@keyneom/sync-kit 0.1.0 → 0.2.0-rc.0

package/dist/sharing/index.d.ts

@@ -0,0 +1,119 @@
+export declare const SHARING_KEY_KIND: "sync-kit-public-key";
+export declare const SHARING_INVITATION_KIND: "sync-kit-share-invitation";
+export declare const SHARED_BACKUP_KIND: "sync-kit-shared-backup";
+export declare const SHARING_ENCRYPTION_ALGORITHM: "ECDH-P256";
+export declare const SHARING_SIGNATURE_ALGORITHM: "ECDSA-P256-SHA256-P1363";
+export declare const SHARING_CONTENT_ALGORITHM: "AES-256-GCM+ECDH-P256+HKDF-SHA256";
+export declare const SHARED_BACKUP_MAX_REVISION_ANCESTORS = 256;
+export type SharingRole = "owner" | "admin" | "writer" | "viewer";
+export type SharingPublicKeyV1 = {
+    keyId: string;
+    encryptionAlgorithm: typeof SHARING_ENCRYPTION_ALGORITHM;
+    encryptionPublicKey: string;
+    signatureAlgorithm: typeof SHARING_SIGNATURE_ALGORITHM;
+    signingPublicKey: string;
+};
+export type SharingPasskeyAssertionV1 = {
+    credentialId: string;
+    credentialPublicKey: JsonWebKey;
+    authenticatorData: string;
+    clientDataJSON: string;
+    signature: string;
+};
+export type SharingAccountBindingV1 = {
+    schemaVersion: 1;
+    kind: "sync-kit-sharing-account-binding";
+    challenge: string;
+    googleIdToken: string;
+    passkey: SharingPasskeyAssertionV1;
+};
+export type SharingPublicKeyResponseV1 = SharingPublicKeyV1 & {
+    schemaVersion: 1;
+    kind: typeof SHARING_KEY_KIND;
+    appId: string;
+    exchangeId: string;
+    createdAt: string;
+    accountBinding?: SharingAccountBindingV1;
+    proof: string;
+};
+export type SharingDatasetGrantV1 = {
+    datasetId: string;
+    role: Exclude<SharingRole, "owner">;
+};
+export type SharingInvitationV1 = {
+    schemaVersion: 1;
+    kind: typeof SHARING_INVITATION_KIND;
+    appId: string;
+    appFolderId: string;
+    exchangeId: string;
+    recipientDrivePermissionId: string;
+    requestedGrants: SharingDatasetGrantV1[];
+    trustedOwnerKeyId: string;
+    createdAt: string;
+    expiresAt?: string;
+    owner: SharingPublicKeyV1;
+    signature: string;
+};
+export type SharingAcceptanceProvenanceV1 = {
+    exchangeId: string;
+    drivePermissionId: string;
+    acceptedAt: string;
+    acceptedByKeyId: string;
+    googleSubject?: string;
+};
+export type SharedBackupParticipantV1 = SharingPublicKeyV1 & {
+    role: SharingRole;
+    accepted?: SharingAcceptanceProvenanceV1;
+};
+export type SharedBackupAccessV1 = {
+    sequence: number;
+    appId?: string;
+    backupId?: string;
+    previousHash?: string;
+    authorKeyId: string;
+    participants: SharedBackupParticipantV1[];
+    keyRotation?: {
+        fromKeyId: string;
+        toKeyId: string;
+        newKeyProof: string;
+    };
+    signature: string;
+};
+export type SharedBackupKeyGrantV1 = {
+    recipientKeyId: string;
+    ephemeralPublicKey: string;
+    kdfSalt: string;
+    nonce: string;
+    wrappedContentKey: string;
+};
+export type SharedBackupEnvelopeV1 = {
+    schemaVersion: 1;
+    kind: typeof SHARED_BACKUP_KIND;
+    algorithm: typeof SHARING_CONTENT_ALGORITHM;
+    appId: string;
+    backupId: string;
+    revisionId: string;
+    parentRevisionId?: string;
+    revisionAncestors?: string[];
+    createdAt: string;
+    authorKeyId: string;
+    accessControl: SharedBackupAccessV1[];
+    keyGrants: SharedBackupKeyGrantV1[];
+    payloadNonce: string;
+    ciphertext: string;
+    signature: string;
+};
+export type SharedBackupCodec<T> = {
+    serialize(value: T): unknown;
+    parse(value: unknown): T;
+};
+export declare function canReadSharedBackup(role: SharingRole): boolean;
+export declare function canWriteSharedBackup(role: SharingRole): boolean;
+export declare function canAdministerSharedBackup(role: SharingRole): boolean;
+export declare function parseSharingPublicKeyResponseV1(value: unknown): SharingPublicKeyResponseV1;
+export declare function parseSharingInvitationV1(value: unknown): SharingInvitationV1;
+export declare function parseSharedBackupEnvelopeV1(value: unknown): SharedBackupEnvelopeV1;
+export declare function sharedBackupParticipants(envelope: SharedBackupEnvelopeV1): SharedBackupParticipantV1[];
+export declare function sharedBackupParticipant(envelope: SharedBackupEnvelopeV1, keyId: string): SharedBackupParticipantV1 | null;
