@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/internal/crypto/keying/checkpoints.d.ts

@@ -0,0 +1,16 @@
+import type { VerifiedAccessManifestCheckpointEvidence } from "./accessManifestSnapshotTypes.js";
+import type { AccessManifest, AccessManifestCheckpoint, IdentityStateHead, KeyingVerificationResult, VerifiedIdentityState, VerifyIdentityStateCheckpointInput } from "./types.js";
+export type { VerifiedAccessManifestCheckpointEvidence } from "./accessManifestSnapshotTypes.js";
+export declare function normalizeIdentityStateHead(value: unknown): IdentityStateHead;
+export declare function verifyIdentityStateCheckpoint({ checkpointPredecessors, head, localCheckpoint, }: VerifyIdentityStateCheckpointInput): Promise<KeyingVerificationResult<VerifiedIdentityState>>;
+export declare function accessManifestCheckpointFromManifest(input: {
+    readonly manifest: AccessManifest;
+    readonly manifestHash: string;
+}): AccessManifestCheckpoint;
+export declare function verifyAccessManifestLocalCheckpoint(input: {
+    readonly current: AccessManifestCheckpoint & {
+        readonly previousManifestHash: string | null;
+    };
+    readonly localCheckpoint: AccessManifestCheckpoint | null | undefined;
+    readonly checkpointPredecessors: readonly VerifiedAccessManifestCheckpointEvidence[] | undefined;
+}): void;

package/internal/crypto/keying/checkpoints.js

@@ -0,0 +1,149 @@
+import { assertExactKeys, normalizeAccessObjectKind, readHashString, readNullableHashString, readPositiveInteger, readString, runVerifier, throwVerification, } from "./shared.js";
+import { makeVerifiedIdentityState } from "./types.js";
+export function normalizeIdentityStateHead(value) {
+    const record = assertExactKeys(value, ["identityId", "previousStateHash", "stateHash", "version"], "identity state head");
+    return {
+        identityId: readString(record, "identityId", "identity state head"),
+        version: readPositiveInteger(record, "version", "identity state head"),
+        stateHash: readHashString(record, "stateHash", "identity state head"),
+        previousStateHash: readNullableHashString(record, "previousStateHash", "identity state head"),
+    };
+}
+function normalizeIdentityStateCheckpoint(value) {
+    const record = assertExactKeys(value, ["identityId", "stateHash", "version"], "identity state checkpoint");
+    return {
+        identityId: readString(record, "identityId", "identity state checkpoint"),
+        version: readPositiveInteger(record, "version", "identity state checkpoint"),
+        stateHash: readHashString(record, "stateHash", "identity state checkpoint"),
+    };
+}
+function identityStateCheckpointFromHead(head) {
+    return {
+        identityId: head.identityId,
+        version: head.version,
+        stateHash: head.stateHash,
+    };
+}
+function verifyIdentityStateCheckpointChain(input) {
+    const { head, localCheckpoint } = input;
+    if (!localCheckpoint) {
+        return;
+    }
+    if (head.identityId !== localCheckpoint.identityId) {
+        throwVerification("object_mismatch", "identity state checkpoint does not match current identity");
+    }
+    if (head.version < localCheckpoint.version) {
+        throwVerification("rollback", "identity state head is older than the local checkpoint");
+    }
+    if (head.version === localCheckpoint.version &&
+        head.stateHash !== localCheckpoint.stateHash) {
+        throwVerification("equivocation", "identity state head conflicts with the local checkpoint");
+    }
+    if (head.version === localCheckpoint.version) {
+        return;
+    }
+    let expectedVersion = localCheckpoint.version + 1;
+    let expectedPreviousHash = localCheckpoint.stateHash;
+    const chain = [
+        ...(input.checkpointPredecessors ?? []).map(normalizeIdentityStateHead),
+        head,
+    ];
+    for (const chainHead of chain) {
+        if (chainHead.identityId !== localCheckpoint.identityId) {
+            throwVerification("object_mismatch", "identity state checkpoint predecessor identity mismatch");
+        }
+        if (chainHead.version !== expectedVersion ||
+            chainHead.previousStateHash !== expectedPreviousHash) {
+            throwVerification("stale_predecessor", "identity state chain does not extend the local checkpoint");
+        }
+        expectedVersion += 1;
+        expectedPreviousHash = chainHead.stateHash;
+    }
+}
+export async function verifyIdentityStateCheckpoint({ checkpointPredecessors, head, localCheckpoint, }) {
+    return runVerifier(async () => {
+        const normalizedHead = normalizeIdentityStateHead(head);
+        verifyIdentityStateCheckpointChain({
+            head: normalizedHead,
+            localCheckpoint: localCheckpoint
+                ? normalizeIdentityStateCheckpoint(localCheckpoint)
+                : null,
+            checkpointPredecessors,
+        });
+        return makeVerifiedIdentityState({
+            identityId: normalizedHead.identityId,
+            version: normalizedHead.version,
+            stateHash: normalizedHead.stateHash,
+            head: normalizedHead,
+            checkpoint: identityStateCheckpointFromHead(normalizedHead),
+        });
+    });
+}
+function normalizeAccessManifestCheckpoint(value) {
+    const record = assertExactKeys(value, ["epoch", "manifestHash", "objectId", "objectKind", "organizationId"], "access manifest checkpoint");
+    return {
+        objectKind: normalizeAccessObjectKind(record.objectKind, "access manifest checkpoint"),
+        objectId: readString(record, "objectId", "access manifest checkpoint"),
+        organizationId: readString(record, "organizationId", "access manifest checkpoint"),
+        epoch: readPositiveInteger(record, "epoch", "access manifest checkpoint"),
+        manifestHash: readHashString(record, "manifestHash", "access manifest checkpoint"),
+    };
+}
+export function accessManifestCheckpointFromManifest(input) {
+    return {
+        objectKind: input.manifest.objectKind,
+        objectId: input.manifest.objectId,
+        organizationId: input.manifest.organizationId,
+        epoch: input.manifest.epoch,
+        manifestHash: input.manifestHash,
+    };
+}
+function accessManifestCheckpointObjectMatches(left, right) {
+    return (left.objectKind === right.objectKind &&
+        left.objectId === right.objectId &&
+        left.organizationId === right.organizationId);
+}
+function verifiedAccessManifestCheckpointLink(manifest) {
+    return {
+        ...manifest.checkpoint,
+        previousManifestHash: manifest.manifest.previousManifestHash,
+    };
+}
+export function verifyAccessManifestLocalCheckpoint(input) {
+    const { current, localCheckpoint } = input;
+    if (!localCheckpoint) {
+        return;
+    }
+    const normalizedCheckpoint = normalizeAccessManifestCheckpoint(localCheckpoint);
+    if (!accessManifestCheckpointObjectMatches(current, normalizedCheckpoint)) {
+        throwVerification("object_mismatch", "access manifest checkpoint does not match current object");
+    }
+    if (current.epoch < normalizedCheckpoint.epoch) {
+        throwVerification("rollback", "access manifest is older than the local checkpoint");
+    }
+    if (current.epoch === normalizedCheckpoint.epoch &&
+        current.manifestHash !== normalizedCheckpoint.manifestHash) {
+        throwVerification("equivocation", "access manifest conflicts with the local checkpoint");
+    }
+    if (current.epoch === normalizedCheckpoint.epoch) {
+        return;
+    }
+    let expectedEpoch = normalizedCheckpoint.epoch + 1;
+    let expectedPreviousHash = normalizedCheckpoint.manifestHash;
+    const chain = [
+        ...(input.checkpointPredecessors ?? []).map(verifiedAccessManifestCheckpointLink),
+        current,
+    ];
+    for (const link of chain) {
+        if (!accessManifestCheckpointObjectMatches(link, normalizedCheckpoint)) {
+            throwVerification("object_mismatch", "access manifest checkpoint predecessor object mismatch");
+        }
+        if (link.epoch !== expectedEpoch ||
+            link.previousManifestHash !== expectedPreviousHash) {
+            throwVerification("stale_predecessor", "access manifest chain does not extend the local checkpoint");
+        }
+        expectedEpoch += 1;
+        expectedPreviousHash = link.manifestHash;
+    }
+}
+//# sourceMappingURL=checkpoints.js.map

