@tearleads/client-sdk 0.0.0-stage → 0.1.11

package/internal/validators/util/containerKekKeyringWire.d.ts

@@ -0,0 +1,105 @@
+import { z } from "zod";
+/**
+ * Shared wire arithmetic for sealed container KEK keyrings.
+ *
+ * These numbers define the exact-length equality every layer enforces: the
+ * server rejects a rotation whose sealed keyring ciphertext differs from
+ * `sealedContainerKekKeyringBytes(keyEpoch)`, and response guards reject any
+ * blob over the `MAX_CONTAINER_KEY_EPOCH` ceiling before cryptographic work.
+ * `@tearleads/crypto` consumes these same constants for seal/open, so the
+ * equation has one definition. The overhead constant is the AES-GCM tag.
+ */
+export declare const MAX_CONTAINER_KEY_EPOCH = 65536;
+export declare const SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES = 8;
+export declare const SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES = 64;
+export declare const SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES = 16;
+export declare function sealedContainerKekKeyringBytes(keyEpoch: number): number;
+/** Parse ceiling: the base64 length of a keyring sealed at the epoch cap. */
+export declare const MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH: number;
+export declare const ContainerKekKeyringWireRecordSchema: z.ZodType<{
+    containerId: string;
+    containerKeyEpochId: string;
+    iv: string;
+    sealed: string;
+    sealingSuite: string;
+    version: number;
+}, {
+    containerId: string;
+    containerKeyEpochId: string;
+    iv: string;
+    sealed: string;
+    sealingSuite: string;
+    version: number;
+}, z.core.$ZodTypeInternals<{
+    containerId: string;
+    containerKeyEpochId: string;
+    iv: string;
+    sealed: string;
+    sealingSuite: string;
+    version: number;
+}, {
+    containerId: string;
+    containerKeyEpochId: string;
+    iv: string;
+    sealed: string;
+    sealingSuite: string;
+    version: number;
+}>>;
+/**
+ * Structural bound applied before any allocation-heavy or cryptographic work.
+ * Content verification (exact length for the epoch, AEAD, per-entry
+ * commitments) happens in `@tearleads/crypto`; this guard only bounds a
+ * hostile payload.
+ */
+export declare function isContainerKekKeyringWireRecord(value: unknown): value is Record<string, unknown>;
+/**
+ * Maximum epochs one kek-log page may serve. Recovery walks the log from the
+ * newest page backward, so the page bound — not the container's lifetime
+ * rotation count — determines a response's size.
+ */
+export declare const CONTAINER_KEK_LOG_PAGE_LIMIT = 256;
+/**
+ * Maximum signed container rekeys one document/blob write may carry inline.
+ * Each rotation ships a keyring, which is O(its epoch) bytes, so an unbounded
+ * batch is an unbounded request body.
+ */
+export declare const MAX_INLINE_CONTAINER_REKEYS = 16;
+/**
+ * Maximum descendant rekeys one container rotation may carry. A rotation must
+ * re-key, in its own transaction, every descendant that sits above a directly
+ * granted container, or a writer granted only further down would wait on
+ * another device's write. The set is empty for almost every rotation, since
+ * child containers carry no direct grant unless shared, so this bounds the
+ * body rather than shaping ordinary traffic. A rotation is never refused for
+ * exceeding it: beyond the cap the remainder repairs lazily.
+ *
+ * A sealed keyring is 64 bytes per retained epoch, so a full batch stays far
+ * inside the API's 100 MiB request limit unless its containers average tens of
+ * thousands of rotations each, which `MAX_CONTAINER_KEY_EPOCH` already treats
+ * as a runaway rather than a use.
+ */
+export declare const MAX_ROTATION_CONTAINER_REKEYS = 64;
+/**
+ * Maximum recipient envelopes one kek-log epoch may serve, applied PER EPOCH
+ * so no epoch can be starved by another's width — a starved epoch is
+ * indistinguishable from an unaddressed one and would surface as a false
+ * `no-addressed-envelope` recovery failure.
+ *
+ * Recovery needs ONE openable anchor per epoch, not every envelope, and the
+ * ranking puts the requester's own direct wrap first, so this cap never costs
+ * a usable anchor. Together with the epoch page limit it bounds the response
+ * at page x cap rows regardless of how many recipients a container has
+ * accumulated.
+ */
+export declare const CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT = 16;
+/**
+ * Maximum authorized principals a single kek-log read may scope wraps to.
+ * A requester's principal set has no intrinsic ceiling and each entry adds a
+ * clause, and bind parameters, to the statement.
+ *
+ * The requester's direct user envelope and their parent-container envelopes
+ * are scoped outside this cap and rank ahead of principal wraps, so the bound
+ * never costs the anchors openable without principal-policy state. Opening a
+ * principal wrap needs that state regardless (see issue #1941).
+ */
+export declare const CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT = 64;