+export type { SharedBackupStorage, SharedBackupTransport, SharedDatasetFile, SharedDatasetPermission, SharedExchangeFile, SharedKeyResponseFile, VersionedSharedDataset, } from "./transport.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/sharing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sharing/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,gBAAgB,EAAG,qBAA8B,CAAC;AAC/D,eAAO,MAAM,uBAAuB,EAAG,2BAAoC,CAAC;AAC5E,eAAO,MAAM,kBAAkB,EAAG,wBAAiC,CAAC;AACpE,eAAO,MAAM,4BAA4B,EAAG,WAAoB,CAAC;AACjE,eAAO,MAAM,2BAA2B,EACtC,yBAAkC,CAAC;AACrC,eAAO,MAAM,yBAAyB,EACpC,mCAA4C,CAAC;AAC/C,eAAO,MAAM,oCAAoC,MAAM,CAAC;AAExD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,OAAO,4BAA4B,CAAC;IACzD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,OAAO,2BAA2B,CAAC;IACvD,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,UAAU,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,kCAAkC,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,yBAAyB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,kBAAkB,GAAG;IAC5D,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,OAAO,gBAAgB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,OAAO,uBAAuB,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,EAAE,MAAM,CAAC;IACnC,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,GAAG;IAC3D,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,6BAA6B,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,yBAAyB,EAAE,CAAC;IAC1C,WAAW,CAAC,EAAE;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,OAAO,kBAAkB,CAAC;IAChC,SAAS,EAAE,OAAO,yBAAyB,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI;IACjC,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;IAC7B,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC;CAC1B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAE9D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAE/D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAEpE;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,0BAA0B,CAgC5B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAiE5E;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,sBAAsB,CA0GxB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,sBAAsB,GAC/B,yBAAyB,EAAE,CAM7B;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,sBAAsB,EAChC,KAAK,EAAE,MAAM,GACZ,yBAAyB,GAAG,IAAI,CAIlC;AAmND,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC"}

package/dist/sharing/index.js

@@ -0,0 +1,360 @@
+import { SyncKitError } from "../core/errors.js";
+import { base64UrlToBytes } from "../crypto/base64url.js";
+export const SHARING_KEY_KIND = "sync-kit-public-key";
+export const SHARING_INVITATION_KIND = "sync-kit-share-invitation";
+export const SHARED_BACKUP_KIND = "sync-kit-shared-backup";
+export const SHARING_ENCRYPTION_ALGORITHM = "ECDH-P256";
+export const SHARING_SIGNATURE_ALGORITHM = "ECDSA-P256-SHA256-P1363";
+export const SHARING_CONTENT_ALGORITHM = "AES-256-GCM+ECDH-P256+HKDF-SHA256";
+export const SHARED_BACKUP_MAX_REVISION_ANCESTORS = 256;
+export function canReadSharedBackup(role) {
+    return role === "owner" || role === "admin" || role === "writer" || role === "viewer";
+}
+export function canWriteSharedBackup(role) {
+    return role === "owner" || role === "admin" || role === "writer";
+}
+export function canAdministerSharedBackup(role) {
+    return role === "owner" || role === "admin";
+}
+export function parseSharingPublicKeyResponseV1(value) {
+    const parsed = parseObject(value, "public-key response");
+    assertExact(parsed.schemaVersion, 1, "schemaVersion");
+    assertExact(parsed.kind, SHARING_KEY_KIND, "kind");
+    assertNonEmptyStrings(parsed, [
+        "appId",
+        "exchangeId",
+        "createdAt",
+        "keyId",
+        "encryptionPublicKey",
+        "signingPublicKey",
+        "proof",
+    ]);
+    assertExact(parsed.encryptionAlgorithm, SHARING_ENCRYPTION_ALGORITHM, "encryptionAlgorithm");
+    assertExact(parsed.signatureAlgorithm, SHARING_SIGNATURE_ALGORITHM, "signatureAlgorithm");
+    validatePublicKey(parsed.encryptionPublicKey, "encryptionPublicKey");
+    validatePublicKey(parsed.signingPublicKey, "signingPublicKey");
+    validateBytes(parsed.keyId, 32, "keyId");
+    validateBytes(parsed.proof, 64, "proof");
+    validateTimestamp(parsed.createdAt, "createdAt");
+    if (parsed.accountBinding !== undefined) {
+        parseSharingAccountBinding(parsed.accountBinding);
+    }
+    return parsed;
+}
+export function parseSharingInvitationV1(value) {
+    const parsed = parseObject(value, "sharing invitation");
+    assertExact(parsed.schemaVersion, 1, "schemaVersion");
+    assertExact(parsed.kind, SHARING_INVITATION_KIND, "kind");
+    assertNonEmptyStrings(parsed, [
+        "appId",
+        "appFolderId",
+        "exchangeId",
+        "recipientDrivePermissionId",
+        "trustedOwnerKeyId",
+        "createdAt",
+        "signature",
+    ]);
+    validateBytes(parsed.trustedOwnerKeyId, 32, "trustedOwnerKeyId");
+    if (parsed.expiresAt !== undefined && !nonEmpty(parsed.expiresAt)) {
+        throw compatibility("expiresAt must be a non-empty string.");
+    }
+    if (!Array.isArray(parsed.requestedGrants) ||
