@keyneom/sync-kit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Keyneom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,157 @@
+# @keyneom/sync-kit
+
+Compatibility-preserving encrypted application-data synchronization for web,
+desktop, JavaScript-native, and native protocol consumers.
+
+The package extracts the behavior already implemented by EasyBC and Family
+Chores. It does not own application schemas, merge policy, persistence, UI, or
+lifecycle policy.
+
+## Status
+
+Version `0.1.0` is implemented and configured as a public MIT-licensed package.
+
+The tests in this repository cover frozen compatibility vectors, mocked
+browser providers, package orchestration, and installation/imports from the
+packed tarball. They do not install this package into EasyBC, Family Chores, or
+Keynote.
+
+As separate baseline checks, the existing sync-related tests in EasyBC and
+Family Chores were run unchanged from those repositories. No consumer
+repository was modified. Consumer migrations and their post-migration test
+runs remain separate release gates.
+
+## Install
+
+```sh
+npm install @keyneom/sync-kit
+```
+
+The package has no runtime dependencies and is ESM-only.
+
+## Subpath exports
+
+```ts
+import {
+  easyBcV1Profile,
+  familyChoresV1Profile,
+} from "@keyneom/sync-kit/crypto";
+import { createSnapshotSync } from "@keyneom/sync-kit/snapshot";
+import { createWebPasskeyProvider } from "@keyneom/sync-kit/keys/web-passkey";
+import { GoogleWebAuthorizationProvider } from "@keyneom/sync-kit/auth/google-web";
+import {
+  GoogleDriveAppDataStore,
+  GoogleDriveSnapshotStore,
+} from "@keyneom/sync-kit/stores/google-drive";
+```
+
+Available exports:
+
+- `/core` — provider contracts and standardized errors
+- `/crypto` — v1 envelopes, profiles, AES-GCM/HKDF backends, base64url,
+  optional gzip, and canonical JSON/AAD helpers
+- `/snapshot` — serialized snapshot synchronization
+- `/snapshot/lifecycle` — opt-in browser lifecycle binding
+- `/keys/web-passkey` — WebAuthn PRF keys with exact credential selection,
+  unlock coalescing, raw-secret zeroing, and explicit cache clearing
+- `/auth/google-web` — Google Identity Services with memory-only token reuse,
+  expiry skew, request coalescing, and explicit invalidation
+- `/stores/google-drive` — low-level `appDataFolder` objects plus a typed
+  snapshot wrapper
+
+The root, `/core`, `/crypto`, and `/snapshot` expose no browser adapter.
+Browser globals and script loading are used only after an explicit browser
+subpath method is called.
+
+## Snapshot integration
+
+Applications provide their own codec and state callbacks:
+
+```ts
+const controller = createSnapshotSync({
+  appId: "family-chores",
+  codec: {
+    serialize: (value) => value,
+    parse: parseFamilyChoresPayload,
+    merge: mergeFamilyChoresPayloads,
+    fingerprint: stableFamilyChoresFingerprint,
+    updatedAt: (value) => value.exportedAt,
+  },
+  envelopeCrypto,
+  keyProvider,
+  authorizationProvider,
+  cloudStore,
+  readLocal,
+  applyMerged,
+  envelopeUpdatedAt: (envelope) => envelope.updatedAt,
+});
+
+await controller.setup();
+await controller.sync("change");
+controller.lock();
+```
+
+The controller serializes cloud operations, queues at most one real local
+change behind active work, ignores foreground feedback during OAuth/passkey
+operations, and avoids encryption/upload when the merged stable fingerprint
+matches the remote value.
+
+## Native applications
+
+The wire protocol is the native compatibility boundary; the browser adapter is
+not.
+
+- EasyBC Android's Kotlin implementation reads the same v1 AES-GCM/HKDF/gzip
+  fixtures as this package.
+- React Native and other JavaScript-native runtimes can inject a
+  `CryptoBackend<K>` backed by platform crypto.
+- Kotlin and Swift applications implement the small key, authorization, store,
+  and crypto contracts natively while consuming the shared fixtures.
+- Tauri applications can use `/core`, `/crypto`, and the low-level Google Drive
+  object store, but should perform OAuth in the system browser through
+  Authorization Code + PKCE.
+
+See [native consumer guidance](docs/native-consumers.md) and the exact
+[v1 compatibility contract](docs/compatibility-v1.md).
+
+## Compatibility and isolation
+
+The explicit profiles preserve both applications' v1 filenames, AAD, HKDF
+labels, compression behavior, and passkey names. V1 readers remain separate
+because their cryptographic contexts are intentionally incompatible.
+
+The Drive snapshot wrapper rejects the wrong `appId` before making a request.
+WebAuthn unlock requests include only the envelope's exact credential ID and
+reject the wrong RP ID before opening passkey UI.
+
+Do not change EasyBC's writer to v2 until Android can read v2. V2 envelopes and
+desktop-specific authorization/key adapters remain deferred.
+
+## Security boundary
+
+The package:
+
+- keeps OAuth tokens and derived keys in memory only;
+- makes AES-GCM keys non-extractable in the WebCrypto backend;
+- zeroes raw PRF output after derivation;
+- clears key and authorization caches on explicit lock/delete;
+- authenticates each v1 ciphertext with its application-specific AAD.
+
+Applications still control provider configuration, metadata exposure, merge
+correctness, local persistence, lifecycle timing, and access to the JavaScript
+runtime. The package does not make a compromised application private.
+
+## Development
+
+```sh
+npm install
+npm run check
+```
+
+`npm run check` verifies deterministic fixtures, lint, types, tests, build
+output, packed contents, npm installation, pnpm installation, and every
+documented subpath import from the installed tarball.
+
+The extraction plan and phase gates are in
+[docs/implementation-plan.md](docs/implementation-plan.md) and
+[docs/execution-checklist.md](docs/execution-checklist.md).