package/internal/validators/util/containerKekKeyringWire.js

@@ -0,0 +1,98 @@
+import { z } from "zod";
+import { registerJsonSchemaFragment } from "../jsonSchema.js";
+import { boundedStringSchema, loosePlainObject } from "../schema.js";
+/**
+ * Shared wire arithmetic for sealed container KEK keyrings.
+ *
+ * These numbers define the exact-length equality every layer enforces: the
+ * server rejects a rotation whose sealed keyring ciphertext differs from
+ * `sealedContainerKekKeyringBytes(keyEpoch)`, and response guards reject any
+ * blob over the `MAX_CONTAINER_KEY_EPOCH` ceiling before cryptographic work.
+ * `@tearleads/crypto` consumes these same constants for seal/open, so the
+ * equation has one definition. The overhead constant is the AES-GCM tag.
+ */
+export const MAX_CONTAINER_KEY_EPOCH = 65536;
+export const SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES = 8;
+export const SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES = 64;
+export const SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES = 16;
+export function sealedContainerKekKeyringBytes(keyEpoch) {
+    return (SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES +
+        (keyEpoch - 1) * SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES +
+        SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES);
+}
+function base64Length(bytes) {
+    return Math.ceil(bytes / 3) * 4;
+}
+/** Parse ceiling: the base64 length of a keyring sealed at the epoch cap. */
+export const MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH = base64Length(sealedContainerKekKeyringBytes(MAX_CONTAINER_KEY_EPOCH));
+const AES_GCM_IV_BASE64_LENGTH = base64Length(12);
+const ContainerKekKeyringVersionSchema = registerJsonSchemaFragment(z.custom((value) => value === 1), { const: 1, type: "number" });
+export const ContainerKekKeyringWireRecordSchema = loosePlainObject({
+    containerId: z.string(),
+    containerKeyEpochId: z.string(),
+    iv: boundedStringSchema(AES_GCM_IV_BASE64_LENGTH),
+    sealed: boundedStringSchema(MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH),
+    sealingSuite: z.string(),
+    version: ContainerKekKeyringVersionSchema,
+});
+/**
+ * Structural bound applied before any allocation-heavy or cryptographic work.
+ * Content verification (exact length for the epoch, AEAD, per-entry
+ * commitments) happens in `@tearleads/crypto`; this guard only bounds a
+ * hostile payload.
+ */
+export function isContainerKekKeyringWireRecord(value) {
+    return ContainerKekKeyringWireRecordSchema.safeParse(value).success;
+}
+/**
+ * Maximum epochs one kek-log page may serve. Recovery walks the log from the
+ * newest page backward, so the page bound — not the container's lifetime
+ * rotation count — determines a response's size.
+ */
+export const CONTAINER_KEK_LOG_PAGE_LIMIT = 256;
+/**
+ * Maximum signed container rekeys one document/blob write may carry inline.
+ * Each rotation ships a keyring, which is O(its epoch) bytes, so an unbounded
+ * batch is an unbounded request body.
+ */
+export const MAX_INLINE_CONTAINER_REKEYS = 16;
+/**
+ * Maximum descendant rekeys one container rotation may carry. A rotation must
+ * re-key, in its own transaction, every descendant that sits above a directly
+ * granted container, or a writer granted only further down would wait on
+ * another device's write. The set is empty for almost every rotation, since
+ * child containers carry no direct grant unless shared, so this bounds the
+ * body rather than shaping ordinary traffic. A rotation is never refused for
+ * exceeding it: beyond the cap the remainder repairs lazily.
+ *
+ * A sealed keyring is 64 bytes per retained epoch, so a full batch stays far
+ * inside the API's 100 MiB request limit unless its containers average tens of
+ * thousands of rotations each, which `MAX_CONTAINER_KEY_EPOCH` already treats
+ * as a runaway rather than a use.
+ */
+export const MAX_ROTATION_CONTAINER_REKEYS = 64;
+/**
+ * Maximum recipient envelopes one kek-log epoch may serve, applied PER EPOCH
+ * so no epoch can be starved by another's width — a starved epoch is
+ * indistinguishable from an unaddressed one and would surface as a false
+ * `no-addressed-envelope` recovery failure.
+ *
+ * Recovery needs ONE openable anchor per epoch, not every envelope, and the
+ * ranking puts the requester's own direct wrap first, so this cap never costs
+ * a usable anchor. Together with the epoch page limit it bounds the response
+ * at page x cap rows regardless of how many recipients a container has
+ * accumulated.
+ */
+export const CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT = 16;
+/**
+ * Maximum authorized principals a single kek-log read may scope wraps to.
+ * A requester's principal set has no intrinsic ceiling and each entry adds a
+ * clause, and bind parameters, to the statement.
+ *
+ * The requester's direct user envelope and their parent-container envelopes
+ * are scoped outside this cap and rank ahead of principal wraps, so the bound
+ * never costs the anchors openable without principal-policy state. Opening a
+ * principal wrap needs that state regardless (see issue #1941).
+ */
+export const CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT = 64;
+//# sourceMappingURL=containerKekKeyringWire.js.map

package/internal/validators/util/containerKekKeyringWire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerKekKeyringWire.js","sourceRoot":"","sources":["containerKekKeyringWire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,wCAAwC,GAAG,EAAE,CAAC;AAC3D,MAAM,CAAC,MAAM,gDAAgD,GAAG,EAAE,CAAC;AAEnE,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC7D,OAAO,CACL,yCAAyC;QACzC,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,wCAAwC;QACzD,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,8CAA8C,GAAG,YAAY,CACxE,8BAA8B,CAAC,uBAAuB,CAAC,CACxD,CAAC;AAEF,MAAM,wBAAwB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;AAClD,MAAM,gCAAgC,GAAG,0BAA0B,CACjE,CAAC,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,EACxC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,EAAE,EAAE,mBAAmB,CAAC,wBAAwB,CAAC;IACjD,MAAM,EAAE,mBAAmB,CAAC,8CAA8C,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,gCAAgC;CAC1C,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport { boundedStringSchema, loosePlainObject } from \"../schema\";\n\n/**\n * Shared wire arithmetic for sealed container KEK keyrings.\n *\n * These numbers define the exact-length equality every layer enforces: the\n * server rejects a rotation whose sealed keyring ciphertext differs from\n * `sealedContainerKekKeyringBytes(keyEpoch)`, and response guards reject any\n * blob over the `MAX_CONTAINER_KEY_EPOCH` ceiling before cryptographic work.\n * `@tearleads/crypto` consumes these same constants for seal/open, so the\n * equation has one definition. The overhead constant is the AES-GCM tag.\n */\nexport const MAX_CONTAINER_KEY_EPOCH = 65536;\nexport const SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES = 8;\nexport const SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES = 64;\nexport const SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES = 16;\n\nexport function sealedContainerKekKeyringBytes(keyEpoch: number): number {\n  return (\n    SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES +\n    (keyEpoch - 1) * SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES +\n    SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES\n  );\n}\n\nfunction base64Length(bytes: number): number {\n  return Math.ceil(bytes / 3) * 4;\n}\n\n/** Parse ceiling: the base64 length of a keyring sealed at the epoch cap. */\nexport const MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH = base64Length(\n  sealedContainerKekKeyringBytes(MAX_CONTAINER_KEY_EPOCH),\n);\n\nconst AES_GCM_IV_BASE64_LENGTH = base64Length(12);\nconst ContainerKekKeyringVersionSchema = registerJsonSchemaFragment(\n  z.custom<number>((value) => value === 1),\n  { const: 1, type: \"number\" },\n);\n\nexport const ContainerKekKeyringWireRecordSchema = loosePlainObject({\n  containerId: z.string(),\n  containerKeyEpochId: z.string(),\n  iv: boundedStringSchema(AES_GCM_IV_BASE64_LENGTH),\n  sealed: boundedStringSchema(MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH),\n  sealingSuite: z.string(),\n  version: ContainerKekKeyringVersionSchema,\n});\n\n/**\n * Structural bound applied before any allocation-heavy or cryptographic work.\n * Content verification (exact length for the epoch, AEAD, per-entry\n * commitments) happens in `@tearleads/crypto`; this guard only bounds a\n * hostile payload.\n */\nexport function isContainerKekKeyringWireRecord(\n  value: unknown,\n): value is Record<string, unknown> {\n  return ContainerKekKeyringWireRecordSchema.safeParse(value).success;\n}\n\n/**\n * Maximum epochs one kek-log page may serve. Recovery walks the log from the\n * newest page backward, so the page bound — not the container's lifetime\n * rotation count — determines a response's size.\n */\nexport const CONTAINER_KEK_LOG_PAGE_LIMIT = 256;\n\n/**\n * Maximum signed container rekeys one document/blob write may carry inline.\n * Each rotation ships a keyring, which is O(its epoch) bytes, so an unbounded\n * batch is an unbounded request body.\n */\nexport const MAX_INLINE_CONTAINER_REKEYS = 16;\n\n/**\n * Maximum descendant rekeys one container rotation may carry. A rotation must\n * re-key, in its own transaction, every descendant that sits above a directly\n * granted container, or a writer granted only further down would wait on\n * another device's write. The set is empty for almost every rotation, since\n * child containers carry no direct grant unless shared, so this bounds the\n * body rather than shaping ordinary traffic. A rotation is never refused for\n * exceeding it: beyond the cap the remainder repairs lazily.\n *\n * A sealed keyring is 64 bytes per retained epoch, so a full batch stays far\n * inside the API's 100 MiB request limit unless its containers average tens of\n * thousands of rotations each, which `MAX_CONTAINER_KEY_EPOCH` already treats\n * as a runaway rather than a use.\n */\nexport const MAX_ROTATION_CONTAINER_REKEYS = 64;\n\n/**\n * Maximum recipient envelopes one kek-log epoch may serve, applied PER EPOCH\n * so no epoch can be starved by another's width — a starved epoch is\n * indistinguishable from an unaddressed one and would surface as a false\n * `no-addressed-envelope` recovery failure.\n *\n * Recovery needs ONE openable anchor per epoch, not every envelope, and the\n * ranking puts the requester's own direct wrap first, so this cap never costs\n * a usable anchor. Together with the epoch page limit it bounds the response\n * at page x cap rows regardless of how many recipients a container has\n * accumulated.\n */\nexport const CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT = 16;\n\n/**\n * Maximum authorized principals a single kek-log read may scope wraps to.\n * A requester's principal set has no intrinsic ceiling and each entry adds a\n * clause, and bind parameters, to the statement.\n *\n * The requester's direct user envelope and their parent-container envelopes\n * are scoped outside this cap and rank ahead of principal wraps, so the bound\n * never costs the anchors openable without principal-policy state. Opening a\n * principal wrap needs that state regardless (see issue #1941).\n */\nexport const CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT = 64;\n"]}

