@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/client/fileSaver.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Platform capability for the app's "download" action — handing a file's bytes
+ * to wherever the running platform surfaces saved files.
+ *
+ * The web shell has a browser download destination, so its default
+ * implementation clicks a hidden `<a download>` pointed at an object URL. The
+ * native WebView shells do NOT: a Capacitor WKWebView / Android System WebView
+ * and Electrobun's desktop WKWebView both treat that anchor click as a silent
+ * no-op, which is why downloads appear "broken" there. Each of those shells
+ * injects its own {@link FileSaver} — Capacitor writes the bytes and opens the
+ * native share sheet; Electrobun writes to the user's Downloads folder — so the
+ * shared app can trigger a download without assuming the browser anchor works.
+ *
+ * The interface lives here (React-free, like the other capability contracts) so
+ * `AppHostConfig` can carry a factory for it and every shell can implement it;
+ * the default browser implementation lives in the app package next to the DOM
+ * code it depends on.
+ */
+/** A file the user asked to save, plus the metadata a platform needs for it. */
+export interface SaveFileRequest {
+    /** Suggested file name including its extension, e.g. `"backup.json"`. */
+    readonly fileName: string;
+    /**
+     * The file's bytes. Backed by a plain `ArrayBuffer` (not a `SharedArrayBuffer`)
+     * so the bytes can go straight into a `Blob` / `fetch` body / native write —
+     * the same shape as the SDK's {@link BlobBytes}.
+     */
+    readonly data: Uint8Array<ArrayBuffer>;
+    /**
+     * MIME type. Platforms that need one (the web anchor's blob, the share sheet)
+     * fall back to `application/octet-stream` when it is absent.
+     */
+    readonly mimeType?: string | null | undefined;
+}
+export interface FileSaver {
+    /**
+     * Saves the file. Resolves once the platform has taken ownership of the bytes
+     * (download started, file written, share sheet completed). A user dismissing
+     * a native save/share sheet is treated as a normal no-op — it resolves rather
+     * than rejecting — so callers need not distinguish cancellation from success.
+     * Rejects only on a genuine failure to write or hand off the file.
+     */
+    saveFile(request: SaveFileRequest): Promise<void>;
+}

package/client/fileSaver.js

@@ -0,0 +1,20 @@
+/**
+ * Platform capability for the app's "download" action — handing a file's bytes
+ * to wherever the running platform surfaces saved files.
+ *
+ * The web shell has a browser download destination, so its default
+ * implementation clicks a hidden `<a download>` pointed at an object URL. The
+ * native WebView shells do NOT: a Capacitor WKWebView / Android System WebView
+ * and Electrobun's desktop WKWebView both treat that anchor click as a silent
+ * no-op, which is why downloads appear "broken" there. Each of those shells
+ * injects its own {@link FileSaver} — Capacitor writes the bytes and opens the
+ * native share sheet; Electrobun writes to the user's Downloads folder — so the
+ * shared app can trigger a download without assuming the browser anchor works.
+ *
+ * The interface lives here (React-free, like the other capability contracts) so
+ * `AppHostConfig` can carry a factory for it and every shell can implement it;
+ * the default browser implementation lives in the app package next to the DOM
+ * code it depends on.
+ */
+export {};
+//# sourceMappingURL=fileSaver.js.map

package/client/fileSaver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileSaver.js","sourceRoot":"","sources":["fileSaver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG","sourcesContent":["/**\n * Platform capability for the app's \"download\" action — handing a file's bytes\n * to wherever the running platform surfaces saved files.\n *\n * The web shell has a browser download destination, so its default\n * implementation clicks a hidden `<a download>` pointed at an object URL. The\n * native WebView shells do NOT: a Capacitor WKWebView / Android System WebView\n * and Electrobun's desktop WKWebView both treat that anchor click as a silent\n * no-op, which is why downloads appear \"broken\" there. Each of those shells\n * injects its own {@link FileSaver} — Capacitor writes the bytes and opens the\n * native share sheet; Electrobun writes to the user's Downloads folder — so the\n * shared app can trigger a download without assuming the browser anchor works.\n *\n * The interface lives here (React-free, like the other capability contracts) so\n * `AppHostConfig` can carry a factory for it and every shell can implement it;\n * the default browser implementation lives in the app package next to the DOM\n * code it depends on.\n */\n\n/** A file the user asked to save, plus the metadata a platform needs for it. */\nexport interface SaveFileRequest {\n  /** Suggested file name including its extension, e.g. `\"backup.json\"`. */\n  readonly fileName: string;\n  /**\n   * The file's bytes. Backed by a plain `ArrayBuffer` (not a `SharedArrayBuffer`)\n   * so the bytes can go straight into a `Blob` / `fetch` body / native write —\n   * the same shape as the SDK's {@link BlobBytes}.\n   */\n  readonly data: Uint8Array<ArrayBuffer>;\n  /**\n   * MIME type. Platforms that need one (the web anchor's blob, the share sheet)\n   * fall back to `application/octet-stream` when it is absent.\n   */\n  readonly mimeType?: string | null | undefined;\n}\n\nexport interface FileSaver {\n  /**\n   * Saves the file. Resolves once the platform has taken ownership of the bytes\n   * (download started, file written, share sheet completed). A user dismissing\n   * a native save/share sheet is treated as a normal no-op — it resolves rather\n   * than rejecting — so callers need not distinguish cancellation from success.\n   * Rejects only on a genuine failure to write or hand off the file.\n   */\n  saveFile(request: SaveFileRequest): Promise<void>;\n}\n"]}

package/client/identity.d.ts

@@ -0,0 +1,50 @@
+import { type EncapsulationKeyPair, type SigningKeyPair } from "../internal/crypto/index.js";
+import { type IdentityKeyPackage } from "./identityKeyPackage.js";
+export interface IdentityOptions {
+    encapsulationKeyPair?: EncapsulationKeyPair | null | undefined;
+    seedPhrase?: string | null | undefined;
+    signingFingerprint?: string | null | undefined;
+    signingKeyPair?: SigningKeyPair | null | undefined;
+}
+export interface IdentitySnapshot {
+    encapsulationKeyPair: EncapsulationKeyPair | null;
+    seedPhrase: string | null;
+    signingFingerprint: string | null;
+    signingKeyPair: SigningKeyPair | null;
+}
+export interface IdentityGenerationResult extends IdentitySnapshot {
+    rootContainerCreated: boolean;
+    rootContainerId: string;
+    userId: string | null;
+}
+export type IdentityListener = () => void;
+export interface Identity {
+    readonly encapsulationKeyPair: EncapsulationKeyPair | null;
+    readonly seedPhrase: string | null;
+    readonly signingFingerprint: string | null;
+    readonly signingKeyPair: SigningKeyPair | null;
+    readonly snapshot: IdentitySnapshot;
+    destroy(): void;
+    exportKeyPackage(): Promise<IdentityKeyPackage>;
+    generate(): Promise<IdentityGenerationResult>;
+    importKeyPackage(keyPackage: unknown): Promise<IdentitySnapshot>;
+    importSeedPhrase(seedPhrase: string): Promise<IdentitySnapshot>;
+    requireSigningKeyPair(operation?: string): SigningKeyPair;
+    refreshSigningFingerprint(): Promise<string | null>;
+    setKeyPairs(options: {
+        encapsulationKeyPair: EncapsulationKeyPair | null;
+        seedPhrase?: string | null | undefined;
+        signingFingerprint?: string | null | undefined;
+        signingKeyPair: SigningKeyPair | null;
+    }): Promise<IdentitySnapshot>;
+    subscribe(listener: IdentityListener): () => void;
+}
+interface IdentityRuntimeHooks {
+    bootstrapLocalRootContainer?: (() => Promise<{
+        containerId: string;
+        created: boolean;
+    }>) | undefined;
+    getUserId?: (() => string | null) | undefined;
+}
+export declare function createIdentity(options: IdentityOptions | undefined, onIdentityChanged: (signingFingerprint: string | null) => void, log: (message: string) => void, runtimeHooks?: IdentityRuntimeHooks): Identity;
+export {};