package/internal/crypto/keying/checkpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoints.js","sourceRoot":"","sources":["checkpoints.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAUlB,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAIpD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,CAAC,EAC3D,qBAAqB,CACtB,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,qBAAqB,CAAC;QACnE,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,qBAAqB,CAAC;QACtE,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,qBAAqB,CAAC;QACrE,iBAAiB,EAAE,sBAAsB,CACvC,MAAM,EACN,mBAAmB,EACnB,qBAAqB,CACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,KAAc;IAEd,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,EACtC,2BAA2B,CAC5B,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,2BAA2B,CAAC;QACzE,OAAO,EAAE,mBAAmB,CAC1B,MAAM,EACN,SAAS,EACT,2BAA2B,CAC5B;QACD,SAAS,EAAE,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,2BAA2B,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,IAAuB;IAEvB,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CAAC,KAI3C;IACC,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAExC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU,EAAE,CAAC;QACnD,iBAAiB,CACf,iBAAiB,EACjB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC;QAC3C,iBAAiB,CACf,UAAU,EACV,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,IACE,IAAI,CAAC,OAAO,KAAK,eAAe,CAAC,OAAO;QACxC,IAAI,CAAC,SAAS,KAAK,eAAe,CAAC,SAAS,EAC5C,CAAC;QACD,iBAAiB,CACf,cAAc,EACd,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,IAAI,eAAe,GAAG,eAAe,CAAC,OAAO,GAAG,CAAC,CAAC;IAClD,IAAI,oBAAoB,GAAG,eAAe,CAAC,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACvE,IAAI;KACL,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,UAAU,KAAK,eAAe,CAAC,UAAU,EAAE,CAAC;YACxD,iBAAiB,CACf,iBAAiB,EACjB,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,IACE,SAAS,CAAC,OAAO,KAAK,eAAe;YACrC,SAAS,CAAC,iBAAiB,KAAK,oBAAoB,EACpD,CAAC;YACD,iBAAiB,CACf,mBAAmB,EACnB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,eAAe,IAAI,CAAC,CAAC;QACrB,oBAAoB,GAAG,SAAS,CAAC,SAAS,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,sBAAsB,EACtB,IAAI,EACJ,eAAe,GACoB;IAGnC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACxD,kCAAkC,CAAC;YACjC,IAAI,EAAE,cAAc;YACpB,eAAe,EAAE,eAAe;gBAC9B,CAAC,CAAC,gCAAgC,CAAC,eAAe,CAAC;gBACnD,CAAC,CAAC,IAAI;YACR,sBAAsB;SACvB,CAAC,CAAC;QAEH,OAAO,yBAAyB,CAAC;YAC/B,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,SAAS,EAAE,cAAc,CAAC,SAAS;YACnC,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,+BAA+B,CAAC,cAAc,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iCAAiC,CACxC,KAAc;IAEd,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,CAAC,EACrE,4BAA4B,CAC7B,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,yBAAyB,CACnC,MAAM,CAAC,UAAU,EACjB,4BAA4B,CAC7B;QACD,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,4BAA4B,CAAC;QACtE,cAAc,EAAE,UAAU,CACxB,MAAM,EACN,gBAAgB,EAChB,4BAA4B,CAC7B;QACD,KAAK,EAAE,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,4BAA4B,CAAC;QACzE,YAAY,EAAE,cAAc,CAC1B,MAAM,EACN,cAAc,EACd,4BAA4B,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAGpD;IACC,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC7C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,IAA8B,EAC9B,KAA+B;IAE/B,OAAO,CACL,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACpC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAChC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAC3C,QAAkD;IAIlD,OAAO;QACL,GAAG,QAAQ,CAAC,UAAU;QACtB,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,oBAAoB;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAQnD;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAE3C,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,oBAAoB,GACxB,iCAAiC,CAAC,eAAe,CAAC,CAAC;IAErD,IAAI,CAAC,qCAAqC,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC1E,iBAAiB,CACf,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAC/C,iBAAiB,CACf,UAAU,EACV,oDAAoD,CACrD,CAAC;IACJ,CAAC;IAED,IACE,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,KAAK;QAC5C,OAAO,CAAC,YAAY,KAAK,oBAAoB,CAAC,YAAY,EAC1D,CAAC;QACD,iBAAiB,CACf,cAAc,EACd,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,KAAK,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,IAAI,aAAa,GAAG,oBAAoB,CAAC,KAAK,GAAG,CAAC,CAAC;IACnD,IAAI,oBAAoB,GAAG,oBAAoB,CAAC,YAAY,CAAC;IAC7D,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,GAAG,CACzC,oCAAoC,CACrC;QACD,OAAO;KACR,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,qCAAqC,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC;YACvE,iBAAiB,CACf,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,IACE,IAAI,CAAC,KAAK,KAAK,aAAa;YAC5B,IAAI,CAAC,oBAAoB,KAAK,oBAAoB,EAClD,CAAC;YACD,iBAAiB,CACf,mBAAmB,EACnB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,aAAa,IAAI,CAAC,CAAC;QACnB,oBAAoB,GAAG,IAAI,CAAC,YAAY,CAAC;IAC3C,CAAC;AACH,CAAC","sourcesContent":["import type { VerifiedAccessManifestCheckpointEvidence } from \"./accessManifestSnapshotTypes\";\nimport {\n  assertExactKeys,\n  normalizeAccessObjectKind,\n  readHashString,\n  readNullableHashString,\n  readPositiveInteger,\n  readString,\n  runVerifier,\n  throwVerification,\n} from \"./shared\";\nimport type {\n  AccessManifest,\n  AccessManifestCheckpoint,\n  IdentityStateCheckpoint,\n  IdentityStateHead,\n  KeyingVerificationResult,\n  VerifiedIdentityState,\n  VerifyIdentityStateCheckpointInput,\n} from \"./types\";\nimport { makeVerifiedIdentityState } from \"./types\";\n\nexport type { VerifiedAccessManifestCheckpointEvidence } from \"./accessManifestSnapshotTypes\";\n\nexport function normalizeIdentityStateHead(value: unknown): IdentityStateHead {\n  const record = assertExactKeys(\n    value,\n    [\"identityId\", \"previousStateHash\", \"stateHash\", \"version\"],\n    \"identity state head\",\n  );\n\n  return {\n    identityId: readString(record, \"identityId\", \"identity state head\"),\n    version: readPositiveInteger(record, \"version\", \"identity state head\"),\n    stateHash: readHashString(record, \"stateHash\", \"identity state head\"),\n    previousStateHash: readNullableHashString(\n      record,\n      \"previousStateHash\",\n      \"identity state head\",\n    ),\n  };\n}\n\nfunction normalizeIdentityStateCheckpoint(\n  value: unknown,\n): IdentityStateCheckpoint {\n  const record = assertExactKeys(\n    value,\n    [\"identityId\", \"stateHash\", \"version\"],\n    \"identity state checkpoint\",\n  );\n\n  return {\n    identityId: readString(record, \"identityId\", \"identity state checkpoint\"),\n    version: readPositiveInteger(\n      record,\n      \"version\",\n      \"identity state checkpoint\",\n    ),\n    stateHash: readHashString(record, \"stateHash\", \"identity state checkpoint\"),\n  };\n}\n\nfunction identityStateCheckpointFromHead(\n  head: IdentityStateHead,\n): IdentityStateCheckpoint {\n  return {\n    identityId: head.identityId,\n    version: head.version,\n    stateHash: head.stateHash,\n  };\n}\n\nfunction verifyIdentityStateCheckpointChain(input: {\n  readonly head: IdentityStateHead;\n  readonly localCheckpoint: IdentityStateCheckpoint | null | undefined;\n  readonly checkpointPredecessors: readonly IdentityStateHead[] | undefined;\n}): void {\n  const { head, localCheckpoint } = input;\n\n  if (!localCheckpoint) {\n    return;\n  }\n\n  if (head.identityId !