@real-life/trust-protocol 0.3.1 → 0.4.0

package/dist/group-star.d.ts

@@ -0,0 +1,251 @@
+import type { Context } from './identity.js';
+/** Entries are padded to the next positive multiple of this (§5.2b). */
+export declare const GROUP_STAR_PAD = 16;
+/**
+ * Chunks hold at most 64 entries (§5.2b): a real entry is about 570
+ * bytes JCS, so a full chunk stays well inside the Delivery Contract's
+ * 65 536-byte plaintext bound at the longest salt.
+ */
+export declare const GROUP_STAR_CHUNK = 64;
+/** The kinds of randomness a group star draws: AEAD nonces of sealed
+ *  pairs, and filler (d and c of filler entries, c of unsealed ones). */
+export type GroupStarRandKind = 'nonce' | 'filler';
+/** The caller's entropy: n fresh bytes of one kind. */
+export type GroupStarDraw = (n: number, kind: GroupStarRandKind) => Uint8Array;
+/** k_g of one direction from the pair secret: `sender` and `recipient` are the two pair anchors, salt in its wire string form. */
+export declare function groupStarKeyOf(shared: Uint8Array, sender: string, recipient: string, salt: string, subtle?: SubtleCrypto): Promise<Uint8Array>;
+/** k_e(G) from the pair secret: the sealing key of one group's entry; G is the canonical u form of the genesis digest. */
+export declare function groupSealKeyOf(shared: Uint8Array, sender: string, recipient: string, salt: string, group: string, subtle?: SubtleCrypto): Promise<Uint8Array>;
+export interface GroupPairFields {
+    /** the genesis digest G, canonical u form */
+    group: string;
+    /** the sender's member anchor in G (for a founder: its founding pair anchor) */
+    member: string;
+    /** oid: of the canonical admission of member, or of the genesis where the sender founded G */
+    memberOp: string;
+    to: string;
+    salt: string;
+}
+/** The opened body of a sealed entry; `memberShared` = X25519(memberX_sender, pairX_recipient). */
+export declare function buildGroupPairWith(i: GroupPairFields, memberShared: Uint8Array, subtle?: SubtleCrypto): Promise<{
+    proof: string;
+    type: string;
+    group: string;
+    member: string;
+    memberOp: string;
+    to: string;
+    salt: string;
+}>;
+export interface GroupStarEntryInput {
+    group: string;
+    /** a real sealed pair; otherwise c is filler */
+    sealed: boolean;
+    /** the sender's member anchor in G (sealed only) */
+    member?: string;
+    memberOp?: string;
+    /** X25519(memberX_sender, pairX_recipient), asked for only when sealed */
+    memberShared?: () => Promise<Uint8Array>;
+}
+export interface GroupStarWithInput {
+    /** X25519(pairX_sender, pairX_recipient) */
+    shared: Uint8Array;
+    /** the sender's pair anchor */
+    sender: string;
+    /** the recipient's pair anchor */
+    to: string;
+    salt: string;
+    /** every group the sender lists toward this recipient */
+    groups: GroupStarEntryInput[];
+    draw: GroupStarDraw;
+    subtle?: SubtleCrypto;
+}
+export type GroupStarChunk = {
+    body: {
+        type: 'group-star@1';
+        salt: string;
+        seq: string;
+        last: boolean;
+        groups: {
+            d: string;
+            c: string;
+        }[];
+    };
+    proof: {
+        mac: string;
+    };
+};
+/** The chunks of one group-star delivery toward one recipient. */
+export declare function buildGroupStarWith(i: GroupStarWithInput): Promise<{
+    chunks: GroupStarChunk[];
+}>;
+/** Is this a schema-valid group-star@1 chunk (visibility-group-star.schema.json)? */
+export declare const groupStarChunkOk: (chunk: unknown) => boolean;
+/** The §5.2b checks of a completed union: a positive multiple of 16
+ *  entries, strictly ascending by d, every c of the same length. */
+export declare function groupStarUnionOk(entries: readonly {
+    d: string;
+    c: string;
+}[]): 'order' | 'size' | 'c length' | null;
+/**
+ * One delivery's chunks → its entry union (5.2a under the group star's
+ * own salt): every chunk schema-valid and MAC-valid under k_g of the
+ * arrival tuple, one salt, seq 1..n each once, exactly the n-th last,
+ * the union strictly ascending by d — and the §5.2b reception rules on
+ * the completed assembly: a positive multiple of 16 entries, every c of
+ * the same length. A failing assembly rejects the delivery.