package/client/identity.js

@@ -0,0 +1,163 @@
+import { createIdentitySeedPhrase, generateIdentityKeyPairsFromSeedPhrase, toFingerprint, } from "../internal/crypto/index.js";
+import { errorMessage } from "../data/errorMessage.js";
+import { createIdentityKeyPackage, parseIdentityKeyPackage, } from "./identityKeyPackage.js";
+import { createListenerSet } from "./listenerSet.js";
+export function createIdentity(options = {}, onIdentityChanged, log, runtimeHooks = {}) {
+    return new IdentityService(options, onIdentityChanged, log, runtimeHooks);
+}
+class IdentityService {
+    onIdentityChanged;
+    log;
+    runtimeHooks;
+    encapsulationKeyPairValue;
+    listeners = createListenerSet();
+    seedPhraseValue;
+    signingFingerprintValue;
+    signingKeyPairValue;
+    snapshotValue;
+    constructor(options = {}, onIdentityChanged, log, runtimeHooks) {
+        this.onIdentityChanged = onIdentityChanged;
+        this.log = log;
+        this.runtimeHooks = runtimeHooks;
+        this.encapsulationKeyPairValue = options.encapsulationKeyPair ?? null;
+        this.seedPhraseValue = options.seedPhrase ?? null;
+        this.signingFingerprintValue = options.signingFingerprint ?? null;
+        this.signingKeyPairValue = options.signingKeyPair ?? null;
+        this.snapshotValue = this.createSnapshot();
+        this.onIdentityChanged(this.signingFingerprintValue);
+    }
+    get encapsulationKeyPair() {
+        return this.encapsulationKeyPairValue;
+    }
+    get seedPhrase() {
+        return this.seedPhraseValue;
+    }
+    get signingFingerprint() {
+        return this.signingFingerprintValue;
+    }
+    get signingKeyPair() {
+        return this.signingKeyPairValue;
+    }
+    get snapshot() {
+        return this.snapshotValue;
+    }
+    destroy() {
+        this.encapsulationKeyPairValue = null;
+        this.seedPhraseValue = null;
+        this.signingFingerprintValue = null;
+        this.signingKeyPairValue = null;
+        this.publishSnapshot();
+        this.log("Key pair destroyed");
+    }
+    exportKeyPackage() {
+        return createIdentityKeyPackage(this.snapshot);
+    }
+    async generate() {
+        const seedPhrase = createIdentitySeedPhrase();
+        const { encapsulationKeyPair, signingKeyPair } = generateIdentityKeyPairsFromSeedPhrase(seedPhrase);
+        const signingFingerprint = await toFingerprint(signingKeyPair.signingPublicKey);
+        const generationContext = await this.createGenerationContext();
+        this.signingKeyPairValue = signingKeyPair;
+        this.encapsulationKeyPairValue = encapsulationKeyPair;
+        this.seedPhraseValue = seedPhrase;
+        this.signingFingerprintValue = signingFingerprint;
+        this.publishSnapshot();
+        this.log("Key pair generated");
+        return {
+            ...this.snapshot,
+            ...generationContext,
+        };
+    }
+    async importKeyPackage(keyPackage) {
+        const parsed = await parseIdentityKeyPackage(keyPackage);
+        this.encapsulationKeyPairValue = parsed.encapsulationKeyPair;
+        this.seedPhraseValue = parsed.package.seedPhrase ?? null;
+        this.signingKeyPairValue = parsed.signingKeyPair;
+        this.signingFingerprintValue = parsed.package.signingFingerprint;
+        this.publishSnapshot();
+        this.log("Key package imported");
+        return this.snapshot;
+    }
+    async importSeedPhrase(seedPhrase) {
+        const derived = generateIdentityKeyPairsFromSeedPhrase(seedPhrase);
+        this.encapsulationKeyPairValue = derived.encapsulationKeyPair;
+        this.seedPhraseValue = derived.seedPhrase;
+        this.signingKeyPairValue = derived.signingKeyPair;
+        this.signingFingerprintValue = await toFingerprint(derived.signingKeyPair.signingPublicKey);
+        this.publishSnapshot();
+        this.log("Seed phrase imported");
+        return this.snapshot;
+    }
+    requireSigningKeyPair(operation = "This operation") {
+        if (!this.signingKeyPairValue) {
+            throw new Error(`${operation} requires a signing key pair.`);
+        }
+        return this.signingKeyPairValue;
+    }
+    async refreshSigningFingerprint() {
+        if (!this.signingKeyPairValue) {
+            this.signingFingerprintValue = null;
+            this.publishSnapshot();
+            return null;
+        }
+        this.signingFingerprintValue = await toFingerprint(this.signingKeyPairValue.signingPublicKey);
+        this.publishSnapshot();
+        return this.signingFingerprintValue;
+    }
+    async setKeyPairs(options) {
+        this.encapsulationKeyPairValue = options.encapsulationKeyPair;
+        this.seedPhraseValue = options.seedPhrase ?? null;
+        this.signingKeyPairValue = options.signingKeyPair;
+        this.signingFingerprintValue = options.signingFingerprint ?? null;
+        if (!this.signingFingerprintValue) {
+            await this.refreshSigningFingerprint();
+        }
+        else {
+            this.publishSnapshot();
+        }
+        return this.snapshot;
+    }
+    subscribe = (listener) => this.listeners.subscribe(listener);
+    createSnapshot() {
+        return {
+            encapsulationKeyPair: this.encapsulationKeyPairValue,
+            seedPhrase: this.seedPhraseValue,
+            signingFingerprint: this.signingFingerprintValue,
+            signingKeyPair: this.signingKeyPairValue,
+        };
+    }
+    async createGenerationContext() {
+        try {
+            const bootstrapLocalRootContainer = this.runtimeHooks.bootstrapLocalRootContainer;
+            if (!bootstrapLocalRootContainer) {
+                throw new Error("identity.generate requires local root container bootstrap.");
+            }
+            const rootContainer = await bootstrapLocalRootContainer();
+            return {
+                rootContainerCreated: rootContainer.created,
+                rootContainerId: rootContainer.containerId,
+                userId: this.runtimeHooks.getUserId?.() ?? null,
+            };
+        }
+        catch (error) {
+            const message = errorMessage(error);
+            this.log(`Root container bootstrap failed: ${message}`);
+            throw error;
+        }
+    }
+    publishSnapshot() {
+        const nextSnapshot = this.createSnapshot();
+        const previousSnapshot = this.snapshotValue;
+        if (previousSnapshot.encapsulationKeyPair ===
+            nextSnapshot.encapsulationKeyPair &&
+            previousSnapshot.seedPhrase === nextSnapshot.seedPhrase &&
+            previousSnapshot.signingFingerprint === nextSnapshot.signingFingerprint &&
+            previousSnapshot.signingKeyPair === nextSnapshot.signingKeyPair) {
+            return;
+        }
+        this.snapshotValue = nextSnapshot;
+        this.onIdentityChanged(nextSnapshot.signingFingerprint);
+        this.listeners.notify();
+    }
+}
+//# sourceMappingURL=identity.js.map