== localCheckpoint.identityId) {\n    throwVerification(\n      \"object_mismatch\",\n      \"identity state checkpoint does not match current identity\",\n    );\n  }\n\n  if (head.version < localCheckpoint.version) {\n    throwVerification(\n      \"rollback\",\n      \"identity state head is older than the local checkpoint\",\n    );\n  }\n\n  if (\n    head.version === localCheckpoint.version &&\n    head.stateHash !== localCheckpoint.stateHash\n  ) {\n    throwVerification(\n      \"equivocation\",\n      \"identity state head conflicts with the local checkpoint\",\n    );\n  }\n\n  if (head.version === localCheckpoint.version) {\n    return;\n  }\n\n  let expectedVersion = localCheckpoint.version + 1;\n  let expectedPreviousHash = localCheckpoint.stateHash;\n  const chain = [\n    ...(input.checkpointPredecessors ?? []).map(normalizeIdentityStateHead),\n    head,\n  ];\n\n  for (const chainHead of chain) {\n    if (chainHead.identityId !== localCheckpoint.identityId) {\n      throwVerification(\n        \"object_mismatch\",\n        \"identity state checkpoint predecessor identity mismatch\",\n      );\n    }\n\n    if (\n      chainHead.version !== expectedVersion ||\n      chainHead.previousStateHash !== expectedPreviousHash\n    ) {\n      throwVerification(\n        \"stale_predecessor\",\n        \"identity state chain does not extend the local checkpoint\",\n      );\n    }\n\n    expectedVersion += 1;\n    expectedPreviousHash = chainHead.stateHash;\n  }\n}\n\nexport async function verifyIdentityStateCheckpoint({\n  checkpointPredecessors,\n  head,\n  localCheckpoint,\n}: VerifyIdentityStateCheckpointInput): Promise<\n  KeyingVerificationResult<VerifiedIdentityState>\n> {\n  return runVerifier(async () => {\n    const normalizedHead = normalizeIdentityStateHead(head);\n    verifyIdentityStateCheckpointChain({\n      head: normalizedHead,\n      localCheckpoint: localCheckpoint\n        ? normalizeIdentityStateCheckpoint(localCheckpoint)\n        : null,\n      checkpointPredecessors,\n    });\n\n    return makeVerifiedIdentityState({\n      identityId: normalizedHead.identityId,\n      version: normalizedHead.version,\n      stateHash: normalizedHead.stateHash,\n      head: normalizedHead,\n      checkpoint: identityStateCheckpointFromHead(normalizedHead),\n    });\n  });\n}\n\nfunction normalizeAccessManifestCheckpoint(\n  value: unknown,\n): AccessManifestCheckpoint {\n  const record = assertExactKeys(\n    value,\n    [\"epoch\", \"manifestHash\", \"objectId\", \"objectKind\", \"organizationId\"],\n    \"access manifest checkpoint\",\n  );\n\n  return {\n    objectKind: normalizeAccessObjectKind(\n      record.objectKind,\n      \"access manifest checkpoint\",\n    ),\n    objectId: readString(record, \"objectId\", \"access manifest checkpoint\"),\n    organizationId: readString(\n      record,\n      \"organizationId\",\n      \"access manifest checkpoint\",\n    ),\n    epoch: readPositiveInteger(record, \"epoch\", \"access manifest checkpoint\"),\n    manifestHash: readHashString(\n      record,\n      \"manifestHash\",\n      \"access manifest checkpoint\",\n    ),\n  };\n}\n\nexport function accessManifestCheckpointFromManifest(input: {\n  readonly manifest: AccessManifest;\n  readonly manifestHash: string;\n}): AccessManifestCheckpoint {\n  return {\n    objectKind: input.manifest.objectKind,\n    objectId: input.manifest.objectId,\n    organizationId: input.manifest.organizationId,\n    epoch: input.manifest.epoch,\n    manifestHash: input.manifestHash,\n  };\n}\n\nfunction accessManifestCheckpointObjectMatches(\n  left: AccessManifestCheckpoint,\n  right: AccessManifestCheckpoint,\n): boolean {\n  return (\n    left.objectKind === right.objectKind &&\n    left.objectId === right.objectId &&\n    left.organizationId === right.organizationId\n  );\n}\n\nfunction verifiedAccessManifestCheckpointLink(\n  manifest: VerifiedAccessManifestCheckpointEvidence,\n): AccessManifestCheckpoint & {\n  readonly previousManifestHash: string | null;\n} {\n  return {\n    ...manifest.checkpoint,\n    previousManifestHash: manifest.manifest.previousManifestHash,\n  };\n}\n\nexport function verifyAccessManifestLocalCheckpoint(input: {\n  readonly current: AccessManifestCheckpoint & {\n    readonly previousManifestHash: string | null;\n  };\n  readonly localCheckpoint: AccessManifestCheckpoint | null | undefined;\n  readonly checkpointPredecessors:\n    | readonly VerifiedAccessManifestCheckpointEvidence[]\n    | undefined;\n}): void {\n  const { current, localCheckpoint } = input;\n\n  if (!localCheckpoint) {\n    return;\n  }\n\n  const normalizedCheckpoint =\n    normalizeAccessManifestCheckpoint(localCheckpoint);\n\n  if (!accessManifestCheckpointObjectMatches(current, normalizedCheckpoint)) {\n    throwVerification(\n      \"object_mismatch\",\n      \"access manifest checkpoint does not match current object\",\n    );\n  }\n\n  if (current.epoch < normalizedCheckpoint.epoch) {\n    throwVerification(\n      \"rollback\",\n      \"access manifest is older than the local checkpoint\",\n    );\n  }\n\n  if (\n    current.epoch === normalizedCheckpoint.epoch &&\n    current.manifestHash !== normalizedCheckpoint.manifestHash\n  ) {\n    throwVerification(\n      \"equivocation\",\n      \"access manifest conflicts with the local checkpoint\",\n    );\n  }\n\n  if (current.epoch === normalizedCheckpoint.epoch) {\n    return;\n  }\n\n  let expectedEpoch = normalizedCheckpoint.epoch + 1;\n  let expectedPreviousHash = normalizedCheckpoint.manifestHash;\n  const chain = [\n    ...(input.checkpointPredecessors ?? []).map(\n      verifiedAccessManifestCheckpointLink,\n    ),\n    current,\n  ];\n\n  for (const link of chain) {\n    if (!accessManifestCheckpointObjectMatches(link, normalizedCheckpoint)) {\n      throwVerification(\n        \"object_mismatch\",\n        \"access manifest checkpoint predecessor object mismatch\",\n      );\n    }\n\n    if (\n      link.epoch !== expectedEpoch ||\n      link.previousManifestHash !== expectedPreviousHash\n    ) {\n      throwVerification(\n        \"stale_predecessor\",\n        \"access manifest chain does not extend the local checkpoint\",\n      );\n    }\n\n    expectedEpoch += 1;\n    expectedPreviousHash = link.manifestHash;\n  }\n}\n"]}

