open-action-consent 0.0.0-stage → 0.2.0

package/dist/gate.js

@@ -0,0 +1,143 @@
+// A framework-neutral executor gate (twin of gate.py): tier, Preview, Consent hand-over, verification right before
+// the action, run, signed Receipt. A pending Preview is reused for the same person and action until it expires, so
+// a framework that re-runs a step after an interruption gets the Preview the person approved.
+import * as crypto from "node:crypto";
+import * as shapes from "./shapes.js";
+import { OACError } from "./errors.js";
+import { digest, KeySet, tokenDigest, verify } from "./jws.js";
+import { MemoryNonces, verifyConsent } from "./consent.js";
+import { actionDigest, buildPreview } from "./preview.js";
+import { makeReceipt } from "./receipts.js";
+import { tierFor } from "./tiers.js";
+export class NeedsConsent extends Error {
+    preview;
+    constructor(preview) { super("the person must approve this preview"); this.preview = preview; }
+}
+export class Gate {
+    executor;
+    key;
+    signers;
+    nonces;
+    policyFloor;
+    profiles = {};
+    pending = new Map(); // person \0 action digest -> preview
+    consents = new Map();
+    receipts = new Map();
+    clock;
+    summarize;
+    constructor(o) {
+        this.executor = o.executor;
+        this.key = o.key;
+        this.signers = o.signers;
+        this.nonces = o.nonces ?? new MemoryNonces();
+        this.policyFloor = o.policyFloor ?? "A";
+        this.clock = o.clock ?? (() => Math.floor(Date.now() / 1000));
+        this.summarize = o.summarize ?? ((a) => `${a.tool}: ` + Object.keys(a.args).sort().map((k) => `${k}=${JSON.stringify(a.args[k])}`).join(", ").slice(0, 480));
+    }
+    profile(tool, p) {
+        const doc = { oac: "0.1", type: "action-profile", tool, effect: p.effect, undo: { kind: p.undo ?? "none", window_s: p.windowS ?? 0 },
+            tier_floor: p.tierFloor ?? "A", binds: { ...(p.binds ?? {}) } };
+        if (p.otherArgs?.length)
+            doc.other_args = [...p.otherArgs];
+        this.profiles[tool] = shapes.profile(doc);
+        return doc;
+    }
+    prof(tool) {
+        const p = Object.hasOwn(this.profiles, tool) ? this.profiles[tool] : undefined;
+        if (!p)
+            throw new OACError("unknown_tool", `${tool} has no OAC profile`);
+        return p;
+    }
+    tier(tool, args, tainted = true) {
+        const profile = this.prof(tool);
+        shapes.checkAction({ tool, args: { ...args } }, profile);
+        return tierFor(profile, { policyFloor: this.policyFloor, tainted });
+    }
+    preview(tool, args, person, evidence) {
+        const action = { tool, args: { ...args } };
+        const key = person + "\0" + actionDigest(action);
+        const now = this.clock();
+        let p = this.pending.get(key);
+        if (!p || now >= p.exp) {
+            p = buildPreview({ profile: this.prof(tool), action, executor: this.executor, sub: person, summary: this.summarize(action), now,
+                previewId: "pv_" + crypto.randomBytes(12).toString("base64url"), evidence });
+            this.pending.set(key, p);
+        }
+        return p;
+    }
+    previewById(id) { return [...this.pending.values()].find((p) => p.id === id); }
+    acceptConsent(token) {
+        let c;
+        try {
+            c = verify(token, this.signers, "oac-consent+jws");
+            shapes.consent(c);
+        }
+        catch {
+            return false;
+        }
+        const pending = new Set([...this.pending.values()].map(digest));
+        let kept = false;
+        for (const item of c.aud === this.executor ? c.items : []) {
+            if (pending.has(item.preview) && !this.consents.has(item.preview)) {
+                this.consents.set(item.preview, token);
+                kept = true;
+            }
+        }
+        return kept;
+    }
+    authorize(tool, args, person, tainted) {
+        const tier = this.tier(tool, args, tainted);
+        if (tier === "D")
+            throw new OACError("tier_d", "this action never runs");
+        if (tier === "A" || tier === "B")
+            return [tier, { kind: "tier" }, null];
+        const action = { tool, args: { ...args } };
+        const preview = this.preview(tool, args, person);
+        const pd = digest(preview);
+        const token = this.consents.get(pd);
+        if (!token)
+            throw new NeedsConsent(preview);
+        const c = verifyConsent(token, { keys: this.signers, executor: this.executor, sub: person, previews: [preview], actions: [action],
+            profiles: this.profiles, now: this.clock(), nonces: this.nonces, policyFloor: this.policyFloor, tainted });
+        this.pending.delete(person + "\0" + actionDigest(action));
+        return ["C", { kind: "consent", ref: c.jti }, pd];
+    }
+    async run(tool, args, fn, o) {
+        const [tier, authority, pd] = this.authorize(tool, args, o.person, o.tainted ?? true);
+        let result;
+        try {
+            result = await fn(args);
+        }
+        catch (e) {
+            this.receipt(o.person, tool, args, tier, authority, pd, null, true);
+            throw e;
+        }
+        return [result, this.receipt(o.person, tool, args, tier, authority, pd, result, false)];
+    }
+    receipt(person, tool, args, tier, authority, pd, result, failed) {
+        const profile = this.profiles[tool];
+        const chain = this.receipts.get(person) ?? [];
+        this.receipts.set(person, chain);
+        const now = this.clock();
+        const undo = { kind: profile.undo.kind };
+        if (undo.kind !== "none" && !failed) {
+            undo.until = now + profile.undo.window_s;
+            if (undo.kind === "native")
+                undo.token = "u_" + crypto.randomBytes(12).toString("base64url");
+        }
+        let rd;
+        try {
+            rd = digest(result ?? null);
+        }
+        catch {
+            rd = digest(String(result));
+        }
+        const payload = { iss: this.executor, sub: person, seq: chain.length + 1, prev: chain.length ? tokenDigest(chain[chain.length - 1]) : null,
+            iat: now, tool, tier, authority, action: actionDigest({ tool, args: { ...args } }), outcome: failed ? "failed" : "ok", result: rd, undo };
+        if (pd)
+            payload.preview = pd;
+        const r = makeReceipt(this.key, payload);
+        chain.push(r);
+        return r;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { CODES, OACError } from "./errors.ts";
+export { canonical, parse } from "./jcs.ts";
+export { digest, generate, KeySet, sign, tokenDigest, verify, type Jwk, type SigningKey } from "./jws.ts";
+export { tierFor } from "./tiers.ts";
+export * as shapes from "./shapes.ts";
+export { actionDigest, buildPreview, checkBinding } from "./preview.ts";
+export { makeConsent, MemoryNonces, verifyConsent, type NonceStore } from "./consent.ts";
+export { checkMandate, loosens, makeMandate } from "./mandate.ts";
+export { makeReceipt, verifyChain } from "./receipts.ts";
+export { checkUndo, makeUndo } from "./undo.ts";
+export { Gate, NeedsConsent, type ProfileSpec } from "./gate.ts";
+export declare const VERSION = "0.2.0";