package/client/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAExB,sCAAsC,EAEtC,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,wBAAwB,EAExB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AA2DlD,MAAM,UAAU,cAAc,CAC5B,UAA2B,EAAE,EAC7B,iBAA8D,EAC9D,GAA8B,EAC9B,eAAqC,EAAE;IAEvC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,eAAe;IAUA;IAGA;IACA;IAbX,yBAAyB,CAA8B;IAC9C,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACzC,eAAe,CAAgB;IAC/B,uBAAuB,CAAgB;IACvC,mBAAmB,CAAwB;IAC3C,aAAa,CAAmB;IAExC,YACE,UAA2B,EAAE,EACZ,iBAER,EACQ,GAA8B,EAC9B,YAAkC;QAJlC,sBAAiB,GAAjB,iBAAiB,CAEzB;QACQ,QAAG,GAAH,GAAG,CAA2B;QAC9B,iBAAY,GAAZ,YAAY,CAAsB;QAEnD,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAClE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,yBAAyB,CAAC;IACxC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACtC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACpC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACjC,CAAC;IAED,gBAAgB;QACd,OAAO,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;QAC9C,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAC5C,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAC5C,cAAc,CAAC,gBAAgB,CAChC,CAAC;QACF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/D,IAAI,CAAC,mBAAmB,GAAG,cAAc,CAAC;QAC1C,IAAI,CAAC,yBAAyB,GAAG,oBAAoB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;QAClC,IAAI,CAAC,uBAAuB,GAAG,kBAAkB,CAAC;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC/B,OAAO;YACL,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,iBAAiB;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,yBAAyB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC;QACjD,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACjE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,MAAM,OAAO,GAAG,sCAAsC,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;QAC1C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,MAAM,aAAa,CAChD,OAAO,CAAC,cAAc,CAAC,gBAAgB,CACxC,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,qBAAqB,CAAC,SAAS,GAAG,gBAAgB;QAChD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACpC,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,uBAAuB,GAAG,MAAM,aAAa,CAChD,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAC1C,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAKjB;QACC,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;QAClD,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAElE,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,SAAS,GAAG,CAAC,QAA0B,EAAgB,EAAE,CACvD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE7B,cAAc;QACpB,OAAO;YACL,oBAAoB,EAAE,IAAI,CAAC,yBAAyB;YACpD,UAAU,EAAE,IAAI,CAAC,eAAe;YAChC,kBAAkB,EAAE,IAAI,CAAC,uBAAuB;YAChD,cAAc,EAAE,IAAI,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,IAAI,CAAC;YACH,MAAM,2BAA2B,GAC/B,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;YAChD,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,EAAE,CAAC;YAE1D,OAAO;gBACL,oBAAoB,EAAE,aAAa,CAAC,OAAO;gBAC3C,eAAe,EAAE,aAAa,CAAC,WAAW;gBAC1C,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI;aAChD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC;QAC5C,IACE,gBAAgB,CAAC,oBAAoB;YACnC,YAAY,CAAC,oBAAoB;YACnC,gBAAgB,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU;YACvD,gBAAgB,CAAC,kBAAkB,KAAK,YAAY,CAAC,kBAAkB;YACvE,gBAAgB,CAAC,cAAc,KAAK,YAAY,CAAC,cAAc,EAC/D,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF","sourcesContent":["import {\n  createIdentitySeedPhrase,\n  type EncapsulationKeyPair,\n  generateIdentityKeyPairsFromSeedPhrase,\n  type SigningKeyPair,\n  toFingerprint,\n} from \"@tearleads/crypto\";\nimport { errorMessage } from \"../data/errorMessage\";\nimport {\n  createIdentityKeyPackage,\n  type IdentityKeyPackage,\n  parseIdentityKeyPackage,\n} from \"./identityKeyPackage\";\nimport { createListenerSet } from \"./listenerSet\";\n\nexport interface IdentityOptions {\n  encapsulationKeyPair?: EncapsulationKeyPair | null | undefined;\n  seedPhrase?: string | null | undefined;\n  signingFingerprint?: string | null | undefined;\n  signingKeyPair?: SigningKeyPair | null | undefined;\n}\n\nexport interface IdentitySnapshot {\n  encapsulationKeyPair: EncapsulationKeyPair | null;\n  seedPhrase: string | null;\n  signingFingerprint: string | null;\n  signingKeyPair: SigningKeyPair | null;\n}\n\nexport interface IdentityGenerationResult extends IdentitySnapshot {\n  rootContainerCreated: boolean;\n  rootContainerId: string;\n  userId: string | null;\n}\n\nexport type IdentityListener = () => void;\n\nexport interface Identity {\n  readonly encapsulationKeyPair: EncapsulationKeyPair | null;\n  readonly seedPhrase: string | null;\n  readonly signingFingerprint: string | null;\n  readonly signingKeyPair: SigningKeyPair | null;\n  readonly snapshot: IdentitySnapshot;\n  destroy(): void;\n  exportKeyPackage(): Promise<IdentityKeyPackage>;\n  generate(): Promise<IdentityGenerationResult>;\n  importKeyPackage(keyPackage: unknown): Promise<IdentitySnapshot>;\n  importSeedPhrase(seedPhrase: string): Promise<IdentitySnapshot>;\n  requireSigningKeyPair(operation?: string): SigningKeyPair;\n  refreshSigningFingerprint(): Promise<string | null>;\n  setKeyPairs(options: {\n    encapsulationKeyPair: EncapsulationKeyPair | null;\n    seedPhrase?: string | null | undefined;\n    signingFingerprint?: string | null | undefined;\n    signingKeyPair: SigningKeyPair | null;\n  }): Promise<IdentitySnapshot>;\n  subscribe(listener: IdentityListener): () => void;\n}\n\ninterface IdentityGenerationContext {\n  rootContainerCreated: boolean;\n  rootContainerId: string;\n  userId: string | null;\n}\n\ninterface IdentityRuntimeHooks {\n  bootstrapLocalRootContainer?:\n    | (() => Promise<{ containerId: string; created: boolean }>)\n    | undefined;\n  getUserId?: (() => string | null) | undefined;\n}\n\nexport function createIdentity(\n  options: IdentityOptions = {},\n  onIdentityChanged: (signingFingerprint: string | null) => void,\n  log: (message: string) => void,\n  runtimeHooks: IdentityRuntimeHooks = {},\n): Identity {\n  return new IdentityService(options, onIdentityChanged, log, runtimeHooks);\n}\n\nclass IdentityService implements Identity {\n  private encapsulationKeyPairValue: EncapsulationKeyPair | null;\n  private readonly listeners = createListenerSet();\n  private seedPhraseValue: string | null;\n  private signingFingerprintValue: string | null;\n  private signingKeyPairValue: SigningKeyPair | null;\n  private snapshotValue: IdentitySnapshot;\n\n  constructor(\n    options: IdentityOptions = {},\n    private readonly onIdentityChanged: (\n      signingFingerprint: string | null,\n    ) => void,\n    private readonly log: (message: string) => void,\n    private readonly runtimeHooks: IdentityRuntimeHooks,\n  ) {\n    this.encapsulationKeyPairValue = options.encapsulationKeyPair ?? null;\n    this.seedPhraseValue = options.seedPhrase ?? null;\n    this.signingFingerprintValue = options.signingFingerprint ?? null;\n    this.signingKeyPairValue = options.signingKeyPair ?? null;\n    this.snapshotValue = this.createSnapshot();\n    this.onIdentityChanged(this.signingFingerprintValue);\n  }\n\n  get encapsulationKeyPair(): EncapsulationKeyPair | null {\n    return this.encapsulationKeyPairValue;\n  }\n\n  get seedPhrase(): string | null {\n    return this.seedPhraseValue;\n  }\n\n  get signingFingerprint(): string | null {\n    return this.signingFingerprintValue;\n  }\n\n  get signingKeyPair(): SigningKeyPair | null {\n    return this.signingKeyPairValue;\n  }\n\n  get snapshot(): IdentitySnapshot {\n    return this.snapshotValue;\n  }\n\n  destroy(): void {\n    this.encapsulationKeyPairValue = null;\n    this.seedPhraseValue = null;\n    this.signingFingerprintValue = null;\n    this.signingKeyPairValue = null;\n    this.publishSnapshot();\n    this.log(\"Key pair destroyed\");\n  }\n\n  exportKeyPackage(): Promise<IdentityKeyPackage> {\n    return createIdentityKeyPackage(this.snapshot);\n  }\n\n  async generate(): Promise<IdentityGenerationResult> {\n    const seedPhrase = createIdentitySeedPhrase();\n    const { encapsulationKeyPair, signingKeyPair } =\n      generateIdentityKeyPairsFromSeedPhrase(seedPhrase);\n    const signingFingerprint = await toFingerprint(\n      signingKeyPair.signingPublicKey,\n    );\n    const generationContext = await this.createGenerationContext();\n\n    this.signingKeyPairValue = signingKeyPair;\n    this.encapsulationKeyPairValue = encapsulationKeyPair;\n    this.seedPhraseValue = seedPhrase;\n    this.signingFingerprintValue = signingFingerprint;\n    this.publishSnapshot();\n    this.log(\"Key pair generated\");\n    return {\n      ...this.snapshot,\n      ...generationContext,\n    };\n  }\n\n  async importKeyPackage(keyPackage: unknown): Promise<IdentitySnapshot> {\n    const parsed = await parseIdentityKeyPackage(keyPackage);\n    this.encapsulationKeyPairValue = parsed.encapsulationKeyPair;\n    this.seedPhraseValue = parsed.package.seedPhrase ?? null;\n    this.signingKeyPairValue = parsed.signingKeyPair;\n    this.signingFingerprintValue = parsed.package.signingFingerprint;\n    this.publishSnapshot();\n    this.log(\"Key package imported\");\n    return this.snapshot;\n  }\n\n  async importSeedPhrase(seedPhrase: string): Promise<IdentitySnapshot> {\n    const derived = generateIdentityKeyPairsFromSeedPhrase(seedPhrase);\n    this.encapsulationKeyPairValue = derived.encapsulationKeyPair;\n    this.seedPhraseValue = derived.seedPhrase;\n    this.signingKeyPairValue = derived.signingKeyPair;\n    this.signingFingerprintValue = await toFingerprint(\n      derived.signingKeyPair.signingPublicKey,\n    );\n    this.publishSnapshot();\n    this.log(\"Seed phrase imported\");\n    return this.snapshot;\n  }\n\n  requireSigningKeyPair(operation = \"This operation\"): SigningKeyPair {\n    if (!this.signingKeyPairValue) {\n      throw new Error(`${operation} requires a signing key pair.`);\n    }\n\n    return this.signingKeyPairValue;\n  }\n\n  async refreshSigningFingerprint(): Promise<string | null> {\n    if (!this.signingKeyPairValue) {\n      this.signingFingerprintValue = null;\n      this.publishSnapshot();\n      return null;\n    }\n\n    this.signingFingerprintValue = await toFingerprint(\n      this.signingKeyPairValue.signingPublicKey,\n    );\n    this.publishSnapshot();\n    return this.signingFingerprintValue;\n  }\n\n  async setKeyPairs(options: {\n    encapsulationKeyPair: EncapsulationKeyPair | null;\n    seedPhrase?: string | null | undefined;\n    signingFingerprint?: string | null | undefined;\n    signingKeyPair: SigningKeyPair | null;\n  }): Promise<IdentitySnapshot> {\n    this.encapsulationKeyPairValue = options.encapsulationKeyPair;\n    this.seedPhraseValue = options.seedPhrase ?? null;\n    this.signingKeyPairValue = options.signingKeyPair;\n    this.signingFingerprintValue = options.signingFingerprint ?? null;\n\n    if (!this.signingFingerprintValue) {\n      await this.refreshSigningFingerprint();\n    } else {\n      this.publishSnapshot();\n    }\n\n    return this.snapshot;\n  }\n\n  subscribe = (listener: IdentityListener): (() => void) =>\n    this.listeners.subscribe(listener);\n\n  private createSnapshot(): IdentitySnapshot {\n    return {\n      encapsulationKeyPair: this.encapsulationKeyPairValue,\n      seedPhrase: this.seedPhraseValue,\n      signingFingerprint: this.signingFingerprintValue,\n      signingKeyPair: this.signingKeyPairValue,\n    };\n  }\n\n  private async createGenerationContext(): Promise<IdentityGenerationContext> {\n    try {\n      const bootstrapLocalRootContainer =\n        this.runtimeHooks.bootstrapLocalRootContainer;\n      if (!bootstrapLocalRootContainer) {\n        throw new Error(\n          \"identity.generate requires local root container bootstrap.\",\n        );\n      }\n\n      const rootContainer = await bootstrapLocalRootContainer();\n\n      return {\n        rootContainerCreated: rootContainer.created,\n        rootContainerId: rootContainer.containerId,\n        userId: this.runtimeHooks.getUserId?.() ?? null,\n      };\n    } catch (error: unknown) {\n      const message = errorMessage(error);\n      this.log(`Root container bootstrap failed: ${message}`);\n      throw error;\n    }\n  }\n\n  private publishSnapshot(): void {\n    const nextSnapshot = this.createSnapshot();\n    const previousSnapshot = this.snapshotValue;\n    if (\n      previousSnapshot.encapsulationKeyPair ===\n        nextSnapshot.encapsulationKeyPair &&\n      previousSnapshot.seedPhrase === nextSnapshot.seedPhrase &&\n      previousSnapshot.signingFingerprint === nextSnapshot.signingFingerprint &&\n      previousSnapshot.signingKeyPair === nextSnapshot.signingKeyPair\n    ) {\n      return;\n    }\n\n    this.snapshotValue = nextSnapshot;\n    this.onIdentityChanged(nextSnapshot.signingFingerprint);\n    this.listeners.notify();\n  }\n}\n"]}

