@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/internal/crypto/keying/writeHeaderAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeHeaderAuthorization.js","sourceRoot":"","sources":["writeHeaderAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,gDAAgD,GACjD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,SAAS,sCAAsC,CAAC,KAM/C;IACC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC;IAE/D,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,iBAAiB,CACf,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,IACE,gBAAgB,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ;QACrD,gBAAgB,CAAC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC/D,gBAAgB,CAAC,YAAY,KAAK,MAAM,CAAC,kBAAkB,EAC3D,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,IACE,kBAAkB,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ;QACjD,kBAAkB,CAAC,mBAAmB,KAAK,gBAAgB,CAAC,YAAY;QACxE,kBAAkB,CAAC,qBAAqB,KAAK,MAAM,CAAC,UAAU,EAC9D,CAAC;QACD,iBAAiB,CACf,eAAe,EACf,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAC/D,CAAC;IACF,IACE,kBAAkB,CAAC,IAAI,KAAK,kBAAkB,CAAC,IAAI;QACnD,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CACxD,EACD,CAAC;QACD,iBAAiB,CACf,eAAe,EACf,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,MAAM,EACN,aAAa,CAAC,yBAAyB,CACxC,CAAC;IACF,gDAAgD,CAAC;QAC/C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,kBAAkB;QAClB,gBAAgB;QAChB,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,aAAa,CAAC,yBAAyB;QAC9C,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,EAAE;QACxD,MAAM,EAAE,MAAM,CAAC,YAAY;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kCAAkC,CAAC,KAM3C;IACC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC;IAEzC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACjC,iBAAiB,CACf,iBAAiB,EACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IACE,cAAc,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ;QACzC,cAAc,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QACvD,cAAc,CAAC,sBAAsB,KAAK,MAAM,CAAC,kBAAkB,EACnE,CAAC;QACD,iBAAiB,CACf,iBAAiB,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,CAAC,iBAAiB,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3D,iBAAiB,CACf,eAAe,EACf,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,IACE,cAAc,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC5C,cAAc,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;QACD,iBAAiB,CACf,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,8BAA8B,CAC5B,MAAM,EACN,aAAa,CAAC,yBAAyB,CACxC,CAAC;IACF,4CAA4C,CAAC;QAC3C,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,cAAc;QACd,MAAM;QACN,KAAK,EAAE,cAAc;QACrB,KAAK,EAAE,aAAa,CAAC,yBAAyB;QAC9C,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,IAAI,EAAE;KACzD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAK/C;IACC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,sCAAsC,CAAC;YACrC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,aAAa,EAAE,KAAK,CAAC,qBAAqB;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,kCAAkC,CAAC;YACjC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,aAAa,EAAE,KAAK,CAAC,iBAAiB;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import {\n  requireWriteAccessThroughCommittedBlobTarget,\n  requireWriteAccessThroughCommittedDocumentTarget,\n} from \"./documentAccess\";\nimport { throwVerification } from \"./shared\";\nimport type { VerifyWriteHeaderInput, WriteHeader } from \"./types\";\nimport { assertWriteHeaderPathCitations } from \"./writeHeaderCitations\";\n\nfunction assertDocumentWriteHeaderAuthorization(input: {\n  readonly authorizationMembership: \"current\" | \"referenced\";\n  readonly authorization: NonNullable<\n    VerifyWriteHeaderInput[\"documentAuthorization\"]\n  >;\n  readonly header: WriteHeader;\n}): void {\n  const { authorization, header } = input;\n  const { documentKekTargets, documentManifest } = authorization;\n\n  if (header.objectKind !== \"document\") {\n    throwVerification(\n      \"object_mismatch\",\n      \"document write authorization requires a document write header\",\n    );\n  }\n\n  if (\n    documentManifest.state.documentId !== header.objectId ||\n    documentManifest.state.organizationId !== header.organizationId ||\n    documentManifest.manifestHash !== header.accessManifestHash\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      \"write header does not match the committed document access manifest\",\n    );\n  }\n\n  if (\n    documentKekTargets.documentId !== header.objectId ||\n    documentKekTargets.linkSetManifestHash !== documentManifest.manifestHash ||\n    documentKekTargets.documentKeyTargetHash !== header.targetHash\n  ) {\n    throwVerification(\n      \"hash_mismatch\",\n      \"write header target hash does not match the verified document KEK targets\",\n    );\n  }\n\n  const linkedContainerIds = new Set(documentManifest.state.linkedContainerIds);\n  const targetContainerIds = new Set(\n    documentKekTargets.targets.map((target) => target.containerId),\n  );\n  if (\n    targetContainerIds.size !== linkedContainerIds.size ||\n    documentKekTargets.targets.some(\n      (target) => !linkedContainerIds.has(target.containerId),\n    )\n  ) {\n    throwVerification(\n      \"hash_mismatch\",\n      \"verified document KEK targets do not cover the committed linked containers\",\n    );\n  }\n\n  assertWriteHeaderPathCitations(\n    header,\n    authorization.authorizingContainerPaths,\n  );\n  requireWriteAccessThroughCommittedDocumentTarget({\n    authorizationMembership: input.authorizationMembership,\n    documentKekTargets,\n    documentManifest,\n    label: \"write header\",\n    paths: authorization.authorizingContainerPaths,\n    principalPolicies: authorization.principalPolicies ?? [],\n    userId: header.writerUserId,\n  });\n}\n\nfunction assertBlobWriteHeaderAuthorization(input: {\n  readonly authorizationMembership: \"current\" | \"referenced\";\n  readonly authorization: NonNullable<\n    VerifyWriteHeaderInput[\"blobAuthorization\"]\n  >;\n  readonly header: WriteHeader;\n}): void {\n  const { authorization, header } = input;\n  const { blobKekTargets } = authorization;\n\n  if (header.objectKind !== \"blob\") {\n    throwVerification(\n      \"object_mismatch\",\n      \"blob write authorization requires a blob write header\",\n    );\n  }\n\n  if (\n    blobKekTargets.blobId !== header.objectId ||\n    blobKekTargets.organizationId !== header.organizationId ||\n    blobKekTargets.blobAccessManifestHash !== header.accessManifestHash\n  ) {\n    throwVerification(\n      \"object_mismatch\",\n      \"write header does not match the committed blob access manifest\",\n    );\n  }\n\n  if (blobKekTargets.blobKeyTargetHash !== header.targetHash) {\n    throwVerification(\n      \"hash_mismatch\",\n      \"write header target hash does not match the verified blob KEK targets\",\n    );\n  }\n\n  if (\n    blobKekTargets.activeBindingIds.length === 0 ||\n    blobKekTargets.targets.length === 0\n  ) {\n    throwVerification(\n      \"missing_dependency\",\n      \"verified blob KEK targets do not cover an active attachment binding\",\n    );\n  }\n\n  assertWriteHeaderPathCitations(\n    header,\n    authorization.authorizingContainerPaths,\n  );\n  requireWriteAccessThroughCommittedBlobTarget({\n    authorizationMembership: input.authorizationMembership,\n    blobKekTargets,\n    header,\n    label: \"write header\",\n    paths: authorization.authorizingContainerPaths,\n    principalPolicies: authorization.principalPolicies ?? [],\n  });\n}\n\nexport function assertWriteHeaderAuthorizations(input: {\n  readonly authorizationMembership: \"current\" | \"referenced\";\n  readonly blobAuthorization: VerifyWriteHeaderInput[\"blobAuthorization\"];\n  readonly documentAuthorization: VerifyWriteHeaderInput[\"documentAuthorization\"];\n  readonly header: WriteHeader;\n}): void {\n  if (input.documentAuthorization) {\n    assertDocumentWriteHeaderAuthorization({\n      authorizationMembership: input.authorizationMembership,\n      authorization: input.documentAuthorization,\n      header: input.header,\n    });\n  }\n\n  if (input.blobAuthorization) {\n    assertBlobWriteHeaderAuthorization({\n      authorizationMembership: input.authorizationMembership,\n      authorization: input.blobAuthorization,\n      header: input.header,\n    });\n  }\n}\n"]}

