@xescure/keeta-utils 0.0.0-stage → 0.1.0

package/dist/identity/keyref.js

@@ -0,0 +1,213 @@
+import { accountKeyAlgorithm, isKeyAlgorithm, keyAlgorithms, parseAddress } from './account.js';
+import { defaultKeyAlgorithm, defaultKeyFormat, formatParams, keyFormats } from './drivers.js';
+import { issue, KeyConfigError } from './error.js';
+import { looksLikeKeyMaterial } from './material.js';
+export const sharedParamNames = ['format', 'index', 'alg', 'expect'];
+export const maximumIndex = 2 ** 32 - 1;
+const schemePattern = /^[a-z][a-z0-9+.-]*$/;
+const indexPattern = /^(0|[1-9][0-9]*)$/;
+// Whitespace and control characters, plus the characters the syntax reserves:
+// "?" for a query and "," as a list separator.
+const forbiddenCharacterPattern = /[\s\p{Cc}?,]/u;
+/**
+ * Parses a ref and reports every problem with it. No issue ever contains the
+ * text, or any part of it: a value that fails to parse may be a secret.
+ */
+export function readKeyRef(text, registry, location, role) {
+    function fail(code, message) {
+        return ({ ref: undefined, issues: [issue(code, location, message, role)] });
+    }
+    if (looksLikeKeyMaterial(text)) {
+        return (fail('KEY_MATERIAL_AS_REF', 'the value looks like key material, not a key reference; it is not shown'));
+    }
+    if (text === '') {
+        return (fail('KEYREF_SYNTAX', 'the key reference is empty'));
+    }
+    if (forbiddenCharacterPattern.test(text)) {
+        return (fail('KEYREF_SYNTAX', 'a key reference must not contain whitespace, control characters, "?" or ","'));
+    }
+    if (text.startsWith('keeta_') && !text.includes(':')) {
+        if (text.includes('#')) {
+            return (fail('PARAM_NOT_ALLOWED', 'a keeta_ address takes no params'));
+        }
+        if (parseAddress(text) === undefined) {
+            return (fail('INVALID_ADDRESS', 'not a valid keeta_ address in its lowercase form'));
+        }
+        return ({ ref: { kind: 'address', address: text }, issues: [] });
+    }
+    const colon = text.indexOf(':');
+    const scheme = text.slice(0, colon);
+    if (colon < 1 || !schemePattern.test(scheme) || !URL.canParse(text)) {
+        return (fail('KEYREF_SYNTAX', 'a key reference is a URL scheme:body[#params] or a keeta_ address'));
+    }
+    const hash = text.indexOf('#');
+    let body = text.slice(colon + 1);
+    let fragment;
+    if (hash >= 0) {
+        body = text.slice(colon + 1, hash);
+        fragment = text.slice(hash + 1);
+        if (fragment === '' || fragment.includes('#')) {
+            return (fail('KEYREF_SYNTAX', 'params follow a single "#" and must not be empty'));
+        }
+    }
+    if (body.includes('%')) {
+        return (fail('KEYREF_SYNTAX', 'the body of a key reference is literal and must not contain "%"'));
+    }
+    if (looksLikeKeyMaterial(body)) {
+        return (fail('KEY_MATERIAL_AS_REF', 'the body looks like key material; it is not shown'));
+    }
+    const driver = registry.driver(scheme);
+    if (driver === undefined) {
+        return (fail('UNKNOWN_SCHEME', `no driver is registered for the scheme; registered: ${registry.schemes().join(', ')}`));
+    }
+    const issues = [];
+    const bodyProblem = driver.checkBody(body);
+    if (bodyProblem !== undefined) {
+        issues.push(issue('INVALID_BODY', location, `${scheme}: ${bodyProblem}`, role));
+    }
+    else if (driver.canonicalBody !== undefined) {
+        body = driver.canonicalBody(body);
+    }
+    const params = readParams([...new URLSearchParams(fragment ?? '')], driver, function (code, message) {
+        issues.push(issue(code, location, message, role));
+    });
+    const [first, ...rest] = issues;
+    if (first !== undefined) {
+        return ({ ref: undefined, issues: [first, ...rest] });
+    }
+    return ({ ref: { kind: 'driver', scheme, body, ...params }, issues: [] });
+}
+function isKeyFormat(value) {
+    return (keyFormats.some(function (format) {
+        return (format === value);
+    }));
+}
+function readParams(entries, driver, report) {
+    const params = { params: {} };
+    const driverParams = {};
+    const seen = new Set();
+    let expectAlgorithm;
+    for (const [name, value] of entries) {
+        if (looksLikeKeyMaterial(name) || looksLikeKeyMaterial(value)) {
+            report('KEY_MATERIAL_AS_REF', 'a param looks like key material; it is not shown');