package/dist/auth/google-web/index.d.ts

@@ -0,0 +1,53 @@
+import type { Authorization, AuthorizationProvider } from "../../core/types.js";
+export declare const GOOGLE_DRIVE_APPDATA_SCOPE = "https://www.googleapis.com/auth/drive.appdata";
+type TokenResponse = {
+    access_token?: string;
+    expires_in?: number;
+    error?: string;
+    error_description?: string;
+};
+type TokenClient = {
+    requestAccessToken(options?: {
+        prompt?: string;
+    }): void;
+};
+type GoogleIdentity = {
+    accounts: {
+        oauth2: {
+            initTokenClient(config: {
+                client_id: string;
+                scope: string;
+                callback(response: TokenResponse): void;
+                error_callback?(error: {
+                    type?: string;
+                }): void;
+            }): TokenClient;
+        };
+    };
+};
+export type GoogleWebAuthorizationOptions = {
+    clientId: string;
+    scope?: string;
+    expirySkewMs?: number;
+    now?: () => number;
+    window?: Window & {
+        google?: GoogleIdentity;
+    };
+    document?: Document;
+};
+export declare class GoogleWebAuthorizationProvider implements AuthorizationProvider<Authorization> {
+    private readonly options;
+    private scriptPromise;
+    private cached;
+    private pending;
+    private generation;
+    constructor(options: GoogleWebAuthorizationOptions);
+    authorize(): Promise<Authorization>;
+    clear(): void;
+    private requestFresh;
+    private loadScript;
+    private window;
+    private document;
+}
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/google-web/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/google-web/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAG7B,eAAO,MAAM,0BAA0B,kDACU,CAAC;AAElD,KAAK,aAAa,GAAG;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzD,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,eAAe,CAAC,MAAM,EAAE;gBACtB,SAAS,EAAE,MAAM,CAAC;gBAClB,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;gBACxC,cAAc,CAAC,CAAC,KAAK,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,GAAG,IAAI,CAAC;aACjD,GAAG,WAAW,CAAC;SACjB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEF,qBAAa,8BACX,YAAW,qBAAqB,CAAC,aAAa,CAAC;IAOnC,OAAO,CAAC,QAAQ,CAAC,OAAO;IALpC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,MAAM,CAAuD;IACrE,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,UAAU,CAAK;gBAEM,OAAO,EAAE,6BAA6B;IAE7D,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAwBzC,KAAK,IAAI,IAAI;YAMC,YAAY;IAyD1B,OAAO,CAAC,UAAU;IAuBlB,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,QAAQ;CAYjB"}