package/internal/validators/util/containerLimits.d.ts

@@ -0,0 +1,2 @@
+/** Maximum number of containers in a root-to-leaf path, including both ends. */
+export declare const MAX_CONTAINER_PATH_LENGTH = 100;

package/internal/validators/util/containerLimits.js

@@ -0,0 +1,3 @@
+/** Maximum number of containers in a root-to-leaf path, including both ends. */
+export const MAX_CONTAINER_PATH_LENGTH = 100;
+//# sourceMappingURL=containerLimits.js.map

package/internal/validators/util/containerLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerLimits.js","sourceRoot":"","sources":["containerLimits.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC","sourcesContent":["/** Maximum number of containers in a root-to-leaf path, including both ends. */\nexport const MAX_CONTAINER_PATH_LENGTH = 100;\n"]}

package/internal/validators/util/documentSyncLimits.d.ts

@@ -0,0 +1,10 @@
+export declare const MAX_DOCUMENT_SYNC_REQUEST_BYTES: number;
+export declare const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES: number;
+export declare const MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES: number;
+export declare const MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES: number;
+export declare const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES = 64;
+export declare const MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH = 512;
+export declare const MAX_DOCUMENT_SYNC_OUTGOING_UPDATES = 64;
+export declare const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS = 64;
+export declare const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS: number;
+export declare const MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS = 64;

package/internal/validators/util/documentSyncLimits.js

@@ -0,0 +1,27 @@
+import { MAX_CONTAINER_PATH_LENGTH } from "./containerLimits.js";
+export const MAX_DOCUMENT_SYNC_REQUEST_BYTES = 16 * 1024 * 1024;
+// A response page must be able to carry the largest accepted atomic rotation
+// baseline (the 100 MiB route ceiling) plus its signed metadata and key-bundle
+// envelope. Ordinary sync updates remain constrained by the smaller request
+// ceiling above.
+export const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES = 128 * 1024 * 1024;
+export const MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES = 16 * 1024 * 1024;
+export const MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES = MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES -
+    MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES;
+export const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES = 64;
+export const MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH = 512;
+export const MAX_DOCUMENT_SYNC_OUTGOING_UPDATES = 64;
+// Individual updates may use the request's remaining budget. The SDK applies
+// the exact serialized-byte ceiling after encryption and trims the batch; a
+// smaller estimate here would permanently strand an otherwise valid update.
+export const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS = 64;
+// Derive the aggregate ceiling from the structural limits so every valid link
+// set remains syncable after later container moves deepen its paths. This is
+// still a finite verification bound; the serialized request has a separate
+// 16 MiB ceiling.
+export const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS = MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS * MAX_CONTAINER_PATH_LENGTH;
+// Flag-day product maximum for every document content-key bundle. Create/link
+// request validation and the client link preflight keep a greenfield database
+// from ever producing a document that cannot fit this sync contract.
+export const MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS = 64;
+//# sourceMappingURL=documentSyncLimits.js.map

package/internal/validators/util/documentSyncLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentSyncLimits.js","sourceRoot":"","sources":["documentSyncLimits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,iBAAiB;AACjB,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACvE,MAAM,CAAC,MAAM,yCAAyC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1E,MAAM,CAAC,MAAM,4CAA4C,GACvD,qCAAqC;IACrC,yCAAyC,CAAC;AAC5C,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AAExD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AACrD,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AACxD,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,kBAAkB;AAClB,MAAM,CAAC,MAAM,yCAAyC,GACpD,qCAAqC,GAAG,yBAAyB,CAAC;AACpE,8EAA8E;AAC9E,8EAA8E;AAC9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC","sourcesContent":["import { MAX_CONTAINER_PATH_LENGTH } from \"./containerLimits\";\n\nexport const MAX_DOCUMENT_SYNC_REQUEST_BYTES = 16 * 1024 * 1024;\n\n// A response page must be able to carry the largest accepted atomic rotation\n// baseline (the 100 MiB route ceiling) plus its signed metadata and key-bundle\n// envelope. Ordinary sync updates remain constrained by the smaller request\n// ceiling above.\nexport const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES = 128 * 1024 * 1024;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES = 16 * 1024 * 1024;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES =\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES -\n  MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES;\nexport const MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES = 64;\nexport const MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH = 512;\n\nexport const MAX_DOCUMENT_SYNC_OUTGOING_UPDATES = 64;\n// Individual updates may use the request's remaining budget. The SDK applies\n// the exact serialized-byte ceiling after encryption and trims the batch; a\n// smaller estimate here would permanently strand an otherwise valid update.\nexport const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS = 64;\n// Derive the aggregate ceiling from the structural limits so every valid link\n// set remains syncable after later container moves deepen its paths. This is\n// still a finite verification bound; the serialized request has a separate\n// 16 MiB ceiling.\nexport const MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS =\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS * MAX_CONTAINER_PATH_LENGTH;\n// Flag-day product maximum for every document content-key bundle. Create/link\n// request validation and the client link preflight keep a greenfield database\n// from ever producing a document that cannot fit this sync contract.\nexport const MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS = 64;\n"]}

