@keyneom/sync-kit 0.1.0 → 0.2.0-rc.0

package/dist/sharing/web-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-crypto.d.ts","sourceRoot":"","sources":["../../src/sharing/web-crypto.ts"],"names":[],"mappings":"AAQA,OAAO,EAeL,KAAK,iBAAiB,EAEtB,KAAK,sBAAsB,EAE3B,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAKpB,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,oBAAoB,EAAE,SAAS,CAAC;IAChC,iBAAiB,EAAE,SAAS,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,6BAA6B,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,4BAA4B,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,wBAAsB,8BAA8B,CAClD,oBAAoB,GAAE,MAA0B,GAC/C,OAAO,CAAC,wBAAwB,CAAC,CAgCnC;AAED,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,wBAAwB,EAClC,KAAK,EAAE;IACL,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C,EACD,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,0BAA0B,CAAC,CA2BrC;AAED,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,wBAAwB,EAClC,KAAK,EAAE;IACL,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B,EAAE,MAAM,CAAC;IACnC,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,EACD,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAsC9B;AAED,wBAAsB,gCAAgC,CACpD,eAAe,EAAE,OAAO,EACxB,aAAa,EAAE,OAAO,EACtB,KAAK,EAAE;IACL,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,EACD,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,EAAE,CAAC,CA4CnC;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACb,GACL,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAED,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,OAAO,EACd,oBAAoB,GAAE,MAA0B,GAC/C,OAAO,CAAC,0BAA0B,CAAC,CA4BrC;AAED,wBAAsB,4BAA4B,CAAC,CAAC,EAClD,KAAK,EAAE,CAAC,EACR,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAC3B,QAAQ,EAAE,wBAAwB,EAClC,KAAK,EAAE;IACL,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,4BAA4B,EAAE,CAAC;IAC7C,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,WAAW,CAAC,EAAE;QACZ,gBAAgB,EAAE,wBAAwB,CAAC;KAC5C,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,EACD,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAmIjC;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,OAAO,EACd,oBAAoB,GAAE,MAA0B,EAChD,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3C,OAAO,CAAC,sBAAsB,CAAC,CAgCjC;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACnD,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAC1C,QAAQ,EAAE,wBAAwB,EAClC,oBAAoB,GAAE,MAA0B,EAChD,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3C,OAAO,CAAC,CAAC,CAAC,CA0EZ;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ3D;AA6HD,wBAAsB,wBAAwB,CAC5C,mBAAmB,EAAE,MAAM,EAC3B,gBAAgB,EAAE,MAAM,EACxB,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAmB7B"}

package/dist/sharing/web-crypto.js

@@ -0,0 +1,645 @@
+import { SyncKitError, asSyncKitError } from "../core/errors.js";
+import { base64UrlToBytes, bytesToBase64Url } from "../crypto/base64url.js";
+import { canonicalAad, canonicalJson, compareUtf16CodeUnits, } from "../crypto/canonical.js";
+import { copyBuffer } from "../crypto/runtime.js";
+import { SHARED_BACKUP_KIND, SHARED_BACKUP_MAX_REVISION_ANCESTORS, SHARING_CONTENT_ALGORITHM, SHARING_ENCRYPTION_ALGORITHM, SHARING_INVITATION_KIND, SHARING_KEY_KIND, SHARING_SIGNATURE_ALGORITHM, canAdministerSharedBackup, canWriteSharedBackup, parseSharedBackupEnvelopeV1, parseSharingInvitationV1, parseSharingPublicKeyResponseV1, sharedBackupParticipant, sharedBackupParticipants, } from "./index.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+export async function createWebCryptoSharingIdentity(cryptoImplementation = globalThis.crypto) {
+    assertWebCrypto(cryptoImplementation);
+    const encryption = await cryptoImplementation.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
+    const signing = await cryptoImplementation.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign", "verify"]);
+    const encryptionPublicKey = bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.exportKey("raw", encryption.publicKey)));
+    const signingPublicKey = bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.exportKey("raw", signing.publicKey)));
+    const publicKey = await createSharingPublicKeyV1(encryptionPublicKey, signingPublicKey, cryptoImplementation);
+    return {
+        publicKey,
+        encryptionPrivateKey: encryption.privateKey,
+        signingPrivateKey: signing.privateKey,
+    };
+}
+export async function createSharingPublicKeyResponseV1(identity, input, options = {}) {
+    requireNonEmpty(input.appId, "appId");