+ */
+export declare function assembleGroupStarWith(i: {
+    shared: () => Promise<Uint8Array>;
+    from: string;
+    own: string;
+    chunks: any[];
+    subtle?: SubtleCrypto;
+}): Promise<{
+    ok: true;
+    salt: string;
+    entries: {
+        d: string;
+        c: string;
+    }[];
+} | {
+    ok: false;
+    reason: string;
+}>;
+/** A group the recipient is a CURRENT member of, with its materialized state. */
+export interface GroupMembership {
+    group: string;
+    /** is this anchor a current member of the recipient's materialized state of the group? */
+    isMember: (anchor: string) => boolean;
+    /** the canonical admission (or the genesis) an oid: names: its subject (genesis: body.members[0]) and its card's key-agreement key */
+    resolve: (oid: string) => {
+        subject: string;
+        keyAgreement: string;
+    } | null;
+}
+export interface GroupStarResult {
+    group: string;
+    hit: boolean;
+    opened: boolean;
+    accepted: boolean;
+    member?: string;
+    memberOp?: string;
+    reason?: string;
+}
+/**
+ * Reception (§5.2b): for each group the recipient is a current member
+ * of, compute d and test the union; on a hit derive k_e(G) and try to
+ * open c — a c that does not open is a miss, not an error. An opened
+ * pair is accepted only if, in order: schema · group = G · to = the
+ * own pair anchor and salt = the assembly's · memberOp names a
+ * canonical admission of member (or the genesis) and member is current
+ * · the MAC verifies under that operation's card key, non-zero ECDH
+ * (`agreeMember(cardKeyAgreement)` = X25519(own pairX, that key), null
+ * where it cannot agree). An accepted pair is class V: merged
+ * holder-locally, never republished.
+ */
+export declare function openGroupStarWith(i: {
+    shared: Uint8Array;
+    from: string;
+    own: string;
+    salt: string;
+    entries: {
+        d: string;
+        c: string;
+    }[];
+    memberships: GroupMembership[];
+    agreeMember: (keyAgreement: string) => Promise<Uint8Array | null>;
+    subtle?: SubtleCrypto;
+}): Promise<GroupStarResult[]>;
+/** k_g of one direction: `sender` and `recipient` are the two pair anchors, salt in its wire string form. */
+export declare function groupStarKey(own: Context, peerKeyAgreement: string, sender: string, recipient: string, salt: string): Promise<Uint8Array>;
+/** k_e(G): the sealing key of one group's entry; G is the canonical u form of the genesis digest. */
+export declare function groupSealKey(own: Context, peerKeyAgreement: string, sender: string, recipient: string, salt: string, group: string): Promise<Uint8Array>;
+export interface GroupPairInput {
+    /** the genesis digest G, canonical u form */
+    group: string;
+    /** the sender's member context in G (for a founder: its founding pair context) */
+    member: Context;
+    /** oid: of the canonical admission of member, or of the genesis where the sender founded G */
+    memberOp: string;
+    to: string;
+    toKeyAgreement: string;
+    salt: string;
+}
+/** The opened body of a sealed entry; proof under memberX × pairX of the recipient. */
+export declare function buildGroupPair(i: GroupPairInput): Promise<{
+    proof: string;
+    type: string;
+    group: string;
+    member: string;
+    memberOp: string;
+    to: string;
+    salt: string;
+}>;
+export interface GroupStarGroup {
+    group: string;
+    /** a real sealed pair (the recipient is trusted, or this group is switched on for it); otherwise c is filler */
+    sealed: boolean;
+    member?: Context;
+    memberOp?: string;
+}
+export interface GroupStarInput {
+    /** the sender's pair context of the relationship */
+    own: Context;
+    to: string;
+    toKeyAgreement: string;
+    salt: string;
+    /** every group the sender lists toward this recipient (its current groups not switched off) */