package/internal/crypto/keying/writeHeaderCitations.js

@@ -0,0 +1,21 @@
+import { readHashArray, throwVerification } from "./shared.js";
+export function readWriteHeaderCitations(value) {
+    const hashes = readHashArray(value, "write header dependencyManifestHashes");
+    const canonical = [...new Set(hashes)].sort();
+    if (hashes.length !== canonical.length ||
+        hashes.some((hash, index) => hash !== canonical[index])) {
+        throwVerification("invalid_shape", "write header dependency hashes must be sorted and unique");
+    }
+    return hashes;
+}
+export function assertWriteHeaderPathCitations(header, paths) {
+    const hashes = [
+        ...new Set(paths.flatMap((path) => path.map((head) => head.manifestHash))),
+    ].sort();
+    if (hashes.length === 0 ||
+        hashes.length !== header.dependencyManifestHashes.length ||
+        hashes.some((hash, index) => hash !== header.dependencyManifestHashes[index])) {
+        throwVerification("hash_mismatch", "write header does not cite its complete authorizing container paths");
+    }
+}
+//# sourceMappingURL=writeHeaderCitations.js.map

package/internal/crypto/keying/writeHeaderCitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeHeaderCitations.js","sourceRoot":"","sources":["writeHeaderCitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG5D,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IACE,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,EACvD,CAAC;QACD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAmB,EACnB,KAA8D;IAE9D,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;KAC3E,CAAC,IAAI,EAAE,CAAC;IACT,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,wBAAwB,CAAC,MAAM;QACxD,MAAM,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CACjE,EACD,CAAC;QACD,iBAAiB,CACf,eAAe,EACf,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { readHashArray, throwVerification } from \"./shared\";\nimport type { VerifiedContainerAccessManifest, WriteHeader } from \"./types\";\n\nexport function readWriteHeaderCitations(value: unknown): string[] {\n  const hashes = readHashArray(value, \"write header dependencyManifestHashes\");\n  const canonical = [...new Set(hashes)].sort();\n  if (\n    hashes.length !== canonical.length ||\n    hashes.some((hash, index) => hash !== canonical[index])\n  ) {\n    throwVerification(\n      \"invalid_shape\",\n      \"write header dependency hashes must be sorted and unique\",\n    );\n  }\n  return hashes;\n}\n\nexport function assertWriteHeaderPathCitations(\n  header: WriteHeader,\n  paths: readonly (readonly VerifiedContainerAccessManifest[])[],\n): void {\n  const hashes = [\n    ...new Set(paths.flatMap((path) => path.map((head) => head.manifestHash))),\n  ].sort();\n  if (\n    hashes.length === 0 ||\n    hashes.length !== header.dependencyManifestHashes.length ||\n    hashes.some(\n      (hash, index) => hash !== header.dependencyManifestHashes[index],\n    )\n  ) {\n    throwVerification(\n      \"hash_mismatch\",\n      \"write header does not cite its complete authorizing container paths\",\n    );\n  }\n}\n"]}

package/internal/crypto/keying.d.ts

@@ -0,0 +1 @@
+export * from "./keying/index.js";

package/internal/crypto/keying.js

@@ -0,0 +1,2 @@
+export * from "./keying/index.js";
+//# sourceMappingURL=keying.js.map

package/internal/crypto/keying.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keying.js","sourceRoot":"","sources":["keying.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC","sourcesContent":["export * from \"./keying/index\";\n"]}

package/internal/crypto/organizationReplacement.d.ts

@@ -0,0 +1,18 @@
+import type { OrganizationProvisioningRequest } from "../validators/request/index.js";
+import { type OrganizationReplacementAuthorization } from "../validators/util/index.js";
+import type { SigningKeyPair } from "./signing/generateKeyPair.js";
+type AuthorizationPayload = Omit<OrganizationReplacementAuthorization, "signature">;
+export type OrganizationReplacementProvisioningInput = Pick<OrganizationProvisioningRequest, "organizationId" | "rootContainerId" | "userId" | "initialOrganizationPolicy" | "initialAdminGroup" | "initialMemberGroup" | "initialRootContainer"> & {
+    readonly replacesOrganizationId: string;
+};
+declare const VERIFIED_REPLACEMENT: unique symbol;
+export interface VerifiedOrganizationReplacementAuthorization extends OrganizationReplacementAuthorization {
+    readonly [VERIFIED_REPLACEMENT]: true;
+}
+/** Commits the exact genesis, independently of the HTTP replacement flags. */
+export declare function organizationReplacementAuthorizationPayload(input: OrganizationReplacementProvisioningInput): Promise<AuthorizationPayload>;
+export declare function organizationReplacementSigningBytes(payload: AuthorizationPayload): Uint8Array;
+/** Only locally built personal genesis artifacts may receive this authorization. */
+export declare function signOrganizationReplacementAuthorization(input: OrganizationReplacementProvisioningInput, keys: SigningKeyPair): Promise<OrganizationReplacementAuthorization>;
+export declare function verifyOrganizationReplacementAuthorization(value: unknown, publicKey: Uint8Array): VerifiedOrganizationReplacementAuthorization;
+export {};