package/internal/crypto/keying/containerAccess.d.ts

@@ -0,0 +1,6 @@
+import type { KeyingVerificationResult, VerifiedContainerAccessManifest, VerifyContainerAccessManifestInput } from "./types.js";
+export { normalizeContainerAccessEventBody } from "./containerAccessBodies.js";
+export { computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, deriveContainerAccessManifest, } from "./containerAccessState.js";
+export { requireContainerPathLast } from "./containerParentAuthority.js";
+export { containerAccessLevelRank, principalPolicyMatchesReference, requireContainerPathUserAccess, resolveContainerPathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, } from "./containerPathAccess.js";
+export declare function verifyContainerAccessManifest({ authorizationMembership, checkpointPredecessors, destinationParentContainerPath, event, expectedManifestHash, localCheckpoint, manifest, parentContainerPath, previousContainerPath, previousManifest, principalPolicies, }: VerifyContainerAccessManifestInput): Promise<KeyingVerificationResult<VerifiedContainerAccessManifest>>;

package/internal/crypto/keying/containerAccess.js

@@ -0,0 +1,58 @@
+import { computeAccessManifestHash, verifyAccessManifest } from "./accessEvent.js";
+import { normalizeContainerAccessEventBody } from "./containerAccessBodies.js";
+import { deriveContainerAccessManifest } from "./containerAccessState.js";
+import { deriveContainerAccessManifestStateFromEvent } from "./containerAccessTransitions.js";
+import { assertContainerPrincipalReferencesProgress } from "./containerPrincipalReferences.js";
+import { assertContainerSystemTopology } from "./containerSystemTopology.js";
+import { runVerifier, throwVerification } from "./shared.js";
+import { makeVerifiedContainerAccessManifest } from "./types.js";
+export { normalizeContainerAccessEventBody } from "./containerAccessBodies.js";
+export { computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, deriveContainerAccessManifest, } from "./containerAccessState.js";
+export { requireContainerPathLast } from "./containerParentAuthority.js";
+export { containerAccessLevelRank, principalPolicyMatchesReference, requireContainerPathUserAccess, resolveContainerPathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, } from "./containerPathAccess.js";
+export async function verifyContainerAccessManifest({ authorizationMembership = "current", checkpointPredecessors, destinationParentContainerPath, event, expectedManifestHash, localCheckpoint, manifest, parentContainerPath, previousContainerPath, previousManifest = null, principalPolicies = [], }) {
+    return runVerifier(async () => {
+        const body = normalizeContainerAccessEventBody(event.body);
+        if (body.eventType === "container.create")
+            await assertContainerSystemTopology(body, event.event.organizationId);
+        const state = deriveContainerAccessManifestStateFromEvent({
+            authorizationMembership,
+            body,
+            destinationParentContainerPath,
+            event,
+            parentContainerPath,
+            previousContainerPath,
+            previousManifest,
+            principalPolicies,
+        });
+        assertContainerPrincipalReferencesProgress(previousManifest?.state.referencedPrincipalHeads ?? [], state.referencedPrincipalHeads);
+        const derivedManifest = await deriveContainerAccessManifest(state);
+        const derivedManifestHash = await computeAccessManifestHash(derivedManifest);
+        if (derivedManifestHash !== expectedManifestHash) {
+            throwVerification("hash_mismatch", "container access manifest hash does not match derived state");
+        }
+        const verifiedManifest = await verifyAccessManifest({
+            manifest,
+            expectedManifestHash,
+            event,
+            expectedObject: {
+                objectKind: "container",
+                objectId: state.containerId,
+            },
+            expectedPreviousManifestHash: state.previousManifestHash,
+            localCheckpoint,
+            checkpointPredecessors,
+        });
+        if (!verifiedManifest.ok) {
+            throw verifiedManifest.error;
+        }
+        return makeVerifiedContainerAccessManifest({
+            manifest: derivedManifest,
+            manifestHash: verifiedManifest.value.manifestHash,
+            event,
+            state,
+            checkpoint: verifiedManifest.value.checkpoint,
+        });
+    });
+}
+//# sourceMappingURL=containerAccess.js.map

package/internal/crypto/keying/containerAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerAccess.js","sourceRoot":"","sources":["containerAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,2CAA2C,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,0CAA0C,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAM1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACL,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,mCAAmC,EACnC,6CAA6C,GAC9C,MAAM,uBAAuB,CAAC;AAC/B,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,uBAAuB,GAAG,SAAS,EACnC,sBAAsB,EACtB,8BAA8B,EAC9B,KAAK,EACL,oBAAoB,EACpB,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GAAG,IAAI,EACvB,iBAAiB,GAAG,EAAE,GACa;IAGnC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,IAAI,GAAG,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,KAAK,kBAAkB;YACvC,MAAM,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,2CAA2C,CAAC;YACxD,uBAAuB;YACvB,IAAI;YACJ,8BAA8B;YAC9B,KAAK;YACL,mBAAmB;YACnB,qBAAqB;YACrB,gBAAgB;YAChB,iBAAiB;SAClB,CAAC,CAAC;QACH,0CAA0C,CACxC,gBAAgB,EAAE,KAAK,CAAC,wBAAwB,IAAI,EAAE,EACtD,KAAK,CAAC,wBAAwB,CAC/B,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,mBAAmB,GACvB,MAAM,yBAAyB,CAAC,eAAe,CAAC,CAAC;QAEnD,IAAI,mBAAmB,KAAK,oBAAoB,EAAE,CAAC;YACjD,iBAAiB,CACf,eAAe,EACf,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC;YAClD,QAAQ;YACR,oBAAoB;YACpB,KAAK;YACL,cAAc,EAAE;gBACd,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,KAAK,CAAC,WAAW;aAC5B;YACD,4BAA4B,EAAE,KAAK,CAAC,oBAAoB;YACxD,eAAe;YACf,sBAAsB;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,gBAAgB,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,OAAO,mCAAmC,CAAC;YACzC,QAAQ,EAAE,eAAe;YACzB,YAAY,EAAE,gBAAgB,CAAC,KAAK,CAAC,YAAY;YACjD,KAAK;YACL,KAAK;YACL,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU;SAC9C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { computeAccessManifestHash, verifyAccessManifest } from \"./accessEvent\";\nimport { normalizeContainerAccessEventBody } from \"./containerAccessBodies\";\nimport { deriveContainerAccessManifest } from \"./containerAccessState\";\nimport { deriveContainerAccessManifestStateFromEvent } from \"./containerAccessTransitions\";\nimport { assertContainerPrincipalReferencesProgress } from \"./containerPrincipalReferences\";\nimport { assertContainerSystemTopology } from \"./containerSystemTopology\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  VerifiedContainerAccessManifest,\n  VerifyContainerAccessManifestInput,\n} from \"./types\";\nimport { makeVerifiedContainerAccessManifest } from \"./types\";\n\nexport { normalizeContainerAccessEventBody } from \"./containerAccessBodies\";\nexport {\n  computeContainerAccessKeyTargetHash,\n  computeContainerAccessStructuralHash,\n  computeContainerDirectGrantRoot,\n  deriveContainerAccessManifest,\n} from \"./containerAccessState\";\nexport { requireContainerPathLast } from \"./containerParentAuthority\";\nexport {\n  containerAccessLevelRank,\n  principalPolicyMatchesReference,\n  requireContainerPathUserAccess,\n  resolveContainerPathUserAccessLevel,\n  resolveHistoricalContainerPathUserAccessLevel,\n} from \"./containerPathAccess\";\nexport async function verifyContainerAccessManifest({\n  authorizationMembership = \"current\",\n  checkpointPredecessors,\n  destinationParentContainerPath,\n  event,\n  expectedManifestHash,\n  localCheckpoint,\n  manifest,\n  parentContainerPath,\n  previousContainerPath,\n  previousManifest = null,\n  principalPolicies = [],\n}: VerifyContainerAccessManifestInput): Promise<\n  KeyingVerificationResult<VerifiedContainerAccessManifest>\n> {\n  return runVerifier(async () => {\n    const body = normalizeContainerAccessEventBody(event.body);\n    if (body.eventType === \"container.create\")\n      await assertContainerSystemTopology(body, event.event.organizationId);\n    const state = deriveContainerAccessManifestStateFromEvent({\n      authorizationMembership,\n      body,\n      destinationParentContainerPath,\n      event,\n      parentContainerPath,\n      previousContainerPath,\n      previousManifest,\n      principalPolicies,\n    });\n    assertContainerPrincipalReferencesProgress(\n      previousManifest?.state.referencedPrincipalHeads ?? [],\n      state.referencedPrincipalHeads,\n    );\n    const derivedManifest = await deriveContainerAccessManifest(state);\n    const derivedManifestHash =\n      await computeAccessManifestHash(derivedManifest);\n\n    if (derivedManifestHash !== expectedManifestHash) {\n      throwVerification(\n        \"hash_mismatch\",\n        \"container access manifest hash does not match derived state\",\n      );\n    }\n\n    const verifiedManifest = await verifyAccessManifest({\n      manifest,\n      expectedManifestHash,\n      event,\n      expectedObject: {\n        objectKind: \"container\",\n        objectId: state.containerId,\n      },\n      expectedPreviousManifestHash: state.previousManifestHash,\n      localCheckpoint,\n      checkpointPredecessors,\n    });\n\n    if (!verifiedManifest.ok) {\n      throw verifiedManifest.error;\n    }\n\n    return makeVerifiedContainerAccessManifest({\n      manifest: derivedManifest,\n      manifestHash: verifiedManifest.value.manifestHash,\n      event,\n      state,\n      checkpoint: verifiedManifest.value.checkpoint,\n    });\n  });\n}\n"]}

package/internal/crypto/keying/containerAccessBodies.d.ts

@@ -0,0 +1,2 @@
+import type { ContainerAccessEventBody, KeyingCanonicalJson } from "./types.js";
+export declare function normalizeContainerAccessEventBody(value: KeyingCanonicalJson): ContainerAccessEventBody;

