@sudp-protocol/authorizer 0.1.0 → 0.2.0

package/README.md

@@ -16,10 +16,12 @@ shapes, and the wrap-key derivation.
 
 ```
 @sudp-protocol/authorizer            ← carrier-agnostic protocol primitives
-  canonicalize, sha256, computeBinding,
+  canonicalize, sha256,
+  computeBinding, computeBatchBinding,
   deriveWrappingKey, wrapBindingAd, sealAd,
-  aeadSeal, aeadOpen, base64url helpers,
-  DS_BIND / DS_WRAP / DS_SEAL constants
+  aeadSeal, aeadOpen, aeadEncrypt, base64url helpers,
+  sealRecord, unsealRecord, recordAad, deriveItemKey,   ← per-record (per-item) seal
+  DS_BIND / DS_WRAP / DS_SEAL / DS_ITEM constants
 
 @sudp-protocol/authorizer/webauthn   ← WebAuthn-specific adapter
   prfToUserKey(prfOutput) → 32-byte y_c
@@ -69,6 +71,16 @@ const wrapped = aeadSeal(Wc, plaintext, wrapBindingAd(credentialId));
 //    part of the grant.
 ```
 
+For batch grants, swap `computeBinding` for `computeBatchBinding(DS_BIND, r, ops)` — same math, one signature covers `ops = (o_1, …, o_n)`.
+
+For **per-item vaults** (a vault stored as many independently-encrypted records
+instead of one blob), seal/open a single record with `sealRecord(k, ctx, pt)` /
+`unsealRecord(k, ctx, sealed)`, where `ctx: SealCtx` is `{ domain, vault, id,
+version }`. sudp binds `ctx` into the AEAD AAD (anti cross-vault / cross-id /
+version-mismatch); the record body, id derivation, and conflict resolution are
+the caller's. Byte-identical to the Rust crate's `seal_record` — see the
+[conformance map](../../README.md#cross-language-alignment).
+
 ## End-to-end protocol walkthrough
 
 For how this package fits with the Rust Custodian and the Requester

package/dist/aad.d.ts

@@ -11,7 +11,7 @@ export declare const WRAP_VERSION = 1;
  *     DS_WRAP ‖ credentialId ‖ ver_be(u16, big-endian)
  *
  * Bound as associated data when sealing/opening `K̂_c` under `W_c`, so a
- * peer-wrapped record cannot be substituted across credentials or versions.
+ * per-credential-wrapped record cannot be substituted across credentials or versions.
  */
 export declare function wrapBindingAd(credentialId: Uint8Array, wrapVersion?: number): Uint8Array;
 /**

package/dist/aad.js

@@ -12,7 +12,7 @@ export const WRAP_VERSION = 0x0001;
  *     DS_WRAP ‖ credentialId ‖ ver_be(u16, big-endian)
  *
  * Bound as associated data when sealing/opening `K̂_c` under `W_c`, so a
- * peer-wrapped record cannot be substituted across credentials or versions.
+ * per-credential-wrapped record cannot be substituted across credentials or versions.
  */
 export function wrapBindingAd(credentialId, wrapVersion = WRAP_VERSION) {
     return concatBytes(DS_WRAP, credentialId, u16beBytes(wrapVersion));

package/dist/binding.d.ts

@@ -19,4 +19,18 @@ export declare const DS_BIND: Uint8Array<ArrayBufferLike>;
  * deployment.
  */
 export declare function computeBinding(domain: Uint8Array, r: Uint8Array, op: unknown): Promise<Uint8Array>;
+/**
+ * Batch counterpart of {@link computeBinding}:
+ *
+ *     β = SHA-256(domain ‖ r ‖ SHA-256(canonical(ops)))
+ *
+ * where `ops` is a JSON array of operations. Byte-aligned with the Rust
+ * crate's `compute_beta_from_canonical(domain, r, &BatchOperations(ops).canonical_bytes())`.
+ *
+ * Semantically identical to `computeBinding(domain, r, ops)` because the
+ * canonical encoder treats arrays uniformly, but named separately so the
+ * "batch" intent is explicit at the call site (and so a single conformance
+ * vector pins the batch shape independently).
+ */
+export declare function computeBatchBinding(domain: Uint8Array, r: Uint8Array, ops: readonly unknown[]): Promise<Uint8Array>;
 //# sourceMappingURL=binding.d.ts.map