package/dist/auth/google-web/index.js

@@ -0,0 +1,115 @@
+import { SyncKitError } from "../../core/errors.js";
+export const GOOGLE_DRIVE_APPDATA_SCOPE = "https://www.googleapis.com/auth/drive.appdata";
+export class GoogleWebAuthorizationProvider {
+    options;
+    scriptPromise = null;
+    cached = null;
+    pending = null;
+    generation = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    async authorize() {
+        const now = this.options.now?.() ?? Date.now();
+        if (this.cached?.clientId === this.options.clientId &&
+            (this.cached.expiresAt ?? 0) > now) {
+            return {
+                accessToken: this.cached.accessToken,
+                ...(this.cached.expiresAt === undefined
+                    ? {}
+                    : { expiresAt: this.cached.expiresAt }),
+            };
+        }
+        if (this.pending)
+            return this.pending;
+        const generation = this.generation;
+        const promise = this.requestFresh(generation);
+        this.pending = promise;
+        try {
+            return await promise;
+        }
+        finally {
+            if (this.pending === promise)
+                this.pending = null;
+        }
+    }
+    clear() {
+        this.cached = null;
+        this.pending = null;
+        this.generation += 1;
+    }
+    async requestFresh(generation) {
+        await this.loadScript();
+        const google = this.window().google;
+        if (!google?.accounts.oauth2) {
+            throw new SyncKitError("authorization", "Google authorization is unavailable.");
+        }
+        return new Promise((resolve, reject) => {
+            const client = google.accounts.oauth2.initTokenClient({
+                client_id: this.options.clientId,
+                scope: this.options.scope ?? GOOGLE_DRIVE_APPDATA_SCOPE,
+                callback: (response) => {
+                    if (!response.access_token) {
+                        reject(new SyncKitError("authorization", response.error_description ??
+                            response.error ??
+                            "Google authorization failed."));
+                        return;
+                    }
+                    const now = this.options.now?.() ?? Date.now();
+                    const expiresInMs = Math.max(0, (response.expires_in ?? 0) * 1_000);
+                    const expiresAt = now +
+                        Math.max(0, expiresInMs - (this.options.expirySkewMs ?? 60_000));
+                    const authorization = {
+                        accessToken: response.access_token,
+                        expiresAt,
+                    };
+                    if (generation === this.generation && expiresAt > now) {
+                        this.cached = {
+                            ...authorization,
+                            clientId: this.options.clientId,
+                        };
+                    }
+                    resolve(authorization);
+                },
+                error_callback: (error) => reject(new SyncKitError("authorization", error.type ?? "Google authorization was cancelled.")),
+            });
+            client.requestAccessToken({ prompt: "" });
+        });
+    }
+    loadScript() {
+        if (this.window().google?.accounts.oauth2)
+            return Promise.resolve();
+        if (this.scriptPromise)
+            return this.scriptPromise;
+        this.scriptPromise = new Promise((resolve, reject) => {
+            const script = this.document().createElement("script");
+            script.src = "https://accounts.google.com/gsi/client";
+            script.async = true;
+            script.defer = true;
+            script.onload = () => resolve();
+            script.onerror = () => {
+                this.scriptPromise = null;
+                reject(new SyncKitError("authorization", "Google authorization could not be loaded."));
+            };
+            this.document().head.append(script);
+        });
+        return this.scriptPromise;
+    }
+    window() {
+        const value = this.options.window ??
+            (typeof window === "undefined" ? undefined : window);
+        if (!value) {
+            throw new SyncKitError("configuration", "Google web authorization requires a browser window.");
+        }
+        return value;
+    }
+    document() {
+        const value = this.options.document ??
+            (typeof document === "undefined" ? undefined : document);
+        if (!value) {
+            throw new SyncKitError("configuration", "Google web authorization requires a browser document.");
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/google-web/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/google-web/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,0BAA0B,GACrC,+CAA+C,CAAC;AAmClD,MAAM,OAAO,8BAA8B;IAQZ;IALrB,aAAa,GAAyB,IAAI,CAAC;IAC3C,MAAM,GAAkD,IAAI,CAAC;IAC7D,OAAO,GAAkC,IAAI,CAAC;IAC9C,UAAU,GAAG,CAAC,CAAC;IAEvB,YAA6B,OAAsC;QAAtC,YAAO,GAAP,OAAO,CAA+B;IAAG,CAAC;IAEvE,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,IACE,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,EAClC,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;aAC1C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;gBACpD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,0BAA0B;gBACvD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;oBACrB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;wBAC3B,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,QAAQ,CAAC,iBAAiB;4BACxB,QAAQ,CAAC,KAAK;4BACd,8BAA8B,CACjC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;oBACpE,MAAM,SAAS,GACb,GAAG;wBACH,IAAI,CAAC,GAAG,CACN,CAAC,EACD,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,CACpD,CAAC;oBACJ,MAAM,aAAa,GAAG;wBACpB,WAAW,EAAE,QAAQ,CAAC,YAAY;wBAClC,SAAS;qBACV,CAAC;oBACF,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;wBACtD,IAAI,CAAC,MAAM,GAAG;4BACZ,GAAG,aAAa;4BAChB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;yBAChC,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,aAAa,CAAC,CAAC;gBACzB,CAAC;gBACD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,KAAK,CAAC,IAAI,IAAI,qCAAqC,CACpD,CACF;aACJ,CAAC,CAAC;YACH,MAAM,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,GAAG,wCAAwC,CAAC;YACtD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;gBACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,2CAA2C,CAC5C,CACF,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,MAAM;QACZ,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,MAAM;YACnB,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,QAAQ;YACrB,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/core/errors.d.ts