package/internal/crypto/organizationReplacement.js

@@ -0,0 +1,133 @@
+import { base64ToBytes, bytesToBase64 } from "../encoding/index.js";
+import { isPlainObject } from "../validators/isPlainObject.js";
+import { OrganizationReplacementAuthorizationSchema, } from "../validators/util/index.js";
+import { serializeKeyingCanonicalJson } from "./keying/canonical.js";
+import { KeyingVerificationError } from "./keying/verificationError.js";
+import { computePrincipalStateHash } from "./principalState.js";
+import { sign } from "./signing/sign.js";
+import { verify } from "./signing/verify.js";
+const VERIFIED_REPLACEMENT = Symbol("verified-organization-replacement");
+function invalid(message) {
+    throw new KeyingVerificationError("object_mismatch", message);
+}
+function assertPersonalGenesis(input) {
+    if (input.organizationId === input.replacesOrganizationId)
+        invalid("A replacement must create a fresh organization");
+    for (const [principalType, principalId, policy] of [
+        ["organization", input.organizationId, input.initialOrganizationPolicy],
+        [
+            "group",
+            input.initialAdminGroup.groupId,
+            input.initialAdminGroup.initialGroupPolicy,
+        ],
+        [
+            "group",
+            input.initialMemberGroup.groupId,
+            input.initialMemberGroup.initialGroupPolicy,
+        ],
+    ]) {
+        const { state, projection } = policy;
+        if (state.principalType !== principalType ||
+            state.principalId !== principalId ||
+            state.version !== 1 ||
+            state.prevStateHash !== null ||
+            state.keyEpoch !== 1 ||
+            state.signerUserId !== input.userId ||
+            state.memberCount !== 1 ||
+            projection.length !== 1 ||
+            projection[0]?.userId !== input.userId ||
+            projection[0]?.role !== "admin")
+            invalid("A replacement must begin with the founding user as sole authority");
+    }
+    const { body, event, manifest } = input.initialRootContainer;
+    if (!isPlainObject(body))
+        invalid("Replacement root body is invalid");
+    const metadataDocumentId = Reflect.get(body, "metadataDocumentId");
+    const grants = Reflect.get(body, "directGrants");
+    const onlyGrant = Array.isArray(grants) && grants.length === 1 ? grants[0] : null;
+    if (Reflect.get(body, "eventType") !== "container.create" ||
+        Reflect.get(body, "parentContainerId") !== null ||
+        Reflect.get(body, "parentManifestHash") !== null ||
+        Reflect.get(body, "systemSlot") !== null ||
+        typeof metadataDocumentId !== "string" ||
+        !isPlainObject(onlyGrant) ||
+        Reflect.get(onlyGrant, "subjectType") !== "group" ||
+        Reflect.get(onlyGrant, "subjectId") !== input.initialAdminGroup.groupId ||
+        Reflect.get(onlyGrant, "accessLevel") !== "admin" ||
+        Reflect.get(event, "eventType") !== "container.create" ||
+        Reflect.get(event, "objectKind") !== "container" ||
+        Reflect.get(event, "objectId") !== input.rootContainerId ||
+        Reflect.get(event, "organizationId") !== input.organizationId ||
+        Reflect.get(event, "signerUserId") !== input.userId ||
+        Reflect.get(manifest, "epoch") !== 1 ||
+        Reflect.get(manifest, "previousManifestHash") !== null ||
+        Reflect.get(manifest, "objectKind") !== "container" ||
+        Reflect.get(manifest, "objectId") !== input.rootContainerId ||
+        Reflect.get(manifest, "organizationId") !== input.organizationId)
+        invalid("A replacement must have a fresh private non-system root");
+    return metadataDocumentId;
+}
+/** Commits the exact genesis, independently of the HTTP replacement flags. */
+export async function organizationReplacementAuthorizationPayload(input) {
+    const rootMetadataDocumentId = assertPersonalGenesis(input);
+    return {
+        replacesOrganizationId: input.replacesOrganizationId,
+        organizationId: input.organizationId,
+        rootContainerId: input.rootContainerId,
+        userId: input.userId,
+        organizationStateHash: await computePrincipalStateHash(input.initialOrganizationPolicy.state),
+        adminGroupId: input.initialAdminGroup.groupId,
+        adminGroupStateHash: await computePrincipalStateHash(input.initialAdminGroup.initialGroupPolicy.state),
+        memberGroupId: input.initialMemberGroup.groupId,
+        memberGroupStateHash: await computePrincipalStateHash(input.initialMemberGroup.initialGroupPolicy.state),
+        rootManifestHash: input.initialRootContainer.expectedManifestHash,
+        rootMetadataDocumentId,
+    };
+}
+export function organizationReplacementSigningBytes(payload) {
+    return new TextEncoder().encode(serializeKeyingCanonicalJson({
+        domain: "tearleads.organization-replacement.v1",
+        replacesOrganizationId: payload.replacesOrganizationId,
+        organizationId: payload.organizationId,
+        rootContainerId: payload.rootContainerId,
+        userId: payload.userId,
+        organizationStateHash: payload.organizationStateHash,
+        adminGroupId: payload.adminGroupId,
+        adminGroupStateHash: payload.adminGroupStateHash,
+        memberGroupId: payload.memberGroupId,
+        memberGroupStateHash: payload.memberGroupStateHash,
+        rootManifestHash: payload.rootManifestHash,
+        rootMetadataDocumentId: payload.rootMetadataDocumentId,
+    }));
+}
+/** Only locally built personal genesis artifacts may receive this authorization. */
+export async function signOrganizationReplacementAuthorization(input, keys) {
+    const payload = await organizationReplacementAuthorizationPayload(input);
+    return OrganizationReplacementAuthorizationSchema.parse({
+        ...payload,
+        signature: bytesToBase64(sign(organizationReplacementSigningBytes(payload), keys.signingPrivateKey)),
+    });
+}
+export function verifyOrganizationReplacementAuthorization(value, publicKey) {
+    const parsed = OrganizationReplacementAuthorizationSchema.safeParse(value);
+    if (!parsed.success)
+        invalid("Organization replacement authorization is missing or malformed");
+    const authorization = parsed.data;
+    let signature;
+    try {
+        signature = base64ToBytes(authorization.signature);
+    }
+    catch {
+        invalid("Organization replacement signature is malformed");
+    }
+    if (!verify(signature, organizationReplacementSigningBytes(authorization), publicKey)) {
+        throw new KeyingVerificationError("signature_mismatch", "Organization replacement signature is invalid");
+    }
+    if (authorization.organizationId === authorization.replacesOrganizationId)
+        invalid("Organization replacement does not name a fresh destination");
+    return Object.freeze({
+        ...authorization,
+        [VERIFIED_REPLACEMENT]: true,
+    });
+}
+//# sourceMappingURL=organizationReplacement.js.map