+            continue;
+        }
+        const validator = driver.params?.[name];
+        if (seen.has(name)) {
+            report('REPEATED_PARAM', 'a param appears more than once');
+            continue;
+        }
+        seen.add(name);
+        if (name === 'format') {
+            if (isKeyFormat(value)) {
+                params.format = value;
+            }
+            else {
+                report('INVALID_PARAM', `format must be one of ${keyFormats.join(', ')}`);
+            }
+        }
+        else if (name === 'index') {
+            if (indexPattern.test(value) && Number(value) <= maximumIndex) {
+                params.index = Number(value);
+            }
+            else {
+                report('INVALID_PARAM', `index must be a decimal integer from 0 to ${maximumIndex}, without leading zeros`);
+            }
+        }
+        else if (name === 'alg') {
+            if (isKeyAlgorithm(value)) {
+                params.alg = value;
+            }
+            else {
+                report('INVALID_PARAM', `alg must be one of ${keyAlgorithms.join(', ')}`);
+            }
+        }
+        else if (name === 'expect') {
+            const account = parseAddress(value);
+            if (account !== undefined) {
+                expectAlgorithm = accountKeyAlgorithm(account);
+            }
+            if (expectAlgorithm === undefined) {
+                report('INVALID_PARAM', 'expect must be the keeta_ address of a key pair, in its lowercase form');
+            }
+            else {
+                params.expect = value;
+            }
+        }
+        else if (validator === undefined) {
+            report('UNKNOWN_PARAM', `a param is unknown to the ${driver.scheme}: driver and the shared params`);
+        }
+        else {
+            const problem = validator(value);
+            if (problem === undefined) {
+                driverParams[name] = value;
+            }
+            else {
+                report('INVALID_PARAM', `${name}: ${problem}`);
+            }
+        }
+    }
+    params.params = driverParams;
+    let accepted;
+    let acceptor;
+    if (driver.kind === 'source') {
+        accepted = formatParams[params.format ?? defaultKeyFormat];
+        acceptor = `the ${params.format ?? defaultKeyFormat} format`;
+    }
+    else {
+        accepted = driver.sharedParams;
+        acceptor = `the ${driver.scheme}: driver`;
+        if (seen.has('format')) {
+            report('PARAM_NOT_ALLOWED', `${acceptor} is a signer and takes no format`);
+        }
+    }
+    for (const name of ['index', 'alg', 'expect']) {
+        if (seen.has(name) && !accepted.includes(name)) {
+            report('PARAM_NOT_ALLOWED', `${acceptor} does not take ${name}`);
+        }
+    }
+    let algorithm = params.alg;
+    if (algorithm === undefined && driver.kind === 'source') {
+        algorithm = defaultKeyAlgorithm;
+    }
+    if (expectAlgorithm !== undefined && algorithm !== undefined && accepted.includes('alg') && algorithm !== expectAlgorithm) {
+        report('INVALID_PARAM', `expect is a ${expectAlgorithm} address but the key is ${algorithm}`);
+    }
+    return (params);
+}
+/**
+ * Parses a ref, throwing a `KeyConfigError` with every problem found.
+ */
+export function parseKeyRef(text, registry, location = 'key reference') {
+    const reading = readKeyRef(text, registry, location);
+    if (reading.ref === undefined) {
+        throw (new KeyConfigError(reading.issues));
+    }
+    return (reading.ref);
+}
+/**
+ * The canonical form: the body as written, then the params present in the
+ * order format, index, alg, expect, then the driver's own params by name,
+ * encoded by `URLSearchParams`.
+ */
+export function formatKeyRef(ref) {
+    if (ref.kind === 'address') {
+        return (ref.address);
+    }
+    const params = new URLSearchParams();
+    for (const name of sharedParamNames) {
+        const value = ref[name];
+        if (value !== undefined) {
+            params.append(name, String(value));
+        }
+    }
+    for (const [name, value] of Object.entries(ref.params).sort()) {
+        params.append(name, value);
+    }
+    const encoded = params.toString();
+    if (encoded === '') {
+        return (`${ref.scheme}:${ref.body}`);
+    }
+    return (`${ref.scheme}:${ref.body}#${encoded}`);
+}
+//# sourceMappingURL=keyref.js.map