+    requireNonEmpty(input.exchangeId, "exchangeId");
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    assertWebCrypto(cryptoImplementation);
+    await assertIdentity(identity, cryptoImplementation);
+    const unsigned = {
+        schemaVersion: 1,
+        kind: SHARING_KEY_KIND,
+        appId: input.appId,
+        exchangeId: input.exchangeId,
+        createdAt: input.createdAt ?? now(options).toISOString(),
+        ...(input.accountBinding ? { accountBinding: input.accountBinding } : {}),
+        ...identity.publicKey,
+    };
+    return parseSharingPublicKeyResponseV1({
+        ...unsigned,
+        proof: bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, identity.signingPrivateKey, copyBuffer(canonicalAad(unsigned))))),
+    });
+}
+export async function createSharingInvitationV1(identity, input, options = {}) {
+    for (const [name, value] of Object.entries({
+        appId: input.appId,
+        appFolderId: input.appFolderId,
+        recipientDrivePermissionId: input.recipientDrivePermissionId,
+    })) {
+        requireNonEmpty(value, name);
+    }
+    const requestedGrants = normalizedRequestedGrants(input.requestedGrants);
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    assertWebCrypto(cryptoImplementation);
+    await assertIdentity(identity, cryptoImplementation);
+    const unsigned = {
+        schemaVersion: 1,
+        kind: SHARING_INVITATION_KIND,
+        appId: input.appId,
+        appFolderId: input.appFolderId,
+        exchangeId: input.exchangeId ?? randomUUID(options),
+        recipientDrivePermissionId: input.recipientDrivePermissionId,
+        requestedGrants,
+        trustedOwnerKeyId: input.trustedOwnerKeyId ?? identity.publicKey.keyId,
+        createdAt: input.createdAt ?? now(options).toISOString(),
+        ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),
+        owner: identity.publicKey,
+    };
+    return parseSharingInvitationV1({
+        ...unsigned,
+        signature: bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, identity.signingPrivateKey, copyBuffer(canonicalAad(unsigned))))),
+    });
+}
+export async function acceptSharingPublicKeyResponseV1(invitationInput, responseInput, input, options = {}) {
+    requireNonEmpty(input.acceptedByKeyId, "acceptedByKeyId");
+    requireNonEmpty(input.drivePermissionId, "drivePermissionId");
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    const invitation = await verifySharingInvitationV1(invitationInput, {
+        crypto: cryptoImplementation,
+        ...(options.now ? { now: options.now } : {}),
+    });
+    const response = await verifySharingPublicKeyResponseV1(responseInput, cryptoImplementation);
+    if (response.appId !== invitation.appId ||
+        response.exchangeId !== invitation.exchangeId) {
+        throw new SyncKitError("authorization", "The public-key response does not match this invitation.");
+    }
+    if (input.drivePermissionId !== invitation.recipientDrivePermissionId) {
+        throw new SyncKitError("authorization", "The response Drive account does not match the invited account.");
+    }
+    const accepted = {
+        exchangeId: invitation.exchangeId,
+        drivePermissionId: input.drivePermissionId,
+        acceptedAt: input.acceptedAt ?? now(options).toISOString(),
+        acceptedByKeyId: input.acceptedByKeyId,
+        ...(input.googleSubject ? { googleSubject: input.googleSubject } : {}),
+    };
+    return invitation.requestedGrants.map((grant) => ({
+        datasetId: grant.datasetId,
+        participant: {
+            publicKey: publicKeyFromResponse(response),
+            role: grant.role,
+            accepted,
+        },
+    }));
+}
+export async function verifySharingInvitationV1(input, options = {}) {
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    assertWebCrypto(cryptoImplementation);
+    const invitation = parseSharingInvitationV1(input);
+    const expectedOwner = await createSharingPublicKeyV1(invitation.owner.encryptionPublicKey, invitation.owner.signingPublicKey, cryptoImplementation);
+    if (expectedOwner.keyId !== invitation.owner.keyId) {
+        throw new SyncKitError("key", "The invitation owner fingerprint does not match its keys.");
+    }
+    const { signature, ...unsigned } = invitation;
+    const valid = await cryptoImplementation.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, await importSigningPublicKey(invitation.owner, cryptoImplementation), copyBuffer(base64UrlToBytes(signature)), copyBuffer(canonicalAad(unsigned)));