package/client/identityKeyPackage.d.ts

@@ -0,0 +1,30 @@
+import { type EncapsulationKeyPair, type SigningKeyPair } from "../internal/crypto/index.js";
+export declare const IDENTITY_KEY_PACKAGE_FORMAT = "tearleads.identity-key-package";
+export interface IdentityKeyPackage {
+    readonly createdAt: string;
+    readonly encapsulationKeyPair: {
+        readonly publicKey: string;
+        readonly secretKey: string;
+    };
+    readonly format: typeof IDENTITY_KEY_PACKAGE_FORMAT;
+    readonly seedPhrase?: string | undefined;
+    readonly signingFingerprint: string;
+    readonly signingKeyPair: {
+        readonly signingPrivateKey: string;
+        readonly signingPublicKey: string;
+    };
+    readonly version: 1;
+}
+interface ParsedIdentityKeyPackage {
+    readonly encapsulationKeyPair: EncapsulationKeyPair;
+    readonly package: IdentityKeyPackage;
+    readonly signingKeyPair: SigningKeyPair;
+}
+export declare function createIdentityKeyPackage(input: {
+    encapsulationKeyPair: EncapsulationKeyPair | null;
+    seedPhrase?: string | null | undefined;
+    signingFingerprint: string | null;
+    signingKeyPair: SigningKeyPair | null;
+}): Promise<IdentityKeyPackage>;
+export declare function parseIdentityKeyPackage(value: unknown): Promise<ParsedIdentityKeyPackage>;
+export {};