package/dist/identity/keyref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyref.js","sourceRoot":"","sources":["../../src/identity/keyref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEhG,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/F,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AA8BrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAEhD,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC;AACzC,8EAA8E;AAC9E,+CAA+C;AAC/C,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAKlD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,QAAwB,EAAE,QAAgB,EAAE,IAAa;IACjG,SAAS,IAAI,CAAC,IAA4B,EAAE,OAAe;QAC1D,OAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,yEAAyE,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACjB,OAAM,CAAC,IAAI,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAM,CAAC,IAAI,CAAC,eAAe,EAAE,6EAA6E,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,OAAM,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAM,CAAC,IAAI,CAAC,eAAe,EAAE,mEAAmE,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,QAA4B,CAAC;IACjC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAM,CAAC,IAAI,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iEAAiE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,uDAAuD,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxH,CAAC;IAED,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,eAAe,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAS,IAAI,EAAE,OAAO;QACjG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAM,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAMD,SAAS,WAAW,CAAC,KAAa;IACjC,OAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAS,MAAM;QACrC,OAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,OAAoC,EAAE,MAAc,EAAE,MAAc;IACvF,MAAM,MAAM,GAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,eAAyC,CAAC;IAE9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;YAClF,SAAS;QACV,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;YAC3D,SAAS;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,eAAe,EAAE,yBAAyB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC/D,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,eAAe,EAAE,6CAA6C,YAAY,yBAAyB,CAAC,CAAC;YAC7G,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,eAAe,EAAE,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3B,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,CAAC,eAAe,EAAE,wEAAwE,CAAC,CAAC;YACnG,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;YACvB,CAAC;QACF,CAAC;aAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,eAAe,EAAE,6BAA6B,MAAM,CAAC,MAAM,gCAAgC,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACP,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3B,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,eAAe,EAAE,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;IAE7B,IAAI,QAAiC,CAAC;IACtC,IAAI,QAAgB,CAAC;IACrB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;QAC3D,QAAQ,GAAG,OAAO,MAAM,CAAC,MAAM,IAAI,gBAAgB,SAAS,CAAC;IAC9D,CAAC;SAAM,CAAC;QACP,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/B,QAAQ,GAAG,OAAO,MAAM,CAAC,MAAM,UAAU,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,mBAAmB,EAAE,GAAG,QAAQ,kCAAkC,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAU,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,mBAAmB,EAAE,GAAG,QAAQ,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;IACF,CAAC;IAED,IAAI,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;IAC3B,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzD,SAAS,GAAG,mBAAmB,CAAC;IACjC,CAAC;IACD,IAAI,eAAe,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAC3H,MAAM,CAAC,eAAe,EAAE,eAAe,eAAe,2BAA2B,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAM,CAAC,MAAM,CAAC,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAwB,EAAE,QAAQ,GAAW,eAAe;IACrG,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAK,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACvC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,OAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/identity/load.d.ts