+    if (!valid) {
+        throw new SyncKitError("crypto", "The sharing invitation signature is invalid.");
+    }
+    if (invitation.expiresAt &&
+        Date.parse(invitation.expiresAt) <=
+            (options.now?.() ?? new Date()).getTime()) {
+        throw new SyncKitError("authorization", "The sharing invitation has expired.");
+    }
+    return invitation;
+}
+export async function verifySharingPublicKeyResponseV1(input, cryptoImplementation = globalThis.crypto) {
+    assertWebCrypto(cryptoImplementation);
+    const response = parseSharingPublicKeyResponseV1(input);
+    const expectedKey = await createSharingPublicKeyV1(response.encryptionPublicKey, response.signingPublicKey, cryptoImplementation);
+    if (expectedKey.keyId !== response.keyId) {
+        throw new SyncKitError("key", "The public-key response fingerprint does not match its keys.");
+    }
+    const { proof, ...unsigned } = response;
+    const valid = await cryptoImplementation.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, await importSigningPublicKey(response, cryptoImplementation), copyBuffer(base64UrlToBytes(proof)), copyBuffer(canonicalAad(unsigned)));
+    if (!valid) {
+        throw new SyncKitError("key", "The public-key response does not prove possession of its signing key.");
+    }
+    return response;
+}
+export async function createSharedBackupEnvelopeV1(value, codec, identity, input, options = {}) {
+    requireNonEmpty(input.appId, "appId");
+    requireNonEmpty(input.backupId, "backupId");
+    const cryptoImplementation = options.crypto ?? globalThis.crypto;
+    assertWebCrypto(cryptoImplementation);
+    await assertIdentity(identity, cryptoImplementation);
+    if (input.keyRotation) {
+        await assertIdentity(input.keyRotation.previousIdentity, cryptoImplementation);
+    }
+    const participants = normalizedParticipants(input.participants);
+    const author = participants.find((participant) => participant.keyId === identity.publicKey.keyId);
+    if (!author || !canWriteSharedBackup(author.role)) {
+        throw new SyncKitError("authorization", "The author is not allowed to write this shared backup.");
+    }
+    const previous = input.previous
+        ? await verifySharedBackupEnvelopeV1(input.previous, cryptoImplementation)
+        : undefined;
+    await assertParticipantKeys(participants, cryptoImplementation);
+    assertRevisionAuthority(input.appId, input.backupId, participants, identity.publicKey.keyId, previous, input.keyRotation?.previousIdentity.publicKey.keyId);
+    const accessControl = await createAccessControl(input.appId, input.backupId, participants, identity, previous, cryptoImplementation, input.keyRotation?.previousIdentity);
+    const revisionId = input.revisionId ?? randomUUID(options);
+    const createdAt = input.createdAt ?? now(options).toISOString();
+    requireNonEmpty(revisionId, "revisionId");
+    const header = {
+        schemaVersion: 1,
+        kind: SHARED_BACKUP_KIND,
+        algorithm: SHARING_CONTENT_ALGORITHM,
+        appId: input.appId,
+        backupId: input.backupId,
+        revisionId,
+        ...(previous ? { parentRevisionId: previous.revisionId } : {}),
+        ...(previous
+            ? {
+                revisionAncestors: [
+                    ...(previous.revisionAncestors ?? []),
+                    previous.revisionId,
+                ].slice(-SHARED_BACKUP_MAX_REVISION_ANCESTORS),
+            }
+            : {}),
+        createdAt,
+        authorKeyId: identity.publicKey.keyId,
+    };
+    const rawContentKey = randomBytes(32, cryptoImplementation);
+    try {
+        const contentKey = await cryptoImplementation.subtle.importKey("raw", copyBuffer(rawContentKey), "AES-GCM", false, ["encrypt", "decrypt"]);
+        const payloadNonce = randomBytes(12, cryptoImplementation);
+        let serialized;
+        try {
+            serialized = codec.serialize(value);
+        }
+        catch (error) {
+            throw new SyncKitError("serialization", "Shared-backup serialization failed.", { cause: error });
+        }
+        const ciphertext = new Uint8Array(await cryptoImplementation.subtle.encrypt(aesGcm(payloadNonce, canonicalAad(header)), contentKey, copyBuffer(encoder.encode(JSON.stringify(serialized)))));
+        const keyGrants = await Promise.all(participants.map((participant) => createKeyGrant(rawContentKey, header, participant, cryptoImplementation)));