package/client/identityKeyPackage.js

@@ -0,0 +1,201 @@
+import { decryptAsRecipient, encryptForRecipients, generateIdentityKeyPairsFromSeedPhrase, ML_DSA87_PUBLIC_KEY_BYTES, ML_DSA87_SECRET_KEY_BYTES, ML_KEM1024_PUBLIC_KEY_BYTES, ML_KEM1024_SECRET_KEY_BYTES, sign, toFingerprint, verify, } from "../internal/crypto/index.js";
+import { base64ToBytes, bytesToBase64 } from "../internal/encoding/index.js";
+import { isPlainObject } from "../internal/validators/isPlainObject.js";
+export const IDENTITY_KEY_PACKAGE_FORMAT = "tearleads.identity-key-package";
+const KEY_PACKAGE_PROBE_MESSAGE = new TextEncoder().encode("tearleads.identity-key-package.probe");
+function readStringProperty(value, property, label) {
+    const rawValue = Reflect.get(value, property);
+    if (typeof rawValue !== "string" || rawValue.length === 0) {
+        throw new Error(`Invalid identity key package: ${label} is required.`);
+    }
+    return rawValue;
+}
+function readOptionalStringProperty(value, property, label) {
+    const rawValue = Reflect.get(value, property);
+    if (rawValue === undefined || rawValue === null) {
+        return null;
+    }
+    if (typeof rawValue !== "string" || rawValue.length === 0) {
+        throw new Error(`Invalid identity key package: ${label} must be a string.`);
+    }
+    return rawValue;
+}
+function readBase64Bytes(input) {
+    let bytes;
+    try {
+        bytes = base64ToBytes(input.value);
+    }
+    catch (error) {
+        throw new Error(`Invalid identity key package: ${input.label} must be base64.`, { cause: error });
+    }
+    if (bytes.length !== input.expectedLength) {
+        throw new Error(`Invalid identity key package: ${input.label} has ${bytes.length} bytes, expected ${input.expectedLength}.`);
+    }
+    return bytes;
+}
+function bytesEqual(left, right) {
+    if (left.length !== right.length) {
+        return false;
+    }
+    let result = 0;
+    for (let index = 0; index < left.length; index += 1) {
+        result |= (left[index] ?? 0) ^ (right[index] ?? 0);
+    }
+    return result === 0;
+}
+function readMatchingSeedPhrase(input) {
+    if (!input.seedPhrase) {
+        return undefined;
+    }
+    let derived;
+    try {
+        derived = generateIdentityKeyPairsFromSeedPhrase(input.seedPhrase);
+    }
+    catch (error) {
+        throw new Error("Invalid identity key package: seed phrase is invalid.", {
+            cause: error,
+        });
+    }
+    if (!bytesEqual(derived.signingKeyPair.signingPrivateKey, input.signingKeyPair.signingPrivateKey) ||
+        !bytesEqual(derived.signingKeyPair.signingPublicKey, input.signingKeyPair.signingPublicKey) ||
+        !bytesEqual(derived.encapsulationKeyPair.secretKey, input.encapsulationKeyPair.secretKey) ||
+        !bytesEqual(derived.encapsulationKeyPair.publicKey, input.encapsulationKeyPair.publicKey)) {
+        throw new Error("Invalid identity key package: seed phrase does not match the key pairs.");
+    }
+    return derived.seedPhrase;
+}
+function readSigningKeyPair(value) {
+    if (!isPlainObject(value)) {
+        throw new Error("Invalid identity key package: signingKeyPair is required.");
+    }
+    return {
+        signingPrivateKey: readBase64Bytes({
+            expectedLength: ML_DSA87_SECRET_KEY_BYTES,
+            label: "signing private key",
+            value: readStringProperty(value, "signingPrivateKey", "signing private key"),
+        }),
+        signingPublicKey: readBase64Bytes({
+            expectedLength: ML_DSA87_PUBLIC_KEY_BYTES,
+            label: "signing public key",
+            value: readStringProperty(value, "signingPublicKey", "signing public key"),
+        }),
+    };
+}
+function readEncapsulationKeyPair(value) {
+    if (!isPlainObject(value)) {
+        throw new Error("Invalid identity key package: encapsulationKeyPair is required.");
+    }
+    return {
+        publicKey: readBase64Bytes({
+            expectedLength: ML_KEM1024_PUBLIC_KEY_BYTES,
+            label: "encapsulation public key",
+            value: readStringProperty(value, "publicKey", "encapsulation public key"),
+        }),
+        secretKey: readBase64Bytes({
+            expectedLength: ML_KEM1024_SECRET_KEY_BYTES,
+            label: "encapsulation secret key",
+            value: readStringProperty(value, "secretKey", "encapsulation secret key"),
+        }),
+    };
+}
+function assertSigningKeyPairMatches(signingKeyPair) {
+    let signature;
+    try {
+        signature = sign(KEY_PACKAGE_PROBE_MESSAGE, signingKeyPair.signingPrivateKey);
+    }
+    catch (error) {
+        throw new Error("Invalid identity key package: signing private key could not sign.", { cause: error });
+    }
+    if (!verify(signature, KEY_PACKAGE_PROBE_MESSAGE, signingKeyPair.signingPublicKey)) {
+        throw new Error("Invalid identity key package: signing private key does not match the public key.");
+    }
+}
+async function assertEncapsulationKeyPairMatches(encapsulationKeyPair) {
+    try {
+        const envelope = await encryptForRecipients(KEY_PACKAGE_PROBE_MESSAGE, [
+            encapsulationKeyPair.publicKey,
+        ]);
+        const decrypted = await decryptAsRecipient(envelope, encapsulationKeyPair.secretKey);
+        if (decrypted.length !== KEY_PACKAGE_PROBE_MESSAGE.length ||
+            decrypted.some((byte, index) => byte !== KEY_PACKAGE_PROBE_MESSAGE[index])) {
+            throw new Error("probe plaintext mismatch");
+        }
+    }
+    catch (error) {
+        throw new Error("Invalid identity key package: encapsulation secret key does not match the public key.", { cause: error });
+    }
+}
+export async function createIdentityKeyPackage(input) {
+    if (!input.signingKeyPair || !input.encapsulationKeyPair) {
+        throw new Error("Cannot export an identity key package without key pairs.");
+    }
+    const signingFingerprint = input.signingFingerprint ??
+        (await toFingerprint(input.signingKeyPair.signingPublicKey));
+    const seedPhrase = readMatchingSeedPhrase({
+        encapsulationKeyPair: input.encapsulationKeyPair,
+        seedPhrase: input.seedPhrase ?? null,
+        signingKeyPair: input.signingKeyPair,
+    });
+    return {
+        createdAt: new Date().toISOString(),
+        encapsulationKeyPair: {
+            publicKey: bytesToBase64(input.encapsulationKeyPair.publicKey),
+            secretKey: bytesToBase64(input.encapsulationKeyPair.secretKey),
+        },
+        format: IDENTITY_KEY_PACKAGE_FORMAT,
+        ...(seedPhrase ? { seedPhrase } : {}),
+        signingFingerprint,
+        signingKeyPair: {
+            signingPrivateKey: bytesToBase64(input.signingKeyPair.signingPrivateKey),
+            signingPublicKey: bytesToBase64(input.signingKeyPair.signingPublicKey),
+        },
+        version: 1,
+    };
+}
+export async function parseIdentityKeyPackage(value) {
+    if (!isPlainObject(value)) {
+        throw new Error("Invalid identity key package: expected an object.");
+    }
+    const format = readStringProperty(value, "format", "format");
+    if (format !== IDENTITY_KEY_PACKAGE_FORMAT) {
+        throw new Error("Invalid identity key package: unsupported format.");
+    }
+    const version = Reflect.get(value, "version");
+    if (version !== 1) {
+        throw new Error("Invalid identity key package: unsupported version.");
+    }
+    const signingFingerprint = readStringProperty(value, "signingFingerprint", "signing fingerprint");
+    const signingKeyPair = readSigningKeyPair(Reflect.get(value, "signingKeyPair"));
+    const computedSigningFingerprint = await toFingerprint(signingKeyPair.signingPublicKey);
+    if (computedSigningFingerprint !== signingFingerprint) {
+        throw new Error("Invalid identity key package: signing fingerprint does not match the public key.");
+    }
+    assertSigningKeyPairMatches(signingKeyPair);
+    const encapsulationKeyPair = readEncapsulationKeyPair(Reflect.get(value, "encapsulationKeyPair"));
+    await assertEncapsulationKeyPairMatches(encapsulationKeyPair);
+    const seedPhrase = readMatchingSeedPhrase({
+        encapsulationKeyPair,
+        seedPhrase: readOptionalStringProperty(value, "seedPhrase", "seed phrase"),
+        signingKeyPair,
+    });
+    return {
+        encapsulationKeyPair,
+        package: {
+            createdAt: readStringProperty(value, "createdAt", "created at"),
+            encapsulationKeyPair: {
+                publicKey: bytesToBase64(encapsulationKeyPair.publicKey),
+                secretKey: bytesToBase64(encapsulationKeyPair.secretKey),
+            },
+            format,
+            ...(seedPhrase ? { seedPhrase } : {}),
+            signingFingerprint,
+            signingKeyPair: {
+                signingPrivateKey: bytesToBase64(signingKeyPair.signingPrivateKey),
+                signingPublicKey: bytesToBase64(signingKeyPair.signingPublicKey),
+            },
+            version,
+        },
+        signingKeyPair,
+    };
+}
+//# sourceMappingURL=identityKeyPackage.js.map