+        parsed.requestedGrants.length === 0) {
+        throw compatibility("requestedGrants must not be empty.");
+    }
+    const datasetIds = new Set();
+    for (const input of parsed.requestedGrants) {
+        const grant = parseObject(input, "requested dataset grant");
+        assertNonEmptyStrings(grant, ["datasetId", "role"]);
+        if (!isRole(grant.role) || grant.role === "owner") {
+            throw compatibility("An invitation has an unsupported requested role.");
+        }
+        const datasetId = grant.datasetId;
+        if (datasetIds.has(datasetId)) {
+            throw compatibility(`Duplicate requested dataset ${datasetId}.`);
+        }
+        datasetIds.add(datasetId);
+    }
+    const owner = parseObject(parsed.owner, "invitation owner");
+    assertNonEmptyStrings(owner, [
+        "keyId",
+        "encryptionPublicKey",
+        "signingPublicKey",
+    ]);
+    assertExact(owner.encryptionAlgorithm, SHARING_ENCRYPTION_ALGORITHM, "encryptionAlgorithm");
+    assertExact(owner.signatureAlgorithm, SHARING_SIGNATURE_ALGORITHM, "signatureAlgorithm");
+    validatePublicKey(owner.encryptionPublicKey, "encryptionPublicKey");
+    validatePublicKey(owner.signingPublicKey, "signingPublicKey");
+    validateBytes(owner.keyId, 32, "owner keyId");
+    validateBytes(parsed.signature, 64, "signature");
+    validateTimestamp(parsed.createdAt, "createdAt");
+    if (parsed.expiresAt) {
+        validateTimestamp(parsed.expiresAt, "expiresAt");
+    }
+    return parsed;
+}
+export function parseSharedBackupEnvelopeV1(value) {
+    const parsed = parseObject(value, "shared-backup envelope");
+    assertExact(parsed.schemaVersion, 1, "schemaVersion");
+    assertExact(parsed.kind, SHARED_BACKUP_KIND, "kind");
+    assertExact(parsed.algorithm, SHARING_CONTENT_ALGORITHM, "algorithm");
+    assertNonEmptyStrings(parsed, [
+        "appId",
+        "backupId",
+        "revisionId",
+        "createdAt",
+        "authorKeyId",
+        "payloadNonce",
+        "ciphertext",
+        "signature",
+    ]);
+    if (parsed.parentRevisionId !== undefined &&
+        !nonEmpty(parsed.parentRevisionId)) {
+        throw compatibility("parentRevisionId must be a non-empty string.");
+    }
+    if (parsed.revisionAncestors !== undefined) {
+        if (!Array.isArray(parsed.revisionAncestors) ||
+            !parsed.revisionAncestors.every(nonEmpty)) {
+            throw compatibility("revisionAncestors must contain revision IDs.");
+        }
+        const ancestors = parsed.revisionAncestors;
+        if (ancestors.length > SHARED_BACKUP_MAX_REVISION_ANCESTORS) {
+            throw compatibility(`revisionAncestors must contain at most ${SHARED_BACKUP_MAX_REVISION_ANCESTORS} revision IDs.`);
+        }
+        if (new Set(ancestors).size !== ancestors.length ||
+            ancestors.includes(parsed.revisionId)) {
+            throw compatibility("revisionAncestors contains a duplicate or cycle.");
+        }
+        if (parsed.parentRevisionId &&
+            ancestors.at(-1) !== parsed.parentRevisionId) {
+            throw compatibility("parentRevisionId must be the last revision ancestor.");
+        }
+        if (!parsed.parentRevisionId && ancestors.length > 0) {
+            throw compatibility("A genesis revision cannot have ancestors.");
+        }
+    }
+    if (!Array.isArray(parsed.accessControl) || parsed.accessControl.length === 0) {
+        throw compatibility("accessControl must not be empty.");
+    }
+    if (!Array.isArray(parsed.keyGrants) || parsed.keyGrants.length === 0) {
+        throw compatibility("keyGrants must not be empty.");
+    }
+    for (const [index, input] of parsed.accessControl.entries()) {
+        parseAccessEntry(input, index);
+    }
+    const accessControl = parsed.accessControl;
+    const participants = accessControl.at(-1)?.participants;
+    if (!participants)
+        throw compatibility("accessControl must not be empty.");
+    const participantIds = new Set(participants.map((participant) => participant.keyId));
+    if (!participantIds.has(parsed.authorKeyId)) {
+        throw compatibility("The revision author is not a participant.");
+    }
+    const grantIds = new Set();
+    for (const input of parsed.keyGrants) {
+        const grant = parseObject(input, "key grant");
+        assertNonEmptyStrings(grant, [
+            "recipientKeyId",
+            "ephemeralPublicKey",
+            "kdfSalt",
+            "nonce",
+            "wrappedContentKey",
+        ]);
+        const recipientKeyId = grant.recipientKeyId;
+        if (!participantIds.has(recipientKeyId)) {
+            throw compatibility("A key grant references a non-participant.");
+        }
+        if (grantIds.has(recipientKeyId)) {