+        const unsigned = {
+            ...header,
+            accessControl,
+            keyGrants,
+            payloadNonce: bytesToBase64Url(payloadNonce),
+            ciphertext: bytesToBase64Url(ciphertext),
+        };
+        const signature = new Uint8Array(await cryptoImplementation.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, identity.signingPrivateKey, copyBuffer(canonicalAad(unsigned))));
+        return parseSharedBackupEnvelopeV1({
+            ...unsigned,
+            signature: bytesToBase64Url(signature),
+        });
+    }
+    catch (error) {
+        throw asSyncKitError(error, "crypto", "The shared backup could not be encrypted.");
+    }
+    finally {
+        rawContentKey.fill(0);
+    }
+}
+export async function verifySharedBackupEnvelopeV1(input, cryptoImplementation = globalThis.crypto, options = {}) {
+    assertWebCrypto(cryptoImplementation);
+    const envelope = parseSharedBackupEnvelopeV1(input);
+    const participants = await verifyAccessControl(envelope.accessControl, cryptoImplementation, options.trustedOwnerKeyId, envelope.appId, envelope.backupId);
+    const author = sharedBackupParticipant(envelope, envelope.authorKeyId);
+    if (!author || !canWriteSharedBackup(author.role)) {
+        throw new SyncKitError("authorization", "The shared-backup author is not an authorized writer.");
+    }
+    await assertParticipantKeys(participants, cryptoImplementation);
+    const { signature, ...unsigned } = envelope;
+    const valid = await cryptoImplementation.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, await importSigningPublicKey(author, cryptoImplementation), copyBuffer(base64UrlToBytes(signature)), copyBuffer(canonicalAad(unsigned)));
+    if (!valid) {
+        throw new SyncKitError("crypto", "The shared-backup signature is invalid.");
+    }
+    return envelope;
+}
+export async function decryptSharedBackupEnvelopeV1(input, codec, identity, cryptoImplementation = globalThis.crypto, options = {}) {
+    assertWebCrypto(cryptoImplementation);
+    await assertIdentity(identity, cryptoImplementation);
+    const envelope = await verifySharedBackupEnvelopeV1(input, cryptoImplementation, options);
+    const participant = sharedBackupParticipant(envelope, identity.publicKey.keyId);
+    if (!participant) {
+        throw new SyncKitError("authorization", "This identity is not a participant in the shared backup.");
+    }
+    const grant = envelope.keyGrants.find((candidate) => candidate.recipientKeyId === identity.publicKey.keyId);
+    if (!grant) {
+        throw new SyncKitError("key", "No content-key grant exists for this identity.");
+    }
+    const header = sharedBackupHeader(envelope);
+    let rawContentKey;
+    try {
+        rawContentKey = await unwrapContentKey(grant, header, identity.encryptionPrivateKey, cryptoImplementation);
+    }
+    catch (error) {
+        throw asSyncKitError(error, "key", "This identity could not unwrap the shared-backup content key.");
+    }
+    try {
+        const contentKey = await cryptoImplementation.subtle.importKey("raw", copyBuffer(rawContentKey), "AES-GCM", false, ["decrypt"]);
+        const plaintext = await cryptoImplementation.subtle.decrypt(aesGcm(base64UrlToBytes(envelope.payloadNonce), canonicalAad(header)), contentKey, copyBuffer(base64UrlToBytes(envelope.ciphertext)));
+        try {
+            return codec.parse(JSON.parse(decoder.decode(plaintext)));
+        }
+        catch (error) {
+            throw new SyncKitError("serialization", "The decrypted shared-backup payload is invalid.", { cause: error });
+        }
+    }
+    catch (error) {
+        throw asSyncKitError(error, "crypto", "This identity could not decrypt the shared backup.");
+    }
+    finally {
+        rawContentKey.fill(0);
+    }
+}
+export function sharingKeyFingerprint(keyId) {
+    const bytes = base64UrlToBytes(keyId);
+    return Array.from(bytes.slice(0, 12), (byte) => byte.toString(16).padStart(2, "0"))
+        .join("")
+        .match(/.{1,4}/gu)
+        ?.join("-") ?? "";
+}
+async function createKeyGrant(rawContentKey, header, participant, cryptoImplementation) {
+    const ephemeral = await cryptoImplementation.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
+    const ephemeralPublicKey = bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.exportKey("raw", ephemeral.publicKey)));