package/internal/crypto/organizationReplacement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationReplacement.js","sourceRoot":"","sources":["organizationReplacement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAEL,0CAA0C,GAC3C,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiB1C,MAAM,oBAAoB,GAAG,MAAM,CAAC,mCAAmC,CAAC,CAAC;AAMzE,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAA+C;IAE/C,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB;QACvD,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI;QACjD,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,yBAAyB,CAAC;QACvE;YACE,OAAO;YACP,KAAK,CAAC,iBAAiB,CAAC,OAAO;YAC/B,KAAK,CAAC,iBAAiB,CAAC,kBAAkB;SAC3C;QACD;YACE,OAAO;YACP,KAAK,CAAC,kBAAkB,CAAC,OAAO;YAChC,KAAK,CAAC,kBAAkB,CAAC,kBAAkB;SAC5C;KACO,EAAE,CAAC;QACX,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACrC,IACE,KAAK,CAAC,aAAa,KAAK,aAAa;YACrC,KAAK,CAAC,WAAW,KAAK,WAAW;YACjC,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,KAAK,CAAC,aAAa,KAAK,IAAI;YAC5B,KAAK,CAAC,QAAQ,KAAK,CAAC;YACpB,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM;YACnC,KAAK,CAAC,WAAW,KAAK,CAAC;YACvB,UAAU,CAAC,MAAM,KAAK,CAAC;YACvB,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC,MAAM;YACtC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO;YAE/B,OAAO,CACL,mEAAmE,CACpE,CAAC;IACN,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,oBAAoB,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACtE,MAAM,kBAAkB,GAAY,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IACE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,kBAAkB;QACrD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,mBAAmB,CAAC,KAAK,IAAI;QAC/C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,IAAI;QAChD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,IAAI;QACxC,OAAO,kBAAkB,KAAK,QAAQ;QACtC,CAAC,aAAa,CAAC,SAAS,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,OAAO;QACjD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,KAAK,CAAC,iBAAiB,CAAC,OAAO;QACvE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,OAAO;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,kBAAkB;QACtD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,WAAW;QAChD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,eAAe;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,KAAK,CAAC,cAAc;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,KAAK,CAAC,MAAM;QACnD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,sBAAsB,CAAC,KAAK,IAAI;QACtD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,WAAW;QACnD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,eAAe;QAC3D,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,KAAK,KAAK,CAAC,cAAc;QAEhE,OAAO,CAAC,yDAAyD,CAAC,CAAC;IACrE,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAC/D,KAA+C;IAE/C,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO;QACL,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,qBAAqB,EAAE,MAAM,yBAAyB,CACpD,KAAK,CAAC,yBAAyB,CAAC,KAAK,CACtC;QACD,YAAY,EAAE,KAAK,CAAC,iBAAiB,CAAC,OAAO;QAC7C,mBAAmB,EAAE,MAAM,yBAAyB,CAClD,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,KAAK,CACjD;QACD,aAAa,EAAE,KAAK,CAAC,kBAAkB,CAAC,OAAO;QAC/C,oBAAoB,EAAE,MAAM,yBAAyB,CACnD,KAAK,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,CAClD;QACD,gBAAgB,EAAE,KAAK,CAAC,oBAAoB,CAAC,oBAAoB;QACjE,sBAAsB;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAA6B;IAE7B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,4BAA4B,CAAC;QAC3B,MAAM,EAAE,uCAAuC;QAC/C,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;KACvD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,KAA+C,EAC/C,IAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,2CAA2C,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,0CAA0C,CAAC,KAAK,CAAC;QACtD,GAAG,OAAO;QACV,SAAS,EAAE,aAAa,CACtB,IAAI,CACF,mCAAmC,CAAC,OAAO,CAAC,EAC5C,IAAI,CAAC,iBAAiB,CACvB,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,KAAc,EACd,SAAqB;IAErB,MAAM,MAAM,GAAG,0CAA0C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,OAAO;QACjB,OAAO,CAAC,gEAAgE,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC;IAClC,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,iDAAiD,CAAC,CAAC;IAC7D,CAAC;IACD,IACE,CAAC,MAAM,CACL,SAAS,EACT,mCAAmC,CAAC,aAAa,CAAC,EAClD,SAAS,CACV,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,cAAc,KAAK,aAAa,CAAC,sBAAsB;QACvE,OAAO,CAAC,4DAA4D,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,aAAa;QAChB,CAAC,oBAAoB,CAAC,EAAE,IAAa;KACtC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject } from \"@tearleads/validators/isPlainObject\";\nimport type { OrganizationProvisioningRequest } from \"@tearleads/validators/request\";\nimport {\n  type OrganizationReplacementAuthorization,\n  OrganizationReplacementAuthorizationSchema,\n} from \"@tearleads/validators/util\";\nimport { serializeKeyingCanonicalJson } from \"./keying/canonical\";\nimport { KeyingVerificationError } from \"./keying/verificationError\";\nimport { computePrincipalStateHash } from \"./principalState\";\nimport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nimport { sign } from \"./signing/sign\";\nimport { verify } from \"./signing/verify\";\n\ntype AuthorizationPayload = Omit<\n  OrganizationReplacementAuthorization,\n  \"signature\"\n>;\nexport type OrganizationReplacementProvisioningInput = Pick<\n  OrganizationProvisioningRequest,\n  | \"organizationId\"\n  | \"rootContainerId\"\n  | \"userId\"\n  | \"initialOrganizationPolicy\"\n  | \"initialAdminGroup\"\n  | \"initialMemberGroup\"\n  | \"initialRootContainer\"\n> & { readonly replacesOrganizationId: string };\n\nconst VERIFIED_REPLACEMENT = Symbol(\"verified-organization-replacement\");\nexport interface VerifiedOrganizationReplacementAuthorization\n  extends OrganizationReplacementAuthorization {\n  readonly [VERIFIED_REPLACEMENT]: true;\n}\n\nfunction invalid(message: string): never {\n  throw new KeyingVerificationError(\"object_mismatch\", message);\n}\n\nfunction assertPersonalGenesis(\n  input: OrganizationReplacementProvisioningInput,\n): string {\n  if (input.organizationId === input.replacesOrganizationId)\n    invalid(\"A replacement must create a fresh organization\");\n  for (const [principalType, principalId, policy] of [\n    [\"organization\", input.organizationId, input.initialOrganizationPolicy],\n    [\n      \"group\",\n      input.initialAdminGroup.groupId,\n      input.initialAdminGroup.initialGroupPolicy,\n    ],\n    [\n      \"group\",\n      input.initialMemberGroup.groupId,\n      input.initialMemberGroup.initialGroupPolicy,\n    ],\n  ] as const) {\n    const { state, projection } = policy;\n    if (\n      state.principalType !