+            throw compatibility(`Duplicate key grant for ${recipientKeyId}.`);
+        }
+        grantIds.add(recipientKeyId);
+        validatePublicKey(grant.ephemeralPublicKey, "ephemeralPublicKey");
+        validateBytes(grant.kdfSalt, 32, "kdfSalt");
+        validateBytes(grant.nonce, 12, "key-grant nonce");
+        base64UrlToBytes(grant.wrappedContentKey);
+    }
+    if (grantIds.size !== participantIds.size) {
+        throw compatibility("Every participant must have exactly one key grant.");
+    }
+    validateBytes(parsed.payloadNonce, 12, "payload nonce");
+    base64UrlToBytes(parsed.ciphertext);
+    validateBytes(parsed.signature, 64, "signature");
+    validateTimestamp(parsed.createdAt, "createdAt");
+    return parsed;
+}
+export function sharedBackupParticipants(envelope) {
+    const participants = envelope.accessControl.at(-1)?.participants;
+    if (!participants) {
+        throw compatibility("accessControl must not be empty.");
+    }
+    return participants;
+}
+export function sharedBackupParticipant(envelope, keyId) {
+    return sharedBackupParticipants(envelope).find((participant) => participant.keyId === keyId) ?? null;
+}
+function parseAccessEntry(input, index) {
+    const entry = parseObject(input, "access-control entry");
+    if (!Number.isSafeInteger(entry.sequence) || entry.sequence !== index) {
+        throw compatibility("Access-control sequence is invalid.");
+    }
+    assertNonEmptyStrings(entry, ["authorKeyId", "signature"]);
+    if (entry.appId !== undefined || entry.backupId !== undefined) {
+        assertNonEmptyStrings(entry, ["appId", "backupId"]);
+    }
+    validateBytes(entry.authorKeyId, 32, "access author keyId");
+    validateBytes(entry.signature, 64, "access signature");
+    if (index === 0) {
+        if (entry.previousHash !== undefined) {
+            throw compatibility("The first access-control entry cannot have a previousHash.");
+        }
+    }
+    else {
+        if (!nonEmpty(entry.previousHash)) {
+            throw compatibility("An access-control entry is missing previousHash.");
+        }
+        validateBytes(entry.previousHash, 32, "access previousHash");
+    }
+    if (!Array.isArray(entry.participants) || entry.participants.length === 0) {
+        throw compatibility("Access-control participants must not be empty.");
+    }
+    const participantIds = new Set();
+    let ownerCount = 0;
+    for (const inputParticipant of entry.participants) {
+        const participant = parseObject(inputParticipant, "participant");
+        assertNonEmptyStrings(participant, [
+            "keyId",
+            "encryptionPublicKey",
+            "signingPublicKey",
+            "role",
+        ]);
+        assertExact(participant.encryptionAlgorithm, SHARING_ENCRYPTION_ALGORITHM, "encryptionAlgorithm");
+        assertExact(participant.signatureAlgorithm, SHARING_SIGNATURE_ALGORITHM, "signatureAlgorithm");
+        if (!isRole(participant.role)) {
+            throw compatibility("A participant has an unsupported role.");
+        }
+        if (participant.accepted !== undefined) {
+            parseAcceptanceProvenance(participant.accepted);
+        }
+        validatePublicKey(participant.encryptionPublicKey, "encryptionPublicKey");
+        validatePublicKey(participant.signingPublicKey, "signingPublicKey");
+        const keyId = participant.keyId;
+        validateBytes(keyId, 32, "participant keyId");
+        if (participantIds.has(keyId)) {
+            throw compatibility(`Duplicate participant ${keyId}.`);
+        }
+        participantIds.add(keyId);
+        if (participant.role === "owner")
+            ownerCount += 1;
+    }
+    if (ownerCount !== 1) {
+        throw compatibility("An access-control entry must have exactly one owner.");
+    }
+    if (entry.keyRotation !== undefined) {
+        const rotation = parseObject(entry.keyRotation, "key rotation");
+        assertNonEmptyStrings(rotation, [
+            "fromKeyId",
+            "toKeyId",
+            "newKeyProof",
+        ]);
+        validateBytes(rotation.fromKeyId, 32, "rotation fromKeyId");
+        validateBytes(rotation.toKeyId, 32, "rotation toKeyId");
+        validateBytes(rotation.newKeyProof, 64, "rotation proof");
+        if (rotation.fromKeyId === rotation.toKeyId) {
+            throw compatibility("A key rotation must change the key ID.");
+        }
+    }
+}
+function parseAcceptanceProvenance(input) {
+    const accepted = parseObject(input, "participant acceptance provenance");
+    assertNonEmptyStrings(accepted, [
+        "exchangeId",
+        "drivePermissionId",
+        "acceptedAt",
+        "acceptedByKeyId",
+    ]);
+    if (accepted.googleSubject !== undefined &&