package/dist/binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,OAAO,6BAAuB,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,CAAC,EAAE,UAAU,EACb,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,UAAU,CAAC,CAGrB"}
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,OAAO,6BAAuB,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,CAAC,EAAE,UAAU,EACb,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,UAAU,EAClB,CAAC,EAAE,UAAU,EACb,GAAG,EAAE,SAAS,OAAO,EAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAErB"}

package/dist/binding.js

@@ -25,4 +25,20 @@ export async function computeBinding(domain, r, op) {
     const opHash = await sha256(canonicalize(op));
     return sha256(concatBytes(domain, r, opHash));
 }
+/**
+ * Batch counterpart of {@link computeBinding}:
+ *
+ *     β = SHA-256(domain ‖ r ‖ SHA-256(canonical(ops)))
+ *
+ * where `ops` is a JSON array of operations. Byte-aligned with the Rust
+ * crate's `compute_beta_from_canonical(domain, r, &BatchOperations(ops).canonical_bytes())`.
+ *
+ * Semantically identical to `computeBinding(domain, r, ops)` because the
+ * canonical encoder treats arrays uniformly, but named separately so the
+ * "batch" intent is explicit at the call site (and so a single conformance
+ * vector pins the batch shape independently).
+ */
+export async function computeBatchBinding(domain, r, ops) {
+    return computeBinding(domain, r, ops);
+}
 //# sourceMappingURL=binding.js.map

package/dist/binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAkB,EAClB,CAAa,EACb,EAAW;IAEX,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAkB,EAClB,CAAa,EACb,EAAW;IAEX,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkB,EAClB,CAAa,EACb,GAAuB;IAEvB,OAAO,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC"}

package/dist/bytes.d.ts

@@ -1,6 +1,13 @@
 export declare function utf8(s: string): Uint8Array;
 export declare function concatBytes(...parts: readonly Uint8Array[]): Uint8Array;
 export declare function u16beBytes(n: number): Uint8Array;
+export declare function u32beBytes(n: number): Uint8Array;
+/**
+ * 8-byte big-endian encoding of a `u64`. Takes a `bigint` so the full unsigned
+ * 64-bit range is exact (a `number` is only safe to 2^53). MUST match the Rust
+ * crate's `u64::to_be_bytes`.
+ */
+export declare function u64beBytes(n: bigint): Uint8Array;
 export declare function bytesToB64Url(b: Uint8Array): string;
 export declare function b64UrlToBytes(s: string): Uint8Array;
 //# sourceMappingURL=bytes.d.ts.map

package/dist/bytes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAEA,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAED,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAUvE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAKhD;AAcD,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAgBnD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAiCnD"}
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAEA,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAED,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAUvE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAKhD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAKhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAWhD;AAcD,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAgBnD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAiCnD"}

package/dist/bytes.js

@@ -20,6 +20,29 @@ export function u16beBytes(n) {
     }
     return new Uint8Array([(n >> 8) & 0xff, n & 0xff]);
 }
+export function u32beBytes(n) {
+    if (!Number.isInteger(n) || n < 0 || n > 0xffffffff) {
+        throw new Error(`u32beBytes: out of range: ${n}`);
+    }
+    return new Uint8Array([(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff]);
+}
+/**
+ * 8-byte big-endian encoding of a `u64`. Takes a `bigint` so the full unsigned
+ * 64-bit range is exact (a `number` is only safe to 2^53). MUST match the Rust
+ * crate's `u64::to_be_bytes`.
+ */
+export function u64beBytes(n) {
+    if (n < 0n || n > 0xffffffffffffffffn) {
+        throw new Error(`u64beBytes: out of range: ${n}`);
+    }
+    const out = new Uint8Array(8);
+    let v = n;
+    for (let i = 7; i >= 0; i--) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
 const B64URL_ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 const B64URL_LOOKUP = (() => {
     const t = new Int8Array(256).fill(-1);