== principalType ||\n      state.principalId !== principalId ||\n      state.version !== 1 ||\n      state.prevStateHash !== null ||\n      state.keyEpoch !== 1 ||\n      state.signerUserId !== input.userId ||\n      state.memberCount !== 1 ||\n      projection.length !== 1 ||\n      projection[0]?.userId !== input.userId ||\n      projection[0]?.role !== \"admin\"\n    )\n      invalid(\n        \"A replacement must begin with the founding user as sole authority\",\n      );\n  }\n  const { body, event, manifest } = input.initialRootContainer;\n  if (!isPlainObject(body)) invalid(\"Replacement root body is invalid\");\n  const metadataDocumentId: unknown = Reflect.get(body, \"metadataDocumentId\");\n  const grants: unknown = Reflect.get(body, \"directGrants\");\n  const onlyGrant =\n    Array.isArray(grants) && grants.length === 1 ? grants[0] : null;\n  if (\n    Reflect.get(body, \"eventType\") !== \"container.create\" ||\n    Reflect.get(body, \"parentContainerId\") !== null ||\n    Reflect.get(body, \"parentManifestHash\") !== null ||\n    Reflect.get(body, \"systemSlot\") !== null ||\n    typeof metadataDocumentId !== \"string\" ||\n    !isPlainObject(onlyGrant) ||\n    Reflect.get(onlyGrant, \"subjectType\") !== \"group\" ||\n    Reflect.get(onlyGrant, \"subjectId\") !== input.initialAdminGroup.groupId ||\n    Reflect.get(onlyGrant, \"accessLevel\") !== \"admin\" ||\n    Reflect.get(event, \"eventType\") !== \"container.create\" ||\n    Reflect.get(event, \"objectKind\") !== \"container\" ||\n    Reflect.get(event, \"objectId\") !== input.rootContainerId ||\n    Reflect.get(event, \"organizationId\") !== input.organizationId ||\n    Reflect.get(event, \"signerUserId\") !== input.userId ||\n    Reflect.get(manifest, \"epoch\") !== 1 ||\n    Reflect.get(manifest, \"previousManifestHash\") !== null ||\n    Reflect.get(manifest, \"objectKind\") !== \"container\" ||\n    Reflect.get(manifest, \"objectId\") !== input.rootContainerId ||\n    Reflect.get(manifest, \"organizationId\") !== input.organizationId\n  )\n    invalid(\"A replacement must have a fresh private non-system root\");\n  return metadataDocumentId;\n}\n\n/** Commits the exact genesis, independently of the HTTP replacement flags. */\nexport async function organizationReplacementAuthorizationPayload(\n  input: OrganizationReplacementProvisioningInput,\n): Promise<AuthorizationPayload> {\n  const rootMetadataDocumentId = assertPersonalGenesis(input);\n  return {\n    replacesOrganizationId: input.replacesOrganizationId,\n    organizationId: input.organizationId,\n    rootContainerId: input.rootContainerId,\n    userId: input.userId,\n    organizationStateHash: await computePrincipalStateHash(\n      input.initialOrganizationPolicy.state,\n    ),\n    adminGroupId: input.initialAdminGroup.groupId,\n    adminGroupStateHash: await computePrincipalStateHash(\n      input.initialAdminGroup.initialGroupPolicy.state,\n    ),\n    memberGroupId: input.initialMemberGroup.groupId,\n    memberGroupStateHash: await computePrincipalStateHash(\n      input.initialMemberGroup.initialGroupPolicy.state,\n    ),\n    rootManifestHash: input.initialRootContainer.expectedManifestHash,\n    rootMetadataDocumentId,\n  };\n}\n\nexport function organizationReplacementSigningBytes(\n  payload: AuthorizationPayload,\n): Uint8Array {\n  return new TextEncoder().encode(\n    serializeKeyingCanonicalJson({\n      domain: \"tearleads.organization-replacement.v1\",\n      replacesOrganizationId: payload.replacesOrganizationId,\n      organizationId: payload.organizationId,\n      rootContainerId: payload.rootContainerId,\n      userId: payload.userId,\n      organizationStateHash: payload.organizationStateHash,\n      adminGroupId: payload.adminGroupId,\n      adminGroupStateHash: payload.adminGroupStateHash,\n      memberGroupId: payload.memberGroupId,\n      memberGroupStateHash: payload.memberGroupStateHash,\n      rootManifestHash: payload.rootManifestHash,\n      rootMetadataDocumentId: payload.rootMetadataDocumentId,\n    }),\n  );\n}\n\n/** Only locally built personal genesis artifacts may receive this authorization. */\nexport async function signOrganizationReplacementAuthorization(\n  input: OrganizationReplacementProvisioningInput,\n  keys: SigningKeyPair,\n): Promise<OrganizationReplacementAuthorization> {\n  const payload = await organizationReplacementAuthorizationPayload(input);\n  return OrganizationReplacementAuthorizationSchema.parse({\n    ...payload,\n    signature: bytesToBase64(\n      sign(\n        organizationReplacementSigningBytes(payload),\n        keys.signingPrivateKey,\n      ),\n    ),\n  });\n}\n\nexport function verifyOrganizationReplacementAuthorization(\n  value: unknown,\n  publicKey: Uint8Array,\n): VerifiedOrganizationReplacementAuthorization {\n  const parsed = OrganizationReplacementAuthorizationSchema.safeParse(value);\n  if (!parsed.success)\n    invalid(\"Organization replacement authorization is missing or malformed\");\n  const authorization = parsed.data;\n  let signature: Uint8Array;\n  try {\n    signature = base64ToBytes(authorization.signature);\n  } catch {\n    invalid(\"Organization replacement signature is malformed\");\n  }\n  if (\n    !verify(\n      signature,\n      organizationReplacementSigningBytes(authorization),\n      publicKey,\n    )\n  ) {\n    throw new KeyingVerificationError(\n      \"signature_mismatch\",\n      \"Organization replacement signature is invalid\",\n    );\n  }\n  if (authorization.organizationId === authorization.replacesOrganizationId)\n    invalid(\"Organization replacement does not name a fresh destination\");\n  return Object.freeze({\n    ...authorization,\n    [VERIFIED_REPLACEMENT]: true as const,\n  });\n}\n"]}