+        !nonEmpty(accepted.googleSubject)) {
+        throw compatibility("googleSubject must be a non-empty string.");
+    }
+    validateBytes(accepted.acceptedByKeyId, 32, "acceptedByKeyId");
+    validateTimestamp(accepted.acceptedAt, "acceptedAt");
+}
+function parseSharingAccountBinding(input) {
+    const binding = parseObject(input, "sharing account binding");
+    assertExact(binding.schemaVersion, 1, "account binding schemaVersion");
+    assertExact(binding.kind, "sync-kit-sharing-account-binding", "account binding kind");
+    assertNonEmptyStrings(binding, ["challenge", "googleIdToken"]);
+    validateBytes(binding.challenge, 32, "account binding challenge");
+    const passkey = parseObject(binding.passkey, "passkey assertion");
+    assertNonEmptyStrings(passkey, [
+        "credentialId",
+        "authenticatorData",
+        "clientDataJSON",
+        "signature",
+    ]);
+    base64UrlToBytes(passkey.credentialId);
+    base64UrlToBytes(passkey.authenticatorData);
+    base64UrlToBytes(passkey.clientDataJSON);
+    base64UrlToBytes(passkey.signature);
+    if (!passkey.credentialPublicKey ||
+        typeof passkey.credentialPublicKey !== "object" ||
+        Array.isArray(passkey.credentialPublicKey)) {
+        throw compatibility("credentialPublicKey must be a JWK object.");
+    }
+}
+function parseObject(value, label) {
+    let parsed = value;
+    if (typeof value === "string") {
+        try {
+            parsed = JSON.parse(value);
+        }
+        catch (error) {
+            throw new SyncKitError("compatibility", `The ${label} is not valid JSON.`, { cause: error });
+        }
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw compatibility(`The ${label} must be an object.`);
+    }
+    return parsed;
+}
+function assertNonEmptyStrings(value, fields) {
+    for (const field of fields) {
+        if (!nonEmpty(value[field])) {
+            throw compatibility(`${field} must be a non-empty string.`);
+        }
+    }
+}
+function assertExact(value, expected, field) {
+    if (value !== expected) {
+        throw compatibility(`${field} is not supported.`);
+    }
+}
+function validatePublicKey(value, field) {
+    validateBytes(value, 65, field);
+    if (base64UrlToBytes(value)[0] !== 4) {
+        throw compatibility(`${field} is not an uncompressed P-256 public key.`);
+    }
+}
+function validateBytes(value, length, field) {
+    if (base64UrlToBytes(value).length !== length) {
+        throw compatibility(`${field} has an invalid length.`);
+    }
+}
+function validateTimestamp(value, field) {
+    if (!Number.isFinite(Date.parse(value))) {
+        throw compatibility(`${field} is not a valid timestamp.`);
+    }
+}
+function isRole(value) {
+    return (value === "owner" ||
+        value === "admin" ||
+        value === "writer" ||
+        value === "viewer");
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function compatibility(message) {
+    return new SyncKitError("compatibility", message);
+}
+//# sourceMappingURL=index.js.map

package/dist/sharing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sharing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAA8B,CAAC;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAAoC,CAAC;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAiC,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAoB,CAAC;AACjE,MAAM,CAAC,MAAM,2BAA2B,GACtC,yBAAkC,CAAC;AACrC,MAAM,CAAC,MAAM,yBAAyB,GACpC,mCAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AAqHxD,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAiB;IACpD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAiB;IACzD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACzD,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IACtD,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACnD,qBAAqB,CAAC,MAAM,EAAE;QAC5B,OAAO;QACP,YAAY;QACZ,WAAW;QACX,OAAO;QACP,qBAAqB;QACrB,kBAAkB;QAClB,OAAO;KACR,CAAC,CAAC;IACH,WAAW,CACT,MAAM,CAAC,mBAAmB,EAC1B,4BAA4B,EAC5B,qBAAqB,CACtB,CAAC;IACF,WAAW,CACT,MAAM,CAAC,kBAAkB,EACzB,2BAA2B,EAC3B,oBAAoB,CACrB,CAAC;IACF,iBAAiB,CAAC,MAAM,CAAC,mBAA6B,EAAE,qBAAqB,CAAC,CAAC;IAC/E,iBAAiB,CAAC,MAAM,CAAC,gBAA0B,EAAE,kBAAkB,CAAC,CAAC;IACzE,aAAa,CAAC,MAAM,CAAC,KAAe,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,aAAa,CAAC,MAAM,CAAC,KAAe,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,MAAM,CAAC,SAAmB,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,0BAA0B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAoC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACxD,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IACtD,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC1D,qBAAqB,CAAC,MAAM,EAAE;QAC5B,OAAO;QACP,aAAa;QACb,YAAY;QACZ,4BAA4B;QAC5B,mBAAmB;QACnB,WAAW;QACX,WAAW;KACZ,CAAC,CAAC;IACH,aAAa,CACX,MAAM,CAAC,iBAA2B,EAClC,EAAE,EACF,mBAAmB,CACpB,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,aAAa,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QACtC,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;QACD,MAAM,aAAa,CAAC,oCAAoC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAC5D,qBAAqB,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClD,MAAM,aAAa,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAmB,CAAC;QAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,CAAC,+BAA+B,SAAS,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC5D,qBAAqB,CAAC,KAAK,EAAE;QAC3B,OAAO;QACP,qBAAqB;QACrB,kBAAkB;KACnB,CAAC,CAAC;IACH,WAAW,CACT,KAAK,CAAC,mBAAmB,EACzB,4BAA4B,EAC5B,qBAAqB,CACtB,CAAC;IACF,WAAW,CACT,KAAK,CAAC,kBAAkB,EACxB,2BAA2B,EAC3B,oBAAoB,CACrB,CAAC;IACF,iBAAiB,CAAC,KAAK,CAAC,mBAA6B,EAAE,qBAAqB,CAAC,CAAC;IAC9E,iBAAiB,CAAC,KAAK,CAAC,gBAA0B,EAAE,kBAAkB,CAAC,CAAC;IACxE,aAAa,CAAC,KAAK,CAAC,KAAe,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IACxD,aAAa,CAAC,MAAM,CAAC,SAAmB,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC3D,iBAAiB,CAAC,MAAM,CAAC,SAAmB,EAAE,WAAW,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAA6B,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAC5D,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IACtD,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACrD,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,yBAAyB,EAAE,WAAW,CAAC,CAAC;IACtE,qBAAqB,CAAC,MAAM,EAAE;QAC5B,OAAO;QACP,UAAU;QACV,YAAY;QACZ,WAAW;QACX,aAAa;QACb,cAAc;QACd,YAAY;QACZ,WAAW;KACZ,CAAC,CAAC;IACH,IACE,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACrC,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAClC,CAAC;QACD,MAAM,aAAa,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACxC,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,EACzC,CAAC;YACD,MAAM,aAAa,CAAC,8CAA8C,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM,GAAG,oCAAoC,EAAE,CAAC;YAC5D,MAAM,aAAa,CACjB,0CAA0C,oCAAoC,gBAAgB,CAC/F,CAAC;QACJ,CAAC;QACD,IACE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM;YAC5C,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAoB,CAAC,EAC/C,CAAC;YACD,MAAM,aAAa,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,IACE,MAAM,CAAC,gBAAgB;YACvB,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,gBAAgB,EAC5C,CAAC;YACD,MAAM,aAAa,CACjB,sDAAsD,CACvD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,aAAa,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,aAAa,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,aAAa,CAAC,8BAA8B,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAuC,CAAC;IACrE,MAAM,YAAY,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IACxD,IAAI,CAAC,YAAY;QAAE,MAAM,aAAa,CAAC,kCAAkC,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CACrD,CAAC;IACF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAqB,CAAC,EAAE,CAAC;QACtD,MAAM,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC9C,qBAAqB,CAAC,KAAK,EAAE;YAC3B,gBAAgB;YAChB,oBAAoB;YACpB,SAAS;YACT,OAAO;YACP,mBAAmB;SACpB,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,KAAK,CAAC,cAAwB,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACxC,MAAM,aAAa,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACjC,MAAM,aAAa,CAAC,2BAA2B,cAAc,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,iBAAiB,CACf,KAAK,CAAC,kBAA4B,EAClC,oBAAoB,CACrB,CAAC;QACF,aAAa,CAAC,KAAK,CAAC,OAAiB,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACtD,aAAa,CAAC,KAAK,CAAC,KAAe,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC5D,gBAAgB,CAAC,KAAK,CAAC,iBAA2B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,aAAa,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,aAAa,CAAC,MAAM,CAAC,YAAsB,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;IAClE,gBAAgB,CAAC,MAAM,CAAC,UAAoB,CAAC,CAAC;IAC9C,aAAa,CAAC,MAAM,CAAC,SAAmB,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC3D,iBAAiB,CAAC,MAAM,CAAC,SAAmB,EAAE,WAAW,CAAC,CAAC;IAC3D,OAAO,MAAgC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAgC;IAEhC,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,aAAa,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAgC,EAChC,KAAa;IAEb,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5C,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,KAAK,KAAK,CAC7C,IAAI,IAAI,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACtE,MAAM,aAAa,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,qBAAqB,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9D,qBAAqB,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,aAAa,CAAC,KAAK,CAAC,WAAqB,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACtE,aAAa,CAAC,KAAK,CAAC,SAAmB,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,aAAa,CAAC,4DAA4D,