UAAU,EAAE,8BAA8B,CAAC;CACrD,GAAG,IAAI,CA4CP"}

package/dist/modules/authority-state/src/index.js

@@ -0,0 +1,194 @@
+import { compareCanonicalStrings } from "../../primitives/src/index.js";
+/**
+ * The canonical domain used when opening a new authority claim. A claim is
+ * bound to the Entity revision, so this comes from its domain contract rather
+ * than from a presentation URL that may use `www` or another site hostname.
+ */
+export function currentEntityPrimaryDomain(revision) {
+    const domains = revision.content.domains.filter((domain) => domain.role === "primary" && domain.valid_until === undefined);
+    if (domains.length !== 1) {
+        throw new Error(`Entity revision ${revision.revision_digest} must have exactly one current primary domain.`);
+    }
+    const primary = domains[0];
+    if (!primary)
+        throw new Error("Entity primary domain selection failed.");
+    return primary.value.toLowerCase();
+}
+/**
+ * Exact current hostnames that can support authority for an Entity revision.
+ * The primary domain is canonical. The recorded site hostname is retained as
+ * an authority domain only when it is the primary domain or one of its
+ * subdomains; this admits an exact official `www` proof without treating an
+ * arbitrary or cross-domain link as vendor authority.
+ */
+export function entityClaimAuthorityDomains(revision) {
+    const primary = currentEntityPrimaryDomain(revision);
+    const site = new URL(revision.content.links.site).hostname.toLowerCase();
+    return [
+        ...new Set([primary, ...(site === primary || site.endsWith(`.${primary}`) ? [site] : [])]),
+    ].sort();
+}
+export function entityAcceptsClaimAuthorityDomain(revision, domain) {
+    return entityClaimAuthorityDomains(revision).includes(domain.toLowerCase());
+}
+export function deriveAuthorityState(events) {
+    const claims = events.filter((event) => event.kind === "authority.claimed");
+    const rechecks = indexByClaimId(events.filter((event) => event.kind === "authority.rechecked"), "authority_claim_id");
+    const revocations = indexByClaimId(events.filter((event) => event.kind === "authority.revoked"), "authority_claim_id");
+    const supersessions = indexByClaimId(events.filter((event) => event.kind === "authority.superseded"), "old_authority_claim_id");
+    const claimsById = new Map();
+    const activeClaims = new Map();
+    const revokedAttestationIds = new Set(events
+        .filter((event) => event.kind === "attestation.revoked")
+        .map((event) => payloadString(event, "target_event_id")));
+    const activeAttestations = events.filter((event) => event.kind === "subject.attested" && !revokedAttestationIds.has(event.event_id));
+    for (const claim of claims) {
+        const claimId = payloadString(claim, "authority_claim_id");
+        if (claimsById.has(claimId))
+            throw new Error(`Duplicate authority claim ID ${claimId}.`);
+        claimsById.set(claimId, claim);
+        const claimRevocations = revocations.get(claimId) ?? [];
+        const claimSupersessions = supersessions.get(claimId) ?? [];
+        for (const transition of [...claimRevocations, ...claimSupersessions]) {
+            if (transition.subject.entity_id !== claim.subject.entity_id) {
+                throw new Error(`Authority transition for ${claimId} targets another entity.`);
+            }
+        }
+        if (claimRevocations.length > 1 || claimSupersessions.length > 1) {
+            throw new Error(`Authority claim ${claimId} has conflicting terminal transitions.`);
+        }
+        if (claimRevocations.length > 0 || claimSupersessions.length > 0)
+            continue;
+        const claimRechecks = [...(rechecks.get(claimId) ?? [])].sort((left, right) => compareCanonicalStrings(payloadString(left, "checked_at"), payloadString(right, "checked_at")));
+        for (const recheck of claimRechecks) {
+            if (recheck.subject.entity_id !== claim.subject.entity_id) {
+                throw new Error(`Authority recheck for ${claimId} targets another entity.`);
+            }
+        }
+        for (const [index, recheck] of claimRechecks.entries()) {
+            const previousBoundary = index === 0
+                ? payloadString(claim, "recheck_due_at")
+                : payloadString(claimRechecks[index - 1], "next_recheck_due_at");
+            const checkedAt = payloadString(recheck, "checked_at");
+            const nextBoundary = payloadString(recheck, "next_recheck_due_at");
+            if (checkedAt > previousBoundary || nextBoundary <= checkedAt) {
+                throw new Error(`Authority claim ${claimId} has a non-contiguous recheck chain.`);
+            }
+            const peer = claimRechecks[index + 1];
+            if (peer && payloadString(peer, "checked_at") === checkedAt) {
+                throw new Error(`Authority claim ${claimId} has conflicting rechecks at ${checkedAt}.`);