package/internal/crypto/keying/containerAccessBodies.js

@@ -0,0 +1,160 @@
+import { isPlainObject } from "../../validators/isPlainObject.js";
+import { referencedPrincipalKey } from "./accessEvent.js";
+import { normalizeContainerReciteAccessEventBody } from "./containerAccessReciteBody.js";
+import { normalizeContainerRekeyAccessEventBody } from "./containerAccessRekeyBody.js";
+import { assertReferencedPrincipalHeadsMatchDirectGrants, managedGrantReferenceKey, normalizeContainerAccessKeyState, normalizeContainerDirectGrant, normalizeContainerDirectGrants, } from "./containerAccessState.js";
+import { normalizeContainerAccessMetadata, normalizeContainerAccessStructural, } from "./containerAccessStructure.js";
+import { normalizeContainerGrantPrincipalHead, normalizeContainerGrantPrincipalHeads, } from "./containerGrantPrincipalHead.js";
+import { assertExactKeys, normalizeContainerGrantSubjectType, readHashString, readNullableHashString, readString, throwVerification, } from "./shared.js";
+function normalizeContainerCreateAccessEventBody(value) {
+    const record = assertExactKeys(value, [
+        "containerKeyEpochId",
+        "containerKeyPublicKey",
+        "directGrants",
+        "eventType",
+        "metadataDocumentId",
+        "systemSlot",
+        "parentContainerId",
+        "parentManifestHash",
+        "referencedPrincipalHeads",
+    ], "container.create event body");
+    const directGrants = record.directGrants;
+    const referencedPrincipalHeads = record.referencedPrincipalHeads;
+    if (!Array.isArray(directGrants)) {
+        throwVerification("invalid_shape", "container.create event body.directGrants must be an array");
+    }
+    if (!Array.isArray(referencedPrincipalHeads)) {
+        throwVerification("invalid_shape", "container.create event body.referencedPrincipalHeads must be an array");
+    }
+    const structural = normalizeContainerAccessStructural({
+        parentContainerId: record.parentContainerId,
+        parentManifestHash: record.parentManifestHash,
+    });
+    const keyState = normalizeContainerAccessKeyState({
+        containerKeyEpochId: record.containerKeyEpochId,
+        containerKeyPublicKey: record.containerKeyPublicKey,
+    });
+    const metadata = normalizeContainerAccessMetadata({
+        metadataDocumentId: record.metadataDocumentId,
+        systemSlot: record.systemSlot,
+    });
+    const normalizedDirectGrants = normalizeContainerDirectGrants(directGrants);
+    const normalizedReferencedPrincipalHeads = normalizeContainerGrantPrincipalHeads(referencedPrincipalHeads);
+    assertReferencedPrincipalHeadsMatchDirectGrants({
+        directGrants: normalizedDirectGrants,
+        referencedPrincipalHeads: normalizedReferencedPrincipalHeads,
+    });
+    return {
+        eventType: "container.create",
+        ...structural,
+        ...keyState,
+        ...metadata,
+        directGrants: normalizedDirectGrants,
+        referencedPrincipalHeads: normalizedReferencedPrincipalHeads,
+    };
+}
+function normalizeContainerGrantAccessEventBody(value) {
+    const record = assertExactKeys(value, [
+        "containerKeyEpochId",
+        "containerKeyPublicKey",
+        "eventType",
+        "grant",
+        "referencedPrincipalHead",
+    ], "container.grant event body");
+    const grant = normalizeContainerDirectGrant(record.grant);
+    const referencedPrincipalHead = record.referencedPrincipalHead === null
+        ? null
+        : normalizeContainerGrantPrincipalHead(record.referencedPrincipalHead);
+    const managedGrantKey = managedGrantReferenceKey(grant);
+    if (managedGrantKey === null && referencedPrincipalHead !== null) {
+        throwVerification("missing_dependency", "container.grant user grants must not include a referenced principal head");
+    }
+    if (managedGrantKey !== null &&
+        (!referencedPrincipalHead ||
+            referencedPrincipalKey(referencedPrincipalHead) !== managedGrantKey)) {
+        throwVerification("missing_dependency", "container.grant managed-principal grants must include the matching referenced principal head");
+    }
+    return {
+        eventType: "container.grant",
+        ...normalizeContainerAccessKeyState({
+            containerKeyEpochId: record.containerKeyEpochId,
+            containerKeyPublicKey: record.containerKeyPublicKey,
+        }),
+        grant,
+        referencedPrincipalHead,
+    };
+}
+function normalizeContainerRevokeAccessEventBody(value) {
+    const record = assertExactKeys(value, [
+        "containerKeyEpochId",
+        "containerKeyPublicKey",
+        "eventType",
+        "keyringHash",
+        "parentManifestHash",
+        "predecessorBridgeHash",
+        "subjectId",
+        "subjectType",
+    ], "container.revoke event body");
+    return {
+        eventType: "container.revoke",
+        parentManifestHash: readNullableHashString(record, "parentManifestHash", "container.revoke event body"),
+        ...normalizeContainerAccessKeyState({
+            containerKeyEpochId: record.containerKeyEpochId,
+            containerKeyPublicKey: record.containerKeyPublicKey,
+        }),
+        keyringHash: readHashString(record, "keyringHash", "container.revoke event body"),
+        predecessorBridgeHash: readHashString(record, "predecessorBridgeHash", "container.revoke event body"),
+        subjectId: readString(record, "subjectId", "container.revoke event body"),
+        subjectType: normalizeContainerGrantSubjectType(record.subjectType, "container.revoke event body"),
+    };
+}
+function normalizeContainerMoveAccessEventBody(value) {
+    const record = assertExactKeys(value, [
+        "containerKeyEpochId",
+        "containerKeyPublicKey",
+        "eventType",
+        "keyringHash",
+        "parentContainerId",
+        "parentManifestHash",
+        "predecessorBridgeHash",
+    ], "container.move event body");
+    return {
+        eventType: "container.move",
+        ...normalizeContainerAccessStructural({
+            parentContainerId: record.parentContainerId,
+            parentManifestHash: record.parentManifestHash,
+        }),
+        ...normalizeContainerAccessKeyState({
+            containerKeyEpochId: record.containerKeyEpochId,
+            containerKeyPublicKey: record.containerKeyPublicKey,
+        }),
+        keyringHash: readHashString(record, "keyringHash", "container.move event body"),
+        predecessorBridgeHash: readHashString(record, "predecessorBridgeHash", "container.move event body"),
+    };
+}
+export function normalizeContainerAccessEventBody(value) {
+    if (!isPlainObject(value)) {
+        throwVerification("invalid_shape", "container access event body must be a plain object");
+    }
+    const eventType = readString(value, "eventType", "container access body");
+    if (eventType === "container.create") {
+        return normalizeContainerCreateAccessEventBody(value);
+    }
+    if (eventType === "container.grant") {
+        return normalizeContainerGrantAccessEventBody(value);
+    }
+    if (eventType === "container.revoke") {
+        return normalizeContainerRevokeAccessEventBody(value);
+    }
+    if (eventType === "container.rekey") {
+        return normalizeContainerRekeyAccessEventBody(value);
+    }
+    if (eventType === "container.recite") {
+        return normalizeContainerReciteAccessEventBody(value);
+    }
+    if (eventType === "container.move") {
+        return normalizeContainerMoveAccessEventBody(value);
+    }
+    throwVerification("invalid_domain", "container access event body eventType is unsupported");
+}
+//# sourceMappingURL=containerAccessBodies.js.map