+    groups: GroupStarGroup[];
+    /** the entropy source (nonces, filler): the caller's, so vectors replay */
+    rand: (n: number) => Uint8Array;
+}
+/** The chunks of one group-star delivery toward one recipient. */
+export declare function buildGroupStar(i: GroupStarInput): Promise<{
+    chunks: GroupStarChunk[];
+}>;
+/**
+ * One delivery's chunks → its entry union (5.2a under the group star's
+ * own salt): every chunk schema-valid and MAC-valid under k_g of the
+ * arrival tuple, one salt, seq 1..n each once, exactly the n-th last,
+ * the union strictly ascending by d — and the §5.2b reception rules on
+ * the completed assembly: a positive multiple of 16 entries, every c of
+ * the same length. A failing assembly rejects the delivery.
+ */
+export declare function assembleGroupStar(i: {
+    own: Context;
+    from: string;
+    fromKeyAgreement: string;
+    chunks: any[];
+}): Promise<{
+    ok: true;
+    salt: string;
+    entries: {
+        d: string;
+        c: string;
+    }[];
+} | {
+    ok: false;
+    reason: string;
+}>;
+/**
+ * Reception (§5.2b): for each group the recipient is a current member
+ * of, compute d and test the union; on a hit derive k_e(G) and try to
+ * open c — a c that does not open is a miss, not an error. An opened
+ * pair is accepted only if, in order: schema · group = G · to = the
+ * own pair anchor and salt = the assembly's · memberOp names a
+ * canonical admission of member (or the genesis) and member is current
+ * · the MAC verifies under that operation's card key, non-zero ECDH.
+ * An accepted pair is class V: merged holder-locally, never republished.
+ */
+export declare function openGroupStar(i: {
+    own: Context;
+    from: string;
+    fromKeyAgreement: string;
+    salt: string;
+    entries: {
+        d: string;
+        c: string;
+    }[];
+    memberships: GroupMembership[];
+}): Promise<GroupStarResult[]>;
+//# sourceMappingURL=group-star.d.ts.map

package/dist/group-star.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-star.d.ts","sourceRoot":"","sources":["../src/group-star.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAQ5C,wEAAwE;AACxE,eAAO,MAAM,cAAc,KAAK,CAAA;AAChC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAIlC;yEACyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,CAAA;AAClD,uDAAuD;AACvD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,KAAK,UAAU,CAAA;AAI9E,kIAAkI;AAClI,wBAAsB,cAAc,CAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,YAA+B,GAAG,OAAO,CAAC,UAAU,CAAC,CAGvK;AACD,0HAA0H;AAC1H,wBAAsB,cAAc,CAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,YAA+B,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtL;AAoBD,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAA;IACd,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AACD,mGAAmG;AACnG,wBAAsB,kBAAkB,CAAE,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAE,YAA+B;;;;;;;;GAK9H;AASD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,MAAM,EAAE,OAAO,CAAA;IACf,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;CACzC;AACD,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,MAAM,EAAE,UAAU,CAAA;IAClB,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,yDAAyD;IACzD,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC7B,IAAI,EAAE,aAAa,CAAA;IACnB,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB;AACD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AAErK,kEAAkE;AAClE,wBAAsB,kBAAkB,CAAE,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CAkCtG;AAID,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,KAAG,OAA+D,CAAA;AAEjH;oEACoE;AACpE,wBAAgB,gBAAgB,CAAE,OAAO,EAAE,SAAS;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAKpH;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBhQ;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAA;IACrC,sIAAsI;IACtI,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAC3E;AACD,MAAM,WAAW,eAAe;