package/dist/index.js

@@ -0,0 +1,13 @@
+// OAC (Open Action Consent) v0.1 reference SDK for TypeScript. Spec: spec/oac-v0.1.md.
+export { CODES, OACError } from "./errors.js";
+export { canonical, parse } from "./jcs.js";
+export { digest, generate, KeySet, sign, tokenDigest, verify } from "./jws.js";
+export { tierFor } from "./tiers.js";
+export * as shapes from "./shapes.js";
+export { actionDigest, buildPreview, checkBinding } from "./preview.js";
+export { makeConsent, MemoryNonces, verifyConsent } from "./consent.js";
+export { checkMandate, loosens, makeMandate } from "./mandate.js";
+export { makeReceipt, verifyChain } from "./receipts.js";
+export { checkUndo, makeUndo } from "./undo.js";
+export { Gate, NeedsConsent } from "./gate.js";
+export const VERSION = "0.2.0";

package/dist/jcs.d.ts

@@ -0,0 +1,8 @@
+export type Json = null | boolean | number | string | Json[] | {
+    [k: string]: Json;
+};
+export declare const MAX_DEPTH = 64;
+export declare function canonical(v: unknown, depth?: number): string;
+export declare function canonicalBytes(v: unknown): Uint8Array;
+/** Parse JSON strictly: no duplicate keys, no fractions or exponents, no NaN, integers in the safe range. */
+export declare function parse(input: string | Uint8Array): Json;