@@ -0,0 +1,38 @@
+import type { UserClient } from '@keetanetwork/keetanet-client';
+import type { UserClientBuilder } from '@keetanetwork/keetanet-client/client/builder.js';
+import type { Account, GenericAccount } from './account.js';
+import type { Driver, DriverContext, Environment } from './drivers.js';
+import type { FeePayer, KeySpec, Loaded } from './schema.js';
+export interface LoadKeysOptions {
+    readonly env: Environment;
+    readonly drivers: readonly Driver[];
+    /**
+     * How file-based sources read; `node:fs/promises` by default.
+     */
+    readonly readFile?: DriverContext['readFile'];
+}
+/**
+ * Decodes the environment and checks every static rule, reporting all
+ * issues at once; only then reads the keys, again reporting every issue.
+ */
+export declare function loadKeys<S extends KeySpec>(spec: S, options: LoadKeysOptions): Promise<Loaded<S>>;
+type PublishOptions = NonNullable<Parameters<UserClientBuilder['publish']>[0]>;
+export type GenerateFeeBlock = NonNullable<PublishOptions['generateFeeBlock']>;
+/**
+ * What the fee block generator needs of a `UserClient`.
+ */
+export interface FeeBlockClient {
+    initBuilder(options?: Parameters<UserClient['initBuilder']>[0]): {
+        computeFeeBlock(staple: Parameters<GenerateFeeBlock>[0], options: {
+            readonly account: GenericAccount;
+            readonly signer: Account;
+        }): ReturnType<GenerateFeeBlock>;
+    };
+}
+/**
+ * The `generateFeeBlock` option for publishing: upstream's default, with the
+ * fee payer's account and signer.
+ */
+export declare function createFeeBlockGenerator(feePayer: FeePayer, client: FeeBlockClient): GenerateFeeBlock;
+export {};
+//# sourceMappingURL=load.d.ts.map

package/dist/identity/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/identity/load.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAEzF,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAkB,WAAW,EAAE,MAAM,cAAc,CAAC;AASvF,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,SAAS,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CA6CvG;AAwGD,KAAK,cAAc,GAAG,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAChE,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;SAAE,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;KAChK,CAAC;CACF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAIpG"}

