@wtfalch/keys 0.1.0

package/dist/held/schema.d.ts

@@ -0,0 +1,278 @@
+export declare const keysHeldEntries: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "keys_held_entries";
+    schema: undefined;
+    columns: {
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "keys_held_entries";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entryId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entry_id";
+            tableName: "keys_held_entries";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        currentVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "current_version";
+            tableName: "keys_held_entries";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: "keys_held_entries";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantArchivedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_archived_at";
+            tableName: "keys_held_entries";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "keys_held_entries";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+/** Append-only in spirit: nothing here updates a row except `current_version`, `revoked_at` and, from #232 on, `wrapped_key`. */
+export declare const keysHeldVersions: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "keys_held_versions";
+    schema: undefined;
+    columns: {
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "keys_held_versions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entryId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entry_id";
+            tableName: "keys_held_versions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        version: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version";
+            tableName: "keys_held_versions";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kekId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kek_id";
+            tableName: "keys_held_versions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        wrappedKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "wrapped_key";
+            tableName: "keys_held_versions";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Buffer<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+        }>;
+        iv: import("drizzle-orm/pg-core").PgColumn<{
+            name: "iv";
+            tableName: "keys_held_versions";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Buffer<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+        }>;
+        ciphertext: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ciphertext";
+            tableName: "keys_held_versions";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Buffer<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+        }>;
+        retiredAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retired_at";
+            tableName: "keys_held_versions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "keys_held_versions";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type KeysHeldEntryRow = typeof keysHeldEntries.$inferSelect;
+export type KeysHeldVersionRow = typeof keysHeldVersions.$inferSelect;

package/dist/held/schema.js

@@ -0,0 +1,43 @@
+import { customType, index, integer, pgTable, primaryKey, text, timestamp, } from 'drizzle-orm/pg-core';
+/**
+ * Mirrors `migrations/0002_keys_held.sql`, which is the source of truth: the
+ * SQL carries the CHECKs and the foreign key that drizzle-kit does not
+ * generate. Unlike `@wtfalch/audit`'s tables, a host never declares its own
+ * columns alongside these -- `./held` owns the whole row, so the tables stay
+ * internal to this module rather than a parameter a host supplies.
+ *
+ * `bytea`, the same way `app-template/src/lib/db/keys.ts` does it: drizzle's
+ * Postgres dialect has no built-in bytea column.
+ */
+const bytea = customType({
+    dataType: () => 'bytea',
+});
+export const keysHeldEntries = pgTable('keys_held_entries', {
+    tenantId: text('tenant_id').notNull(),
+    entryId: text('entry_id').notNull(),
+    currentVersion: integer('current_version').notNull().default(0),
+    revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    /**
+     * Set once, by `archiveTenant`, on every entry row this tenant holds.
+     * This package has no `tenants` table of its own, so "tenant archived"
+     * -- one of #232's three shred-eligibility clocks -- is recorded here,
+     * per entry, rather than on a row this package doesn't own.
+     */
+    tenantArchivedAt: timestamp('tenant_archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [primaryKey({ columns: [table.tenantId, table.entryId] })]);
+/** Append-only in spirit: nothing here updates a row except `current_version`, `revoked_at` and, from #232 on, `wrapped_key`. */
+export const keysHeldVersions = pgTable('keys_held_versions', {
+    tenantId: text('tenant_id').notNull(),
+    entryId: text('entry_id').notNull(),
+    version: integer('version').notNull(),
+    kekId: text('kek_id').notNull(),
+    wrappedKey: bytea('wrapped_key'),
+    iv: bytea('iv').notNull(),
+    ciphertext: bytea('ciphertext').notNull(),
+    retiredAt: timestamp('retired_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+}, (table) => [
+    primaryKey({ columns: [table.tenantId, table.entryId, table.version] }),
+    index('keys_held_versions_kek_idx').on(table.kekId),
+]);