package/internal/validators/util/index.d.ts

@@ -0,0 +1,14 @@
+export { type AccessEventBundleWireResponse, AccessEventBundleWireResponseSchema, type AccessManifestBundleWire, type AccessManifestBundleWireResponse, AccessManifestBundleWireResponseSchema, AccessManifestBundleWireSchema, isAccessEventBundleWireResponse, isAccessManifestBundleWire, isAccessManifestBundleWireArray, isAccessManifestBundleWireResponse, isOptionalAccessManifestBundleWireArray, } from "./accessManifestBundle.js";
+export { MAX_MULTIPART_BLOB_PART_BYTES } from "./blob.js";
+export { CONTAINER_KEK_LOG_PAGE_LIMIT, CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT, ContainerKekKeyringWireRecordSchema, isContainerKekKeyringWireRecord, MAX_CONTAINER_KEY_EPOCH, MAX_INLINE_CONTAINER_REKEYS, MAX_ROTATION_CONTAINER_REKEYS, MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH, SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES, SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES, SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES, sealedContainerKekKeyringBytes, } from "./containerKekKeyringWire.js";
+export { MAX_CONTAINER_PATH_LENGTH } from "./containerLimits.js";
+export { MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS, MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS, MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS, MAX_DOCUMENT_SYNC_OUTGOING_UPDATES, MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH, MAX_DOCUMENT_SYNC_REQUEST_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES, MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES, } from "./documentSyncLimits.js";
+export { isSerializedKeyEnvelope, isSerializedKeyEnvelopeArray, type SerializedKeyEnvelope, } from "./keyEnvelope.js";
+export { isOrganizationReplacementAuthorization, type OrganizationReplacementAuthorization, OrganizationReplacementAuthorizationSchema, } from "./organizationReplacement.js";
+export { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT } from "./principalHistoryWire.js";
+export { PROJECTION_HISTORY_HINT_CHARACTERS, ProjectionHistoryHeadersSchema, type ProjectionHistoryPrefix, ProjectionHistoryPrefixesSchema, parseProjectionHistoryHints, } from "./projectionHistoryWire.js";
+export { hasArrayProperty, hasBooleanProperty, hasNonEmptyStringProperty, hasNullableNumberProperty, hasNullableStringProperty, hasNumberProperty, hasObjectProperty, hasOptionalStringProperty, hasPositiveIntegerProperty, hasPropertyValue, hasStringProperty, isNonEmptyStringArray, isOptionalRecordArray, isOptionalRecordArrayArray, isRecordArray, isRecordArrayArray, isStringArray, } from "./properties.js";
+export { AUTH_CHALLENGE_HEX_LENGTH, isAuthChallengeHexString, isByteArray, isByteArrayOfLength, isSha256HexString, ML_DSA87_PUBLIC_KEY_BYTES, ML_DSA87_SIGNATURE_BYTES, ML_KEM1024_PUBLIC_KEY_BYTES, SHA256_HEX_LENGTH, } from "./protocol.js";
+export { CANONICAL_SIGNED_AT_PATTERN, isCanonicalSignedAt, MAX_SIGNED_AT_YEAR, MIN_SIGNED_AT_YEAR, SIGNED_AT_CONTRACT, } from "./signedAt.js";
+export { isUuidV4String } from "./uuid.js";
+export { isWalLsnString, parseWalLsn } from "./walLsn.js";

package/internal/validators/util/index.js

@@ -0,0 +1,15 @@
+export { AccessEventBundleWireResponseSchema, AccessManifestBundleWireResponseSchema, AccessManifestBundleWireSchema, isAccessEventBundleWireResponse, isAccessManifestBundleWire, isAccessManifestBundleWireArray, isAccessManifestBundleWireResponse, isOptionalAccessManifestBundleWireArray, } from "./accessManifestBundle.js";
+export { MAX_MULTIPART_BLOB_PART_BYTES } from "./blob.js";
+export { CONTAINER_KEK_LOG_PAGE_LIMIT, CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT, CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT, ContainerKekKeyringWireRecordSchema, isContainerKekKeyringWireRecord, MAX_CONTAINER_KEY_EPOCH, MAX_INLINE_CONTAINER_REKEYS, MAX_ROTATION_CONTAINER_REKEYS, MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH, SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES, SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES, SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES, sealedContainerKekKeyringBytes, } from "./containerKekKeyringWire.js";
+export { MAX_CONTAINER_PATH_LENGTH } from "./containerLimits.js";
+export { MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS, MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS, MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS, MAX_DOCUMENT_SYNC_OUTGOING_UPDATES, MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH, MAX_DOCUMENT_SYNC_REQUEST_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES, MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES, MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES, } from "./documentSyncLimits.js";
+export { isSerializedKeyEnvelope, isSerializedKeyEnvelopeArray, } from "./keyEnvelope.js";
+export { isOrganizationReplacementAuthorization, OrganizationReplacementAuthorizationSchema, } from "./organizationReplacement.js";
+export { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT } from "./principalHistoryWire.js";
+export { PROJECTION_HISTORY_HINT_CHARACTERS, ProjectionHistoryHeadersSchema, ProjectionHistoryPrefixesSchema, parseProjectionHistoryHints, } from "./projectionHistoryWire.js";
+export { hasArrayProperty, hasBooleanProperty, hasNonEmptyStringProperty, hasNullableNumberProperty, hasNullableStringProperty, hasNumberProperty, hasObjectProperty, hasOptionalStringProperty, hasPositiveIntegerProperty, hasPropertyValue, hasStringProperty, isNonEmptyStringArray, isOptionalRecordArray, isOptionalRecordArrayArray, isRecordArray, isRecordArrayArray, isStringArray, } from "./properties.js";
+export { AUTH_CHALLENGE_HEX_LENGTH, isAuthChallengeHexString, isByteArray, isByteArrayOfLength, isSha256HexString, ML_DSA87_PUBLIC_KEY_BYTES, ML_DSA87_SIGNATURE_BYTES, ML_KEM1024_PUBLIC_KEY_BYTES, SHA256_HEX_LENGTH, } from "./protocol.js";
+export { CANONICAL_SIGNED_AT_PATTERN, isCanonicalSignedAt, MAX_SIGNED_AT_YEAR, MIN_SIGNED_AT_YEAR, SIGNED_AT_CONTRACT, } from "./signedAt.js";
+export { isUuidV4String } from "./uuid.js";
+export { isWalLsnString, parseWalLsn } from "./walLsn.js";
+//# sourceMappingURL=index.js.map