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAEzJ;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAE,CAAC,EAAE;IAC1C,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAC;IACjI,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAC1F,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CA0B7B;AAeD,6GAA6G;AAC7G,wBAAsB,YAAY,CAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhJ;AACD,qGAAqG;AACrG,wBAAsB,YAAY,CAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE/J;AAGD,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IACb,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAA;IACf,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAA;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;CACb;AACD,uFAAuF;AACvF,wBAAsB,cAAc,CAAE,CAAC,EAAE,cAAc;;;;;;;;GAEtD;AAGD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,gHAAgH;IAChH,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AACD,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,GAAG,EAAE,OAAO,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,+FAA+F;IAC/F,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,2EAA2E;IAC3E,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,UAAU,CAAA;CAChC;AACD,kEAAkE;AAClE,wBAAsB,cAAc,CAAE,CAAC,EAAE,cAAc;YAhM6B,cAAc,EAAE;GA0MnG;AAGD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAE,CAAC,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,EAAE,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE7N;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAE,CAAC,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAS/M"}

package/dist/group-star.js

@@ -0,0 +1,348 @@
+// group-star — group-star@1, the sender's groups blinded to every
+// contact and sealed to the chosen ones (Trust Layer 0.31 §5.2b, task
+// group-star/0.1): the pure wire constructions over raw X25519 shared
+// secrets (lib Stage 2, PR 4b).
+//
+// Byte-identical with vectors/group-star.json (check:generators:lib). The
+// holder's trust module (trust/group-star.ts) builds on these functions
+// with secrets from its KeyProvider.
+//
+//   k_g    = HKDF(X25519(pairX_sender, pairX_recipient),
+//                 "rltp/visibility/blind/group-star/" || senderPair || "/" || recipientPair || "/" || salt)
+//   k_e(G) = HKDF(same ikm,
+//                 "rltp/visibility/seal/group-star/" || senderPair || "/" || recipientPair || "/" || salt || "/" || G)
+//   entry  = { d: HMAC(k_g, UTF-8 of G), c: AES-256-GCM(k_e(G), nonce, AAD = bytes of d, JCS(group-pair@1)) }
+//   proof  = { mac: HMAC(k_g, JCS(body)) }
+//   group-pair@1 = { type, group, member, memberOp, to, salt, proof },
+//     proof = HMAC(HKDF(ECDH(memberX_sender, pairX_recipient), "rltp/visibility/mac/group-pair"), JCS(pair without proof))
+//
+// A `c` that is not a real pair is FILLER: random bytes of exactly the
+// length a real c has in this star. The list is padded with filler
+// entries to the next multiple of 16 (an empty list to 16: the all-
+// filler star), sorted by d once, and sliced in order into chunks of at
+// most 64 (5.2a). Entropy comes from the caller's `draw`, by kind, so
+// vectors replay; this module draws none itself.
+import { jcs, makeValidator } from './core.js';
+import { SCHEMAS } from './schemas.js';
+import { b64uOf, ecdh, fromB64u, hkdf, platformSubtle, xRawOfMk } from './crypto.js';
+import { macU } from './anchor.js';
+const te = new TextEncoder();
+const td = new TextDecoder('utf-8', { fatal: true });
+const VAL = makeValidator(SCHEMAS);
+const schemaOk = (file, data) => VAL.validate(data, SCHEMAS[file], SCHEMAS[file]).length === 0;
+/** Entries are padded to the next positive multiple of this (§5.2b). */
+export const GROUP_STAR_PAD = 16;
+/**
+ * Chunks hold at most 64 entries (§5.2b): a real entry is about 570
+ * bytes JCS, so a full chunk stays well inside the Delivery Contract's
+ * 65 536-byte plaintext bound at the longest salt.