package/dist/held/shred.d.ts

@@ -0,0 +1,34 @@
+import type { HeldKeysDb } from './index.js';
+/**
+ * Calls `keys_shred_expired()` -- 0003_keys_shred.sql's `SECURITY DEFINER`
+ * sweep -- and returns how many `keys_held_versions` rows it shredded. Takes
+ * no row-targeting argument itself, matching the function: the function
+ * decides eligibility on its own from `retired_at`, `revoked_at` and
+ * `tenant_archived_at`, never from anything this caller supplies.
+ */
+export declare function shredExpired(db: HeldKeysDb): Promise<number>;
+/** Which of #232's three shred-eligibility clocks a version's is. */
+export type ShredClockReason = 'retired' | 'entry_revoked' | 'tenant_archived';
+export interface ShredClock {
+    readonly tenantId: string;
+    readonly entryId: string;
+    readonly version: number;
+    readonly reason: ShredClockReason;
+    readonly startedAt: Date;
+}
+/**
+ * Every still-wrapped version whose shred clock started after `since` -- the
+ * earliest of its own `retired_at`, its entry's `revoked_at`, or its
+ * tenant's `tenant_archived_at`, whichever is set. #225's revised answer:
+ * "the write that starts the clock is itself an alert" -- a host's
+ * housekeeping tick calls this once a tick, with `since` set to the last
+ * tick's time, and alerts on a non-empty result, so an operator can reverse
+ * a forged retire/revoke/archive inside the 30-day
+ * `KEYSTORE_SHRED_DELAY_DAYS` window before `keys_shred_expired()` fires.
+ *
+ * A row already shredded (`wrapped_key is null`) has no clock left to alert
+ * on and is excluded.
+ */
+export declare function shredClocks(db: HeldKeysDb, options: {
+    readonly since: Date;
+}): Promise<readonly ShredClock[]>;

package/dist/held/shred.js

@@ -0,0 +1,76 @@
+import { and, eq, sql } from 'drizzle-orm';
+import { keysHeldEntries, keysHeldVersions } from './schema.js';
+/**
+ * Calls `keys_shred_expired()` -- 0003_keys_shred.sql's `SECURITY DEFINER`
+ * sweep -- and returns how many `keys_held_versions` rows it shredded. Takes
+ * no row-targeting argument itself, matching the function: the function
+ * decides eligibility on its own from `retired_at`, `revoked_at` and
+ * `tenant_archived_at`, never from anything this caller supplies.
+ */
+export async function shredExpired(db) {
+    const result = await db.execute(sql `select keys_shred_expired() as n`);
+    const [row] = rowsOf(result);
+    return Number(row?.n ?? 0);
+}
+/**
+ * Every still-wrapped version whose shred clock started after `since` -- the
+ * earliest of its own `retired_at`, its entry's `revoked_at`, or its
+ * tenant's `tenant_archived_at`, whichever is set. #225's revised answer:
+ * "the write that starts the clock is itself an alert" -- a host's
+ * housekeeping tick calls this once a tick, with `since` set to the last
+ * tick's time, and alerts on a non-empty result, so an operator can reverse
+ * a forged retire/revoke/archive inside the 30-day
+ * `KEYSTORE_SHRED_DELAY_DAYS` window before `keys_shred_expired()` fires.
+ *
+ * A row already shredded (`wrapped_key is null`) has no clock left to alert
+ * on and is excluded.
+ */
+export async function shredClocks(db, options) {
+    const rows = await db
+        .select({
+        tenantId: keysHeldVersions.tenantId,
+        entryId: keysHeldVersions.entryId,
+        version: keysHeldVersions.version,
+        retiredAt: keysHeldVersions.retiredAt,
+        revokedAt: keysHeldEntries.revokedAt,
+        tenantArchivedAt: keysHeldEntries.tenantArchivedAt,
+    })
+        .from(keysHeldVersions)
+        .innerJoin(keysHeldEntries, and(eq(keysHeldVersions.tenantId, keysHeldEntries.tenantId), eq(keysHeldVersions.entryId, keysHeldEntries.entryId)))
+        .where(sql `${keysHeldVersions.wrappedKey} is not null`);
+    const clocks = [];
+    for (const row of rows) {
+        const candidates = [
+            { reason: 'retired', at: row.retiredAt },
+            { reason: 'entry_revoked', at: row.revokedAt },
+            { reason: 'tenant_archived', at: row.tenantArchivedAt },
+        ];
+        let earliest;
+        for (const candidate of candidates) {
+            if (candidate.at === null)
+                continue;
+            if (!earliest || candidate.at.getTime() < earliest.at.getTime()) {
+                earliest = { reason: candidate.reason, at: candidate.at };
+            }
+        }
+        if (earliest && earliest.at.getTime() > options.since.getTime()) {
+            clocks.push({
+                tenantId: row.tenantId,
+                entryId: row.entryId,
+                version: row.version,
+                reason: earliest.reason,
+                startedAt: earliest.at,
+            });
+        }
+    }
+    return clocks;
+}
+// Mirrors the same driver-shape helper in src/issued/index.ts: postgres-js's
+// db.execute returns an array-like directly, PGlite's returns `{ rows }`.
+// Kept as its own copy rather than a shared import -- ./issued and ./held
+// store nothing in common by design (map Notes, 2026-09-13).
+function rowsOf(result) {
+    if (Array.isArray(result))
+        return result;
+    return (result.rows ?? []);
+}