+    const kdfSalt = randomBytes(32, cryptoImplementation);
+    const nonce = randomBytes(12, cryptoImplementation);
+    const grantHeader = {
+        appId: header.appId,
+        backupId: header.backupId,
+        revisionId: header.revisionId,
+        recipientKeyId: participant.keyId,
+        ephemeralPublicKey,
+        kdfSalt: bytesToBase64Url(kdfSalt),
+        nonce: bytesToBase64Url(nonce),
+    };
+    const wrappingKey = await deriveWrappingKey(ephemeral.privateKey, await importEncryptionPublicKey(participant, cryptoImplementation), kdfSalt, grantHeader, cryptoImplementation);
+    const wrappedContentKey = await cryptoImplementation.subtle.encrypt(aesGcm(nonce, canonicalAad(grantHeader)), wrappingKey, copyBuffer(rawContentKey));
+    return {
+        recipientKeyId: participant.keyId,
+        ephemeralPublicKey,
+        kdfSalt: bytesToBase64Url(kdfSalt),
+        nonce: bytesToBase64Url(nonce),
+        wrappedContentKey: bytesToBase64Url(new Uint8Array(wrappedContentKey)),
+    };
+}
+async function unwrapContentKey(grant, header, privateKey, cryptoImplementation) {
+    const grantHeader = {
+        appId: header.appId,
+        backupId: header.backupId,
+        revisionId: header.revisionId,
+        recipientKeyId: grant.recipientKeyId,
+        ephemeralPublicKey: grant.ephemeralPublicKey,
+        kdfSalt: grant.kdfSalt,
+        nonce: grant.nonce,
+    };
+    const wrappingKey = await deriveWrappingKey(privateKey, await importEcdhPublicKey(grant.ephemeralPublicKey, cryptoImplementation), base64UrlToBytes(grant.kdfSalt), grantHeader, cryptoImplementation);
+    return new Uint8Array(await cryptoImplementation.subtle.decrypt(aesGcm(base64UrlToBytes(grant.nonce), canonicalAad(grantHeader)), wrappingKey, copyBuffer(base64UrlToBytes(grant.wrappedContentKey))));
+}
+async function deriveWrappingKey(privateKey, publicKey, salt, context, cryptoImplementation) {
+    const secret = new Uint8Array(await cryptoImplementation.subtle.deriveBits({ name: "ECDH", public: publicKey }, privateKey, 256));
+    try {
+        const material = await cryptoImplementation.subtle.importKey("raw", copyBuffer(secret), "HKDF", false, ["deriveKey"]);
+        return await cryptoImplementation.subtle.deriveKey({
+            name: "HKDF",
+            hash: "SHA-256",
+            salt: copyBuffer(salt),
+            info: copyBuffer(encoder.encode(`sync-kit-sharing-v1:${canonicalJson(context)}`)),
+        }, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+    }
+    finally {
+        secret.fill(0);
+    }
+}
+export async function createSharingPublicKeyV1(encryptionPublicKey, signingPublicKey, cryptoImplementation) {
+    const digest = await cryptoImplementation.subtle.digest("SHA-256", copyBuffer(canonicalAad({
+        encryptionAlgorithm: SHARING_ENCRYPTION_ALGORITHM,
+        encryptionPublicKey,
+        signatureAlgorithm: SHARING_SIGNATURE_ALGORITHM,
+        signingPublicKey,
+    })));
+    return {
+        keyId: bytesToBase64Url(new Uint8Array(digest)),
+        encryptionAlgorithm: SHARING_ENCRYPTION_ALGORITHM,
+        encryptionPublicKey,
+        signatureAlgorithm: SHARING_SIGNATURE_ALGORITHM,
+        signingPublicKey,
+    };
+}
+async function assertIdentity(identity, cryptoImplementation) {
+    const expected = await createSharingPublicKeyV1(identity.publicKey.encryptionPublicKey, identity.publicKey.signingPublicKey, cryptoImplementation);
+    if (expected.keyId !== identity.publicKey.keyId) {
+        throw new SyncKitError("key", "The sharing identity fingerprint is invalid.");
+    }
+}
+async function assertParticipantKeys(participants, cryptoImplementation) {
+    for (const participant of participants) {
+        const expected = await createSharingPublicKeyV1(participant.encryptionPublicKey, participant.signingPublicKey, cryptoImplementation);
+        if (expected.keyId !== participant.keyId) {
+            throw new SyncKitError("key", `Participant fingerprint ${participant.keyId} is invalid.`);
+        }
+    }
+}
+async function createAccessControl(appId, backupId, participants, identity, previous, cryptoImplementation, previousIdentity) {
+    if (previous &&
+        canonicalJson(sharedBackupParticipants(previous)) ===
+            canonicalJson(participants)) {
+        return previous.accessControl;
+    }
+    const priorEntry = previous?.accessControl.at(-1);
+    const sequence = previous?.accessControl.length ?? 0;
+    const previousHash = priorEntry