package/internal/validators/util/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mCAAmC,EAGnC,sCAAsC,EACtC,8BAA8B,EAC9B,+BAA+B,EAC/B,0BAA0B,EAC1B,+BAA+B,EAC/B,kCAAkC,EAClC,uCAAuC,GACxC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EACL,4BAA4B,EAC5B,uCAAuC,EACvC,mCAAmC,EACnC,mCAAmC,EACnC,+BAA+B,EAC/B,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,8CAA8C,EAC9C,gDAAgD,EAChD,wCAAwC,EACxC,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACL,yCAAyC,EACzC,qCAAqC,EACrC,qCAAqC,EACrC,kCAAkC,EAClC,oCAAoC,EACpC,+BAA+B,EAC/B,yCAAyC,EACzC,qCAAqC,EACrC,uCAAuC,EACvC,4CAA4C,GAC7C,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sCAAsC,EAEtC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAE9B,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC","sourcesContent":["export {\n  type AccessEventBundleWireResponse,\n  AccessEventBundleWireResponseSchema,\n  type AccessManifestBundleWire,\n  type AccessManifestBundleWireResponse,\n  AccessManifestBundleWireResponseSchema,\n  AccessManifestBundleWireSchema,\n  isAccessEventBundleWireResponse,\n  isAccessManifestBundleWire,\n  isAccessManifestBundleWireArray,\n  isAccessManifestBundleWireResponse,\n  isOptionalAccessManifestBundleWireArray,\n} from \"./accessManifestBundle\";\nexport { MAX_MULTIPART_BLOB_PART_BYTES } from \"./blob\";\nexport {\n  CONTAINER_KEK_LOG_PAGE_LIMIT,\n  CONTAINER_KEK_LOG_PRINCIPAL_SCOPE_LIMIT,\n  CONTAINER_KEK_WRAPS_PER_EPOCH_LIMIT,\n  ContainerKekKeyringWireRecordSchema,\n  isContainerKekKeyringWireRecord,\n  MAX_CONTAINER_KEY_EPOCH,\n  MAX_INLINE_CONTAINER_REKEYS,\n  MAX_ROTATION_CONTAINER_REKEYS,\n  MAX_SEALED_CONTAINER_KEK_KEYRING_BASE64_LENGTH,\n  SEALED_CONTAINER_KEK_KEYRING_AEAD_OVERHEAD_BYTES,\n  SEALED_CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  SEALED_CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  sealedContainerKekKeyringBytes,\n} from \"./containerKekKeyringWire\";\nexport { MAX_CONTAINER_PATH_LENGTH } from \"./containerLimits\";\nexport {\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATH_REFS,\n  MAX_DOCUMENT_SYNC_AUTHORIZATION_PATHS,\n  MAX_DOCUMENT_SYNC_CONTENT_KEY_TARGETS,\n  MAX_DOCUMENT_SYNC_OUTGOING_UPDATES,\n  MAX_DOCUMENT_SYNC_PULL_CURSOR_LENGTH,\n  MAX_DOCUMENT_SYNC_REQUEST_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_ENVELOPE_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_BYTES,\n  MAX_DOCUMENT_SYNC_RESPONSE_PAGE_UPDATES,\n  MAX_DOCUMENT_SYNC_RESPONSE_UPDATE_PAGE_BYTES,\n} from \"./documentSyncLimits\";\nexport {\n  isSerializedKeyEnvelope,\n  isSerializedKeyEnvelopeArray,\n  type SerializedKeyEnvelope,\n} from \"./keyEnvelope\";\nexport {\n  isOrganizationReplacementAuthorization,\n  type OrganizationReplacementAuthorization,\n  OrganizationReplacementAuthorizationSchema,\n} from \"./organizationReplacement\";\nexport { PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT } from \"./principalHistoryWire\";\nexport {\n  PROJECTION_HISTORY_HINT_CHARACTERS,\n  ProjectionHistoryHeadersSchema,\n  type ProjectionHistoryPrefix,\n  ProjectionHistoryPrefixesSchema,\n  parseProjectionHistoryHints,\n} from \"./projectionHistoryWire\";\nexport {\n  hasArrayProperty,\n  hasBooleanProperty,\n  hasNonEmptyStringProperty,\n  hasNullableNumberProperty,\n  hasNullableStringProperty,\n  hasNumberProperty,\n  hasObjectProperty,\n  hasOptionalStringProperty,\n  hasPositiveIntegerProperty,\n  hasPropertyValue,\n  hasStringProperty,\n  isNonEmptyStringArray,\n  isOptionalRecordArray,\n  isOptionalRecordArrayArray,\n  isRecordArray,\n  isRecordArrayArray,\n  isStringArray,\n} from \"./properties\";\nexport {\n  AUTH_CHALLENGE_HEX_LENGTH,\n  isAuthChallengeHexString,\n  isByteArray,\n  isByteArrayOfLength,\n  isSha256HexString,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  SHA256_HEX_LENGTH,\n} from \"./protocol\";\nexport {\n  CANONICAL_SIGNED_AT_PATTERN,\n  isCanonicalSignedAt,\n  MAX_SIGNED_AT_YEAR,\n  MIN_SIGNED_AT_YEAR,\n  SIGNED_AT_CONTRACT,\n} from \"./signedAt\";\nexport { isUuidV4String } from \"./uuid\";\nexport { isWalLsnString, parseWalLsn } from \"./walLsn\";\n"]}

package/internal/validators/util/keyEnvelope.d.ts

@@ -0,0 +1,7 @@
+export interface SerializedKeyEnvelope {
+    keyFingerprint: string;
+    kemCipherText: string;
+    wrappedKey: string;
+}
+export declare function isSerializedKeyEnvelope(value: unknown): value is SerializedKeyEnvelope;
+export declare function isSerializedKeyEnvelopeArray(value: unknown): value is SerializedKeyEnvelope[];

package/internal/validators/util/keyEnvelope.js

@@ -0,0 +1,12 @@
+import { isPlainObject } from "../isPlainObject.js";
+import { hasStringProperty } from "./properties.js";
+export function isSerializedKeyEnvelope(value) {
+    return (isPlainObject(value) &&
+        hasStringProperty(value, "keyFingerprint") &&
+        hasStringProperty(value, "kemCipherText") &&
+        hasStringProperty(value, "wrappedKey"));
+}
+export function isSerializedKeyEnvelopeArray(value) {
+    return Array.isArray(value) && value.every(isSerializedKeyEnvelope);
+}
+//# sourceMappingURL=keyEnvelope.js.map