package/internal/crypto/principalContainerGrants.d.ts

@@ -0,0 +1,3 @@
+import type { PrincipalContainerGrant } from "./principalStateTypes.js";
+export declare function normalizePrincipalContainerGrants(grants: ReadonlyArray<PrincipalContainerGrant>): PrincipalContainerGrant[];
+export declare function computePrincipalContainerGrantRoot(grants: ReadonlyArray<PrincipalContainerGrant>): Promise<string>;

package/internal/crypto/principalContainerGrants.js

@@ -0,0 +1,39 @@
+import { compareCanonicalStrings } from "./canonicalOrdering.js";
+import { toFingerprint } from "./fingerprint.js";
+const TEXT_ENCODER = new TextEncoder();
+function comparePrincipalContainerGrants(left, right) {
+    const containerComparison = compareCanonicalStrings(left.containerId, right.containerId);
+    return containerComparison !== 0
+        ? containerComparison
+        : compareCanonicalStrings(left.accessLevel, right.accessLevel);
+}
+export function normalizePrincipalContainerGrants(grants) {
+    const normalized = grants
+        .map((grant) => {
+        if (typeof grant.containerId !== "string" ||
+            grant.containerId.length === 0 ||
+            (grant.accessLevel !== "admin" &&
+                grant.accessLevel !== "read" &&
+                grant.accessLevel !== "write")) {
+            throw new Error("Principal container grant is invalid");
+        }
+        return {
+            accessLevel: grant.accessLevel,
+            containerId: grant.containerId,
+        };
+    })
+        .sort(comparePrincipalContainerGrants);
+    for (let index = 1; index < normalized.length; index += 1) {
+        if (normalized[index - 1]?.containerId === normalized[index]?.containerId) {
+            throw new Error("Principal cannot contain duplicate container grants");
+        }
+    }
+    return normalized;
+}
+export async function computePrincipalContainerGrantRoot(grants) {
+    return toFingerprint(TEXT_ENCODER.encode(JSON.stringify(normalizePrincipalContainerGrants(grants).map((grant) => ({
+        accessLevel: grant.accessLevel,
+        containerId: grant.containerId,
+    })))));
+}
+//# sourceMappingURL=principalContainerGrants.js.map

package/internal/crypto/principalContainerGrants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalContainerGrants.js","sourceRoot":"","sources":["principalContainerGrants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,SAAS,+BAA+B,CACtC,IAA6B,EAC7B,KAA8B;IAE9B,MAAM,mBAAmB,GAAG,uBAAuB,CACjD,IAAI,CAAC,WAAW,EAChB,KAAK,CAAC,WAAW,CAClB,CAAC;IACF,OAAO,mBAAmB,KAAK,CAAC;QAC9B,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM;SACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACrC,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,KAAK,CAAC,WAAW,KAAK,OAAO;gBAC5B,KAAK,CAAC,WAAW,KAAK,MAAM;gBAC5B,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACzC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,MAA8C;IAE9C,OAAO,aAAa,CAClB,YAAY,CAAC,MAAM,CACjB,IAAI,CAAC,SAAS,CACZ,iCAAiC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CACJ,CACF,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { compareCanonicalStrings } from \"./canonicalOrdering\";\nimport { toFingerprint } from \"./fingerprint\";\nimport type { PrincipalContainerGrant } from \"./principalStateTypes\";\n\nconst TEXT_ENCODER = new TextEncoder();\n\nfunction comparePrincipalContainerGrants(\n  left: PrincipalContainerGrant,\n  right: PrincipalContainerGrant,\n): number {\n  const containerComparison = compareCanonicalStrings(\n    left.containerId,\n    right.containerId,\n  );\n  return containerComparison !== 0\n    ? containerComparison\n    : compareCanonicalStrings(left.accessLevel, right.accessLevel);\n}\n\nexport function normalizePrincipalContainerGrants(\n  grants: ReadonlyArray<PrincipalContainerGrant>,\n): PrincipalContainerGrant[] {\n  const normalized = grants\n    .map((grant) => {\n      if (\n        typeof grant.containerId !== \"string\" ||\n        grant.containerId.length === 0 ||\n        (grant.accessLevel !== \"admin\" &&\n          grant.accessLevel !== \"read\" &&\n          grant.accessLevel !== \"write\")\n      ) {\n        throw new Error(\"Principal container grant is invalid\");\n      }\n      return {\n        accessLevel: grant.accessLevel,\n        containerId: grant.containerId,\n      };\n    })\n    .sort(comparePrincipalContainerGrants);\n  for (let index = 1; index < normalized.length; index += 1) {\n    if (normalized[index - 1]?.containerId === normalized[index]?.containerId) {\n      throw new Error(\"Principal cannot contain duplicate container grants\");\n    }\n  }\n  return normalized;\n}\n\nexport async function computePrincipalContainerGrantRoot(\n  grants: ReadonlyArray<PrincipalContainerGrant>,\n): Promise<string> {\n  return toFingerprint(\n    TEXT_ENCODER.encode(\n      JSON.stringify(\n        normalizePrincipalContainerGrants(grants).map((grant) => ({\n          accessLevel: grant.accessLevel,\n          containerId: grant.containerId,\n        })),\n      ),\n    ),\n  );\n}\n"]}

package/internal/crypto/principalMemberEnvelopes.d.ts

@@ -0,0 +1,7 @@
+import { PrincipalPolicyValidationError } from "./principalPolicyValidationError.js";
+import type { PrincipalStateMemberEnvelope } from "./principalStateTypes.js";
+export declare class PrincipalMemberEnvelopeValidationError extends PrincipalPolicyValidationError {
+    constructor(message: string);
+}
+export declare function normalizePrincipalStateMemberEnvelopes(envelopes: ReadonlyArray<PrincipalStateMemberEnvelope>): PrincipalStateMemberEnvelope[];
+export declare function computePrincipalMemberEnvelopesRoot(envelopes: ReadonlyArray<PrincipalStateMemberEnvelope>): Promise<string>;