@@ -0,0 +1,11 @@
+export type SyncErrorCode = "authorization" | "compatibility" | "configuration" | "crypto" | "decompression" | "key" | "not-found" | "provider" | "serialization" | "state";
+export declare class SyncKitError extends Error {
+    readonly code: SyncErrorCode;
+    readonly status: number | undefined;
+    constructor(code: SyncErrorCode, message: string, options?: ErrorOptions & {
+        status?: number;
+    });
+}
+export declare function isSyncKitError(value: unknown): value is SyncKitError;
+export declare function asSyncKitError(value: unknown, code: SyncErrorCode, message: string): SyncKitError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,eAAe,GACf,eAAe,GACf,QAAQ,GACR,eAAe,GACf,KAAK,GACL,WAAW,GACX,UAAU,GACV,eAAe,GACf,OAAO,CAAC;AAEZ,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGlC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;CAOnD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,GACd,YAAY,CAId"}

package/dist/core/errors.js

@@ -0,0 +1,19 @@
+export class SyncKitError extends Error {
+    code;
+    status;
+    constructor(code, message, options = {}) {
+        super(message, options);
+        this.name = "SyncKitError";
+        this.code = code;
+        this.status = options.status;
+    }
+}
+export function isSyncKitError(value) {
+    return value instanceof SyncKitError;
+}
+export function asSyncKitError(value, code, message) {
+    return isSyncKitError(value)
+        ? value
+        : new SyncKitError(code, message, { cause: value });
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAgB;IACpB,MAAM,CAAqB;IAEpC,YACE,IAAmB,EACnB,OAAe,EACf,UAA8C,EAAE;QAEhD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,YAAY,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,IAAmB,EACnB,OAAe;IAEf,OAAO,cAAc,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/core/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./errors.js";
+export * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,3 @@
+export * from "./errors.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/types.d.ts