+        ? await accessControlHash(priorEntry, cryptoImplementation)
+        : undefined;
+    const rotationUnsigned = previousIdentity
+        ? {
+            appId,
+            backupId,
+            sequence,
+            ...(previousHash ? { previousHash } : {}),
+            fromKeyId: previousIdentity.publicKey.keyId,
+            toKeyId: identity.publicKey.keyId,
+            participants,
+        }
+        : undefined;
+    const keyRotation = previousIdentity && rotationUnsigned
+        ? {
+            fromKeyId: previousIdentity.publicKey.keyId,
+            toKeyId: identity.publicKey.keyId,
+            newKeyProof: bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, identity.signingPrivateKey, copyBuffer(canonicalAad(rotationUnsigned))))),
+        }
+        : undefined;
+    const accessSigner = previousIdentity ?? identity;
+    const unsigned = {
+        appId,
+        backupId,
+        sequence,
+        ...(previousHash ? { previousHash } : {}),
+        authorKeyId: accessSigner.publicKey.keyId,
+        participants,
+        ...(keyRotation ? { keyRotation } : {}),
+    };
+    const entry = {
+        ...unsigned,
+        signature: bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, accessSigner.signingPrivateKey, copyBuffer(canonicalAad(unsigned))))),
+    };
+    return [...(previous?.accessControl ?? []), entry];
+}
+async function verifyAccessControl(accessControl, cryptoImplementation, trustedOwnerKeyId, appId, backupId) {
+    let previous;
+    let ownerKeyId;
+    for (const entry of accessControl) {
+        if ((entry.appId !== undefined || entry.backupId !== undefined) &&
+            (entry.appId !== appId || entry.backupId !== backupId)) {
+            throw new SyncKitError("authorization", "An access-control entry belongs to another dataset.");
+        }
+        await assertParticipantKeys(entry.participants, cryptoImplementation);
+        const owner = entry.participants.find((participant) => participant.role === "owner");
+        if (!owner) {
+            throw new SyncKitError("authorization", "An access-control entry has no owner.");
+        }
+        if (ownerKeyId === undefined) {
+            ownerKeyId = owner.keyId;
+            if (trustedOwnerKeyId && trustedOwnerKeyId !== ownerKeyId) {
+                throw new SyncKitError("authorization", "The shared backup does not match the trusted owner key.");
+            }
+        }
+        let author;
+        let validRotation = false;
+        if (previous) {
+            const expectedHash = await accessControlHash(previous, cryptoImplementation);
+            if (entry.previousHash !== expectedHash) {
+                throw new SyncKitError("crypto", "The access-control history hash is invalid.");
+            }
+            author = previous.participants.find((participant) => participant.keyId === entry.authorKeyId);
+            validRotation = entry.keyRotation
+                ? await verifyAccessKeyRotation(entry, previous, cryptoImplementation)
+                : false;
+            if (!author ||
+                (!canAdministerSharedBackup(author.role) && !validRotation)) {
+                throw new SyncKitError("authorization", "An access-control change was not signed by a prior owner or admin.");
+            }
+            if (owner.keyId !== ownerKeyId) {
+                if (!validRotation ||
+                    entry.keyRotation?.fromKeyId !== ownerKeyId ||
+                    entry.keyRotation.toKeyId !== owner.keyId) {
+                    throw new SyncKitError("authorization", "Owner transfer is not supported by sharing v1.");
+                }
+                ownerKeyId = owner.keyId;
+            }
+        }
+        else {
+            if (entry.keyRotation) {
+                throw new SyncKitError("authorization", "A genesis access entry cannot rotate a key.");
+            }
+            author = entry.participants.find((participant) => participant.keyId === entry.authorKeyId);
+            if (author?.role !== "owner") {
+                throw new SyncKitError("authorization", "The first access-control entry was not signed by its owner.");
+            }
+        }
+        const { signature, ...unsigned } = entry;
+        const valid = await cryptoImplementation.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, await importSigningPublicKey(author, cryptoImplementation), copyBuffer(base64UrlToBytes(signature)), copyBuffer(canonicalAad(unsigned)));