package/dist/bytes.js.map

@@ -1 +1 @@
-{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,IAAI,CAAC,CAAS;IAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAG,KAA4B;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,YAAY,GAAG,kEAAkE,CAAC;AACxF,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,KAAK,CAAC,CAAS;IACtB,kEAAkE;IAClE,OAAO,YAAY,CAAC,CAAC,CAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAa;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QACvD,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACtB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC7E,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../src/bytes.ts"],"names":[],"mappings":"AAAA,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,IAAI,CAAC,CAAS;IAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAG,KAA4B;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,YAAY,GAAG,kEAAkE,CAAC;AACxF,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,KAAK,CAAC,CAAS;IACtB,kEAAkE;IAClE,OAAO,YAAY,CAAC,CAAC,CAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAa;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QACvD,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC;QACtB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC7E,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -10,11 +10,12 @@
  * For the WebAuthn PRF → y_c adapter and assertion helpers, import from
  * `@sudp-protocol/authorizer/webauthn`.
  */
-export { utf8, concatBytes, u16beBytes, bytesToB64Url, b64UrlToBytes, } from "./bytes.js";
+export { utf8, concatBytes, u16beBytes, u32beBytes, u64beBytes, bytesToB64Url, b64UrlToBytes, } from "./bytes.js";
 export { canonicalize } from "./canonical.js";
 export { sha256 } from "./hash.js";
-export { computeBinding, DS_BIND } from "./binding.js";
+export { computeBatchBinding, computeBinding, DS_BIND } from "./binding.js";
 export { deriveWrappingKey } from "./kdf.js";
 export { wrapBindingAd, sealAd, DS_WRAP, DS_SEAL, WRAP_VERSION } from "./aad.js";
 export { aeadEncrypt, aeadSeal, aeadOpen } from "./aead.js";
+export { recordAad, deriveItemKey, sealRecord, unsealRecord, DS_ITEM, RECORD_SUITE_XCHACHA20POLY1305, type SealCtx, } from "./record.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,YAAY,EACZ,OAAO,EACP,8BAA8B,EAC9B,KAAK,OAAO,GACb,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -10,11 +10,12 @@
  * For the WebAuthn PRF → y_c adapter and assertion helpers, import from
  * `@sudp-protocol/authorizer/webauthn`.
  */
-export { utf8, concatBytes, u16beBytes, bytesToB64Url, b64UrlToBytes, } from "./bytes.js";
+export { utf8, concatBytes, u16beBytes, u32beBytes, u64beBytes, bytesToB64Url, b64UrlToBytes, } from "./bytes.js";
 export { canonicalize } from "./canonical.js";
 export { sha256 } from "./hash.js";
-export { computeBinding, DS_BIND } from "./binding.js";
+export { computeBatchBinding, computeBinding, DS_BIND } from "./binding.js";
 export { deriveWrappingKey } from "./kdf.js";
 export { wrapBindingAd, sealAd, DS_WRAP, DS_SEAL, WRAP_VERSION } from "./aad.js";
 export { aeadEncrypt, aeadSeal, aeadOpen } from "./aead.js";
+export { recordAad, deriveItemKey, sealRecord, unsealRecord, DS_ITEM, RECORD_SUITE_XCHACHA20POLY1305, } from "./record.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,YAAY,EACZ,OAAO,EACP,8BAA8B,GAE/B,MAAM,aAAa,CAAC"}