package/dist/identity/load.js

@@ -0,0 +1,167 @@
+import { readFile } from 'node:fs/promises';
+import * as KeetaNet from '@keetanetwork/keetanet-client';
+import { accountKeyAlgorithm, parseAddress, upstreamKeyAlgorithm } from './account.js';
+import { createDriverRegistry, defaultIndex, defaultKeyAlgorithm, defaultKeyFormat } from './drivers.js';
+import { decodeEnvironment } from './environment.js';
+import { KeyConfigError } from './error.js';
+import { formatKeyRef } from './keyref.js';
+import { checkPassphraseText, checkSeedText } from './material.js';
+import { analyzeKeyConfig, checkExpectedAccount, checkUnknownVariables, fieldIssue } from './rules.js';
+/**
+ * Decodes the environment and checks every static rule, reporting all
+ * issues at once; only then reads the keys, again reporting every issue.
+ */
+export async function loadKeys(spec, options) {
+    const registry = createDriverRegistry(options.drivers);
+    const analysis = analyzeKeyConfig(spec, decodeEnvironment(spec, options.env), registry);
+    KeyConfigError.throwIfAny([...analysis.issues, ...checkUnknownVariables(spec, options.env, analysis.referencedVariables)]);
+    const issues = [];
+    const accounts = new Map();
+    const signers = new Map();
+    for (const slot of analysis.slots) {
+        const account = await loadSlot(slot, registry, { env: options.env, readFile: options.readFile ?? readFile }, issues);
+        if (account === undefined) {
+            continue;
+        }
+        accounts.set(slot.field.path, account);
+        if (slot.field.block.kind === 'signer') {
+            // loadSlot has checked that a signer's account is a key pair.
+            signers.set(slot.field.path, account.assertAccount());
+        }
+    }
+    KeyConfigError.throwIfAny(issues);
+    const loaded = {};
+    for (const [role, block] of Object.entries(spec.roles)) {
+        if (block.kind === 'network') {
+            loaded[role] = analysis.networks.get(role);
+        }
+        else if (block.kind !== 'actor') {
+            loaded[role] = accounts.get(role);
+        }
+        else {
+            const signer = signers.get(`${role}.signer`);
+            if (signer === undefined) {
+                throw (new Error(`the signer of ${role} did not load, without an issue`));
+            }
+            const actor = {
+                signer,
+                account: accounts.get(`${role}.account`) ?? signer,
+                network: analysis.networks.get(`${role}.network`)
+            };
+            if (block.options.feePayer !== undefined) {
+                actor['feePayer'] = resolveFeePayer(signer, signers.get(`${role}.feePayer`), accounts.get(`${role}.feeAccount`));
+            }
+            loaded[role] = actor;
+        }
+    }
+    // Each role was assembled from the fields of its own block.
+    return loaded;
+}
+async function loadSlot(slot, registry, context, issues) {
+    const ref = slot.ref;
+    if (ref.kind === 'address') {
+        return (KeetaNet.lib.Account.fromPublicKeyString(ref.address));
+    }
+    function report(code, message) {
+        issues.push(fieldIssue(slot.field, code, `${formatKeyRef(ref)}: ${message}`));
+        return (undefined);
+    }
+    let account;
+    const driver = registry.driver(ref.scheme);
+    try {
+        if (driver?.kind === 'signer') {
+            account = await driver.load(ref, context);
+        }
+        else if (driver?.kind === 'source') {
+            account = await decode(ref, await driver.read(ref, context), report);
+        }
+    }
+    catch (error) {
+        // A driver's message may hold anything; only its KeyConfigError
+        // issues are written to be shown.
+        if (!KeyConfigError.isInstance(error)) {
+            return (report('READ_FAILED', 'the driver failed'));
+        }
+        for (const found of error.issues) {
+            report(found.code, found.message);
+        }
+        return (undefined);
+    }
+    if (account === undefined) {
+        return (undefined);
+    }
+    if (slot.field.block.kind === 'signer') {
+        const algorithm = accountKeyAlgorithm(account);
+        if (!account.hasPrivateKey || algorithm === undefined) {
+            return (report('SIGNER_REQUIRED', 'loaded an account that cannot sign'));
+        }
+        if (!slot.field.block.constraints.algorithms.includes(algorithm)) {
+            report('ALGORITHM_UNSUPPORTED', `loaded a ${algorithm} key, which this role does not take`);
+        }
+    }
+    issues.push(...checkExpectedAccount(account, slot));
+    return (account);
+}
+async function decode(ref, bytes, report) {
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return (report('INVALID_CONTENT', 'the key is not UTF-8 text'));
+    }
+    const format = ref.format ?? defaultKeyFormat;
+    if (format === 'public') {
+        return (parseAddress(text.trim()) ?? report('INVALID_CONTENT', 'the value is not a keeta_ address'));
+    }
+    let check = checkSeedText(text);
+    if (format === 'passphrase') {
+        check = checkPassphraseText(text);
+    }
+    if (!check.valid) {
+        return (report('INVALID_CONTENT', check.reason));
+    }
+    try {
+        let seed = check.content;
+        if (format === 'passphrase') {
+            seed = await KeetaNet.lib.Account.seedFromPassphrase(check.content);
+        }
+        return (KeetaNet.lib.Account.fromSeed(seed, ref.index ?? defaultIndex, upstreamKeyAlgorithm(ref.alg ?? defaultKeyAlgorithm)));
+    }
+    catch (error) {
+        return (report('INVALID_CONTENT', `upstream rejected the ${format}${upstreamCode(error)}`));
+    }
+}
+/**
+ * Upstream's error codes name the problem without the key, which its
+ * messages may quote.
+ */
+function upstreamCode(error) {
+    if (typeof error !== 'object' || error === null) {
+        return ('');
+    }
+    const code = Reflect.get(error, 'code');
+    if (typeof code === 'string' && /^[A-Z][A-Z0-9_]*$/.test(code)) {
+        return (` (${code})`);
+    }
+    return ('');
+}
+function resolveFeePayer(signer, feePayerSigner, feeAccount) {
+    if (feePayerSigner !== undefined) {
+        return ({ signer: feePayerSigner, account: feeAccount ?? feePayerSigner });
+    }
+    if (feeAccount !== undefined) {
+        return ({ signer, account: feeAccount });
+    }
+    return (undefined);
+}
+/**
+ * The `generateFeeBlock` option for publishing: upstream's default, with the
+ * fee payer's account and signer.
+ */
+export function createFeeBlockGenerator(feePayer, client) {
+    return (function (staple, options) {
+        return (client.initBuilder(options).computeFeeBlock(staple, { account: feePayer.account, signer: feePayer.signer }));
+    });
+}
+//# sourceMappingURL=load.js.map