+        if (!valid) {
+            throw new SyncKitError("crypto", "An access-control signature is invalid.");
+        }
+        previous = entry;
+    }
+    const participants = previous?.participants;
+    if (!participants) {
+        throw new SyncKitError("compatibility", "Access-control history is empty.");
+    }
+    return participants;
+}
+async function verifyAccessKeyRotation(entry, previous, cryptoImplementation) {
+    const rotation = entry.keyRotation;
+    if (!rotation ||
+        !entry.appId ||
+        !entry.backupId ||
+        entry.authorKeyId !== rotation.fromKeyId) {
+        return false;
+    }
+    const from = previous.participants.find((participant) => participant.keyId === rotation.fromKeyId);
+    const to = entry.participants.find((participant) => participant.keyId === rotation.toKeyId);
+    if (!from ||
+        !to ||
+        !canWriteSharedBackup(from.role) ||
+        from.role !== to.role ||
+        canonicalJson(from.accepted ?? null) !== canonicalJson(to.accepted ?? null)) {
+        return false;
+    }
+    const expectedParticipants = previous.participants
+        .map((participant) => (participant.keyId === from.keyId ? to : participant))
+        .sort((left, right) => compareUtf16CodeUnits(left.keyId, right.keyId));
+    if (canonicalJson(expectedParticipants) !== canonicalJson(entry.participants)) {
+        return false;
+    }
+    const proof = {
+        appId: entry.appId,
+        backupId: entry.backupId,
+        sequence: entry.sequence,
+        ...(entry.previousHash ? { previousHash: entry.previousHash } : {}),
+        fromKeyId: rotation.fromKeyId,
+        toKeyId: rotation.toKeyId,
+        participants: entry.participants,
+    };
+    return cryptoImplementation.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, await importSigningPublicKey(to, cryptoImplementation), copyBuffer(base64UrlToBytes(rotation.newKeyProof)), copyBuffer(canonicalAad(proof)));
+}
+async function accessControlHash(entry, cryptoImplementation) {
+    return bytesToBase64Url(new Uint8Array(await cryptoImplementation.subtle.digest("SHA-256", copyBuffer(canonicalAad(entry)))));
+}
+function normalizedParticipants(input) {
+    if (input.length === 0) {
+        throw new SyncKitError("configuration", "participants must not be empty.");
+    }
+    const participants = input
+        .map(({ publicKey, role, accepted }) => ({
+        ...publicKey,
+        role,
+        ...(accepted ? { accepted } : {}),
+    }))
+        .sort((left, right) => compareUtf16CodeUnits(left.keyId, right.keyId));
+    const duplicate = participants.find((participant, index) => index > 0 && participants[index - 1]?.keyId === participant.keyId);
+    if (duplicate) {
+        throw new SyncKitError("configuration", `Duplicate participant ${duplicate.keyId}.`);
+    }
+    if (participants.filter((participant) => participant.role === "owner").length !== 1) {
+        throw new SyncKitError("configuration", "A shared backup must have exactly one owner.");
+    }
+    return participants;
+}
+function normalizedRequestedGrants(input) {
+    if (input.length === 0) {
+        throw new SyncKitError("configuration", "requestedGrants must not be empty.");
+    }
+    const grants = [...input].sort((left, right) => compareUtf16CodeUnits(left.datasetId, right.datasetId));
+    for (const [index, grant] of grants.entries()) {
+        requireNonEmpty(grant.datasetId, "datasetId");
+        if (index > 0 && grants[index - 1]?.datasetId === grant.datasetId) {
+            throw new SyncKitError("configuration", `Duplicate requested dataset ${grant.datasetId}.`);
+        }
+    }
+    return grants;
+}
+function publicKeyFromResponse(response) {
+    return {
+        keyId: response.keyId,
+        encryptionAlgorithm: response.encryptionAlgorithm,
+        encryptionPublicKey: response.encryptionPublicKey,
+        signatureAlgorithm: response.signatureAlgorithm,
+        signingPublicKey: response.signingPublicKey,
+    };
+}
+function assertRevisionAuthority(appId, backupId, participants, authorKeyId, previous, rotationFromKeyId) {
+    if (!previous) {
+        const owner = participants.find((participant) => participant.role === "owner");
+        if (owner?.keyId !== authorKeyId) {
+            throw new SyncKitError("authorization", "Only the owner can create the first shared-backup revision.");
+        }
+        return;
+    }
+    if (previous.appId !== appId || previous.backupId !== backupId) {