package/dist/record.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Per-record seal/unseal — the per-item vault primitive, authorizer-side mirror
+ * of the Rust crate's `sudp::state::{seal_record, unseal_record}`.
+ *
+ * Eats bytes, spits bytes: the record's business structure, serialization,
+ * id derivation, version comparison, merge, tombstones, and GC are ALL the
+ * caller's concern. This module only seals one record under the vault key `K`
+ * bound — via AEAD associated data — to a structured {@link SealCtx}, so a
+ * record can never be opened under a different vault / id / version / domain.
+ *
+ * The AAD binding detects cross-vault splicing, cross-id substitution,
+ * version/ciphertext mismatch, and cross-domain confusion. It does NOT by
+ * itself prevent rollback (an attacker substituting a strictly older but
+ * validly-sealed record with its matching older `version`) — keep a monotonic
+ * per-id version store on the caller side, and put richer causal/merge metadata
+ * (HLC, device id, …) INSIDE the plaintext so the AEAD authenticates it too.
+ *
+ * Every byte layout here (canonical AAD, HKDF info, sealed framing) MUST stay
+ * byte-for-byte aligned with `custodian/rust/src/state/record.rs`; the
+ * conformance vectors in `test/conformance.test.ts` are pinned against the Rust
+ * `assert_eq!` anchors.
+ */
+/** Per-record (per-item) domain-separation label. */
+export declare const DS_ITEM: Uint8Array<ArrayBufferLike>;
+/** Suite/format tag: `0x01` = XChaCha20-Poly1305 + canonical AAD v1. */
+export declare const RECORD_SUITE_XCHACHA20POLY1305 = 1;
+/**
+ * Structured sealing context for one record. sudp builds the AEAD associated
+ * data from these fields; callers MUST NOT hand-assemble opaque AAD.
+ */
+export interface SealCtx {
+    /** Purpose separation within the per-record domain, e.g. `"item"` / `"keyset"`. */
+    domain: string;
+    /** Vault identifier (anti cross-vault splice). */
+    vault: Uint8Array;
+    /** Opaque record id — typically `HMAC_K(name)`; never interpreted (anti X-as-Y). */
+    id: Uint8Array;
+    /**
+     * Opaque, monotonic-per-id ordering value. sudp binds it into the AAD but
+     * never interprets it — meaning (server sequence number, Lamport/HLC stamp,
+     * version-vector, …) and the whole conflict-resolution strategy are the
+     * caller's. Recommended scalar encoding for the common case: `u64`
+     * big-endian (`u64beBytes(n)`). Binds the ciphertext to a version (detects
+     * mismatch, not rollback).
+     */
+    version: Uint8Array;
+}
+/**
+ * Canonical, length-prefixed associated data for a per-record seal:
+ *
+ *     AAD = suite(1) ‖ lp(DS_ITEM) ‖ lp(domain_utf8) ‖ lp(vault) ‖ lp(id) ‖ lp(version)
+ *     where lp(x) = len_be(x.length as u32, 4 bytes) ‖ x
+ *
+ * MUST be byte-identical to the Rust crate's `record_aad`.
+ */
+export declare function recordAad(suite: number, ctx: SealCtx): Uint8Array;
+/**
+ * Derive the per-record AEAD key `K_aead` from the vault key `k`:
+ *
+ *     K_aead = HKDF-SHA-256(ikm = k, salt = "", info = DS_ITEM)
+ *
+ * Domain-separated so `K_aead` never shares raw bytes with the caller's
+ * `HMAC_K(name)` record-id derivation. MUST match the Rust crate's
+ * `derive_item_key`.
+ */
+export declare function deriveItemKey(k: Uint8Array): Promise<Uint8Array>;
+/**
+ * Seal one record. Output layout: `suite(1) ‖ nonce(24) ‖ ciphertext ‖ tag(16)`.
+ * A fresh random 24-byte nonce is generated per call (Web Crypto).
+ */
+export declare function sealRecord(k: Uint8Array, ctx: SealCtx, plaintext: Uint8Array): Promise<Uint8Array>;
+/**
+ * Unseal one record. Throws on any authentication failure (AAD mismatch and
+ * tag mismatch are indistinguishable — the same Poly1305 check) or on a
+ * structurally malformed blob (empty / unknown suite tag).
+ */
+export declare function unsealRecord(k: Uint8Array, ctx: SealCtx, sealed: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=record.d.ts.map

package/dist/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,qDAAqD;AACrD,eAAO,MAAM,OAAO,6BAAuB,CAAC;AAE5C,wEAAwE;AACxE,eAAO,MAAM,8BAA8B,IAAO,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,KAAK,EAAE,UAAU,CAAC;IAClB,oFAAoF;IACpF,EAAE,EAAE,UAAU,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,UAAU,CAAC;CACrB;AAOD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,UAAU,CASjE;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBtE;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,CAAC,EAAE,UAAU,EACb,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,CAAC,EAAE,UAAU,EACb,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAWrB"}