package/dist/jcs.js

@@ -0,0 +1,177 @@
+// RFC 8785 (JCS) canonical JSON for the OAC subset, plus a strict parser. OAC carries integers only (money in minor
+// units, time in unix seconds), so JCS reduces to: keys sorted by UTF-16 code units (JavaScript's default sort),
+// no whitespace, strings as JSON.stringify writes them, integers in plain decimal within +-(2^53 - 1).
+import { OACError } from "./errors.js";
+export const MAX_DEPTH = 64; // arrays and objects nested deeper than this are refused
+function str(s) {
+    if (!s.isWellFormed())
+        throw new OACError("malformed", "string is not valid Unicode");
+    return JSON.stringify(s);
+}
+export function canonical(v, depth = 0) {
+    if (v === null)
+        return "null";
+    if (v === true)
+        return "true";
+    if (v === false)
+        return "false";
+    if (typeof v === "number") {
+        if (!Number.isInteger(v))
+            throw new OACError("malformed", "non-integer numbers are not allowed");
+        if (!Number.isSafeInteger(v))
+            throw new OACError("malformed", "integer out of the safe range");
+        return String(v === 0 ? 0 : v);
+    }
+    if (typeof v === "string")
+        return str(v);
+    if (typeof v === "object" && depth >= MAX_DEPTH)
+        throw new OACError("malformed", "nested too deeply");
+    if (Array.isArray(v))
+        return "[" + v.map((x) => canonical(x, depth + 1)).join(",") + "]";
+    if (typeof v === "object") {
+        const o = v;
+        const keys = Object.keys(o).map((k) => [k, str(k)]); // Unicode check before sorting
+        return "{" + keys.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0)).map(([k, s]) => s + ":" + canonical(o[k], depth + 1)).join(",") + "}";
+    }
+    throw new OACError("malformed", `type ${typeof v} cannot be canonicalized`);
+}
+export function canonicalBytes(v) {
+    return new TextEncoder().encode(canonical(v));
+}
+const WS = new Set([" ", "\t", "\n", "\r"]);
+const ESC = { '"': '"', "\\": "\\", "/": "/", b: "\b", f: "\f", n: "\n", r: "\r", t: "\t" };
+/** Parse JSON strictly: no duplicate keys, no fractions or exponents, no NaN, integers in the safe range. */
+export function parse(input) {
+    let text;
+    try {
+        text = typeof input === "string" ? input : new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(input);
+    }
+    catch {
+        throw new OACError("malformed", "not UTF-8");
+    }
+    let i = 0, depth = 0;
+    const bad = (why) => { throw new OACError("malformed", why); };
+    const ws = () => { while (i < text.length && WS.has(text[i]))
+        i++; };
+    const value = () => {
+        ws();
+        const c = text[i];
+        if (c === "{" || c === "[") {
+            depth++;
+            if (depth > MAX_DEPTH)
+                bad("nested too deeply");
+        }
+        if (c === "{") {
+            i++;
+            const entries = [];
+            const seen = new Set();
+            ws();
+            if (text[i] === "}") {
+                i++;
+                depth--;
+                return Object.fromEntries(entries);
+            }
+            for (;;) {
+                ws();
+                if (text[i] !== '"')
+                    bad("expected a key");
+                const k = string();
+                if (seen.has(k))
+                    bad(`duplicate key ${k}`);
+                seen.add(k);
+                ws();
+                if (text[i++] !== ":")
+                    bad("expected :");
+                entries.push([k, value()]);
+                ws();
+                if (text[i] === ",") {
+                    i++;
+                    continue;
+                }
+                if (text[i] === "}") {
+                    i++;
+                    depth--;
+                    return Object.fromEntries(entries);
+                }
+                bad("expected , or }");
+            }
+        }
+        if (c === "[") {
+            i++;
+            const out = [];
+            ws();
+            if (text[i] === "]") {
+                i++;
+                depth--;
+                return out;
+            }
+            for (;;) {
+                out.push(value());
+                ws();
+                if (text[i] === ",") {
+                    i++;
+                    continue;
+                }
+                if (text[i] === "]") {
+                    i++;
+                    depth--;
+                    return out;
+                }
+                bad("expected , or ]");
+            }
+        }
+        if (c === '"')
+            return string();
+        for (const [word, val] of [["true", true], ["false", false], ["null", null]]) {
+            if (text.startsWith(word, i)) {
+                i += word.length;
+                return val;
+            }
+        }
+        const m = /^-?(0|[1-9][0-9]*)/.exec(text.slice(i));
+        if (!m)
+            return bad("not JSON");
+        i += m[0].length;
+        if (i < text.length && ".eE".includes(text[i]))
+            bad("non-integer numbers are not allowed");
+        const n = Number(m[0]);
+        if (!Number.isSafeInteger(n))
+            bad("integer out of the safe range");
+        return n;
+    };
+    const string = () => {
+        i++; // opening quote
+        let out = "";
+        for (;;) {
+            if (i >= text.length)
+                bad("unterminated string");
+            const c = text[i++];
+            if (c === '"')
+                return out;
+            if (c < " ")
+                bad("control character in string");
+            if (c !== "\\") {
+                out += c;
+                continue;
+            }
+            const e = text[i++];
+            if (e === "u") {
+                const hex = text.slice(i, i + 4);
+                if (!/^[0-9a-fA-F]{4}$/.test(hex))
+                    bad("bad \\u escape");
+                out += String.fromCharCode(parseInt(hex, 16));
+                i += 4;
+            }
+            else if (e in ESC)
+                out += ESC[e];
+            else
+                bad("bad escape");
+        }
+    };
+    const v = value();
+    ws();
+    if (i !== text.length)
+        bad("trailing characters");
+    canonical(v); // Unicode check
+    return v;
+}