package/dist/issued/codec.d.ts

@@ -0,0 +1,3 @@
+/** Base64url, used only to store a `Uint8Array` (the Worker's signature) in a `text` column. */
+export declare function toBase64Url(bytes: Uint8Array): string;
+export declare function fromBase64Url(value: string): Uint8Array;

package/dist/issued/codec.js

@@ -0,0 +1,7 @@
+/** Base64url, used only to store a `Uint8Array` (the Worker's signature) in a `text` column. */
+export function toBase64Url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+export function fromBase64Url(value) {
+    return new Uint8Array(Buffer.from(value, 'base64url'));
+}

package/dist/issued/encoding.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The bytes a signature is over, and nothing else.
+ *
+ * No Node-only APIs in this file: the Worker (#233) imports it too, and a
+ * Cloudflare Worker has `TextEncoder` but not `Buffer` or `node:crypto`.
+ */
+import { type SignableRow, type SignedKind } from '../worker-contract.js';
+/**
+ * RFC 8785 JSON Canonicalization: object keys sorted by UTF-16 code unit, no
+ * insignificant whitespace, numbers in ECMAScript's shortest round-trip form,
+ * strings escaped exactly as `JSON.stringify` already escapes them.
+ *
+ * Refuses `undefined`, functions, symbols, non-finite numbers and any object
+ * that is not a plain object or an array — silently coercing one of these
+ * (the way `JSON.stringify` drops an `undefined` property, or turns `NaN`
+ * into `null`) would change what gets signed without changing what the
+ * caller thinks it asked to sign.
+ *
+ * A JS `number`'s own `String()` already implements ECMA-262's
+ * `Number::toString` for radix 10 — the same "shortest string that parses
+ * back to this value" algorithm JCS specifies — so no separate formatting
+ * step is needed. `String(-0)` and `String(0)` both give `"0"`, matching
+ * JCS's own worked example.
+ *
+ * Default `Array.prototype.sort()` on strings compares by UTF-16 code unit
+ * already (JS strings are UTF-16 sequences and the default comparator
+ * converts to strings and compares them lexicographically by code unit), so
+ * `Object.keys(obj).sort()` alone gives JCS's key order.
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * `wtfalch-keys:${kind}:v1\n` + `canonicalJson(value)`, as UTF-8 bytes.
+ *
+ * The domain tag separates what an `'issued-row'` signature can authenticate
+ * from what a `'caller-credential'` signature can, so the same Ed25519 key
+ * signing both kinds never lets one message's bytes be replayed as the
+ * other's.
+ */
+export declare function encodeSigned(kind: SignedKind, value: unknown): Uint8Array;
+/**
+ * The eight `SignableRow` fields, by explicit allowlist — never the stored
+ * row object itself. A column added to the table later (or a driver that
+ * hands back extra properties) must not silently join the signed bytes.
+ */
+export declare function pickSignable<TGrant>(row: SignableRow<TGrant>): SignableRow<TGrant>;
+/** Every id in the contract matches `ID_PATTERN`. Throws with `label` naming the field. */
+export declare function assertValidId(id: string, label: string): void;
+export declare function isValidId(id: string): boolean;