@@ -0,0 +1,52 @@
+export type SyncReason = "startup" | "foreground" | "change" | "manual";
+export type SnapshotOperation = "setup" | "enable" | "sync" | "reset";
+export type Authorization = {
+    accessToken: string;
+    expiresAt?: number;
+};
+export interface AuthorizationProvider<A = Authorization> {
+    authorize(): Promise<A>;
+    clear(): void;
+}
+export type StoredEnvelope<E> = {
+    fileId: string;
+    envelope: E;
+};
+export interface CloudStore<E, A = Authorization> {
+    find(appId: string, authorization: A): Promise<StoredEnvelope<E> | null>;
+    write(appId: string, envelope: E, authorization: A, existingId?: string): Promise<string>;
+    delete?(appId: string, fileId: string, authorization: A): Promise<void>;
+}
+export type KeyCreationContext = {
+    appId: string;
+};
+export type CreatedKey<M, K> = {
+    metadata: M;
+    key: K;
+};
+export interface KeyProvider<E, K, M> {
+    create(context: KeyCreationContext): Promise<CreatedKey<M, K>>;
+    unlock(envelope: E): Promise<K>;
+    clear(): void;
+}
+export interface EnvelopeCrypto<T, E, K, M> {
+    encrypt(value: T, key: K, metadata: M): Promise<E>;
+    decrypt(envelope: E, key: K): Promise<T>;
+    metadataFromEnvelope(envelope: E): M;
+}
+export interface SyncCodec<T> {
+    serialize(value: T): unknown;
+    parse(value: unknown): T;
+    merge(local: T, remote: T): T;
+    fingerprint(value: T): string;
+    updatedAt?(value: T): string;
+}
+export type SyncOutcome = "created" | "merged" | "unchanged" | "reset" | "coalesced";
+export type SyncResult<T> = {
+    operation: SnapshotOperation;
+    outcome: SyncOutcome;
+    fileId: string | null;
+    syncedAt: string | null;
+    value: T | null;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACxE,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtE,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,aAAa;IACtD,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,CAAC,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,aAAa;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzE,KAAK,CACH,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,EACX,aAAa,EAAE,CAAC,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI;IAC7B,QAAQ,EAAE,CAAC,CAAC;IACZ,GAAG,EAAE,CAAC,CAAC;CACR,CAAC;AAEF,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClC,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACxC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzC,oBAAoB,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;IAC7B,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC;IACzB,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,WAAW,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;IAC9B,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,OAAO,GACP,WAAW,CAAC;AAEhB,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAC1B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;CACjB,CAAC"}

package/dist/core/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":""}

package/dist/crypto/base64url.d.ts

@@ -0,0 +1,3 @@
+export declare function bytesToBase64Url(bytes: Uint8Array): string;
+export declare function base64UrlToBytes(value: string): Uint8Array;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/crypto/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/crypto/base64url.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAU1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAiB1D"}

package/dist/crypto/base64url.js

@@ -0,0 +1,34 @@
+import { SyncKitError } from "../core/errors.js";
+const base64UrlPattern = /^[A-Za-z0-9_-]*$/u;
+export function bytesToBase64Url(bytes) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64url");
+    }
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/u, "");
+}
+export function base64UrlToBytes(value) {
+    if (!base64UrlPattern.test(value) || value.length % 4 === 1) {
+        throw new SyncKitError("serialization", "Invalid base64url value.");
+    }
+    try {
+        if (typeof Buffer !== "undefined") {
+            return new Uint8Array(Buffer.from(value, "base64url"));
+        }
+        const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+        const binary = atob(padded);
+        return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    }
+    catch (error) {
+        throw new SyncKitError("serialization", "Invalid base64url value.", {
+            cause: error,
+        });
+    }
+}
+//# sourceMappingURL=base64url.js.map

package/dist/crypto/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/crypto/base64url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,EAAE;YAClE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/crypto/canonical.d.ts