package/dist/record.js

@@ -0,0 +1,93 @@
+import { aeadOpen, aeadSeal } from "./aead.js";
+import { concatBytes, u32beBytes, utf8 } from "./bytes.js";
+/**
+ * Per-record seal/unseal — the per-item vault primitive, authorizer-side mirror
+ * of the Rust crate's `sudp::state::{seal_record, unseal_record}`.
+ *
+ * Eats bytes, spits bytes: the record's business structure, serialization,
+ * id derivation, version comparison, merge, tombstones, and GC are ALL the
+ * caller's concern. This module only seals one record under the vault key `K`
+ * bound — via AEAD associated data — to a structured {@link SealCtx}, so a
+ * record can never be opened under a different vault / id / version / domain.
+ *
+ * The AAD binding detects cross-vault splicing, cross-id substitution,
+ * version/ciphertext mismatch, and cross-domain confusion. It does NOT by
+ * itself prevent rollback (an attacker substituting a strictly older but
+ * validly-sealed record with its matching older `version`) — keep a monotonic
+ * per-id version store on the caller side, and put richer causal/merge metadata
+ * (HLC, device id, …) INSIDE the plaintext so the AEAD authenticates it too.
+ *
+ * Every byte layout here (canonical AAD, HKDF info, sealed framing) MUST stay
+ * byte-for-byte aligned with `custodian/rust/src/state/record.rs`; the
+ * conformance vectors in `test/conformance.test.ts` are pinned against the Rust
+ * `assert_eq!` anchors.
+ */
+/** Per-record (per-item) domain-separation label. */
+export const DS_ITEM = utf8("sudp/v1/item");
+/** Suite/format tag: `0x01` = XChaCha20-Poly1305 + canonical AAD v1. */
+export const RECORD_SUITE_XCHACHA20POLY1305 = 0x01;
+/** Length-prefixed field: `len_be(u32) ‖ bytes`. */
+function lp(field) {
+    return concatBytes(u32beBytes(field.byteLength), field);
+}
+/**
+ * Canonical, length-prefixed associated data for a per-record seal:
+ *
+ *     AAD = suite(1) ‖ lp(DS_ITEM) ‖ lp(domain_utf8) ‖ lp(vault) ‖ lp(id) ‖ lp(version)
+ *     where lp(x) = len_be(x.length as u32, 4 bytes) ‖ x
+ *
+ * MUST be byte-identical to the Rust crate's `record_aad`.
+ */
+export function recordAad(suite, ctx) {
+    return concatBytes(new Uint8Array([suite & 0xff]), lp(DS_ITEM), lp(utf8(ctx.domain)), lp(ctx.vault), lp(ctx.id), lp(ctx.version));
+}
+/**
+ * Derive the per-record AEAD key `K_aead` from the vault key `k`:
+ *
+ *     K_aead = HKDF-SHA-256(ikm = k, salt = "", info = DS_ITEM)
+ *
+ * Domain-separated so `K_aead` never shares raw bytes with the caller's
+ * `HMAC_K(name)` record-id derivation. MUST match the Rust crate's
+ * `derive_item_key`.
+ */
+export async function deriveItemKey(k) {
+    const km = await crypto.subtle.importKey("raw", k, "HKDF", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(0),
+        info: DS_ITEM,
+    }, km, 256);
+    return new Uint8Array(bits);
+}
+/**
+ * Seal one record. Output layout: `suite(1) ‖ nonce(24) ‖ ciphertext ‖ tag(16)`.
+ * A fresh random 24-byte nonce is generated per call (Web Crypto).
+ */
+export async function sealRecord(k, ctx, plaintext) {
+    const kAead = await deriveItemKey(k);
+    const aad = recordAad(RECORD_SUITE_XCHACHA20POLY1305, ctx);
+    const sealed = aeadSeal(kAead, plaintext, aad); // nonce ‖ ct ‖ tag
+    const out = new Uint8Array(1 + sealed.byteLength);
+    out[0] = RECORD_SUITE_XCHACHA20POLY1305;
+    out.set(sealed, 1);
+    return out;
+}
+/**
+ * Unseal one record. Throws on any authentication failure (AAD mismatch and
+ * tag mismatch are indistinguishable — the same Poly1305 check) or on a
+ * structurally malformed blob (empty / unknown suite tag).
+ */
+export async function unsealRecord(k, ctx, sealed) {
+    if (sealed.byteLength < 1) {
+        throw new Error("unsealRecord: empty sealed blob");
+    }
+    const suite = sealed[0];
+    if (suite !== RECORD_SUITE_XCHACHA20POLY1305) {
+        throw new Error("unsealRecord: unknown suite tag");
+    }
+    const kAead = await deriveItemKey(k);
+    const aad = recordAad(suite, ctx);
+    return aeadOpen(kAead, sealed.slice(1), aad);
+}
+//# sourceMappingURL=record.js.map