package/client/identityKeyPackage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityKeyPackage.js","sourceRoot":"","sources":["identityKeyPackage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,oBAAoB,EACpB,sCAAsC,EACtC,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAE3B,IAAI,EACJ,aAAa,EACb,MAAM,GACP,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAC;AAE5E,MAAM,yBAAyB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACxD,sCAAsC,CACvC,CAAC;AAwBF,SAAS,kBAAkB,CACzB,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,KAIxB;IACC,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,CAAC,KAAK,kBAAkB,EAC9D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,CAAC,KAAK,QAAQ,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,cAAc,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IACC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAkE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,GAAG,sCAAsC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE;YACvE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,IACE,CAAC,UAAU,CACT,OAAO,CAAC,cAAc,CAAC,iBAAiB,EACxC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CACvC;QACD,CAAC,UAAU,CACT,OAAO,CAAC,cAAc,CAAC,gBAAgB,EACvC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CACtC;QACD,CAAC,UAAU,CACT,OAAO,CAAC,oBAAoB,CAAC,SAAS,EACtC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CACrC;QACD,CAAC,UAAU,CACT,OAAO,CAAC,oBAAoB,CAAC,SAAS,EACtC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CACrC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,UAAU,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,eAAe,CAAC;YACjC,cAAc,EAAE,yBAAyB;YACzC,KAAK,EAAE,qBAAqB;YAC5B,KAAK,EAAE,kBAAkB,CACvB,KAAK,EACL,mBAAmB,EACnB,qBAAqB,CACtB;SACF,CAAC;QACF,gBAAgB,EAAE,eAAe,CAAC;YAChC,cAAc,EAAE,yBAAyB;YACzC,KAAK,EAAE,oBAAoB;YAC3B,KAAK,EAAE,kBAAkB,CACvB,KAAK,EACL,kBAAkB,EAClB,oBAAoB,CACrB;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,eAAe,CAAC;YACzB,cAAc,EAAE,2BAA2B;YAC3C,KAAK,EAAE,0BAA0B;YACjC,KAAK,EAAE,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,0BAA0B,CAAC;SAC1E,CAAC;QACF,SAAS,EAAE,eAAe,CAAC;YACzB,cAAc,EAAE,2BAA2B;YAC3C,KAAK,EAAE,0BAA0B;YACjC,KAAK,EAAE,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,0BAA0B,CAAC;SAC1E,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,cAA8B;IACjE,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CACd,yBAAyB,EACzB,cAAc,CAAC,iBAAiB,CACjC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mEAAmE,EACnE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IACE,CAAC,MAAM,CACL,SAAS,EACT,yBAAyB,EACzB,cAAc,CAAC,gBAAgB,CAChC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,oBAA0C;IAE1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,yBAAyB,EAAE;YACrE,oBAAoB,CAAC,SAAS;SAC/B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC,QAAQ,EACR,oBAAoB,CAAC,SAAS,CAC/B,CAAC;QAEF,IACE,SAAS,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;YACrD,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uFAAuF,EACvF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAK9C;IACC,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,kBAAkB,GACtB,KAAK,CAAC,kBAAkB;QACxB,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,sBAAsB,CAAC;QACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,oBAAoB,EAAE;YACpB,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC;YAC9D,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC;SAC/D;QACD,MAAM,EAAE,2BAA2B;QACnC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,kBAAkB;QAClB,cAAc,EAAE;YACd,iBAAiB,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,iBAAiB,CAAC;YACxE,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC;SACvE;QACD,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAc;IAEd,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,kBAAkB,GAAG,kBAAkB,CAC3C,KAAK,EACL,oBAAoB,EACpB,qBAAqB,CACtB,CAAC;IACF,MAAM,cAAc,GAAG,kBAAkB,CACvC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CACrC,CAAC;IACF,MAAM,0BAA0B,GAAG,MAAM,aAAa,CACpD,cAAc,CAAC,gBAAgB,CAChC,CAAC;IACF,IAAI,0BAA0B,KAAK,kBAAkB,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,2BAA2B,CAAC,cAAc,CAAC,CAAC;IAE5C,MAAM,oBAAoB,GAAG,wBAAwB,CACnD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAC3C,CAAC;IACF,MAAM,iCAAiC,CAAC,oBAAoB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,sBAAsB,CAAC;QACxC,oBAAoB;QACpB,UAAU,EAAE,0BAA0B,CAAC,KAAK,EAAE,YAAY,EAAE,aAAa,CAAC;QAC1E,cAAc;KACf,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,OAAO,EAAE;YACP,SAAS,EAAE,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC;YAC/D,oBAAoB,EAAE;gBACpB,SAAS,EAAE,aAAa,CAAC,oBAAoB,CAAC,SAAS,CAAC;gBACxD,SAAS,EAAE,aAAa,CAAC,oBAAoB,CAAC,SAAS,CAAC;aACzD;YACD,MAAM;YACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,kBAAkB;YAClB,cAAc,EAAE;gBACd,iBAAiB,EAAE,aAAa,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBAClE,gBAAgB,EAAE,aAAa,CAAC,cAAc,CAAC,gBAAgB,CAAC;aACjE;YACD,OAAO;SACR;QACD,cAAc;KACf,CAAC;AACJ,CAAC","sourcesContent":["import {\n  decryptAsRecipient,\n  type EncapsulationKeyPair,\n  encryptForRecipients,\n  generateIdentityKeyPairsFromSeedPhrase,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SECRET_KEY_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  ML_KEM1024_SECRET_KEY_BYTES,\n  type SigningKeyPair,\n  sign,\n  toFingerprint,\n  verify,\n} from \"@tearleads/crypto\";\nimport { base64ToBytes, bytesToBase64 } from \"@tearleads/encoding\";\nimport { isPlainObject } from \"@tearleads/validators/isPlainObject\";\n\nexport const IDENTITY_KEY_PACKAGE_FORMAT = \"tearleads.identity-key-package\";\n\nconst KEY_PACKAGE_PROBE_MESSAGE = new TextEncoder().encode(\n  \"tearleads.identity-key-package.probe\",\n);\n\nexport interface IdentityKeyPackage {\n  readonly createdAt: string;\n  readonly encapsulationKeyPair: {\n    readonly publicKey: string;\n    readonly secretKey: string;\n  };\n  readonly format: typeof IDENTITY_KEY_PACKAGE_FORMAT;\n  readonly seedPhrase?: string | undefined;\n  readonly signingFingerprint: string;\n  readonly signingKeyPair: {\n    readonly signingPrivateKey: string;\n    readonly signingPublicKey: string;\n  };\n  readonly version: 1;\n}\n\ninterface ParsedIdentityKeyPackage {\n  readonly encapsulationKeyPair: EncapsulationKeyPair;\n  readonly package: IdentityKeyPackage;\n  readonly signingKeyPair: SigningKeyPair;\n}\n\nfunction readStringProperty(\n  value: object,\n  property: string,\n  label: string,\n): string {\n  const rawValue = Reflect.get(value, property);\n  if (typeof rawValue !== \"string\" || rawValue.length === 0) {\n    throw new Error(`Invalid identity key package: ${label} is required.`);\n  }\n\n  return rawValue;\n}\n\nfunction readOptionalStringProperty(\n  value: object,\n  property: string,\n  label: string,\n): string | null {\n  const rawValue = Reflect.get(value, property);\n  if (rawValue === undefined || rawValue === null) {\n    return null;\n  }\n  if (typeof rawValue !== \"string\" || rawValue.length === 0) {\n    throw new Error(`Invalid identity key package: ${label} must be a string.`);\n  }\n\n  return rawValue;\n}\n\nfunction readBase64Bytes(input: {\n  expectedLength: number;\n  label: string;\n  value: string;\n}): Uint8Array {\n  let bytes: Uint8Array;\n  try {\n    bytes = base64ToBytes(input.value);\n  } catch (error) {\n    throw new Error(\n      `Invalid identity key package: ${input.label} must be base64.`,\n      { cause: error },\n    );\n  }\n\n  if (bytes.length !== input.expectedLength) {\n    throw new Error(\n      `Invalid identity key package: ${input.label} has ${bytes.length} bytes, expected ${input.expectedLength}.`,\n    );\n  }\n\n  return bytes;\n}\n\nfunction bytesEqual(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.length !== right.