package/dist/jws.d.ts

@@ -0,0 +1,39 @@
+import * as crypto from "node:crypto";
+export declare const ALGS: string[];
+export type Jwk = {
+    kty: string;
+    crv: string;
+    x: string;
+    y?: string;
+    kid?: string;
+};
+export type SigningKey = {
+    alg: string;
+    private: crypto.KeyObject;
+    jwk: Jwk & {
+        kid: string;
+    };
+};
+export declare function b64url(data: Uint8Array): string;
+export declare function b64urlDecode(text: string): Uint8Array;
+export declare function digestBytes(data: Uint8Array): string;
+/** The digest of a JSON value: sha-256 over its JCS bytes. */
+export declare function digest(value: unknown): string;
+export declare function thumbprint(jwk: Jwk): string;
+export declare function ed25519FromSeed(seed: Uint8Array): SigningKey;
+export declare function p256FromSeed(seed: Uint8Array): SigningKey;
+export declare function generate(alg?: string): SigningKey;
+/** Public keys a verifier trusts, grouped by issuer: {iss: [jwk, ...]}. A kid maps to one key and one issuer. */
+export declare class KeySet {
+    private keys;
+    constructor(byIssuer: Record<string, Jwk[]>);
+    get(kid: string): (Jwk & {
+        kid: string;
+    }) | undefined;
+    issuer(kid: string): string | undefined;
+}
+export declare function sign(payload: Record<string, unknown>, key: SigningKey, typ: string): string;
+/** Check the envelope and signature; return the payload. Field checks are the caller's. */
+export declare function verify(token: string, keys: KeySet, typ: string): Record<string, any>;
+/** The digest a later object uses to name a signed token (receipt chains, undo requests). */
+export declare function tokenDigest(token: string): string;