+ */
+export const GROUP_STAR_CHUNK = 64;
+const NONCE = 12;
+const TAG = 16;
+const isZero = (b) => b.every((x) => x === 0);
+/** k_g of one direction from the pair secret: `sender` and `recipient` are the two pair anchors, salt in its wire string form. */
+export async function groupStarKeyOf(shared, sender, recipient, salt, subtle = platformSubtle()) {
+    if (isZero(shared))
+        throw new Error('all-zero shared secret (Trust §2.1)');
+    return hkdf(shared, `rltp/visibility/blind/group-star/${sender}/${recipient}/${salt}`, 32, subtle);
+}
+/** k_e(G) from the pair secret: the sealing key of one group's entry; G is the canonical u form of the genesis digest. */
+export async function groupSealKeyOf(shared, sender, recipient, salt, group, subtle = platformSubtle()) {
+    if (isZero(shared))
+        throw new Error('all-zero shared secret (Trust §2.1)');
+    return hkdf(shared, `rltp/visibility/seal/group-star/${sender}/${recipient}/${salt}/${group}`, 32, subtle);
+}
+// ── AEAD (§2.1): AES-256-GCM, 128-bit tag, 96-bit nonce; u + base64url(nonce || ct || tag) ──
+async function seal(key, aad, plaintext, nonce, S) {
+    const k = await S.importKey('raw', key, 'AES-GCM', false, ['encrypt']);
+    const ct = new Uint8Array(await S.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: te.encode(aad), tagLength: 128 }, k, te.encode(plaintext)));
+    const out = new Uint8Array(NONCE + ct.length);
+    out.set(nonce);
+    out.set(ct, NONCE);
+    return 'u' + b64uOf(out);
+}
+async function open(key, aad, c, S) {
+    try {
+        const raw = fromB64u(c.slice(1));
+        if (raw.length <= NONCE + TAG)
+            return null;
+        const k = await S.importKey('raw', key, 'AES-GCM', false, ['decrypt']);
+        const pt = await S.decrypt({ name: 'AES-GCM', iv: raw.subarray(0, NONCE), additionalData: te.encode(aad), tagLength: 128 }, k, raw.subarray(NONCE));
+        return td.decode(pt);
+    }
+    catch {
+        return null;
+    }
+}
+/** The opened body of a sealed entry; `memberShared` = X25519(memberX_sender, pairX_recipient). */
+export async function buildGroupPairWith(i, memberShared, subtle = platformSubtle()) {
+    if (isZero(memberShared))
+        throw new Error('all-zero shared secret (Trust §2.1)');
+    const unproved = { type: 'group-pair@1', group: i.group, member: i.member, memberOp: i.memberOp, to: i.to, salt: i.salt };
+    const k = await hkdf(memberShared, 'rltp/visibility/mac/group-pair', 32, subtle);
+    return { ...unproved, proof: await macU(k, jcs(unproved), subtle) };
+}
+// every field of a group pair but salt has a fixed length on the wire
+// (did:key 56, digest 47, oid 47, mac 44), so a real c's length is a
+// function of the salt alone — the filler length of this star
+const sealedLength = (to, salt) => NONCE + TAG + te.encode(jcs({
+    type: 'group-pair@1', group: 'u' + 'A'.repeat(46), member: to, memberOp: 'oid:' + 'A'.repeat(43), to, salt, proof: 'u' + 'A'.repeat(43),
+})).length;
+/** The chunks of one group-star delivery toward one recipient. */
+export async function buildGroupStarWith(i) {
+    const S = i.subtle ?? platformSubtle();
+    const kg = await groupStarKeyOf(i.shared, i.sender, i.to, i.salt, S);