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,MAAM,aAAa,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,aAAa,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,gBAAgB,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAClD,MAAM,WAAW,GAAG,WAAW,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACjE,qBAAqB,CAAC,WAAW,EAAE;YACjC,OAAO;YACP,qBAAqB;YACrB,kBAAkB;YAClB,MAAM;SACP,CAAC,CAAC;QACH,WAAW,CACT,WAAW,CAAC,mBAAmB,EAC/B,4BAA4B,EAC5B,qBAAqB,CACtB,CAAC;QACF,WAAW,CACT,WAAW,CAAC,kBAAkB,EAC9B,2BAA2B,EAC3B,oBAAoB,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,CAAC,wCAAwC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvC,yBAAyB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,iBAAiB,CACf,WAAW,CAAC,mBAA6B,EACzC,qBAAqB,CACtB,CAAC;QACF,iBAAiB,CACf,WAAW,CAAC,gBAA0B,EACtC,kBAAkB,CACnB,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAe,CAAC;QAC1C,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC9C,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,CAAC,yBAAyB,KAAK,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO;YAAE,UAAU,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,aAAa,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChE,qBAAqB,CAAC,QAAQ,EAAE;YAC9B,WAAW;YACX,SAAS;YACT,aAAa;SACd,CAAC,CAAC;QACH,aAAa,CAAC,QAAQ,CAAC,SAAmB,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACtE,aAAa,CAAC,QAAQ,CAAC,OAAiB,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAClE,aAAa,CAAC,QAAQ,CAAC,WAAqB,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,aAAa,CAAC,wCAAwC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,mCAAmC,CAAC,CAAC;IACzE,qBAAqB,CAAC,QAAQ,EAAE;QAC9B,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,iBAAiB;KAClB,CAAC,CAAC;IACH,IACE,QAAQ,CAAC,aAAa,KAAK,SAAS;QACpC,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EACjC,CAAC;QACD,MAAM,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,aAAa,CACX,QAAQ,CAAC,eAAyB,EAClC,EAAE,EACF,iBAAiB,CAClB,CAAC;IACF,iBAAiB,CAAC,QAAQ,CAAC,UAAoB,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC9D,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACvE,WAAW,CACT,OAAO,CAAC,IAAI,EACZ,kCAAkC,EAClC,sBAAsB,CACvB,CAAC;IACF,qBAAqB,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/D,aAAa,CAAC,OAAO,CAAC,SAAmB,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAClE,qBAAqB,CAAC,OAAO,EAAE;QAC7B,cAAc;QACd,mBAAmB;QACnB,gBAAgB;QAChB,WAAW;KACZ,CAAC,CAAC;IACH,gBAAgB,CAAC,OAAO,CAAC,YAAsB,CAAC,CAAC;IACjD,gBAAgB,CAAC,OAAO,CAAC,iBAA2B,CAAC,CAAC;IACtD,gBAAgB,CAAC,OAAO,CAAC,cAAwB,CAAC,CAAC;IACnD,gBAAgB,CAAC,OAAO,CAAC,SAAmB,CAAC,CAAC;IAC9C,IACE,CAAC,OAAO,CAAC,mBAAmB;QAC5B,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ;QAC/C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAC1C,CAAC;QACD,MAAM,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,OAAO,KAAK,qBAAqB,EACjC,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,aAAa,CAAC,OAAO,KAAK,qBAAqB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAA8B,EAC9B,MAAgB;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,aAAa,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,QAAiB,EAAE,KAAa;IACnE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,aAAa,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAChC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,aAAa,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,MAAc,EAAE,KAAa;IACjE,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,aAAa,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,aAAa,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,CACL,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,QAAQ,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC"}

package/dist/sharing/transport.d.ts

@@ -0,0 +1,65 @@
+import type { SharedBackupEnvelopeV1, SharingInvitationV1, SharingPublicKeyResponseV1, SharingRole } from "./index.js";
+export type SharedBackupStorage = {
+    appFolderId: string;
+    exchangesFolderId: string;
+};
+export type SharedDatasetFile = {
+    datasetId: string;
+    fileId: string;
+    name: string;
+    canEdit?: boolean;
+};
+export type VersionedSharedDataset = SharedDatasetFile & {
+    envelope: SharedBackupEnvelopeV1;
+    version: string;
+};
+export type SharedExchangeFile = {
+    fileId: string;
+    exchangeId: string;
+    kind: "invitation" | "key-response";
+    keyId?: string;
+    createdTime?: string;
+};
+export type SharedKeyResponseFile = {
+    fileId: string;
+    response: SharingPublicKeyResponseV1;
+    ownerPermissionId: string;
+};
+export type SharedDatasetPermission = {
+    permissionId?: string;
+    role: "reader" | "writer";
+};
+/**
+ * Client-side transport required by the sharing controller. Implementations
+ * may use Google Drive or another provider, but cannot depend on a trusted app
+ * backend.