package/dist/identity/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/identity/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,+BAA+B,CAAC;AAG1D,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEvF,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzG,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAavG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAoB,IAAO,EAAE,OAAwB;IAClF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxF,cAAc,CAAC,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAE3H,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QACrH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACV,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,8DAA8D;YAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IACD,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAK,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,iCAAiC,CAAC,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,GAA4B;gBACtC,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,MAAM;gBAClD,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,UAAU,CAAC;aACjD,CAAC;YACF,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC1C,KAAK,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACF,CAAC;IACD,4DAA4D;IAC5D,OAAO,MAAoB,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAU,EAAE,QAAwB,EAAE,OAAsB,EAAE,MAAwB;IAC7G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,SAAS,MAAM,CAAC,IAAwB,EAAE,OAAe;QACxD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAM,CAAC,SAAS,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,OAAmC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC;QACJ,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACtE,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,gEAAgE;QAChE,kCAAkC;QAClC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAM,CAAC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAM,CAAC,SAAS,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAM,CAAC,SAAS,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACvD,OAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,uBAAuB,EAAE,YAAY,SAAS,qCAAqC,CAAC,CAAC;QAC7F,CAAC;IACF,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,OAAM,CAAC,OAAO,CAAC,CAAC;AACjB,CAAC;AAID,KAAK,UAAU,MAAM,CAAC,GAAiB,EAAE,KAAiB,EAAE,MAAc;IACzE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACR,OAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAC9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC7B,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClB,OAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC;QACJ,IAAI,IAAI,GAAyB,KAAK,CAAC,OAAO,CAAC;QAC/C,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC7B,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC;QACD,OAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,YAAY,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAC9H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,OAAM,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAM,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAM,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,MAAe,EAAE,cAAmC,EAAE,UAAsC;IACpH,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,OAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAM,CAAC,SAAS,CAAC,CAAC;AACnB,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAkB,EAAE,MAAsB;IACjF,OAAM,CAAC,UAAS,MAAM,EAAE,OAAO;QAC9B,OAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/identity/material.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Whether a value that should be a ref looks like a secret instead: a 64-digit
+ * hex seed or private key, or a passphrase of 12 or more words.
+ */
+export declare function looksLikeKeyMaterial(value: string): boolean;
+export type ContentCheck = {
+    readonly valid: true;
+    readonly content: string;
+} | {
+    readonly valid: false;
+    readonly reason: string;
+};
+/**
+ * The content checks on bytes read from a source, after trimming. A reason
+ * never includes the content.
+ */
+export declare function checkSeedText(text: string): ContentCheck;
+export declare function checkPassphraseText(text: string): ContentCheck;
+//# sourceMappingURL=material.d.ts.map

package/dist/identity/material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"material.d.ts","sourceRoot":"","sources":["../../src/identity/material.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS3D;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnI;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAMxD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAM9D"}