package/internal/crypto/keying/containerAccessBodies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerAccessBodies.js","sourceRoot":"","sources":["containerAccessBodies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,sCAAsC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EACL,+CAA+C,EAC/C,wBAAwB,EACxB,gCAAgC,EAChC,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,eAAe,EACf,kCAAkC,EAClC,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAUlB,SAAS,uCAAuC,CAC9C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,qBAAqB;QACrB,uBAAuB;QACvB,cAAc;QACd,WAAW;QACX,oBAAoB;QACpB,YAAY;QACZ,mBAAmB;QACnB,oBAAoB;QACpB,0BAA0B;KAC3B,EACD,6BAA6B,CAC9B,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB,CAAC;IAEjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,iBAAiB,CACf,eAAe,EACf,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC7C,iBAAiB,CACf,eAAe,EACf,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,kCAAkC,CAAC;QACpD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gCAAgC,CAAC;QAChD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gCAAgC,CAAC;QAChD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,kCAAkC,GACtC,qCAAqC,CAAC,wBAAwB,CAAC,CAAC;IAElE,+CAA+C,CAAC;QAC9C,YAAY,EAAE,sBAAsB;QACpC,wBAAwB,EAAE,kCAAkC;KAC7D,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,kBAAkB;QAC7B,GAAG,UAAU;QACb,GAAG,QAAQ;QACX,GAAG,QAAQ;QACX,YAAY,EAAE,sBAAsB;QACpC,wBAAwB,EAAE,kCAAkC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,qBAAqB;QACrB,uBAAuB;QACvB,WAAW;QACX,OAAO;QACP,yBAAyB;KAC1B,EACD,4BAA4B,CAC7B,CAAC;IACF,MAAM,KAAK,GAAG,6BAA6B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,uBAAuB,GAC3B,MAAM,CAAC,uBAAuB,KAAK,IAAI;QACrC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,oCAAoC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAExD,IAAI,eAAe,KAAK,IAAI,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;QACjE,iBAAiB,CACf,oBAAoB,EACpB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,IACE,eAAe,KAAK,IAAI;QACxB,CAAC,CAAC,uBAAuB;YACvB,sBAAsB,CAAC,uBAAuB,CAAC,KAAK,eAAe,CAAC,EACtE,CAAC;QACD,iBAAiB,CACf,oBAAoB,EACpB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,iBAAiB;QAC5B,GAAG,gCAAgC,CAAC;YAClC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,CAAC;QACF,KAAK;QACL,uBAAuB;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,uCAAuC,CAC9C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,qBAAqB;QACrB,uBAAuB;QACvB,WAAW;QACX,aAAa;QACb,oBAAoB;QACpB,uBAAuB;QACvB,WAAW;QACX,aAAa;KACd,EACD,6BAA6B,CAC9B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,kBAAkB;QAC7B,kBAAkB,EAAE,sBAAsB,CACxC,MAAM,EACN,oBAAoB,EACpB,6BAA6B,CAC9B;QACD,GAAG,gCAAgC,CAAC;YAClC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,CAAC;QACF,WAAW,EAAE,cAAc,CACzB,MAAM,EACN,aAAa,EACb,6BAA6B,CAC9B;QACD,qBAAqB,EAAE,cAAc,CACnC,MAAM,EACN,uBAAuB,EACvB,6BAA6B,CAC9B;QACD,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,6BAA6B,CAAC;QACzE,WAAW,EAAE,kCAAkC,CAC7C,MAAM,CAAC,WAAW,EAClB,6BAA6B,CAC9B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qCAAqC,CAC5C,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,qBAAqB;QACrB,uBAAuB;QACvB,WAAW;QACX,aAAa;QACb,mBAAmB;QACnB,oBAAoB;QACpB,uBAAuB;KACxB,EACD,2BAA2B,CAC5B,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,gBAAgB;QAC3B,GAAG,kCAAkC,CAAC;YACpC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;SAC9C,CAAC;QACF,GAAG,gCAAgC,CAAC;YAClC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,CAAC;QACF,WAAW,EAAE,cAAc,CACzB,MAAM,EACN,aAAa,EACb,2BAA2B,CAC5B;QACD,qBAAqB,EAAE,cAAc,CACnC,MAAM,EACN,uBAAuB,EACvB,2BAA2B,CAC5B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAA0B;IAE1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,iBAAiB,CACf,eAAe,EACf,oDAAoD,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,uBAAuB,CAAC,CAAC;IAE1E,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,uCAAuC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,uCAAuC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,sCAAsC,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACrC,OAAO,uCAAuC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACnC,OAAO,qCAAqC,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,iBAAiB,CACf,gBAAgB,EAChB,sDAAsD,CACvD,CAAC;AACJ,CAAC","sourcesContent":["import { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport { referencedPrincipalKey } from \"./accessEvent\";\nimport { normalizeContainerReciteAccessEventBody } from \"./containerAccessReciteBody\";\nimport { normalizeContainerRekeyAccessEventBody } from \"./containerAccessRekeyBody\";\nimport {\n  assertReferencedPrincipalHeadsMatchDirectGrants,\n  managedGrantReferenceKey,\n  normalizeContainerAccessKeyState,\n  normalizeContainerDirectGrant,\n  normalizeContainerDirectGrants,\n} from \"./containerAccessState\";\nimport {\n  normalizeContainerAccessMetadata,\n  normalizeContainerAccessStructural,\n} from \"./containerAccessStructure\";\nimport {\n  normalizeContainerGrantPrincipalHead,\n  normalizeContainerGrantPrincipalHeads,\n} from \"./containerGrantPrincipalHead\";\nimport {\n  assertExactKeys,\n  normalizeContainerGrantSubjectType,\n  readHashString,\n  readNullableHashString,\n  readString,\n  throwVerification,\n} from \"./shared\";\nimport type {\n  ContainerAccessEventBody,\n  ContainerCreateAccessEventBody,\n  ContainerGrantAccessEventBody,\n  ContainerMoveAccessEventBody,\n  ContainerRevokeAccessEventBody,\n  KeyingCanonicalJson,\n} from \"./types\";\n\nfunction normalizeContainerCreateAccessEventBody(\n  value: KeyingCanonicalJson,\n): ContainerCreateAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\n      \"containerKeyEpochId\",\n      \"containerKeyPublicKey\",\n      \"directGrants\",\n      \"eventType\",\n      \"metadataDocumentId\",\n      \"systemSlot\",\n      \"parentContainerId\",\n      \"parentManifestHash\",\n      \"referencedPrincipalHeads\",\n    ],\n    \"container.create event body\",\n  );\n  const directGrants = record.directGrants;\n  const referencedPrincipalHeads = record.referencedPrincipalHeads;\n\n  if (!Array.isArray(directGrants)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"container.create event body.directGrants must be an array\",\n    );\n  }\n\n  if (!Array.isArray(referencedPrincipalHeads)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"container.create event body.referencedPrincipalHeads must be an array\",\n    );\n  }\n\n  const structural = normalizeContainerAccessStructural({\n    parentContainerId: record.parentContainerId,\n    parentManifestHash: record.parentManifestHash,\n  });\n  const keyState = normalizeContainerAccessKeyState({\n    containerKeyEpochId: record.containerKeyEpochId,\n    containerKeyPublicKey: record.containerKeyPublicKey,\n  });\n  const metadata = normalizeContainerAccessMetadata({\n    metadataDocumentId: record.metadataDocumentId,\n    systemSlot: record.systemSlot,\n  });\n  const normalizedDirectGrants = normalizeContainerDirectGrants(directGrants);\n  const normalizedReferencedPrincipalHeads =\n    normalizeContainerGrantPrincipalHeads(referencedPrincipalHeads);\n\n  assertReferencedPrincipalHeadsMatchDirectGrants({\n    directGrants: normalizedDirectGrants,\n    referencedPrincipalHeads: normalizedReferencedPrincipalHeads,\n  });\n\n  return {\n    eventType: \"container.create\",\n    ...structural,\n    ...keyState,\n    ...metadata,\n    directGrants: normalizedDirectGrants,\n    referencedPrincipalHeads: normalizedReferencedPrincipalHeads,\n  };\n}\n\nfunction normalizeContainerGrantAccessEventBody(\n  value: KeyingCanonicalJson,\n): ContainerGrantAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\n      \"containerKeyEpochId\",\n      \"containerKeyPublicKey\",\n      \"eventType\",\n      \"grant\",\n      \"referencedPrincipalHead\",\n    ],\n    \"container.grant event body\",\n  );\n  const grant = normalizeContainerDirectGrant(record.grant);\n  const referencedPrincipalHead =\n    record.referencedPrincipalHead === null\n      ? null\n      : normalizeContainerGrantPrincipalHead(record.referencedPrincipalHead);\n  const managedGrantKey = managedGrantReferenceKey(grant);\n\n  if (managedGrantKey === null && referencedPrincipalHead !== null) {\n    throwVerification(\n      \"missing_dependency\",\n      \"container.grant user grants must not include a referenced principal head\",\n    );\n  }\n\n  if (\n    managedGrantKey !== null &&\n    (!referencedPrincipalHead ||\n      referencedPrincipalKey(referencedPrincipalHead) !== managedGrantKey)\n  ) {\n    throwVerification(\n      \"missing_dependency\",\n      \"container.grant managed-principal grants must include the matching referenced principal head\",\n    );\n  }\n\n  return {\n    eventType: \"container.grant\",\n    ...normalizeContainerAccessKeyState({\n      containerKeyEpochId: record.containerKeyEpochId,\n      containerKeyPublicKey: record.containerKeyPublicKey,\n    }),\n    grant,\n    referencedPrincipalHead,\n  };\n}\n\nfunction normalizeContainerRevokeAccessEventBody(\n  value: KeyingCanonicalJson,\n): ContainerRevokeAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\n      \"containerKeyEpochId\",\n      \"containerKeyPublicKey\",\n      \"eventType\",\n      \"keyringHash\",\n      \"parentManifestHash\",\n      \"predecessorBridgeHash\",\n      \"subjectId\",\n      \"subjectType\",\n    ],\n    \"container.revoke event body\",\n  );\n\n  return {\n    eventType: \"container.revoke\",\n    parentManifestHash: readNullableHashString(\n      record,\n      \"parentManifestHash\",\n      \"container.revoke event body\",\n    ),\n    ...normalizeContainerAccessKeyState({\n      containerKeyEpochId: record.containerKeyEpochId,\n      containerKeyPublicKey: record.containerKeyPublicKey,\n    }),\n    keyringHash: readHashString(\n      record,\n      \"keyringHash\",\n      \"container.revoke event body\",\n    ),\n    predecessorBridgeHash: readHashString(\n      record,\n      \"predecessorBridgeHash\",\n      \"container.revoke event body\",\n    ),\n    subjectId: readString(record, \"subjectId\", \"container.revoke event body\"),\n    subjectType: normalizeContainerGrantSubjectType(\n      record.subjectType,\n      \"container.revoke event body\",\n    ),\n  };\n}\n\nfunction normalizeContainerMoveAccessEventBody(\n  value: KeyingCanonicalJson,\n): ContainerMoveAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\n      \"containerKeyEpochId\",\n      \"containerKeyPublicKey\",\n      \"eventType\",\n      \"keyringHash\",\n      \"parentContainerId\",\n      \"parentManifestHash\",\n      \"predecessorBridgeHash\",\n    ],\n    \"container.move event body\",\n  );\n\n  return {\n    eventType: \"container.move\",\n    ...normalizeContainerAccessStructural({\n      parentContainerId: record.parentContainerId,\n      parentManifestHash: record.parentManifestHash,\n    }),\n    ...normalizeContainerAccessKeyState({\n      containerKeyEpochId: record.containerKeyEpochId,\n      containerKeyPublicKey: record.containerKeyPublicKey,\n    }),\n    keyringHash: readHashString(\n      record,\n      \"keyringHash\",\n      \"container.move event body\",\n    ),\n    predecessorBridgeHash: readHashString(\n      record,\n      \"predecessorBridgeHash\",\n      \"container.move event body\",\n    ),\n  };\n}\n\nexport function normalizeContainerAccessEventBody(\n  value: KeyingCanonicalJson,\n): ContainerAccessEventBody {\n  if (!isPlainObject(value)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"container access event body must be a plain object\",\n    );\n  }\n\n  const eventType = readString(value, \"eventType\", \"container access body\");\n\n  if (eventType === \"container.create\") {\n    return normalizeContainerCreateAccessEventBody(value);\n  }\n\n  if (eventType === \"container.grant\") {\n    return normalizeContainerGrantAccessEventBody(value);\n  }\n\n  if (eventType === \"container.revoke\") {\n    return normalizeContainerRevokeAccessEventBody(value);\n  }\n\n  if (eventType === \"container.rekey\") {\n    return normalizeContainerRekeyAccessEventBody(value);\n  }\n\n  if (eventType === \"container.recite\") {\n    return normalizeContainerReciteAccessEventBody(value);\n  }\n\n  if (eventType === \"container.move\") {\n    return normalizeContainerMoveAccessEventBody(value);\n  }\n\n  throwVerification(\n    \"invalid_domain\",\n    \"container access event body eventType is unsupported\",\n  );\n}\n"]}