package/dist/jws.js

@@ -0,0 +1,175 @@
+// Keys, digests and the JWS envelope (RFC 7515 compact). Header = exactly {alg, kid, typ}, JCS-canonical; payload =
+// JCS-canonical JSON; a token whose bytes are not the canonical form of what they parse to is refused.
+// Algorithms: EdDSA (Ed25519, RFC 8037) and ES256 (P-256, raw r||s, low-S only). kid = the RFC 7638 JWK thumbprint.
+// Every trusted key belongs to exactly one issuer, and a token's `iss` must be its key's issuer.
+import * as crypto from "node:crypto";
+import { OACError } from "./errors.js";
+import { canonical, canonicalBytes, parse } from "./jcs.js";
+export const ALGS = ["EdDSA", "ES256"];
+const B64URL = /^[A-Za-z0-9_-]*$/;
+const enc = new TextEncoder();
+export function b64url(data) {
+    return Buffer.from(data).toString("base64url");
+}
+export function b64urlDecode(text) {
+    if (typeof text !== "string" || !B64URL.test(text) || text.length % 4 === 1)
+        throw new OACError("malformed", "not base64url");
+    const raw = Buffer.from(text, "base64url");
+    if (b64url(raw) !== text)
+        throw new OACError("malformed", "non-canonical base64url");
+    return raw;
+}
+export function digestBytes(data) {
+    return "sha-256:" + b64url(crypto.createHash("sha256").update(data).digest());
+}
+/** The digest of a JSON value: sha-256 over its JCS bytes. */
+export function digest(value) {
+    return digestBytes(canonicalBytes(value));
+}
+export function thumbprint(jwk) {
+    let members;
+    if (jwk.kty === "OKP")
+        members = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+    else if (jwk.kty === "EC")
+        members = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+    else
+        throw new OACError("malformed", "unsupported key type");
+    return b64url(crypto.createHash("sha256").update(canonicalBytes(members)).digest());
+}
+function withKid(jwk) {
+    return { ...jwk, kid: thumbprint(jwk) };
+}
+const ED25519_PKCS8 = Buffer.from("302e020100300506032b657004220420", "hex");
+const P256_ORDER = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+export function ed25519FromSeed(seed) {
+    const priv = crypto.createPrivateKey({ key: Buffer.concat([ED25519_PKCS8, Buffer.from(seed)]), format: "der", type: "pkcs8" });
+    const pub = crypto.createPublicKey(priv).export({ format: "jwk" });
+    return { alg: "EdDSA", private: priv, jwk: withKid({ kty: "OKP", crv: "Ed25519", x: pub.x }) };
+}
+export function p256FromSeed(seed) {
+    const d = (BigInt("0x" + Buffer.from(seed).toString("hex")) % (P256_ORDER - 1n)) + 1n;
+    const dBytes = Buffer.from(d.toString(16).padStart(64, "0"), "hex");
+    const ecdh = crypto.createECDH("prime256v1");
+    ecdh.setPrivateKey(dBytes);
+    const point = ecdh.getPublicKey(); // 04 || x || y
+    const jwk = { kty: "EC", crv: "P-256", x: b64url(point.subarray(1, 33)), y: b64url(point.subarray(33, 65)) };
+    const priv = crypto.createPrivateKey({ key: { ...jwk, d: b64url(dBytes) }, format: "jwk" });
+    return { alg: "ES256", private: priv, jwk: withKid(jwk) };
+}
+export function generate(alg = "EdDSA") {
+    if (alg === "EdDSA")
+        return ed25519FromSeed(crypto.randomBytes(32));
+    if (alg === "ES256") {
+        const { privateKey } = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+        const pub = crypto.createPublicKey(privateKey).export({ format: "jwk" });
+        return { alg, private: privateKey, jwk: withKid({ kty: "EC", crv: "P-256", x: pub.x, y: pub.y }) };
+    }
+    throw new OACError("bad_alg", alg);
+}
+/** Public keys a verifier trusts, grouped by issuer: {iss: [jwk, ...]}. A kid maps to one key and one issuer. */
+export class KeySet {
+    keys = new Map();
+    constructor(byIssuer) {
+        if (byIssuer === null || typeof byIssuer !== "object" || Array.isArray(byIssuer)) {
+            throw new OACError("malformed", "keys are grouped by issuer: {iss: [jwk, ...]}");
+        }
+        for (const [iss, jwks] of Object.entries(byIssuer)) {
+            for (const jwk of jwks) {
+                const kid = thumbprint(jwk);
+                if (jwk.kid !== undefined && jwk.kid !== kid)
+                    throw new OACError("malformed", "kid is not the key's thumbprint");
+                const prev = this.keys.get(kid);
+                if (prev && prev[1] !== iss)
+                    throw new OACError("malformed", "one key cannot belong to two issuers");
+                this.keys.set(kid, [{ ...jwk, kid }, iss]);
+            }
+        }
+    }
+    get(kid) {
+        return this.keys.get(kid)?.[0];
+    }
+    issuer(kid) {
+        return this.keys.get(kid)?.[1];
+    }
+}
+const HALF_N = P256_ORDER / 2n;
+const big = (b) => BigInt("0x" + (Buffer.from(b).toString("hex") || "0"));
+export function sign(payload, key, typ) {
+    const header = { alg: key.alg, kid: key.jwk.kid, typ };
+    const input = b64url(canonicalBytes(header)) + "." + b64url(canonicalBytes(payload));