+    const cLen = sealedLength(i.to, i.salt);
+    const ds = new Set(), cs = new Set();
+    const entries = [];
+    const fillerC = () => { for (;;) {
+        const c = 'u' + b64uOf(i.draw(cLen, 'filler'));
+        if (!cs.has(c))
+            return c;
+    } };
+    for (const g of i.groups) {
+        const d = await macU(kg, g.group, S);
+        if (ds.has(d))
+            continue; // one entry per group
+        let c;
+        if (g.sealed) {
+            if (!g.member || !g.memberOp || !g.memberShared)
+                throw new Error('a sealed group pair needs member and memberOp');
+            const pair = await buildGroupPairWith({ group: g.group, member: g.member, memberOp: g.memberOp, to: i.to, salt: i.salt }, await g.memberShared(), S);
+            c = await seal(await groupSealKeyOf(i.shared, i.sender, i.to, i.salt, g.group, S), d, jcs(pair), i.draw(NONCE, 'nonce'), S);
+            if (c.length !== 'u'.length + Math.ceil(cLen * 4 / 3))
+                throw new Error('group pair of unexpected length — filler would be distinguishable');
+        }
+        else
+            c = fillerC();
+        ds.add(d);
+        cs.add(c);
+        entries.push({ d, c });
+    }
+    const target = Math.max(GROUP_STAR_PAD, Math.ceil(entries.length / GROUP_STAR_PAD) * GROUP_STAR_PAD);
+    while (entries.length < target) {
+        let d;
+        do
+            d = 'u' + b64uOf(i.draw(32, 'filler'));
+        while (ds.has(d)); // collisions with any value are resampled
+        const c = fillerC();
+        ds.add(d);
+        cs.add(c);
+        entries.push({ d, c });
+    }
+    entries.sort((x, y) => (x.d < y.d ? -1 : x.d > y.d ? 1 : 0));
+    const n = Math.ceil(entries.length / GROUP_STAR_CHUNK);
+    const chunks = [];
+    for (let k = 0; k < n; k++) {
+        const body = { type: 'group-star@1', salt: i.salt, seq: String(k + 1), last: k === n - 1, groups: entries.slice(k * GROUP_STAR_CHUNK, (k + 1) * GROUP_STAR_CHUNK) };
+        chunks.push({ body, proof: { mac: await macU(kg, jcs(body), S) } });
+    }
+    return { chunks };
+}
+// ── the recipient ───────────────────────────────────────────────────────
+/** Is this a schema-valid group-star@1 chunk (visibility-group-star.schema.json)? */
+export const groupStarChunkOk = (chunk) => schemaOk('visibility-group-star.schema.json', chunk);
+/** The §5.2b checks of a completed union: a positive multiple of 16
+ *  entries, strictly ascending by d, every c of the same length. */
+export function groupStarUnionOk(entries) {
+    if (!entries.every((e, k) => k === 0 || entries[k - 1].d < e.d))
+        return 'order';
+    if (entries.length === 0 || entries.length % GROUP_STAR_PAD !== 0)
+        return 'size';
+    if (entries.some((e) => e.c.length !== entries[0].c.length))
+        return 'c length';
+    return null;
+}
+/**
+ * One delivery's chunks → its entry union (5.2a under the group star's
+ * own salt): every chunk schema-valid and MAC-valid under k_g of the
+ * arrival tuple, one salt, seq 1..n each once, exactly the n-th last,
+ * the union strictly ascending by d — and the §5.2b reception rules on
+ * the completed assembly: a positive multiple of 16 entries, every c of
+ * the same length. A failing assembly rejects the delivery.