package/internal/validators/util/keyEnvelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyEnvelope.js","sourceRoot":"","sources":["keyEnvelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD,MAAM,UAAU,uBAAuB,CACrC,KAAc;IAEd,OAAO,CACL,aAAa,CAAC,KAAK,CAAC;QACpB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,eAAe,CAAC;QACzC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAc;IAEd,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACtE,CAAC","sourcesContent":["import { isPlainObject } from \"../isPlainObject\";\nimport { hasStringProperty } from \"./properties\";\n\nexport interface SerializedKeyEnvelope {\n  keyFingerprint: string;\n  kemCipherText: string;\n  wrappedKey: string;\n}\n\nexport function isSerializedKeyEnvelope(\n  value: unknown,\n): value is SerializedKeyEnvelope {\n  return (\n    isPlainObject(value) &&\n    hasStringProperty(value, \"keyFingerprint\") &&\n    hasStringProperty(value, \"kemCipherText\") &&\n    hasStringProperty(value, \"wrappedKey\")\n  );\n}\n\nexport function isSerializedKeyEnvelopeArray(\n  value: unknown,\n): value is SerializedKeyEnvelope[] {\n  return Array.isArray(value) && value.every(isSerializedKeyEnvelope);\n}\n"]}

package/internal/validators/util/organizationReplacement.d.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+/** An identity authorizes one fresh personal organization to replace another. */
+export declare const OrganizationReplacementAuthorizationSchema: z.ZodObject<{
+    replacesOrganizationId: z.ZodCustom<string, string>;
+    organizationId: z.ZodCustom<string, string>;
+    rootContainerId: z.ZodCustom<string, string>;
+    userId: z.ZodCustom<string, string>;
+    organizationStateHash: z.ZodCustom<string, string>;
+    adminGroupId: z.ZodCustom<string, string>;
+    adminGroupStateHash: z.ZodCustom<string, string>;
+    memberGroupId: z.ZodCustom<string, string>;
+    memberGroupStateHash: z.ZodCustom<string, string>;
+    rootManifestHash: z.ZodCustom<string, string>;
+    rootMetadataDocumentId: z.ZodCustom<string, string>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationReplacementAuthorization = z.infer<typeof OrganizationReplacementAuthorizationSchema>;
+export declare function isOrganizationReplacementAuthorization(value: unknown): value is OrganizationReplacementAuthorization;

package/internal/validators/util/organizationReplacement.js

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import { nonEmptyStringSchema, sha256HexStringSchema, uuidV4StringSchema, } from "../schema.js";
+/** An identity authorizes one fresh personal organization to replace another. */
+export const OrganizationReplacementAuthorizationSchema = z.strictObject({
+    replacesOrganizationId: uuidV4StringSchema,
+    organizationId: uuidV4StringSchema,
+    rootContainerId: uuidV4StringSchema,
+    userId: uuidV4StringSchema,
+    organizationStateHash: sha256HexStringSchema,
+    adminGroupId: uuidV4StringSchema,
+    adminGroupStateHash: sha256HexStringSchema,
+    memberGroupId: uuidV4StringSchema,
+    memberGroupStateHash: sha256HexStringSchema,
+    rootManifestHash: sha256HexStringSchema,
+    rootMetadataDocumentId: uuidV4StringSchema,
+    signature: nonEmptyStringSchema,
+});
+export function isOrganizationReplacementAuthorization(value) {
+    return OrganizationReplacementAuthorizationSchema.safeParse(value).success;
+}
+//# sourceMappingURL=organizationReplacement.js.map

package/internal/validators/util/organizationReplacement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReplacement.js","sourceRoot":"","sources":["organizationReplacement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,iFAAiF;AACjF,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE,sBAAsB,EAAE,kBAAkB;IAC1C,cAAc,EAAE,kBAAkB;IAClC,eAAe,EAAE,kBAAkB;IACnC,MAAM,EAAE,kBAAkB;IAC1B,qBAAqB,EAAE,qBAAqB;IAC5C,YAAY,EAAE,kBAAkB;IAChC,mBAAmB,EAAE,qBAAqB;IAC1C,aAAa,EAAE,kBAAkB;IACjC,oBAAoB,EAAE,qBAAqB;IAC3C,gBAAgB,EAAE,qBAAqB;IACvC,sBAAsB,EAAE,kBAAkB;IAC1C,SAAS,EAAE,oBAAoB;CAChC,CAAC,CAAC;AAMH,MAAM,UAAU,sCAAsC,CACpD,KAAc;IAEd,OAAO,0CAA0C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n  nonEmptyStringSchema,\n  sha256HexStringSchema,\n  uuidV4StringSchema,\n} from \"../schema\";\n\n/** An identity authorizes one fresh personal organization to replace another. */\nexport const OrganizationReplacementAuthorizationSchema = z.strictObject({\n  replacesOrganizationId: uuidV4StringSchema,\n  organizationId: uuidV4StringSchema,\n  rootContainerId: uuidV4StringSchema,\n  userId: uuidV4StringSchema,\n  organizationStateHash: sha256HexStringSchema,\n  adminGroupId: uuidV4StringSchema,\n  adminGroupStateHash: sha256HexStringSchema,\n  memberGroupId: uuidV4StringSchema,\n  memberGroupStateHash: sha256HexStringSchema,\n  rootManifestHash: sha256HexStringSchema,\n  rootMetadataDocumentId: uuidV4StringSchema,\n  signature: nonEmptyStringSchema,\n});\n\nexport type OrganizationReplacementAuthorization = z.infer<\n  typeof OrganizationReplacementAuthorizationSchema\n>;\n\nexport function isOrganizationReplacementAuthorization(\n  value: unknown,\n): value is OrganizationReplacementAuthorization {\n  return OrganizationReplacementAuthorizationSchema.safeParse(value).success;\n}\n"]}

package/internal/validators/util/principalHistoryWire.d.ts

@@ -0,0 +1,2 @@
+/** Per-response history depth; never a limit on the lifetime of a policy. */
+export declare const PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT = 32;

package/internal/validators/util/principalHistoryWire.js

@@ -0,0 +1,3 @@
+/** Per-response history depth; never a limit on the lifetime of a policy. */
+export const PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT = 32;
+//# sourceMappingURL=principalHistoryWire.js.map

package/internal/validators/util/principalHistoryWire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalHistoryWire.js","sourceRoot":"","sources":["principalHistoryWire.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC","sourcesContent":["/** Per-response history depth; never a limit on the lifetime of a policy. */\nexport const PRINCIPAL_POLICY_HISTORY_PAGE_LIMIT = 32;\n"]}

package/internal/validators/util/projectionHistoryWire.d.ts

@@ -0,0 +1,23 @@
+import { z } from "zod";
+/** Request budgets restrict cache hints, never the history a reader can recover. */
+export declare const PROJECTION_HISTORY_HINT_CHARACTERS = 4096;
+declare const ProjectionHistoryPrefixSchema: z.ZodObject<{
+    key: z.ZodCustom<string, string>;
+    count: z.ZodCustom<number, number>;
+    digest: z.ZodCustom<string, string>;
+}, z.core.$strict>;
+export declare const ProjectionHistoryPrefixesSchema: z.ZodCustom<{
+    key: string;
+    count: number;
+    digest: string;
+}[], {
+    key: string;
+    count: number;
+    digest: string;
+}[]>;
+export type ProjectionHistoryPrefix = z.infer<typeof ProjectionHistoryPrefixSchema>;
+export declare function parseProjectionHistoryHints(value: string): ProjectionHistoryPrefix[] | null;
+export declare const ProjectionHistoryHeadersSchema: z.ZodObject<{
+    "x-projection-history": z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export {};