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    result |= (left[index] ?? 0) ^ (right[index] ?? 0);\n  }\n  return result === 0;\n}\n\nfunction readMatchingSeedPhrase(input: {\n  encapsulationKeyPair: EncapsulationKeyPair;\n  seedPhrase: string | null;\n  signingKeyPair: SigningKeyPair;\n}): string | undefined {\n  if (!input.seedPhrase) {\n    return undefined;\n  }\n\n  let derived: ReturnType<typeof generateIdentityKeyPairsFromSeedPhrase>;\n  try {\n    derived = generateIdentityKeyPairsFromSeedPhrase(input.seedPhrase);\n  } catch (error) {\n    throw new Error(\"Invalid identity key package: seed phrase is invalid.\", {\n      cause: error,\n    });\n  }\n\n  if (\n    !bytesEqual(\n      derived.signingKeyPair.signingPrivateKey,\n      input.signingKeyPair.signingPrivateKey,\n    ) ||\n    !bytesEqual(\n      derived.signingKeyPair.signingPublicKey,\n      input.signingKeyPair.signingPublicKey,\n    ) ||\n    !bytesEqual(\n      derived.encapsulationKeyPair.secretKey,\n      input.encapsulationKeyPair.secretKey,\n    ) ||\n    !bytesEqual(\n      derived.encapsulationKeyPair.publicKey,\n      input.encapsulationKeyPair.publicKey,\n    )\n  ) {\n    throw new Error(\n      \"Invalid identity key package: seed phrase does not match the key pairs.\",\n    );\n  }\n\n  return derived.seedPhrase;\n}\n\nfunction readSigningKeyPair(value: unknown): SigningKeyPair {\n  if (!isPlainObject(value)) {\n    throw new Error(\n      \"Invalid identity key package: signingKeyPair is required.\",\n    );\n  }\n\n  return {\n    signingPrivateKey: readBase64Bytes({\n      expectedLength: ML_DSA87_SECRET_KEY_BYTES,\n      label: \"signing private key\",\n      value: readStringProperty(\n        value,\n        \"signingPrivateKey\",\n        \"signing private key\",\n      ),\n    }),\n    signingPublicKey: readBase64Bytes({\n      expectedLength: ML_DSA87_PUBLIC_KEY_BYTES,\n      label: \"signing public key\",\n      value: readStringProperty(\n        value,\n        \"signingPublicKey\",\n        \"signing public key\",\n      ),\n    }),\n  };\n}\n\nfunction readEncapsulationKeyPair(value: unknown): EncapsulationKeyPair {\n  if (!isPlainObject(value)) {\n    throw new Error(\n      \"Invalid identity key package: encapsulationKeyPair is required.\",\n    );\n  }\n\n  return {\n    publicKey: readBase64Bytes({\n      expectedLength: ML_KEM1024_PUBLIC_KEY_BYTES,\n      label: \"encapsulation public key\",\n      value: readStringProperty(value, \"publicKey\", \"encapsulation public key\"),\n    }),\n    secretKey: readBase64Bytes({\n      expectedLength: ML_KEM1024_SECRET_KEY_BYTES,\n      label: \"encapsulation secret key\",\n      value: readStringProperty(value, \"secretKey\", \"encapsulation secret key\"),\n    }),\n  };\n}\n\nfunction assertSigningKeyPairMatches(signingKeyPair: SigningKeyPair): void {\n  let signature: Uint8Array;\n  try {\n    signature = sign(\n      KEY_PACKAGE_PROBE_MESSAGE,\n      signingKeyPair.signingPrivateKey,\n    );\n  } catch (error) {\n    throw new Error(\n      \"Invalid identity key package: signing private key could not sign.\",\n      { cause: error },\n    );\n  }\n\n  if (\n    !verify(\n      signature,\n      KEY_PACKAGE_PROBE_MESSAGE,\n      signingKeyPair.signingPublicKey,\n    )\n  ) {\n    throw new Error(\n      \"Invalid identity key package: signing private key does not match the public key.\",\n    );\n  }\n}\n\nasync function assertEncapsulationKeyPairMatches(\n  encapsulationKeyPair: EncapsulationKeyPair,\n): Promise<void> {\n  try {\n    const envelope = await encryptForRecipients(KEY_PACKAGE_PROBE_MESSAGE, [\n      encapsulationKeyPair.publicKey,\n    ]);\n    const decrypted = await decryptAsRecipient(\n      envelope,\n      encapsulationKeyPair.secretKey,\n    );\n\n    if (\n      decrypted.length !== KEY_PACKAGE_PROBE_MESSAGE.length ||\n      decrypted.some((byte, index) => byte !== KEY_PACKAGE_PROBE_MESSAGE[index])\n    ) {\n      throw new Error(\"probe plaintext mismatch\");\n    }\n  } catch (error) {\n    throw new Error(\n      \"Invalid identity key package: encapsulation secret key does not match the public key.\",\n      { cause: error },\n    );\n  }\n}\n\nexport async function createIdentityKeyPackage(input: {\n  encapsulationKeyPair: EncapsulationKeyPair | null;\n  seedPhrase?: string | null | undefined;\n  signingFingerprint: string | null;\n  signingKeyPair: SigningKeyPair | null;\n}): Promise<IdentityKeyPackage> {\n  if (!input.signingKeyPair || !input.encapsulationKeyPair) {\n    throw new Error(\"Cannot export an identity key package without key pairs.\");\n  }\n\n  const signingFingerprint =\n    input.signingFingerprint ??\n    (await toFingerprint(input.signingKeyPair.signingPublicKey));\n  const seedPhrase = readMatchingSeedPhrase({\n    encapsulationKeyPair: input.encapsulationKeyPair,\n    seedPhrase: input.seedPhrase ?? null,\n    signingKeyPair: input.signingKeyPair,\n  });\n\n  return {\n    createdAt: new Date().toISOString(),\n    encapsulationKeyPair: {\n      publicKey: bytesToBase64(input.encapsulationKeyPair.publicKey),\n      secretKey: bytesToBase64(input.encapsulationKeyPair.secretKey),\n    },\n    format: IDENTITY_KEY_PACKAGE_FORMAT,\n    ...(seedPhrase ? { seedPhrase } : {}),\n    signingFingerprint,\n    signingKeyPair: {\n      signingPrivateKey: bytesToBase64(input.signingKeyPair.signingPrivateKey),\n      signingPublicKey: bytesToBase64(input.signingKeyPair.signingPublicKey),\n    },\n    version: 1,\n  };\n}\n\nexport async function parseIdentityKeyPackage(\n  value: unknown,\n): Promise<ParsedIdentityKeyPackage> {\n  if (!isPlainObject(value)) {\n    throw new Error(\"Invalid identity key package: expected an object.\");\n  }\n\n  const format = readStringProperty(value, \"format\", \"format\");\n  if (format !== IDENTITY_KEY_PACKAGE_FORMAT) {\n    throw new Error(\"Invalid identity key package: unsupported format.\");\n  }\n\n  const version = Reflect.get(value, \"version\");\n  if (version !== 1) {\n    throw new Error(\"Invalid identity key package: unsupported version.\");\n  }\n\n  const signingFingerprint = readStringProperty(\n    value,\n    \"signingFingerprint\",\n    \"signing fingerprint\",\n  );\n  const signingKeyPair = readSigningKeyPair(\n    Reflect.get(value, \"signingKeyPair\"),\n  );\n  const computedSigningFingerprint = await toFingerprint(\n    signingKeyPair.signingPublicKey,\n  );\n  if (computedSigningFingerprint !== signingFingerprint) {\n    throw new Error(\n      \"Invalid identity key package: signing fingerprint does not match the public key.\",\n    );\n  }\n  assertSigningKeyPairMatches(signingKeyPair);\n\n  const encapsulationKeyPair = readEncapsulationKeyPair(\n    Reflect.get(value, \"encapsulationKeyPair\"),\n  );\n  await assertEncapsulationKeyPairMatches(encapsulationKeyPair);\n  const seedPhrase = readMatchingSeedPhrase({\n    encapsulationKeyPair,\n    seedPhrase: readOptionalStringProperty(value, \"seedPhrase\", \"seed phrase\"),\n    signingKeyPair,\n  });\n\n  return {\n    encapsulationKeyPair,\n    package: {\n      createdAt: readStringProperty(value, \"createdAt\", \"created at\"),\n      encapsulationKeyPair: {\n        publicKey: bytesToBase64(encapsulationKeyPair.publicKey),\n        secretKey: bytesToBase64(encapsulationKeyPair.secretKey),\n      },\n      format,\n      ...(seedPhrase ? { seedPhrase } : {}),\n      signingFingerprint,\n      signingKeyPair: {\n        signingPrivateKey: bytesToBase64(signingKeyPair.signingPrivateKey),\n        signingPublicKey: bytesToBase64(signingKeyPair.signingPublicKey),\n      },\n      version,\n    },\n    signingKeyPair,\n  };\n}\n"]}