+ */
+export async function assembleGroupStarWith(i) {
+    const S = i.subtle ?? platformSubtle();
+    if (!Array.isArray(i.chunks) || !i.chunks.length)
+        return { ok: false, reason: 'no chunk' };
+    for (const ch of i.chunks)
+        if (!groupStarChunkOk(ch))
+            return { ok: false, reason: 'schema' };
+    const salt = i.chunks[0].body.salt;
+    if (i.chunks.some((ch) => ch.body.salt !== salt))
+        return { ok: false, reason: 'salt' };
+    let kg;
+    try {
+        kg = await groupStarKeyOf(await i.shared(), i.from, i.own, salt, S);
+    }
+    catch {
+        return { ok: false, reason: 'ecdh' };
+    }
+    for (const ch of i.chunks)
+        if ((await macU(kg, jcs(ch.body), S)) !== ch.proof.mac)
+            return { ok: false, reason: 'mac' };
+    const bySeq = new Map();
+    for (const ch of i.chunks) {
+        if (bySeq.has(ch.body.seq))
+            return { ok: false, reason: 'seq repeated' };
+        bySeq.set(ch.body.seq, ch.body);
+    }
+    const lasts = i.chunks.filter((ch) => ch.body.last);
+    if (lasts.length !== 1)
+        return { ok: false, reason: 'last' };
+    const n = Number(lasts[0].body.seq);
+    if (bySeq.size !== n)
+        return { ok: false, reason: 'incomplete' };
+    const entries = [];
+    for (let k = 1; k <= n; k++) {
+        const b = bySeq.get(String(k));
+        if (!b)
+            return { ok: false, reason: 'incomplete' };
+        entries.push(...b.groups);
+    }
+    const bad = groupStarUnionOk(entries);
+    if (bad !== null)
+        return { ok: false, reason: bad };
+    return { ok: true, salt, entries };
+}
+/**
+ * Reception (§5.2b): for each group the recipient is a current member
+ * of, compute d and test the union; on a hit derive k_e(G) and try to
+ * open c — a c that does not open is a miss, not an error. An opened
+ * pair is accepted only if, in order: schema · group = G · to = the
+ * own pair anchor and salt = the assembly's · memberOp names a
+ * canonical admission of member (or the genesis) and member is current
+ * · the MAC verifies under that operation's card key, non-zero ECDH
+ * (`agreeMember(cardKeyAgreement)` = X25519(own pairX, that key), null
+ * where it cannot agree). An accepted pair is class V: merged
+ * holder-locally, never republished.
+ */
+export async function openGroupStarWith(i) {
+    const S = i.subtle ?? platformSubtle();
+    const kg = await groupStarKeyOf(i.shared, i.from, i.own, i.salt, S);
+    const byD = new Map(i.entries.map((e) => [e.d, e.c]));
+    const out = [];
+    for (const m of i.memberships) {
+        const d = await macU(kg, m.group, S);
+        const c = byD.get(d);
+        if (c === undefined) {
+            out.push({ group: m.group, hit: false, opened: false, accepted: false });
+            continue;
+        }
+        const pt = await open(await groupSealKeyOf(i.shared, i.from, i.own, i.salt, m.group, S), d, c, S);
+        if (pt === null) {
+            out.push({ group: m.group, hit: true, opened: false, accepted: false });
+            continue;
+        }
+        const reject = (reason) => out.push({ group: m.group, hit: true, opened: true, accepted: false, reason });
+        let pair;
+        try {
+            pair = JSON.parse(pt);
+        }
+        catch {
+            reject('schema');
+            continue;
+        }
+        if (!schemaOk('visibility-group-pair.schema.json', pair)) {
+            reject('schema');
+            continue;
+        }
+        if (pair.group !== m.group) {
+            reject('group');
+            continue;
+        }
+        if (pair.to !== i.own || pair.salt !== i.salt) {
+            reject('to');
+            continue;
+        }
+        const op = m.resolve(pair.memberOp);
+        if (!op || op.subject !== pair.member || !m.isMember(pair.member)) {
+            reject('member');
+            continue;
+        }
+        const sh = await i.agreeMember(op.keyAgreement);
+        if (!sh || isZero(sh)) {
+            reject('mac');
+            continue;
+        }
+        const { proof, ...unproved } = pair;
+        if ((await macU(await hkdf(sh, 'rltp/visibility/mac/group-pair', 32, S), jcs(unproved), S)) !== proof) {
+            reject('mac');
+            continue;
+        }
+        out.push({ group: m.group, hit: true, opened: true, accepted: true, member: pair.member, memberOp: pair.memberOp });
+    }
+    return out;
+}
+// ── over identity Contexts ─────────────────────────────────────────────
+// The same constructions with the private keys of identity Contexts (the
+// form vectors, generators and tests use); the holder goes through the
+// *With forms with secrets from its KeyProvider. Entropy (AEAD nonces,
+// filler) is the caller's `rand`, so the vectors replay.