package/dist/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../src/record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;AAE5C,wEAAwE;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAwBnD,oDAAoD;AACpD,SAAS,EAAE,CAAC,KAAiB;IAC3B,OAAO,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAY;IACnD,OAAO,WAAW,CAChB,IAAI,UAAU,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,EAC9B,EAAE,CAAC,OAAO,CAAC,EACX,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EACpB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EACb,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EACV,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,CAAa;IAC/C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,CAA2B,EAC3B,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAA2B;QACjD,IAAI,EAAE,OAAiC;KACxC,EACD,EAAE,EACF,GAAG,CACJ,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAa,EACb,GAAY,EACZ,SAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB;IACnE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,GAAG,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,CAAa,EACb,GAAY,EACZ,MAAkB;IAElB,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IACzB,IAAI,KAAK,KAAK,8BAA8B,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sudp-protocol/authorizer",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Authorizer-side primitives for SUDP (Secret-Use Delegation Protocol): canonical JSON, β computation, wrapping-key derivation, AEAD-as-wrap, plus a WebAuthn adapter under the ./webauthn subpath.",
   "license": "Apache-2.0",
   "author": "Miracle <xhyumiracle@gmail.com>",

package/src/aad.ts

@@ -15,7 +15,7 @@ export const WRAP_VERSION = 0x0001;
  *     DS_WRAP ‖ credentialId ‖ ver_be(u16, big-endian)
  *
  * Bound as associated data when sealing/opening `K̂_c` under `W_c`, so a
- * peer-wrapped record cannot be substituted across credentials or versions.
+ * per-credential-wrapped record cannot be substituted across credentials or versions.
  */
 export function wrapBindingAd(
   credentialId: Uint8Array,

package/src/binding.ts

@@ -31,3 +31,24 @@ export async function computeBinding(
   const opHash = await sha256(canonicalize(op));
   return sha256(concatBytes(domain, r, opHash));
 }
+
+/**
+ * Batch counterpart of {@link computeBinding}:
+ *
+ *     β = SHA-256(domain ‖ r ‖ SHA-256(canonical(ops)))
+ *
+ * where `ops` is a JSON array of operations. Byte-aligned with the Rust
+ * crate's `compute_beta_from_canonical(domain, r, &BatchOperations(ops).canonical_bytes())`.
+ *
+ * Semantically identical to `computeBinding(domain, r, ops)` because the
+ * canonical encoder treats arrays uniformly, but named separately so the
+ * "batch" intent is explicit at the call site (and so a single conformance
+ * vector pins the batch shape independently).
+ */
+export async function computeBatchBinding(
+  domain: Uint8Array,
+  r: Uint8Array,
+  ops: readonly unknown[],
+): Promise<Uint8Array> {
+  return computeBinding(domain, r, ops);
+}

package/src/bytes.ts

@@ -23,6 +23,31 @@ export function u16beBytes(n: number): Uint8Array {
   return new Uint8Array([(n >> 8) & 0xff, n & 0xff]);
 }
 