package/client/index.d.ts

@@ -0,0 +1,30 @@
+export { createDomainScope, type DomainScope } from "../data/domainScope.js";
+export type { LocalProjectionReconciledDelta, LocalProjectionSnapshot, } from "../stores/local-projection/index.js";
+export { enqueueReconciliationForEvents, type ReconciliationService, } from "../sync/reconciliation/index.js";
+export { createUnavailableDirectCheckout, type DirectCheckoutAppearance, type DirectCheckoutCapability, type DirectCheckoutConfirmation, type DirectCheckoutSession, DirectCheckoutUnavailableError, } from "./billing/directCheckout.js";
+export { createRevenueCatPurchases, createUnavailablePurchases, PurchaseAbortedError, PurchaseAlreadyOwnedError, PurchaseCancelledError, PurchaseIdentityPendingError, PurchaseProviderStalledError, type PurchasesCapability, PurchasesUnavailableError, type RevenueCatBackend, type RevenueCatCustomerInfo, type RevenueCatPackage, type RevenueCatPurchasesConfig, type SyncPurchaseResult, type SyncSubscriptionOption, } from "./billing/purchases.js";
+export { type BlobStoreFactory, Blobs } from "./blobs.js";
+export type { BlobInfo, BlobInfoAttachmentKind, BlobInfoDocumentReference, BlobInfoInput, BlobInfoList, BlobInfoSort, BlobInfoSortDirection, BlobInfoSortKey, ContainerContents, ContainerContentsContextValue, ContainerContentsStore, ContainerContentsStoreOptions, ContainerDocumentLinkInput, ContainerDocumentLinks, ContainerDocumentObjectSyncState, ContainerDocumentObjectSyncStatus, ContainerDocumentQueries, ContainerDocumentSidebarRow, ContainerInfo, ContainerInfoInput, ContainerItemRow, ContainerItemSort, ContainerItemSortDirection, ContainerItemSortKey, ContainerNode, ContainerShareAccessLevel, DocumentAttributionRangesInput, DocumentAttributionRangesPage, DocumentInfo, DocumentInfoInput, LinkDocumentToContainerInput, MergeDocumentSummary, MoveDocumentToContainerInput, OpenContainerDocumentInput, PendingWriteQueueItem, PendingWriteQueueItemStatus, PendingWriteQueueObjectKind, PendingWriteQueueOperation, PendingWriteQueueOperationKind, PendingWriteQueueOperationStatus, PurgeDocumentInput, PurgeDocumentResult, SetActiveDocumentContainerInput, SetLinkedContainerIdsForDocument, UnlinkDocumentFromContainerInput, } from "./containerContents.js";
+export { createContainerDocumentObjectSyncState } from "./containerContents.js";
+export { Database, type DatabaseListener, type DatabaseOptions, type DatabaseSnapshot, type DatabaseStatus, } from "./database.js";
+export type { DeviceFirst, DeviceFirstContainerContents, LocalProjectionView, } from "./deviceFirst.js";
+export type { DocumentAttachmentStatus, DocumentAttachmentUpload, DocumentContextValue, DocumentList, DocumentSort, DocumentSortDirection, DocumentSortKey, DocumentStore, DocumentSubscriptionOptions, Documents, DocumentsRuntime, ListDocumentsInput, OpenDocumentInput, OpenDocumentOptions, PersistedDocumentListener, } from "./documents.js";
+export { DEFAULT_DOCUMENT_ID } from "./documents.js";
+export { Events, type EventsListener, type EventsSnapshot, } from "./events.js";
+export type { FileSaver, SaveFileRequest } from "./fileSaver.js";
+export type { Identity, IdentityGenerationResult, IdentityListener, IdentityOptions, IdentitySnapshot, } from "./identity.js";
+export { IDENTITY_KEY_PACKAGE_FORMAT, type IdentityKeyPackage, } from "./identityKeyPackage.js";
+export type { BrowserLocalKeyringOptions, IndexedDbLocalKeyringManifestStoreOptions, IndexedDbWrappingKeyKeystoreOptions, LocalKeyPurpose, LocalKeyring, LocalKeyringManifest, LocalKeyringManifestFormat, LocalKeyringManifestStorage, LocalKeyringManifestStore, LocalKeyringOptions, LocalKeyringScope, LocalKeyringSession, LocalSecretContext, LocalStorageLocalKeyringManifestStoreOptions, NormalizedLocalKeyringScope, UnwrapLocalSecretInput, WrapLocalSecretInput, WrappedLocalSecretEnvelope, WrappedLocalSecretFormat, WrappingKeyHandle, WrappingKeyKeystore, WrappingKeyMaterialStorage, } from "./localKeyring/index.js";
+export { createBrowserLocalKeyring, createBrowserLocalKeyringManifestStore, createIndexedDbLocalKeyringManifestStore, createIndexedDbWrappingKeyKeystore, createLocalKeyring, createLocalStorageLocalKeyringManifestStore, createMemoryLocalKeyringManifestStore, createMemoryWrappingKeyKeystore, createWebViewLocalKeyring, decodeLocalKeyringSqliteKey, encodeLocalKeyringSqliteKey, LOCAL_KEYRING_MANIFEST_FORMAT, localKeyringScopeKey, normalizeLocalKeyringScope, parseLocalKeyringManifest, serializeLocalKeyringManifest, WRAPPED_LOCAL_SECRET_FORMAT, } from "./localKeyring/index.js";
+export type { LocalKeyringPinCode, PinCodeBrowserLocalKeyringOptions, PinCodeWrappingKeyKeystoreOptions, } from "./localKeyring/localKeyringPinCode.js";
+export { createPinCodeBrowserLocalKeyring, createPinCodeWrappingKeyKeystore, isPinCodeWrappedLocalSecretEnvelope, } from "./localKeyring/localKeyringPinCode.js";
+export type { Logger } from "./logger.js";
+export { createBrowserNetworkStatusSource, Network, type NetworkListener, type NetworkMode, type NetworkStatusSource, } from "./network.js";
+export type { AddOrganizationGroupUserInput, ImportedOrganizationUser, LocalOrganizationSummary, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGrantRef, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationProfile, Organizations, OrganizationUserDetail, RemoveOrganizationGroupUserInput, } from "./organizations/index.js";
+export type { PrincipalHistoryKeyProvider, PrincipalHistoryKeyScope, } from "./principalHistoryProtection.js";
+export type { SecurityIncident, SecurityIncidentListener, SecurityIncidentObjectKind, SecurityIncidents, } from "./securityIncidents.js";
+export { PurgedOrganizationRecoveryBillingRequiredError } from "./session/sessionRecoveryErrors.js";
+export type { CreateOrganizationOptions, Session, SessionContext, SessionCreateOrganizationResult, SessionListener, SessionRecoverOrganizationResult, SessionRegistrationRefusal, SessionRegistrationResult, SessionSnapshot, UserSession, } from "./session/sessionTypes.js";
+export { SyncBillingGate, type SyncBillingGateListener, } from "./syncBillingGate.js";
+export { type ClientDatabaseOptions, type ClientOptions, Tearleads, } from "./Tearleads.js";
+export type { ResolvedUserIdentity, UserIdentities, } from "./userIdentities.js";