package/internal/validators/util/projectionHistoryWire.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { registerJsonSchemaFragment, registerJsonSchemaRuntimeRefinements, } from "../jsonSchema.js";
+import { projectionHistoryHeaderRefinement } from "../projectionHistoryRefinements.js";
+import { arraySchema, boundedNonEmptyStringSchema, boundedPositiveIntegerSchema, sha256HexStringSchema, } from "../schema.js";
+/** Request budgets restrict cache hints, never the history a reader can recover. */
+export const PROJECTION_HISTORY_HINT_CHARACTERS = 4096;
+const ProjectionHistoryPrefixSchema = z.strictObject({
+    key: boundedNonEmptyStringSchema(512),
+    count: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),
+    digest: sha256HexStringSchema,
+});
+export const ProjectionHistoryPrefixesSchema = arraySchema(ProjectionHistoryPrefixSchema, 32);
+export function parseProjectionHistoryHints(value) {
+    try {
+        const parsed = ProjectionHistoryPrefixesSchema.safeParse(JSON.parse(decodeURIComponent(value)));
+        return parsed.success &&
+            new Set(parsed.data.map((item) => item.key)).size === parsed.data.length
+            ? parsed.data
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+const hintHeader = registerJsonSchemaFragment(z.string().max(PROJECTION_HISTORY_HINT_CHARACTERS), {
+    type: "string",
+    maxLength: PROJECTION_HISTORY_HINT_CHARACTERS,
+    description: "URI-encoded JSON array of exact device-verified history prefixes (key, count, digest); at most 32 unique keys",
+});
+export const ProjectionHistoryHeadersSchema = z.object({
+    "x-projection-history": registerJsonSchemaRuntimeRefinements(hintHeader.refine((value) => parseProjectionHistoryHints(value) !== null), [projectionHistoryHeaderRefinement]).optional(),
+});
+//# sourceMappingURL=projectionHistoryWire.js.map

package/internal/validators/util/projectionHistoryWire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionHistoryWire.js","sourceRoot":"","sources":["projectionHistoryWire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,oCAAoC,GACrC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB,oFAAoF;AACpF,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AACvD,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,GAAG,EAAE,2BAA2B,CAAC,GAAG,CAAC;IACrC,KAAK,EAAE,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC5D,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CACxD,6BAA6B,EAC7B,EAAE,CACH,CAAC;AAKF,MAAM,UAAU,2BAA2B,CACzC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CACtD,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CACtC,CAAC;QACF,OAAO,MAAM,CAAC,OAAO;YACnB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;YACxE,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,0BAA0B,CAC3C,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAClD;IACE,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,kCAAkC;IAC7C,WAAW,EACT,+GAA+G;CAClH,CACF,CAAC;AACF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,sBAAsB,EAAE,oCAAoC,CAC1D,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EACzE,CAAC,iCAAiC,CAAC,CACpC,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n  registerJsonSchemaFragment,\n  registerJsonSchemaRuntimeRefinements,\n} from \"../jsonSchema\";\nimport { projectionHistoryHeaderRefinement } from \"../projectionHistoryRefinements\";\nimport {\n  arraySchema,\n  boundedNonEmptyStringSchema,\n  boundedPositiveIntegerSchema,\n  sha256HexStringSchema,\n} from \"../schema\";\n\n/** Request budgets restrict cache hints, never the history a reader can recover. */\nexport const PROJECTION_HISTORY_HINT_CHARACTERS = 4096;\nconst ProjectionHistoryPrefixSchema = z.strictObject({\n  key: boundedNonEmptyStringSchema(512),\n  count: boundedPositiveIntegerSchema(Number.MAX_SAFE_INTEGER),\n  digest: sha256HexStringSchema,\n});\nexport const ProjectionHistoryPrefixesSchema = arraySchema(\n  ProjectionHistoryPrefixSchema,\n  32,\n);\nexport type ProjectionHistoryPrefix = z.infer<\n  typeof ProjectionHistoryPrefixSchema\n>;\n\nexport function parseProjectionHistoryHints(\n  value: string,\n): ProjectionHistoryPrefix[] | null {\n  try {\n    const parsed = ProjectionHistoryPrefixesSchema.safeParse(\n      JSON.parse(decodeURIComponent(value)),\n    );\n    return parsed.success &&\n      new Set(parsed.data.map((item) => item.key)).size === parsed.data.length\n      ? parsed.data\n      : null;\n  } catch {\n    return null;\n  }\n}\n\nconst hintHeader = registerJsonSchemaFragment(\n  z.string().max(PROJECTION_HISTORY_HINT_CHARACTERS),\n  {\n    type: \"string\",\n    maxLength: PROJECTION_HISTORY_HINT_CHARACTERS,\n    description:\n      \"URI-encoded JSON array of exact device-verified history prefixes (key, count, digest); at most 32 unique keys\",\n  },\n);\nexport const ProjectionHistoryHeadersSchema = z.object({\n  \"x-projection-history\": registerJsonSchemaRuntimeRefinements(\n    hintHeader.refine((value) => parseProjectionHistoryHints(value) !== null),\n    [projectionHistoryHeaderRefinement],\n  ).optional(),\n});\n"]}

package/internal/validators/util/properties.d.ts

@@ -0,0 +1,17 @@
+export declare function hasStringProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, string>;
+export declare function hasNumberProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, number>;
+export declare function hasPositiveIntegerProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, number>;
+export declare function hasBooleanProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, boolean>;
+export declare function hasNullableNumberProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, number | null>;
+export declare function hasOptionalStringProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, string | undefined>;
+export declare function hasNonEmptyStringProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, string>;
+export declare function hasNullableStringProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, string | null>;
+export declare function hasArrayProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, unknown[]>;
+export declare function hasObjectProperty<Key extends string>(value: Record<string, unknown>, key: Key): value is Record<string, unknown> & Record<Key, Record<string, unknown>>;
+export declare function hasPropertyValue<Key extends string, ExactValue>(value: Record<string, unknown>, key: Key, expected: ExactValue): value is Record<string, unknown> & Record<Key, ExactValue>;
+export declare function isRecordArray(value: unknown): value is Record<string, unknown>[];
+export declare function isRecordArrayArray(value: unknown): value is Record<string, unknown>[][];
+export declare function isOptionalRecordArray(value: unknown): value is Record<string, unknown>[] | undefined;
+export declare function isOptionalRecordArrayArray(value: unknown): value is Record<string, unknown>[][] | undefined;
+export declare function isStringArray(value: unknown): value is string[];
+export declare function isNonEmptyStringArray(value: unknown): value is string[];