package/internal/crypto/principalMemberEnvelopes.js

@@ -0,0 +1,69 @@
+import { base64ToBytes, bytesToBase64 } from "../encoding/index.js";
+import { ML_KEM1024_CIPHERTEXT_BYTES, ML_KEM1024_SECRET_KEY_BYTES, } from "./encapsulation/generateKeyPair.js";
+import { toFingerprint } from "./fingerprint.js";
+import { PrincipalPolicyValidationError } from "./principalPolicyValidationError.js";
+import { AES_GCM_TAG_BYTES } from "./symmetric.js";
+const TEXT_ENCODER = new TextEncoder();
+export class PrincipalMemberEnvelopeValidationError extends PrincipalPolicyValidationError {
+    constructor(message) {
+        super("invalid_artifact", message);
+        this.name = "PrincipalMemberEnvelopeValidationError";
+    }
+}
+function invalidEnvelope(message) {
+    throw new PrincipalMemberEnvelopeValidationError(message);
+}
+/**
+ * Envelopes are ordered by user id alone — recipient identity is the user id
+ * now that a principal cannot contain another principal.
+ */
+function compareEnvelopes(left, right) {
+    return left.userId < right.userId ? -1 : left.userId > right.userId ? 1 : 0;
+}
+function requireCanonicalBase64(value, label) {
+    let bytes;
+    try {
+        bytes = base64ToBytes(value);
+    }
+    catch {
+        invalidEnvelope(`${label} must use canonical base64 encoding`);
+    }
+    if (bytesToBase64(bytes) !== value) {
+        invalidEnvelope(`${label} must use canonical base64 encoding`);
+    }
+    return bytes;
+}
+export function normalizePrincipalStateMemberEnvelopes(envelopes) {
+    const normalized = envelopes
+        .map((envelope) => ({
+        userId: envelope.userId,
+        memberKeyFingerprint: envelope.memberKeyFingerprint,
+        kemCipherText: envelope.kemCipherText,
+        wrappedKey: envelope.wrappedKey,
+    }))
+        .sort(compareEnvelopes);
+    for (const [index, envelope] of normalized.entries()) {
+        if (envelope.userId.length === 0 ||
+            !/^[0-9a-f]{64}$/.test(envelope.memberKeyFingerprint)) {
+            invalidEnvelope("Principal member envelope identity is invalid");
+        }
+        const previous = normalized[index - 1];
+        if (previous?.userId === envelope.userId) {
+            invalidEnvelope("Principal state cannot contain duplicate member envelopes");
+        }
+        const kemCipherText = requireCanonicalBase64(envelope.kemCipherText, "Principal member envelope KEM ciphertext");
+        if (kemCipherText.length !== ML_KEM1024_CIPHERTEXT_BYTES) {
+            invalidEnvelope(`Principal member envelope KEM ciphertext must contain exactly ${ML_KEM1024_CIPHERTEXT_BYTES} bytes`);
+        }
+        const wrappedKey = requireCanonicalBase64(envelope.wrappedKey, "Principal member envelope wrapped key");
+        const expectedWrappedKeyBytes = ML_KEM1024_SECRET_KEY_BYTES + AES_GCM_TAG_BYTES;
+        if (wrappedKey.length !== expectedWrappedKeyBytes) {
+            invalidEnvelope(`Principal member envelope wrapped key must contain exactly ${expectedWrappedKeyBytes} bytes`);
+        }
+    }
+    return normalized;
+}
+export async function computePrincipalMemberEnvelopesRoot(envelopes) {
+    return toFingerprint(TEXT_ENCODER.encode(JSON.stringify(normalizePrincipalStateMemberEnvelopes(envelopes))));
+}
+//# sourceMappingURL=principalMemberEnvelopes.js.map

package/internal/crypto/principalMemberEnvelopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalMemberEnvelopes.js","sourceRoot":"","sources":["principalMemberEnvelopes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAEvC,MAAM,OAAO,sCAAuC,SAAQ,8BAA8B;IACxF,YAAY,OAAe;QACzB,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,wCAAwC,CAAC;IACvD,CAAC;CACF;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,sCAAsC,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,IAAkC,EAClC,KAAmC;IAEnC,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,eAAe,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACnC,eAAe,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,SAAsD;IAEtD,MAAM,UAAU,GAAG,SAAS;SACzB,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC;SACF,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IACE,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5B,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACrD,CAAC;YACD,eAAe,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,QAAQ,EAAE,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,eAAe,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,sBAAsB,CAC1C,QAAQ,CAAC,aAAa,EACtB,0CAA0C,CAC3C,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;YACzD,eAAe,CACb,iEAAiE,2BAA2B,QAAQ,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,sBAAsB,CACvC,QAAQ,CAAC,UAAU,EACnB,uCAAuC,CACxC,CAAC;QACF,MAAM,uBAAuB,GAC3B,2BAA2B,GAAG,iBAAiB,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAClD,eAAe,CACb,8DAA8D,uBAAuB,QAAQ,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,SAAsD;IAEtD,OAAO,aAAa,CAClB,YAAY,CAAC,MAAM,CACjB,IAAI,CAAC,SAAS,CAAC,sCAAsC,CAAC,SAAS,CAAC,CAAC,CAClE,CACF,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport {\n  ML_KEM1024_CIPHERTEXT_BYTES,\n  ML_KEM1024_SECRET_KEY_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nimport { toFingerprint } from \"./fingerprint\";\nimport { PrincipalPolicyValidationError } from \"./principalPolicyValidationError\";\nimport type { PrincipalStateMemberEnvelope } from \"./principalStateTypes\";\nimport { AES_GCM_TAG_BYTES } from \"./symmetric\";\n\nconst TEXT_ENCODER = new TextEncoder();\n\nexport class PrincipalMemberEnvelopeValidationError extends PrincipalPolicyValidationError {\n  constructor(message: string) {\n    super(\"invalid_artifact\", message);\n    this.name = \"PrincipalMemberEnvelopeValidationError\";\n  }\n}\n\nfunction invalidEnvelope(message: string): never {\n  throw new PrincipalMemberEnvelopeValidationError(message);\n}\n\n/**\n * Envelopes are ordered by user id alone — recipient identity is the user id\n * now that a principal cannot contain another principal.\n */\nfunction compareEnvelopes(\n  left: PrincipalStateMemberEnvelope,\n  right: PrincipalStateMemberEnvelope,\n): number {\n  return left.userId < right.userId ? -1 : left.userId > right.userId ? 1 : 0;\n}\n\nfunction requireCanonicalBase64(value: string, label: string): Uint8Array {\n  let bytes: Uint8Array;\n  try {\n    bytes = base64ToBytes(value);\n  } catch {\n    invalidEnvelope(`${label} must use canonical base64 encoding`);\n  }\n  if (bytesToBase64(bytes) !== value) {\n    invalidEnvelope(`${label} must use canonical base64 encoding`);\n  }\n  return bytes;\n}\n\nexport function normalizePrincipalStateMemberEnvelopes(\n  envelopes: ReadonlyArray<PrincipalStateMemberEnvelope>,\n): PrincipalStateMemberEnvelope[] {\n  const normalized = envelopes\n    .map((envelope) => ({\n      userId: envelope.userId,\n      memberKeyFingerprint: envelope.memberKeyFingerprint,\n      kemCipherText: envelope.kemCipherText,\n      wrappedKey: envelope.wrappedKey,\n    }))\n    .sort(compareEnvelopes);\n\n  for (const [index, envelope] of normalized.entries()) {\n    if (\n      envelope.userId.length === 0 ||\n      !/^[0-9a-f]{64}$/.test(envelope.memberKeyFingerprint)\n    ) {\n      invalidEnvelope(\"Principal member envelope identity is invalid\");\n    }\n    const previous = normalized[index - 1];\n    if (previous?.userId === envelope.userId) {\n      invalidEnvelope(\n        \"Principal state cannot contain duplicate member envelopes\",\n      );\n    }\n    const kemCipherText = requireCanonicalBase64(\n      envelope.kemCipherText,\n      \"Principal member envelope KEM ciphertext\",\n    );\n    if (kemCipherText.length !== ML_KEM1024_CIPHERTEXT_BYTES) {\n      invalidEnvelope(\n        `Principal member envelope KEM ciphertext must contain exactly ${ML_KEM1024_CIPHERTEXT_BYTES} bytes`,\n      );\n    }\n    const wrappedKey = requireCanonicalBase64(\n      envelope.wrappedKey,\n      \"Principal member envelope wrapped key\",\n    );\n    const expectedWrappedKeyBytes =\n      ML_KEM1024_SECRET_KEY_BYTES + AES_GCM_TAG_BYTES;\n    if (wrappedKey.length !== expectedWrappedKeyBytes) {\n      invalidEnvelope(\n        `Principal member envelope wrapped key must contain exactly ${expectedWrappedKeyBytes} bytes`,\n      );\n    }\n  }\n\n  return normalized;\n}\n\nexport async function computePrincipalMemberEnvelopesRoot(\n  envelopes: ReadonlyArray<PrincipalStateMemberEnvelope>,\n): Promise<string> {\n  return toFingerprint(\n    TEXT_ENCODER.encode(\n      JSON.stringify(normalizePrincipalStateMemberEnvelopes(envelopes)),\n    ),\n  );\n}\n"]}