+const shared = async (own, peerKeyAgreement) => {
+    const x = xRawOfMk(peerKeyAgreement);
+    if (!x)
+        throw new Error('peer key agreement is not a multikey');
+    const sh = await ecdh(own.x.priv, x);
+    if (sh.every((b) => b === 0))
+        throw new Error('all-zero shared secret (Trust §2.1)'); // rejected before key derivation
+    return sh;
+};
+/** k_g of one direction: `sender` and `recipient` are the two pair anchors, salt in its wire string form. */
+export async function groupStarKey(own, peerKeyAgreement, sender, recipient, salt) {
+    return groupStarKeyOf(await shared(own, peerKeyAgreement), sender, recipient, salt);
+}
+/** k_e(G): the sealing key of one group's entry; G is the canonical u form of the genesis digest. */
+export async function groupSealKey(own, peerKeyAgreement, sender, recipient, salt, group) {
+    return groupSealKeyOf(await shared(own, peerKeyAgreement), sender, recipient, salt, group);
+}
+/** The opened body of a sealed entry; proof under memberX × pairX of the recipient. */
+export async function buildGroupPair(i) {
+    return buildGroupPairWith({ group: i.group, member: i.member.anchor, memberOp: i.memberOp, to: i.to, salt: i.salt }, await shared(i.member, i.toKeyAgreement));
+}
+/** The chunks of one group-star delivery toward one recipient. */
+export async function buildGroupStar(i) {
+    const rnd = i.rand;
+    return buildGroupStarWith({
+        shared: await shared(i.own, i.toKeyAgreement), sender: i.own.anchor, to: i.to, salt: i.salt,
+        groups: i.groups.map((g) => ({
+            group: g.group, sealed: g.sealed, member: g.member?.anchor, memberOp: g.memberOp,
+            memberShared: g.member ? () => shared(g.member, i.toKeyAgreement) : undefined,
+        })),
+        draw: (n) => rnd(n),
+    });
+}
+// ── the recipient ───────────────────────────────────────────────────────
+/**
+ * One delivery's chunks → its entry union (5.2a under the group star's
+ * own salt): every chunk schema-valid and MAC-valid under k_g of the
+ * arrival tuple, one salt, seq 1..n each once, exactly the n-th last,
+ * the union strictly ascending by d — and the §5.2b reception rules on
+ * the completed assembly: a positive multiple of 16 entries, every c of
+ * the same length. A failing assembly rejects the delivery.
+ */
+export async function assembleGroupStar(i) {
+    return assembleGroupStarWith({ shared: () => shared(i.own, i.fromKeyAgreement), from: i.from, own: i.own.anchor, chunks: i.chunks });
+}
+/**
+ * Reception (§5.2b): for each group the recipient is a current member
+ * of, compute d and test the union; on a hit derive k_e(G) and try to
+ * open c — a c that does not open is a miss, not an error. An opened
+ * pair is accepted only if, in order: schema · group = G · to = the
+ * own pair anchor and salt = the assembly's · memberOp names a
+ * canonical admission of member (or the genesis) and member is current
+ * · the MAC verifies under that operation's card key, non-zero ECDH.
+ * An accepted pair is class V: merged holder-locally, never republished.
+ */
+export async function openGroupStar(i) {
+    const res = await openGroupStarWith({
+        shared: await shared(i.own, i.fromKeyAgreement), from: i.from, own: i.own.anchor, salt: i.salt, entries: i.entries, memberships: i.memberships,
+        agreeMember: async (keyAgreement) => {
+            const memberX = xRawOfMk(keyAgreement);
+            return memberX ? ecdh(i.own.x.priv, memberX) : null;
+        },
+    });
+    return res.map(({ memberOp: _, ...r }) => r);
+}
+//# sourceMappingURL=group-star.js.map