+export function u32beBytes(n: number): Uint8Array {
+  if (!Number.isInteger(n) || n < 0 || n > 0xffffffff) {
+    throw new Error(`u32beBytes: out of range: ${n}`);
+  }
+  return new Uint8Array([(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff]);
+}
+
+/**
+ * 8-byte big-endian encoding of a `u64`. Takes a `bigint` so the full unsigned
+ * 64-bit range is exact (a `number` is only safe to 2^53). MUST match the Rust
+ * crate's `u64::to_be_bytes`.
+ */
+export function u64beBytes(n: bigint): Uint8Array {
+  if (n < 0n || n > 0xffffffffffffffffn) {
+    throw new Error(`u64beBytes: out of range: ${n}`);
+  }
+  const out = new Uint8Array(8);
+  let v = n;
+  for (let i = 7; i >= 0; i--) {
+    out[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return out;
+}
+
 const B64URL_ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 const B64URL_LOOKUP = (() => {
   const t = new Int8Array(256).fill(-1);

package/src/index.ts

@@ -15,13 +15,24 @@ export {
   utf8,
   concatBytes,
   u16beBytes,
+  u32beBytes,
+  u64beBytes,
   bytesToB64Url,
   b64UrlToBytes,
 } from "./bytes.js";
 
 export { canonicalize } from "./canonical.js";
 export { sha256 } from "./hash.js";
-export { computeBinding, DS_BIND } from "./binding.js";
+export { computeBatchBinding, computeBinding, DS_BIND } from "./binding.js";
 export { deriveWrappingKey } from "./kdf.js";
 export { wrapBindingAd, sealAd, DS_WRAP, DS_SEAL, WRAP_VERSION } from "./aad.js";
 export { aeadEncrypt, aeadSeal, aeadOpen } from "./aead.js";
+export {
+  recordAad,
+  deriveItemKey,
+  sealRecord,
+  unsealRecord,
+  DS_ITEM,
+  RECORD_SUITE_XCHACHA20POLY1305,
+  type SealCtx,
+} from "./record.js";