package/internal/crypto/keying/containerAccessReciteBody.d.ts

@@ -0,0 +1,3 @@
+import type { ContainerReciteAccessEventBody, KeyingCanonicalJson } from "./types.js";
+export declare const MAX_CONTAINER_RECITATION_EPOCH = 512;
+export declare function normalizeContainerReciteAccessEventBody(value: KeyingCanonicalJson): ContainerReciteAccessEventBody;

package/internal/crypto/keying/containerAccessReciteBody.js

@@ -0,0 +1,19 @@
+import { normalizeContainerKekWrappingPublicKey } from "./containerKekWrapping.js";
+import { assertExactKeys, readNullableString, throwVerification, } from "./shared.js";
+// Reserve half of the API's 1024 same-KEK write-history budget for ordinary
+// mutations. This absolute epoch ceiling does not reset when a container rekeys.
+export const MAX_CONTAINER_RECITATION_EPOCH = 512;
+export function normalizeContainerReciteAccessEventBody(value) {
+    const record = assertExactKeys(value, ["containerKeyEpochId", "containerKeyPublicKey", "eventType"], "container.recite event body");
+    const containerKeyPublicKey = normalizeContainerKekWrappingPublicKey(record.containerKeyPublicKey);
+    const containerKeyEpochId = readNullableString(record, "containerKeyEpochId", "container.recite event body");
+    if ((containerKeyEpochId === null) !== (containerKeyPublicKey === null)) {
+        throwVerification("invalid_shape", "Container KEK epoch and public key must both be present or both be null");
+    }
+    return {
+        eventType: "container.recite",
+        containerKeyPublicKey,
+        containerKeyEpochId,
+    };
+}
+//# sourceMappingURL=containerAccessReciteBody.js.map

package/internal/crypto/keying/containerAccessReciteBody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerAccessReciteBody.js","sourceRoot":"","sources":["containerAccessReciteBody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAMlB,4EAA4E;AAC5E,iFAAiF;AACjF,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,MAAM,UAAU,uCAAuC,CACrD,KAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,WAAW,CAAC,EAC7D,6BAA6B,CAC9B,CAAC;IACF,MAAM,qBAAqB,GAAG,sCAAsC,CAClE,MAAM,CAAC,qBAAqB,CAC7B,CAAC;IACF,MAAM,mBAAmB,GAAG,kBAAkB,CAC5C,MAAM,EACN,qBAAqB,EACrB,6BAA6B,CAC9B,CAAC;IACF,IAAI,CAAC,mBAAmB,KAAK,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,iBAAiB,CACf,eAAe,EACf,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,kBAAkB;QAC7B,qBAAqB;QACrB,mBAAmB;KACpB,CAAC;AACJ,CAAC","sourcesContent":["import { normalizeContainerKekWrappingPublicKey } from \"./containerKekWrapping\";\nimport {\n  assertExactKeys,\n  readNullableString,\n  throwVerification,\n} from \"./shared\";\nimport type {\n  ContainerReciteAccessEventBody,\n  KeyingCanonicalJson,\n} from \"./types\";\n\n// Reserve half of the API's 1024 same-KEK write-history budget for ordinary\n// mutations. This absolute epoch ceiling does not reset when a container rekeys.\nexport const MAX_CONTAINER_RECITATION_EPOCH = 512;\n\nexport function normalizeContainerReciteAccessEventBody(\n  value: KeyingCanonicalJson,\n): ContainerReciteAccessEventBody {\n  const record = assertExactKeys(\n    value,\n    [\"containerKeyEpochId\", \"containerKeyPublicKey\", \"eventType\"],\n    \"container.recite event body\",\n  );\n  const containerKeyPublicKey = normalizeContainerKekWrappingPublicKey(\n    record.containerKeyPublicKey,\n  );\n  const containerKeyEpochId = readNullableString(\n    record,\n    \"containerKeyEpochId\",\n    \"container.recite event body\",\n  );\n  if ((containerKeyEpochId === null) !== (containerKeyPublicKey === null)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"Container KEK epoch and public key must both be present or both be null\",\n    );\n  }\n  return {\n    eventType: \"container.recite\",\n    containerKeyPublicKey,\n    containerKeyEpochId,\n  };\n}\n"]}