package/dist/identity/material.js

@@ -0,0 +1,34 @@
+const hexKeyPattern = /^[0-9a-fA-F]{64}$/;
+/**
+ * Whether a value that should be a ref looks like a secret instead: a 64-digit
+ * hex seed or private key, or a passphrase of 12 or more words.
+ */
+export function looksLikeKeyMaterial(value) {
+    const trimmed = value.trim();
+    if (hexKeyPattern.test(trimmed)) {
+        return (true);
+    }
+    const words = trimmed.split(/\s+/).filter(function (word) {
+        return (word !== '');
+    });
+    return (words.length >= 12);
+}
+/**
+ * The content checks on bytes read from a source, after trimming. A reason
+ * never includes the content.
+ */
+export function checkSeedText(text) {
+    const trimmed = text.trim();
+    if (!hexKeyPattern.test(trimmed)) {
+        return ({ valid: false, reason: 'a seed must be 64 hexadecimal digits' });
+    }
+    return ({ valid: true, content: trimmed });
+}
+export function checkPassphraseText(text) {
+    const trimmed = text.trim();
+    if (trimmed === '') {
+        return ({ valid: false, reason: 'a passphrase must not be empty' });
+    }
+    return ({ valid: true, content: trimmed });
+}
+//# sourceMappingURL=material.js.map

package/dist/identity/material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"material.js","sourceRoot":"","sources":["../../src/identity/material.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAM,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,UAAS,IAAI;QACtD,OAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAC5B,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,OAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/identity/rules.d.ts

@@ -0,0 +1,56 @@
+import type { GenericAccount, Network } from './account.js';
+import type { DriverRegistry, Environment } from './drivers.js';
+import type { KeyConfigIssue, KeyConfigIssueCode } from './error.js';
+import type { KeyRef } from './keyref.js';
+import type { ConfigText, Field, KeySpec, SignerConstraints } from './schema.js';
+/**
+ * A parsed ref and the field it fills.
+ */
+export interface Slot {
+    readonly field: Field;
+    readonly ref: KeyRef;
+}
+export interface Analysis {
+    readonly issues: readonly KeyConfigIssue[];
+    readonly networks: ReadonlyMap<string, Network>;
+    /**
+     * Complete only when there are no issues.
+     */
+    readonly slots: readonly Slot[];
+    /**
+     * The variables the refs read, which are therefore not unknown.
+     */
+    readonly referencedVariables: ReadonlySet<string>;
+}
+interface Problem {
+    readonly code: KeyConfigIssueCode;
+    readonly message: string;
+}
+export declare function fieldIssue(field: Field, code: KeyConfigIssueCode, message: string): KeyConfigIssue;
+/**
+ * The static rules for a ref in a signer position, against the driver's
+ * declared capabilities. `network` undefined is unknown, which counts as
+ * `main`.
+ */
+export declare function checkSignerRef(ref: KeyRef, registry: DriverRegistry, constraints: SignerConstraints, network: Network | undefined): Problem[];
+/**
+ * The static rules for a ref in a signerless position.
+ */
+export declare function checkPublicRef(ref: KeyRef, registry: DriverRegistry): Problem[];
+/**
+ * After loading: whether the key is the one its ref expects. The message
+ * names the derived public key, never anything else about the key.
+ */
+export declare function checkExpectedAccount(account: GenericAccount, slot: Slot): KeyConfigIssue[];
+/**
+ * Every rule that needs only the spec and the refs, so it runs before any
+ * secret is read.
+ */
+export declare function analyzeKeyConfig(spec: KeySpec, config: ConfigText, registry: DriverRegistry): Analysis;
+/**
+ * Every variable under a declared prefix (`PREFIX_*`, or a bare actor
+ * prefix) that neither a role nor a ref reads, so that a typo fails.
+ */
+export declare function checkUnknownVariables(spec: KeySpec, env: Environment, referencedVariables: ReadonlySet<string>): KeyConfigIssue[];
+export {};
+//# sourceMappingURL=rules.d.ts.map

package/dist/identity/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/identity/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAgB,OAAO,EAAE,MAAM,cAAc,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAsB,MAAM,cAAc,CAAC;AAEpF,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,IAAI;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAChC;;OAEG;IACH,QAAQ,CAAC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClD;AAED,UAAU,OAAO;IAChB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAElG;AA2BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,EAAE,CAoC7I;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,EAAE,CAW/E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,GAAG,cAAc,EAAE,CAK1F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,QAAQ,CA8CtG;AAaD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE,CAkBjI"}