package/internal/crypto/principalPolicyValidationError.d.ts

@@ -0,0 +1,6 @@
+export type PrincipalPolicyValidationErrorCode = "invalid_artifact" | "invalid_shape" | "missing_state" | "state_conflict" | "unauthorized_signer";
+export declare class PrincipalPolicyValidationError extends Error {
+    readonly code: PrincipalPolicyValidationErrorCode;
+    constructor(code: PrincipalPolicyValidationErrorCode, message: string);
+}
+export declare function throwPrincipalPolicyValidationError(code: PrincipalPolicyValidationErrorCode, message: string): never;

package/internal/crypto/principalPolicyValidationError.js

@@ -0,0 +1,12 @@
+export class PrincipalPolicyValidationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "PrincipalPolicyValidationError";
+    }
+}
+export function throwPrincipalPolicyValidationError(code, message) {
+    throw new PrincipalPolicyValidationError(code, message);
+}
+//# sourceMappingURL=principalPolicyValidationError.js.map

package/internal/crypto/principalPolicyValidationError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyValidationError.js","sourceRoot":"","sources":["principalPolicyValidationError.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAE5C;IADX,YACW,IAAwC,EACjD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAoC;QAIjD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,mCAAmC,CACjD,IAAwC,EACxC,OAAe;IAEf,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["export type PrincipalPolicyValidationErrorCode =\n  | \"invalid_artifact\"\n  | \"invalid_shape\"\n  | \"missing_state\"\n  | \"state_conflict\"\n  | \"unauthorized_signer\";\n\nexport class PrincipalPolicyValidationError extends Error {\n  constructor(\n    readonly code: PrincipalPolicyValidationErrorCode,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"PrincipalPolicyValidationError\";\n  }\n}\n\nexport function throwPrincipalPolicyValidationError(\n  code: PrincipalPolicyValidationErrorCode,\n  message: string,\n): never {\n  throw new PrincipalPolicyValidationError(code, message);\n}\n"]}

package/internal/crypto/principalState.d.ts

@@ -0,0 +1,17 @@
+import type { ManagedRecipientPrincipalType, PrincipalProjectionMember, PrincipalProjectionRole, PrincipalStateHeaderInput, PrincipalStateMember, PrincipalStateSigningInput, SignedPrincipalState, UnsignedPrincipalState } from "./principalStateTypes.js";
+export type { ManagedRecipientPrincipalType, PrincipalContainerGrant, PrincipalContainerGrantAccessLevel, PrincipalProjectionMember, PrincipalProjectionRole, PrincipalStateExternalAuthority, PrincipalStateHeaderInput, PrincipalStateMember, PrincipalStateMemberEnvelope, PrincipalStateMembershipMode, PrincipalStatePayloadCipherSuite, PrincipalStateSigningInput, SignedPrincipalState, UnsignedPrincipalState, } from "./principalStateTypes.js";
+export declare function encodeUnsignedPrincipalState(state: UnsignedPrincipalState): Uint8Array;
+export declare function toUnsignedPrincipalState(state: UnsignedPrincipalState): UnsignedPrincipalState;
+export declare function normalizeUnsignedPrincipalState(state: UnsignedPrincipalState): Promise<UnsignedPrincipalState>;
+export declare function isManagedRecipientPrincipalType(value: string): value is ManagedRecipientPrincipalType;
+export declare function isPrincipalProjectionRole(value: string): value is PrincipalProjectionRole;
+export declare function normalizePrincipalStateMembers(members: ReadonlyArray<PrincipalStateMember>): PrincipalStateMember[];
+export declare function derivePrincipalProjectionMembers(members: ReadonlyArray<PrincipalStateMember>): PrincipalProjectionMember[];
+export declare function normalizePrincipalProjectionMembers(members: ReadonlyArray<PrincipalProjectionMember>): PrincipalProjectionMember[];
+export declare function computePrincipalMembershipRoot(members: ReadonlyArray<PrincipalStateMember>): Promise<string>;
+export declare function computePrincipalProjectionRoot(members: ReadonlyArray<PrincipalProjectionMember>): Promise<string>;
+export declare function computePrincipalStatePayloadCiphertextHash(ciphertext: string): Promise<string>;
+export declare function buildPrincipalStateSigningInput(input: PrincipalStateHeaderInput): Promise<PrincipalStateSigningInput>;
+export declare function serializeUnsignedPrincipalState(state: UnsignedPrincipalState): Promise<string>;
+export declare function computePrincipalStateHash(state: UnsignedPrincipalState): Promise<string>;
+export declare function signPrincipalState(state: PrincipalStateSigningInput, secretKey: Uint8Array): Promise<SignedPrincipalState>;