package/internal/crypto/keying/containerAccessRekeyBody.js

@@ -0,0 +1,35 @@
+import { isPlainObject } from "../../validators/isPlainObject.js";
+import { normalizeContainerGrantPrincipalHeads } from "./containerGrantPrincipalHead.js";
+import { normalizeContainerKekWrappingPublicKey } from "./containerKekWrapping.js";
+import { assertExactKeys, readHashString, readNullableHashString, readString, throwVerification, } from "./shared.js";
+export function normalizeContainerRekeyAccessEventBody(value) {
+    if (!isPlainObject(value)) {
+        throwVerification("invalid_shape", "container.rekey event body must be a plain object");
+    }
+    const record = assertExactKeys(value, [
+        "containerKeyEpochId",
+        "containerKeyPublicKey",
+        "eventType",
+        "keyringHash",
+        "parentManifestHash",
+        "predecessorBridgeHash",
+        "referencedPrincipalHeads",
+    ], "container.rekey event body");
+    const referencedPrincipalHeads = record.referencedPrincipalHeads;
+    if (!Array.isArray(referencedPrincipalHeads)) {
+        throwVerification("invalid_shape", "container.rekey event body.referencedPrincipalHeads must be an array");
+    }
+    const containerKeyPublicKey = normalizeContainerKekWrappingPublicKey(record.containerKeyPublicKey);
+    if (containerKeyPublicKey === null)
+        throwVerification("invalid_shape", "Container rekey requires a public key");
+    return {
+        containerKeyPublicKey,
+        eventType: "container.rekey",
+        parentManifestHash: readNullableHashString(record, "parentManifestHash", "container.rekey event body"),
+        containerKeyEpochId: readString(record, "containerKeyEpochId", "container.rekey event body"),
+        keyringHash: readHashString(record, "keyringHash", "container.rekey event body"),
+        predecessorBridgeHash: readHashString(record, "predecessorBridgeHash", "container.rekey event body"),
+        referencedPrincipalHeads: normalizeContainerGrantPrincipalHeads(referencedPrincipalHeads),
+    };
+}
+//# sourceMappingURL=containerAccessRekeyBody.js.map

package/internal/crypto/keying/containerAccessRekeyBody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerAccessRekeyBody.js","sourceRoot":"","sources":["containerAccessRekeyBody.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EACL,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,UAAU,EACV,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAMlB,MAAM,UAAU,sCAAsC,CACpD,KAA0B;IAE1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,iBAAiB,CACf,eAAe,EACf,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,KAAK,EACL;QACE,qBAAqB;QACrB,uBAAuB;QACvB,WAAW;QACX,aAAa;QACb,oBAAoB;QACpB,uBAAuB;QACvB,0BAA0B;KAC3B,EACD,4BAA4B,CAC7B,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC7C,iBAAiB,CACf,eAAe,EACf,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAG,sCAAsC,CAClE,MAAM,CAAC,qBAAqB,CAC7B,CAAC;IACF,IAAI,qBAAqB,KAAK,IAAI;QAChC,iBAAiB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IAC9E,OAAO;QACL,qBAAqB;QACrB,SAAS,EAAE,iBAAiB;QAC5B,kBAAkB,EAAE,sBAAsB,CACxC,MAAM,EACN,oBAAoB,EACpB,4BAA4B,CAC7B;QACD,mBAAmB,EAAE,UAAU,CAC7B,MAAM,EACN,qBAAqB,EACrB,4BAA4B,CAC7B;QACD,WAAW,EAAE,cAAc,CACzB,MAAM,EACN,aAAa,EACb,4BAA4B,CAC7B;QACD,qBAAqB,EAAE,cAAc,CACnC,MAAM,EACN,uBAAuB,EACvB,4BAA4B,CAC7B;QACD,wBAAwB,EAAE,qCAAqC,CAC7D,wBAAwB,CACzB;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport { normalizeContainerGrantPrincipalHeads } from \"./containerGrantPrincipalHead\";\nimport { normalizeContainerKekWrappingPublicKey } from \"./containerKekWrapping\";\nimport {\n  assertExactKeys,\n  readHashString,\n  readNullableHashString,\n  readString,\n  throwVerification,\n} from \"./shared\";\nimport type {\n  ContainerRekeyAccessEventBody,\n  KeyingCanonicalJson,\n} from \"./types\";\n\nexport function normalizeContainerRekeyAccessEventBody(\n  value: KeyingCanonicalJson,\n): ContainerRekeyAccessEventBody {\n  if (!isPlainObject(value)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"container.rekey event body must be a plain object\",\n    );\n  }\n  const record = assertExactKeys(\n    value,\n    [\n      \"containerKeyEpochId\",\n      \"containerKeyPublicKey\",\n      \"eventType\",\n      \"keyringHash\",\n      \"parentManifestHash\",\n      \"predecessorBridgeHash\",\n      \"referencedPrincipalHeads\",\n    ],\n    \"container.rekey event body\",\n  );\n  const referencedPrincipalHeads = record.referencedPrincipalHeads;\n  if (!Array.isArray(referencedPrincipalHeads)) {\n    throwVerification(\n      \"invalid_shape\",\n      \"container.rekey event body.referencedPrincipalHeads must be an array\",\n    );\n  }\n\n  const containerKeyPublicKey = normalizeContainerKekWrappingPublicKey(\n    record.containerKeyPublicKey,\n  );\n  if (containerKeyPublicKey === null)\n    throwVerification(\"invalid_shape\", \"Container rekey requires a public key\");\n  return {\n    containerKeyPublicKey,\n    eventType: \"container.rekey\",\n    parentManifestHash: readNullableHashString(\n      record,\n      \"parentManifestHash\",\n      \"container.rekey event body\",\n    ),\n    containerKeyEpochId: readString(\n      record,\n      \"containerKeyEpochId\",\n      \"container.rekey event body\",\n    ),\n    keyringHash: readHashString(\n      record,\n      \"keyringHash\",\n      \"container.rekey event body\",\n    ),\n    predecessorBridgeHash: readHashString(\n      record,\n      \"predecessorBridgeHash\",\n      \"container.rekey event body\",\n    ),\n    referencedPrincipalHeads: normalizeContainerGrantPrincipalHeads(\n      referencedPrincipalHeads,\n    ),\n  };\n}\n"]}

package/internal/crypto/keying/containerAccessState.d.ts

@@ -0,0 +1,16 @@
+import type { ContainerAccessKeyState, ContainerAccessManifest, ContainerAccessManifestState, ContainerAccessMetadata, ContainerAccessStructural, ContainerDirectGrant, ContainerGrantPrincipalHead } from "./types.js";
+export declare function normalizeContainerDirectGrant(value: unknown): ContainerDirectGrant;
+export declare function normalizeContainerDirectGrants(values: readonly unknown[]): ContainerDirectGrant[];
+export declare function normalizeContainerAccessKeyState(value: unknown): ContainerAccessKeyState;
+export declare function managedGrantReferenceKey(grant: ContainerDirectGrant): string | null;
+export declare function assertReferencedPrincipalHeadsMatchDirectGrants(input: {
+    readonly directGrants: readonly ContainerDirectGrant[];
+    readonly referencedPrincipalHeads: readonly ContainerGrantPrincipalHead[];
+}): void;
+export declare function normalizeContainerAccessManifestState(value: ContainerAccessManifestState): ContainerAccessManifestState;
+export declare function computeContainerAccessStructuralHash(structural: ContainerAccessStructural & ContainerAccessMetadata): Promise<string>;
+export declare function computeContainerDirectGrantRoot(grants: readonly ContainerDirectGrant[]): Promise<string>;
+export declare function computeContainerAccessKeyTargetHash(keyState: ContainerAccessKeyState): Promise<string>;
+export declare function deriveContainerAccessManifest(state: ContainerAccessManifestState): Promise<ContainerAccessManifest>;
+export declare function upsertContainerDirectGrant(grants: readonly ContainerDirectGrant[], grant: ContainerDirectGrant): ContainerDirectGrant[];
+export declare function removeContainerDirectGrant(grants: readonly ContainerDirectGrant[], revokedGrant: Pick<ContainerDirectGrant, "subjectId" | "subjectType">): ContainerDirectGrant[];