package/internal/validators/util/properties.js

@@ -0,0 +1,58 @@
+import { isPlainObject } from "../isPlainObject.js";
+export function hasStringProperty(value, key) {
+    return typeof value[key] === "string";
+}
+export function hasNumberProperty(value, key) {
+    return typeof value[key] === "number";
+}
+export function hasPositiveIntegerProperty(value, key) {
+    return (hasNumberProperty(value, key) &&
+        Number.isInteger(value[key]) &&
+        value[key] > 0);
+}
+export function hasBooleanProperty(value, key) {
+    return typeof value[key] === "boolean";
+}
+export function hasNullableNumberProperty(value, key) {
+    return typeof value[key] === "number" || value[key] === null;
+}
+export function hasOptionalStringProperty(value, key) {
+    return value[key] === undefined || typeof value[key] === "string";
+}
+export function hasNonEmptyStringProperty(value, key) {
+    return hasStringProperty(value, key) && value[key].length > 0;
+}
+export function hasNullableStringProperty(value, key) {
+    return value[key] === null || typeof value[key] === "string";
+}
+export function hasArrayProperty(value, key) {
+    return Array.isArray(value[key]);
+}
+export function hasObjectProperty(value, key) {
+    const v = value[key];
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export function hasPropertyValue(value, key, expected) {
+    return value[key] === expected;
+}
+export function isRecordArray(value) {
+    return Array.isArray(value) && value.every(isPlainObject);
+}
+export function isRecordArrayArray(value) {
+    return Array.isArray(value) && value.every(isRecordArray);
+}
+export function isOptionalRecordArray(value) {
+    return value === undefined || isRecordArray(value);
+}
+export function isOptionalRecordArrayArray(value) {
+    return value === undefined || isRecordArrayArray(value);
+}
+export function isStringArray(value) {
+    return (Array.isArray(value) && value.every((entry) => typeof entry === "string"));
+}
+export function isNonEmptyStringArray(value) {
+    return (Array.isArray(value) &&
+        value.length > 0 &&
+        value.every((entry) => typeof entry === "string" && entry.length > 0));
+}
+//# sourceMappingURL=properties.js.map

package/internal/validators/util/properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"properties.js","sourceRoot":"","sources":["properties.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,UAAU,iBAAiB,CAC/B,KAA8B,EAC9B,GAAQ;IAER,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA8B,EAC9B,GAAQ;IAER,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAA8B,EAC9B,GAAQ;IAER,OAAO,CACL,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA8B,EAC9B,GAAQ;IAER,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA8B,EAC9B,GAAQ;IAER,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA8B,EAC9B,GAAQ;IAER,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA8B,EAC9B,GAAQ;IAER,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA8B,EAC9B,GAAQ;IAER,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAA8B,EAC9B,GAAQ;IAER,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAA8B,EAC9B,GAAQ;IAER,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAA8B,EAC9B,GAAQ,EACR,QAAoB;IAEpB,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc;IAEd,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAc;IAEd,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,OAAO,KAAK,KAAK,SAAS,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC","sourcesContent":["import { isPlainObject } from \"../isPlainObject\";\n\nexport function hasStringProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, string> {\n  return typeof value[key] === \"string\";\n}\n\nexport function hasNumberProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, number> {\n  return typeof value[key] === \"number\";\n}\n\nexport function hasPositiveIntegerProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, number> {\n  return (\n    hasNumberProperty(value, key) &&\n    Number.isInteger(value[key]) &&\n    value[key] > 0\n  );\n}\n\nexport function hasBooleanProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, boolean> {\n  return typeof value[key] === \"boolean\";\n}\n\nexport function hasNullableNumberProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, number | null> {\n  return typeof value[key] === \"number\" || value[key] === null;\n}\n\nexport function hasOptionalStringProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, string | undefined> {\n  return value[key] === undefined || typeof value[key] === \"string\";\n}\n\nexport function hasNonEmptyStringProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, string> {\n  return hasStringProperty(value, key) && value[key].length > 0;\n}\n\nexport function hasNullableStringProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, string | null> {\n  return value[key] === null || typeof value[key] === \"string\";\n}\n\nexport function hasArrayProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, unknown[]> {\n  return Array.isArray(value[key]);\n}\n\nexport function hasObjectProperty<Key extends string>(\n  value: Record<string, unknown>,\n  key: Key,\n): value is Record<string, unknown> & Record<Key, Record<string, unknown>> {\n  const v = value[key];\n  return typeof v === \"object\" && v !== null && !Array.isArray(v);\n}\n\nexport function hasPropertyValue<Key extends string, ExactValue>(\n  value: Record<string, unknown>,\n  key: Key,\n  expected: ExactValue,\n): value is Record<string, unknown> & Record<Key, ExactValue> {\n  return value[key] === expected;\n}\n\nexport function isRecordArray(\n  value: unknown,\n): value is Record<string, unknown>[] {\n  return Array.isArray(value) && value.every(isPlainObject);\n}\n\nexport function isRecordArrayArray(\n  value: unknown,\n): value is Record<string, unknown>[][] {\n  return Array.isArray(value) && value.every(isRecordArray);\n}\n\nexport function isOptionalRecordArray(\n  value: unknown,\n): value is Record<string, unknown>[] | undefined {\n  return value === undefined || isRecordArray(value);\n}\n\nexport function isOptionalRecordArrayArray(\n  value: unknown,\n): value is Record<string, unknown>[][] | undefined {\n  return value === undefined || isRecordArrayArray(value);\n}\n\nexport function isStringArray(value: unknown): value is string[] {\n  return (\n    Array.isArray(value) && value.every((entry) => typeof entry === \"string\")\n  );\n}\n\nexport function isNonEmptyStringArray(value: unknown): value is string[] {\n  return (\n    Array.isArray(value) &&\n    value.length > 0 &&\n    value.every((entry) => typeof entry === \"string\" && entry.length > 0)\n  );\n}\n"]}

package/internal/validators/util/protocol.d.ts

@@ -0,0 +1,9 @@
+export declare const SHA256_HEX_LENGTH = 64;
+export declare const AUTH_CHALLENGE_HEX_LENGTH = 64;
+export declare const ML_DSA87_PUBLIC_KEY_BYTES = 2592;
+export declare const ML_DSA87_SIGNATURE_BYTES = 4627;
+export declare const ML_KEM1024_PUBLIC_KEY_BYTES = 1568;
+export declare function isByteArray(value: unknown): value is number[];
+export declare function isByteArrayOfLength(value: unknown, length: number): value is number[];
+export declare function isSha256HexString(value: unknown): value is string;
+export declare function isAuthChallengeHexString(value: unknown): value is string;