+ */
+export interface SharedBackupTransport {
+    ensureStorage(): Promise<SharedBackupStorage>;
+    listDatasets(): Promise<SharedDatasetFile[]>;
+    readDataset(fileId: string): Promise<VersionedSharedDataset>;
+    createDataset(datasetId: string, envelope: SharedBackupEnvelopeV1): Promise<VersionedSharedDataset>;
+    writeDataset(current: VersionedSharedDataset, envelope: SharedBackupEnvelopeV1): Promise<VersionedSharedDataset>;
+    grantExchangeAccess(emailAddress: string, options?: {
+        sendNotificationEmail?: boolean;
+        emailMessage?: string;
+    }): Promise<{
+        drivePermissionId: string;
+        appFolderId: string;
+    }>;
+    createInvitation(invitation: SharingInvitationV1): Promise<string>;
+    createKeyResponse(response: SharingPublicKeyResponseV1): Promise<string>;
+    listExchanges(options?: {
+        exchangeId?: string;
+        kind?: SharedExchangeFile["kind"];
+    }): Promise<SharedExchangeFile[]>;
+    readInvitation(fileId: string): Promise<SharingInvitationV1>;
+    readKeyResponse(fileId: string, expectedDrivePermissionId: string): Promise<SharedKeyResponseFile>;
+    deleteExchange(fileId: string): Promise<void>;
+    setDatasetPermission(fileId: string, emailAddress: string, role: Exclude<SharingRole, "owner" | "admin"> | "admin", options?: {
+        existingDirectPermissionId?: string;
+        hasInheritedReadAccess?: boolean;
+    }): Promise<SharedDatasetPermission>;
+    removeDatasetPermission(fileId: string, permissionId: string): Promise<void>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/sharing/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/sharing/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,WAAW,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG;IACvD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,YAAY,GAAG,cAAc,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,YAAY,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC7C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC7D,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,YAAY,CACV,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,mBAAmB,CACjB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,gBAAgB,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,iBAAiB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,aAAa,CAAC,OAAO,CAAC,EAAE;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7D,eAAe,CACb,MAAM,EAAE,MAAM,EACd,yBAAyB,EAAE,MAAM,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,oBAAoB,CAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,OAAO,EACvD,OAAO,CAAC,EAAE;QACR,0BAA0B,CAAC,EAAE,MAAM,CAAC;QACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;KAClC,GACA,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,uBAAuB,CACrB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/sharing/transport.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=transport.js.map

package/dist/sharing/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/sharing/transport.ts"],"names":[],"mappings":""}

package/dist/sharing/web-crypto.d.ts

@@ -0,0 +1,68 @@
+import { type SharedBackupCodec, type SharedBackupEnvelopeV1, type SharingAcceptanceProvenanceV1, type SharingAccountBindingV1, type SharingDatasetGrantV1, type SharingPublicKeyResponseV1, type SharingPublicKeyV1, type SharingInvitationV1, type SharingRole } from "./index.js";
+export type WebCryptoSharingIdentity = {
+    publicKey: SharingPublicKeyV1;
+    encryptionPrivateKey: CryptoKey;
+    signingPrivateKey: CryptoKey;
+};
+export type SharedBackupParticipantInput = {
+    publicKey: SharingPublicKeyV1;
+    role: SharingRole;
+    accepted?: SharingAcceptanceProvenanceV1;
+};
+export type AcceptedSharingGrantV1 = {
+    datasetId: string;
+    participant: SharedBackupParticipantInput;
+};
+export type WebCryptoSharingOptions = {
+    crypto?: Crypto;
+    now?: () => Date;
+    randomUUID?: () => string;
+};
+export declare function createWebCryptoSharingIdentity(cryptoImplementation?: Crypto): Promise<WebCryptoSharingIdentity>;
+export declare function createSharingPublicKeyResponseV1(identity: WebCryptoSharingIdentity, input: {
+    appId: string;
+    exchangeId: string;
+    createdAt?: string;
+    accountBinding?: SharingAccountBindingV1;
+}, options?: WebCryptoSharingOptions): Promise<SharingPublicKeyResponseV1>;
+export declare function createSharingInvitationV1(identity: WebCryptoSharingIdentity, input: {
+    appId: string;
+    appFolderId: string;
+    exchangeId?: string;
+    recipientDrivePermissionId: string;
+    requestedGrants: SharingDatasetGrantV1[];
+    trustedOwnerKeyId?: string;
+    createdAt?: string;
+    expiresAt?: string;
+}, options?: WebCryptoSharingOptions): Promise<SharingInvitationV1>;
+export declare function acceptSharingPublicKeyResponseV1(invitationInput: unknown, responseInput: unknown, input: {
+    acceptedByKeyId: string;
+    drivePermissionId: string;
+    acceptedAt?: string;
+    googleSubject?: string;
+}, options?: WebCryptoSharingOptions): Promise<AcceptedSharingGrantV1[]>;
+export declare function verifySharingInvitationV1(input: unknown, options?: {
+    crypto?: Crypto;
+    now?: () => Date;
+}): Promise<SharingInvitationV1>;
+export declare function verifySharingPublicKeyResponseV1(input: unknown, cryptoImplementation?: Crypto): Promise<SharingPublicKeyResponseV1>;
+export declare function createSharedBackupEnvelopeV1<T>(value: T, codec: SharedBackupCodec<T>, identity: WebCryptoSharingIdentity, input: {
+    appId: string;
+    backupId: string;
+    participants: SharedBackupParticipantInput[];
+    previous?: SharedBackupEnvelopeV1;
+    keyRotation?: {
+        previousIdentity: WebCryptoSharingIdentity;
+    };
+    revisionId?: string;
+    createdAt?: string;
+}, options?: WebCryptoSharingOptions): Promise<SharedBackupEnvelopeV1>;
+export declare function verifySharedBackupEnvelopeV1(input: unknown, cryptoImplementation?: Crypto, options?: {
+    trustedOwnerKeyId?: string;
+}): Promise<SharedBackupEnvelopeV1>;
+export declare function decryptSharedBackupEnvelopeV1<T>(input: unknown, codec: Pick<SharedBackupCodec<T>, "parse">, identity: WebCryptoSharingIdentity, cryptoImplementation?: Crypto, options?: {
+    trustedOwnerKeyId?: string;
+}): Promise<T>;
+export declare function sharingKeyFingerprint(keyId: string): string;
+export declare function createSharingPublicKeyV1(encryptionPublicKey: string, signingPublicKey: string, cryptoImplementation: Crypto): Promise<SharingPublicKeyV1>;
+//# sourceMappingURL=web-crypto.d.ts.map