+    let sig = key.alg === "EdDSA"
+        ? crypto.sign(null, enc.encode(input), key.private)
+        : crypto.sign("sha256", enc.encode(input), { key: key.private, dsaEncoding: "ieee-p1363" });
+    if (key.alg === "ES256" && big(sig.subarray(32)) > HALF_N) { // low-S: the other spelling of the same signature
+        const s = (P256_ORDER - big(sig.subarray(32))).toString(16).padStart(64, "0");
+        sig = Buffer.concat([sig.subarray(0, 32), Buffer.from(s, "hex")]);
+    }
+    return input + "." + b64url(sig);
+}
+function checkSig(jwk, alg, data, sig) {
+    let ok;
+    try {
+        if (alg === "EdDSA") {
+            if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519")
+                throw new OACError("bad_alg", "key is not Ed25519");
+            const pub = crypto.createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: jwk.x }, format: "jwk" });
+            ok = crypto.verify(null, data, pub, sig);
+        }
+        else {
+            if (jwk.kty !== "EC" || jwk.crv !== "P-256")
+                throw new OACError("bad_alg", "key is not P-256");
+            if (sig.length !== 64)
+                throw new OACError("bad_signature", "ES256 signature must be 64 bytes");
+            if (big(sig.subarray(32)) > HALF_N)
+                throw new OACError("bad_signature", "ES256 signature must be low-S");
+            const pub = crypto.createPublicKey({ key: { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y }, format: "jwk" });
+            ok = crypto.verify("sha256", data, { key: pub, dsaEncoding: "ieee-p1363" }, sig);
+        }
+    }
+    catch (e) {
+        if (e instanceof OACError)
+            throw e;
+        throw new OACError("bad_signature", "invalid key or signature encoding");
+    }
+    if (!ok)
+        throw new OACError("bad_signature");
+}
+function canonicalPart(part) {
+    const raw = b64urlDecode(part);
+    const value = parse(raw);
+    if (Buffer.compare(Buffer.from(canonicalBytes(value)), Buffer.from(raw)) !== 0)
+        throw new OACError("not_canonical");
+    return value;
+}
+/** Check the envelope and signature; return the payload. Field checks are the caller's. */
+export function verify(token, keys, typ) {
+    if (typeof token !== "string" || !/^[\x00-\x7f]*$/.test(token))
+        throw new OACError("malformed", "token must be an ASCII string");
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new OACError("malformed", "a compact JWS has three parts");
+    const header = canonicalPart(parts[0]);
+    if (header === null || typeof header !== "object" || Array.isArray(header) || canonical(Object.keys(header).sort()) !== '["alg","kid","typ"]') {
+        throw new OACError("malformed", "header must be exactly alg, kid, typ");
+    }
+    if (header.typ !== typ)
+        throw new OACError("bad_type", `expected ${typ}`);
+    if (!ALGS.includes(header.alg))
+        throw new OACError("bad_alg", String(header.alg));
+    const jwk = typeof header.kid === "string" ? keys.get(header.kid) : undefined;
+    if (jwk === undefined)
+        throw new OACError("unknown_key");
+    checkSig(jwk, header.alg, enc.encode(parts[0] + "." + parts[1]), b64urlDecode(parts[2]));
+    const payload = canonicalPart(parts[1]);
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+        throw new OACError("malformed", "payload must be an object");
+    if (payload.iss !== keys.issuer(header.kid))
+        throw new OACError("wrong_issuer", "the token names another issuer than its key's");
+    return payload;
+}
+/** The digest a later object uses to name a signed token (receipt chains, undo requests). */
+export function tokenDigest(token) {
+    if (typeof token !== "string" || !/^[\x00-\x7f]*$/.test(token))
+        throw new OACError("malformed", "token must be an ASCII string");
+    return digestBytes(enc.encode(token));
+}

package/dist/mandate.d.ts

@@ -0,0 +1,24 @@
+import { KeySet, type SigningKey } from "./jws.ts";
+export declare const TYP = "oac-mandate+jws";
+export declare const MAX_S: number;
+export declare function makeMandate(key: SigningKey, payload: Record<string, any>): string;
+export type Usage = {
+    calls_today?: number;
+    calls_this_run?: number;
+    amount_today_minor?: number;
+};
+export declare function checkMandate(token: string, o: {
+    keys: KeySet;
+    action: Record<string, any>;
+    profile: Record<string, any>;
+    holder: Record<string, any>;
+    sub: string;
+    now: number;
+    tainted: boolean;
+    usage?: Usage | null;
+    revoked?: Iterable<string>;
+    statusLists?: Record<string, string>;
+    policyFloor?: string;
+}): Record<string, any>;
+/** What a replacement mandate allows that the old one did not; non-empty = the signer needs fresh proof (spec 7.4). */
+export declare function loosens(old: Record<string, any>, nw: Record<string, any>): string[];