+            }
+        }
+        activeClaims.set(claimId, {
+            authorityClaimId: claimId,
+            entityId: claim.subject.entity_id,
+            authorizedIssuerId: payloadString(claim, "authorized_issuer_id"),
+            controlledDomain: payloadString(claim, "controlled_domain"),
+            validUntil: claimRechecks.length > 0
+                ? payloadString(claimRechecks.at(-1), "next_recheck_due_at")
+                : payloadString(claim, "recheck_due_at"),
+            eventIds: [
+                claim.event_id,
+                ...claimRechecks.map((event) => event.event_id),
+            ].sort(),
+        });
+    }
+    for (const transition of [
+        ...events.filter((event) => event.kind === "authority.rechecked"),
+        ...events.filter((event) => event.kind === "authority.revoked"),
+    ]) {
+        const claimId = payloadString(transition, "authority_claim_id");
+        if (!claimsById.has(claimId)) {
+            throw new Error(`${transition.kind} targets missing authority claim ${claimId}.`);
+        }
+    }
+    for (const transition of events.filter((event) => event.kind === "authority.superseded")) {
+        const oldClaimId = payloadString(transition, "old_authority_claim_id");
+        const newClaimId = payloadString(transition, "new_authority_claim_id");
+        const oldClaim = claimsById.get(oldClaimId);
+        const newClaim = claimsById.get(newClaimId);
+        if (!oldClaim || !newClaim) {
+            throw new Error(`Authority supersession targets missing replacement claim ${newClaimId}.`);
+        }
+        if (oldClaim.subject.entity_id !== transition.subject.entity_id ||
+            newClaim.subject.entity_id !== transition.subject.entity_id) {
+            throw new Error("Authority supersession claims must belong to its exact entity.");
+        }
+    }
+    const activeByEntity = new Map();
+    for (const claim of activeClaims.values()) {
+        const prior = activeByEntity.get(claim.entityId);
+        if (prior) {
+            throw new Error(`Entity ${claim.entityId} has conflicting active authority claims ${prior} and ${claim.authorityClaimId}.`);
+        }
+        activeByEntity.set(claim.entityId, claim.authorityClaimId);
+    }
+    return { activeClaims, activeAttestations };
+}
+/** A connected Entity identity lineage may carry only one live claim authority. */
+export function assertEntityIdentityAuthorityClosure(input) {
+    const adjacency = new Map();
+    const connect = (left, right) => {
+        const leftEdges = adjacency.get(left) ?? new Set();
+        const rightEdges = adjacency.get(right) ?? new Set();
+        leftEdges.add(right);
+        rightEdges.add(left);
+        adjacency.set(left, leftEdges);
+        adjacency.set(right, rightEdges);
+    };
+    for (const [source, target] of Object.entries(input.identities.canonical_entity_resolutions)) {
+        connect(source, target);
+    }
+    for (const [source, targets] of Object.entries(input.identities.split_relationships)) {
+        for (const target of targets)
+            connect(source, target);
+    }
+    const claimsByEntity = new Map();
+    for (const [claimId, claim] of input.activeClaims) {
+        claimsByEntity.set(claim.entityId, { claimId, entityId: claim.entityId });
+    }
+    const visited = new Set();
+    for (const entityId of claimsByEntity.keys()) {
+        if (visited.has(entityId))
+            continue;
+        const queue = [entityId];
+        const claims = [];
+        while (queue.length > 0) {
+            const current = queue.pop();
+            if (!current || visited.has(current))
+                continue;
+            visited.add(current);
+            const claim = claimsByEntity.get(current);
+            if (claim)
+                claims.push(claim);
+            for (const connected of adjacency.get(current) ?? []) {
+                if (!visited.has(connected))
+                    queue.push(connected);
+            }
+        }
+        if (claims.length > 1) {
+            throw new Error(`Connected Entity identities have conflicting active authority claims: ${claims
+                .map((claim) => `${claim.entityId}:${claim.claimId}`)
+                .sort(compareCanonicalStrings)
+                .join(", ")}.`);
+        }
+    }
+}
+function indexByClaimId(events, field) {
+    const index = new Map();
+    for (const event of events) {
+        const key = payloadString(event, field);
+        const entries = index.get(key) ?? [];
+        entries.push(event);
+        index.set(key, entries);
+    }
+    return index;
+}
+function payloadString(event, field) {
+    const value = event.payload[field];
+    if (typeof value !== "string") {
+        throw new Error(`Event ${event.event_id} lacks string payload ${field}.`);
+    }
+    return value;
+}
+//# sourceMappingURL=index.js.map