package/src/record.ts

@@ -0,0 +1,147 @@
+import { aeadOpen, aeadSeal } from "./aead.js";
+import { concatBytes, u32beBytes, utf8 } from "./bytes.js";
+
+/**
+ * Per-record seal/unseal — the per-item vault primitive, authorizer-side mirror
+ * of the Rust crate's `sudp::state::{seal_record, unseal_record}`.
+ *
+ * Eats bytes, spits bytes: the record's business structure, serialization,
+ * id derivation, version comparison, merge, tombstones, and GC are ALL the
+ * caller's concern. This module only seals one record under the vault key `K`
+ * bound — via AEAD associated data — to a structured {@link SealCtx}, so a
+ * record can never be opened under a different vault / id / version / domain.
+ *
+ * The AAD binding detects cross-vault splicing, cross-id substitution,
+ * version/ciphertext mismatch, and cross-domain confusion. It does NOT by
+ * itself prevent rollback (an attacker substituting a strictly older but
+ * validly-sealed record with its matching older `version`) — keep a monotonic
+ * per-id version store on the caller side, and put richer causal/merge metadata
+ * (HLC, device id, …) INSIDE the plaintext so the AEAD authenticates it too.
+ *
+ * Every byte layout here (canonical AAD, HKDF info, sealed framing) MUST stay
+ * byte-for-byte aligned with `custodian/rust/src/state/record.rs`; the
+ * conformance vectors in `test/conformance.test.ts` are pinned against the Rust
+ * `assert_eq!` anchors.
+ */
+
+/** Per-record (per-item) domain-separation label. */
+export const DS_ITEM = utf8("sudp/v1/item");
+
+/** Suite/format tag: `0x01` = XChaCha20-Poly1305 + canonical AAD v1. */
+export const RECORD_SUITE_XCHACHA20POLY1305 = 0x01;
+
+/**
+ * Structured sealing context for one record. sudp builds the AEAD associated
+ * data from these fields; callers MUST NOT hand-assemble opaque AAD.
+ */
+export interface SealCtx {
+  /** Purpose separation within the per-record domain, e.g. `"item"` / `"keyset"`. */
+  domain: string;
+  /** Vault identifier (anti cross-vault splice). */
+  vault: Uint8Array;
+  /** Opaque record id — typically `HMAC_K(name)`; never interpreted (anti X-as-Y). */
+  id: Uint8Array;
+  /**
+   * Opaque, monotonic-per-id ordering value. sudp binds it into the AAD but
+   * never interprets it — meaning (server sequence number, Lamport/HLC stamp,
+   * version-vector, …) and the whole conflict-resolution strategy are the
+   * caller's. Recommended scalar encoding for the common case: `u64`
+   * big-endian (`u64beBytes(n)`). Binds the ciphertext to a version (detects
+   * mismatch, not rollback).
+   */
+  version: Uint8Array;
+}
+
+/** Length-prefixed field: `len_be(u32) ‖ bytes`. */
+function lp(field: Uint8Array): Uint8Array {
+  return concatBytes(u32beBytes(field.byteLength), field);
+}
+
+/**
+ * Canonical, length-prefixed associated data for a per-record seal:
+ *
+ *     AAD = suite(1) ‖ lp(DS_ITEM) ‖ lp(domain_utf8) ‖ lp(vault) ‖ lp(id) ‖ lp(version)
+ *     where lp(x) = len_be(x.length as u32, 4 bytes) ‖ x
+ *
+ * MUST be byte-identical to the Rust crate's `record_aad`.
+ */
+export function recordAad(suite: number, ctx: SealCtx): Uint8Array {
+  return concatBytes(
+    new Uint8Array([suite & 0xff]),
+    lp(DS_ITEM),
+    lp(utf8(ctx.domain)),
+    lp(ctx.vault),
+    lp(ctx.id),
+    lp(ctx.version),
+  );
+}
+
+/**
+ * Derive the per-record AEAD key `K_aead` from the vault key `k`:
+ *
+ *     K_aead = HKDF-SHA-256(ikm = k, salt = "", info = DS_ITEM)
+ *
+ * Domain-separated so `K_aead` never shares raw bytes with the caller's
+ * `HMAC_K(name)` record-id derivation. MUST match the Rust crate's
+ * `derive_item_key`.
+ */
+export async function deriveItemKey(k: Uint8Array): Promise<Uint8Array> {
+  const km = await crypto.subtle.importKey(
+    "raw",
+    k as unknown as ArrayBuffer,
+    "HKDF",
+    false,
+    ["deriveBits"],
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0) as unknown as ArrayBuffer,
+      info: DS_ITEM as unknown as ArrayBuffer,
+    },
+    km,
+    256,
+  );
+  return new Uint8Array(bits);
+}
+
+/**
+ * Seal one record. Output layout: `suite(1) ‖ nonce(24) ‖ ciphertext ‖ tag(16)`.
+ * A fresh random 24-byte nonce is generated per call (Web Crypto).
+ */
+export async function sealRecord(
+  k: Uint8Array,
+  ctx: SealCtx,
+  plaintext: Uint8Array,
+): Promise<Uint8Array> {
+  const kAead = await deriveItemKey(k);
+  const aad = recordAad(RECORD_SUITE_XCHACHA20POLY1305, ctx);
+  const sealed = aeadSeal(kAead, plaintext, aad); // nonce ‖ ct ‖ tag
+  const out = new Uint8Array(1 + sealed.byteLength);
+  out[0] = RECORD_SUITE_XCHACHA20POLY1305;
+  out.set(sealed, 1);
+  return out;
+}
+
+/**
+ * Unseal one record. Throws on any authentication failure (AAD mismatch and
+ * tag mismatch are indistinguishable — the same Poly1305 check) or on a
+ * structurally malformed blob (empty / unknown suite tag).
+ */
+export async function unsealRecord(
+  k: Uint8Array,
+  ctx: SealCtx,
+  sealed: Uint8Array,
+): Promise<Uint8Array> {
+  if (sealed.byteLength < 1) {
+    throw new Error("unsealRecord: empty sealed blob");
+  }
+  const suite = sealed[0]!;
+  if (suite !== RECORD_SUITE_XCHACHA20POLY1305) {
+    throw new Error("unsealRecord: unknown suite tag");
+  }
+  const kAead = await deriveItemKey(k);
+  const aad = recordAad(suite, ctx);
+  return aeadOpen(kAead, sealed.slice(1), aad);
+}