@@ -0,0 +1,3 @@
+export declare function canonicalJson(value: unknown): string;
+export declare function canonicalAad(value: unknown): Uint8Array;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/crypto/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEvD"}

package/dist/crypto/canonical.js

@@ -0,0 +1,30 @@
+import { SyncKitError } from "../core/errors.js";
+export function canonicalJson(value) {
+    return JSON.stringify(canonicalValue(value));
+}
+export function canonicalAad(value) {
+    return new TextEncoder().encode(canonicalJson(value));
+}
+function canonicalValue(value) {
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new SyncKitError("serialization", "Canonical JSON does not support non-finite numbers.");
+        }
+        return value;
+    }
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => [key, canonicalValue(child)]));
+    }
+    throw new SyncKitError("serialization", `Canonical JSON does not support ${typeof value}.`);
+}
+//# sourceMappingURL=canonical.js.map

package/dist/crypto/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,mCAAmC,OAAO,KAAK,GAAG,CACnD,CAAC;AACJ,CAAC"}

package/dist/crypto/envelope.d.ts

@@ -0,0 +1,31 @@
+import type { EnvelopeCrypto, SyncCodec } from "../core/types.js";
+import type { CryptoBackend } from "./runtime.js";
+import type { V1CompatibilityProfile } from "./profiles.js";
+import { V1_ALGORITHM } from "./profiles.js";
+export type SyncEnvelopeV1 = {
+    schemaVersion: 1;
+    algorithm: typeof V1_ALGORITHM;
+    compression?: "gzip";
+    credentialId: string;
+    rpId: string;
+    prfInput: string;
+    kdfSalt: string;
+    nonce: string;
+    ciphertext: string;
+    updatedAt: string;
+};
+export type V1KeyMetadata = {
+    credentialId: string;
+    rpId: string;
+    prfInput: Uint8Array;
+    kdfSalt: Uint8Array;
+};
+export declare function parseSyncEnvelopeV1(value: unknown, profile: V1CompatibilityProfile): SyncEnvelopeV1;
+export declare function deriveContentKey<K>(profile: V1CompatibilityProfile, inputKeyMaterial: Uint8Array, salt: Uint8Array, backend: CryptoBackend<K>): Promise<K>;
+export declare function encryptSyncEnvelopeV1<T, K>(value: T, key: K, metadata: V1KeyMetadata, profile: V1CompatibilityProfile, codec: Pick<SyncCodec<T>, "serialize" | "updatedAt">, backend: CryptoBackend<K>, options?: {
+    nonce?: Uint8Array;
+    now?: () => Date;
+}): Promise<SyncEnvelopeV1>;
+export declare function decryptSyncEnvelopeV1<T, K>(input: SyncEnvelopeV1, key: K, profile: V1CompatibilityProfile, codec: Pick<SyncCodec<T>, "parse">, backend: CryptoBackend<K>): Promise<T>;
+export declare function createV1EnvelopeCrypto<T, K>(profile: V1CompatibilityProfile, codec: SyncCodec<T>, backend: CryptoBackend<K>): EnvelopeCrypto<T, SyncEnvelopeV1, K, V1KeyMetadata>;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/crypto/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/crypto/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAK7C,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,EAAE,OAAO,YAAY,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAmChB;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,OAAO,EAAE,sBAAsB,EAC/B,gBAAgB,EAAE,UAAU,EAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAC9C,KAAK,EAAE,CAAC,EACR,GAAG,EAAE,CAAC,EACN,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC,EACpD,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAO,GACrD,OAAO,CAAC,cAAc,CAAC,CA2CzB;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,CAAC,EAC9C,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,CAAC,EACN,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAClC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,CAAC,EACzC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EACnB,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GACxB,cAAc,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,aAAa,CAAC,CAarD"}