+        throw new SyncKitError("compatibility", "The previous revision belongs to a different shared backup.");
+    }
+    const priorAuthor = sharedBackupParticipant(previous, rotationFromKeyId ?? authorKeyId);
+    if (!priorAuthor || !canWriteSharedBackup(priorAuthor.role)) {
+        throw new SyncKitError("authorization", "The previous revision does not authorize this writer.");
+    }
+    const participantsChanged = canonicalJson(sharedBackupParticipants(previous)) !==
+        canonicalJson(participants);
+    if (participantsChanged &&
+        !rotationFromKeyId &&
+        !canAdministerSharedBackup(priorAuthor.role)) {
+        throw new SyncKitError("authorization", "Only an owner or admin can change shared-backup participants.");
+    }
+    const priorOwner = sharedBackupParticipants(previous).find((participant) => participant.role === "owner");
+    const nextOwner = participants.find((participant) => participant.role === "owner");
+    if (priorOwner?.keyId !== nextOwner?.keyId &&
+        (rotationFromKeyId !== priorOwner?.keyId ||
+            authorKeyId !== nextOwner?.keyId)) {
+        throw new SyncKitError("authorization", "Owner transfer is not supported by sharing v1.");
+    }
+    if (rotationFromKeyId) {
+        const replacement = participants.find((participant) => participant.keyId === authorKeyId);
+        const expected = sharedBackupParticipants(previous)
+            .map((participant) => participant.keyId === rotationFromKeyId
+            ? replacement
+            : participant)
+            .filter((participant) => participant !== undefined)
+            .sort((left, right) => compareUtf16CodeUnits(left.keyId, right.keyId));
+        if (replacement?.role !== priorAuthor.role ||
+            canonicalJson(replacement?.accepted ?? null) !==
+                canonicalJson(priorAuthor.accepted ?? null) ||
+            canonicalJson(expected) !== canonicalJson(participants)) {
+            throw new SyncKitError("authorization", "A key rotation may only replace the current writer's key.");
+        }
+    }
+}
+function sharedBackupHeader(envelope) {
+    return {
+        schemaVersion: envelope.schemaVersion,
+        kind: envelope.kind,
+        algorithm: envelope.algorithm,
+        appId: envelope.appId,
+        backupId: envelope.backupId,
+        revisionId: envelope.revisionId,
+        ...(envelope.parentRevisionId
+            ? { parentRevisionId: envelope.parentRevisionId }
+            : {}),
+        ...(envelope.revisionAncestors
+            ? { revisionAncestors: envelope.revisionAncestors }
+            : {}),
+        createdAt: envelope.createdAt,
+        authorKeyId: envelope.authorKeyId,
+    };
+}
+function importEncryptionPublicKey(publicKey, cryptoImplementation) {
+    return importEcdhPublicKey(publicKey.encryptionPublicKey, cryptoImplementation);
+}
+function importEcdhPublicKey(value, cryptoImplementation) {
+    return cryptoImplementation.subtle.importKey("raw", copyBuffer(base64UrlToBytes(value)), { name: "ECDH", namedCurve: "P-256" }, false, []);
+}
+function importSigningPublicKey(publicKey, cryptoImplementation) {
+    return cryptoImplementation.subtle.importKey("raw", copyBuffer(base64UrlToBytes(publicKey.signingPublicKey)), { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+}
+function aesGcm(nonce, additionalData) {
+    return {
+        name: "AES-GCM",
+        iv: copyBuffer(nonce),
+        additionalData: copyBuffer(additionalData),
+        tagLength: 128,
+    };
+}
+function randomBytes(length, cryptoImplementation) {
+    return cryptoImplementation.getRandomValues(new Uint8Array(length));
+}
+function randomUUID(options) {
+    const implementation = options.randomUUID ??
+        (options.crypto ?? globalThis.crypto).randomUUID?.bind(options.crypto ?? globalThis.crypto);
+    if (!implementation) {
+        throw new SyncKitError("configuration", "Secure UUID generation is unavailable.");
+    }
+    return implementation();
+}
+function now(options) {
+    return options.now?.() ?? new Date();
+}
+function requireNonEmpty(value, name) {
+    if (!value.trim())
+        throw new TypeError(`${name} must not be empty.`);
+}
+function assertWebCrypto(value) {
+    if (!value?.subtle || !value.getRandomValues) {
+        throw new SyncKitError("configuration", "A WebCrypto implementation with P-256 support is required.");
+    }
+}
+//# sourceMappingURL=web-crypto.js.map