package/dist/issued/encoding.js

@@ -0,0 +1,132 @@
+/**
+ * The bytes a signature is over, and nothing else.
+ *
+ * No Node-only APIs in this file: the Worker (#233) imports it too, and a
+ * Cloudflare Worker has `TextEncoder` but not `Buffer` or `node:crypto`.
+ */
+import { ID_PATTERN, SIGNED_PREFIX, } from '../worker-contract.js';
+// ---------------------------------------------------------------------------
+// canonicalJson — RFC 8785 (JCS)
+// ---------------------------------------------------------------------------
+/**
+ * RFC 8785 JSON Canonicalization: object keys sorted by UTF-16 code unit, no
+ * insignificant whitespace, numbers in ECMAScript's shortest round-trip form,
+ * strings escaped exactly as `JSON.stringify` already escapes them.
+ *
+ * Refuses `undefined`, functions, symbols, non-finite numbers and any object
+ * that is not a plain object or an array — silently coercing one of these
+ * (the way `JSON.stringify` drops an `undefined` property, or turns `NaN`
+ * into `null`) would change what gets signed without changing what the
+ * caller thinks it asked to sign.
+ *
+ * A JS `number`'s own `String()` already implements ECMA-262's
+ * `Number::toString` for radix 10 — the same "shortest string that parses
+ * back to this value" algorithm JCS specifies — so no separate formatting
+ * step is needed. `String(-0)` and `String(0)` both give `"0"`, matching
+ * JCS's own worked example.
+ *
+ * Default `Array.prototype.sort()` on strings compares by UTF-16 code unit
+ * already (JS strings are UTF-16 sequences and the default comparator
+ * converts to strings and compares them lexicographically by code unit), so
+ * `Object.keys(obj).sort()` alone gives JCS's key order.
+ */
+export function canonicalJson(value) {
+    return encodeValue(value);
+}
+function encodeValue(value) {
+    if (value === null)
+        return 'null';
+    const t = typeof value;
+    if (t === 'boolean')
+        return value ? 'true' : 'false';
+    if (t === 'number') {
+        const n = value;
+        if (!Number.isFinite(n)) {
+            throw new TypeError('canonicalJson: non-finite numbers (NaN, Infinity) are refused');
+        }
+        return String(n);
+    }
+    if (t === 'string')
+        return encodeString(value);
+    if (t === 'undefined')
+        throw new TypeError('canonicalJson: undefined is refused');
+    if (t === 'function')
+        throw new TypeError('canonicalJson: a function is refused');
+    if (t === 'symbol')
+        throw new TypeError('canonicalJson: a symbol is refused');
+    if (t === 'bigint')
+        throw new TypeError('canonicalJson: a bigint is refused');
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => encodeValue(item)).join(',')}]`;
+    }
+    if (t === 'object') {
+        if (!isPlainObject(value)) {
+            throw new TypeError('canonicalJson: only plain objects and arrays are refused otherwise');
+        }
+        const keys = Object.keys(value).sort();
+        const parts = keys.map((key) => `${encodeString(key)}:${encodeValue(value[key])}`);
+        return `{${parts.join(',')}}`;
+    }
+    throw new TypeError(`canonicalJson: unsupported type ${t}`);
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * String literals use the same escaping `JSON.stringify` already produces —
+ * control characters, `"` and `\` escaped, `/` left alone — which is exactly
+ * what RFC 8785 specifies, so no separate escaper is written here.
+ */
+function encodeString(value) {
+    return JSON.stringify(value);
+}
+// ---------------------------------------------------------------------------
+// encodeSigned
+// ---------------------------------------------------------------------------
+/**
+ * `wtfalch-keys:${kind}:v1\n` + `canonicalJson(value)`, as UTF-8 bytes.
+ *
+ * The domain tag separates what an `'issued-row'` signature can authenticate
+ * from what a `'caller-credential'` signature can, so the same Ed25519 key
+ * signing both kinds never lets one message's bytes be replayed as the
+ * other's.
+ */
+export function encodeSigned(kind, value) {
+    const header = `${SIGNED_PREFIX}${kind}:v1\n`;
+    return new TextEncoder().encode(header + canonicalJson(value));
+}
+// ---------------------------------------------------------------------------
+// pickSignable
+// ---------------------------------------------------------------------------
+/**
+ * The eight `SignableRow` fields, by explicit allowlist — never the stored
+ * row object itself. A column added to the table later (or a driver that
+ * hands back extra properties) must not silently join the signed bytes.
+ */
+export function pickSignable(row) {
+    return {
+        id: row.id,
+        issuedById: row.issuedById,
+        keyPrefix: row.keyPrefix,
+        secretHash: row.secretHash,
+        previousSecretHash: row.previousSecretHash,
+        previousValidUntil: row.previousValidUntil,
+        grants: row.grants,
+        expiresAt: row.expiresAt,
+    };
+}
+// ---------------------------------------------------------------------------
+// Id validation
+// ---------------------------------------------------------------------------
+/** Every id in the contract matches `ID_PATTERN`. Throws with `label` naming the field. */
+export function assertValidId(id, label) {
+    if (!ID_PATTERN.test(id)) {
+        throw new TypeError(`${label} does not match ID_PATTERN: ${JSON.stringify(id)}`);
+    }
+}
+export function isValidId(id) {
+    return ID_PATTERN.test(id);
+}