npm - @tearleads/client-sdk - Versions diffs - 0.1.11 → 0.1.13 - Mend

@tearleads/client-sdk 0.1.11 → 0.1.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (141) hide show

package/internal/crypto/index.d.ts CHANGED Viewed

@@ -20,7 +20,7 @@ export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, type IdentitySeedPhraseKeyPairs, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, type IncrementalSha256, } from "./incrementalSha256.js";
 export type { AccessEvent, AccessEventType, AccessManifest, AccessManifestCheckpoint, AccessManifestTransparencyLeaf, AccessObjectKind, AnyVerifiedAccessManifest, AnyVerifiedPrincipalPolicy, AttachmentAccessEventBody, AttachmentBindAccessEventBody, AttachmentDetachAccessEventBody, BlobAccessManifest, BlobContentKeyTarget, ContainerAccessEventBody, ContainerAccessKeyState, ContainerAccessLevel, ContainerAccessManifest, ContainerAccessManifestState, ContainerAccessStructural, ContainerCreateAccessEventBody, ContainerDirectGrant, ContainerGrantAccessEventBody, ContainerGrantPrincipalHead, ContainerGrantSubjectType, ContainerKekKeyring, ContainerKekKeyringEntry, ContainerKekPredecessorBridge, ContainerKekRecipientTarget, ContainerKekTarget, ContainerKeyEpoch, ContainerKeyWrap, ContainerMoveAccessEventBody, ContainerReciteAccessEventBody, ContainerRekeyAccessEventBody, ContainerRevokeAccessEventBody, ContainerUserRecipientKey, ContentObjectKind, ContentRecordEncryptionSuite, ContentRecordNonceDomain, DeriveBlobKekTargetsInput, DeriveContainerKekRecipientTargetsInput, DeriveDocumentKekTargetsInput, DocumentAccessEventBody, DocumentContentKeyTarget, DocumentContentRecordMetadataInput, DocumentLinkAccessEventBody, DocumentLinkSetManifestState, DocumentLinkSetStructural, DocumentPurgeAccessEventBody, DocumentUnlinkAccessEventBody, IdentityStateCheckpoint, IdentityStateHead, IdentityStateTransparencyLeaf, KekRecipientKind, KeyingCanonicalJson, KeyingHashDomain, KeyingLocalCheckpointStore, KeyingVerificationCode, KeyingVerificationResult, ManagedPrincipalKind, PrincipalHistoryIndexNode, PrincipalPolicyAuthorization, PrincipalPolicyBundle, PrincipalPolicyCheckpoint, PrincipalPolicyCurrent, PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, PrincipalPolicyHistoryInput, PrincipalPolicyHistoryPage, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryReferenceProof, PrincipalPolicyHistoryVerifier, PrincipalPolicyMemberEnvelopes, PrincipalPolicyPayload, PrincipalPolicySignedState, PrincipalPolicySignerPublicKey, PrincipalPolicySnapshot, PrincipalPolicyStateChainEntry, PrincipalPolicyTransitionMismatch, PrincipalPolicyTransitionMismatchCode, PrincipalPolicyTransparencyLeaf, ReferencedPrincipalHead, SignedTransparencyTreeHead, TransparencyConsistencyProof, TransparencyInclusionProof, TransparencyLeaf, TransparencyLeafKind, TransparencyTreeCheckpoint, UnsignedAccessEvent, UnsignedTransparencyTreeHead, UnsignedWriteHeader, VerifiedAccessEvent, VerifiedAccessManifest, VerifiedAccessManifestCheckpointEvidence, VerifiedAccessManifestSnapshot, VerifiedAttachmentBinding, VerifiedAttachmentDetach, VerifiedBlobKekTargets, VerifiedContainerAccessManifest, VerifiedContainerKekState, VerifiedContainerParentEdge, VerifiedDocumentKekTargets, VerifiedDocumentLinkSetManifest, VerifiedDocumentLinkSetSnapshot, VerifiedDocumentLinkSetStateEvidence, VerifiedIdentityState, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent, VerifiedPrincipalPolicyHistory, VerifiedPrincipalPolicySelection, VerifiedPrincipalPolicySnapshot, VerifiedTransparencyProof, VerifiedTransparencyTreeHead, VerifiedWriteHeader, VerifyAccessEventInput, VerifyAccessManifestInput, VerifyAttachmentBindingEventInput, VerifyAttachmentDetachEventInput, VerifyContainerAccessManifestInput, VerifyContainerKekStateInput, VerifyContainerParentEdgeInput, VerifyDocumentLinkSetManifestInput, VerifyDocumentPurgeEventInput, VerifyIdentityStateCheckpointInput, VerifyPrincipalPolicyBundleInput, VerifyPrincipalPolicySnapshotInput, VerifySignedTransparencyTreeHeadInput, VerifyTransparencyConsistencyProofInput, VerifyTransparencyInclusionProofInput, VerifyTransparencyProofInput, VerifyWriteHeaderInput, WriteHeader, } from "./keying.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, type VerifiedOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js CHANGED Viewed

@@ -14,7 +14,7 @@ export { decryptGroupMetadata, encodeBuiltinGroupMetadata, encryptGroupMetadata,
 export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, } from "./incrementalSha256.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n BlobEnvelopeHeaderRecord,\n BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n MAX_BLOB_ENVELOPE_HEADER_BYTES,\n parseBlobEnvelopeV2,\n parseBlobEnvelopeV2Header,\n readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n BLOB_CHUNK_SIZE_BYTES,\n BLOB_ENCRYPTED_BYTES_FORMAT,\n BLOB_ENCRYPTED_BYTES_VERSION,\n BLOB_ENVELOPE_MAGIC_BYTES,\n BLOB_ENVELOPE_PREFIX_BYTES,\n blobChunkPlaintextByteLength,\n computeBlobChunkCount,\n computeBlobEncryptedByteLength,\n deriveBlobChunkIv,\n encodeBlobEnvelopeV2Header,\n joinBlobPartBytes,\n MAX_BLOB_CHUNK_COUNT,\n normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n AUTH_CHALLENGE_BYTES,\n AUTH_CHALLENGE_HEX_LENGTH,\n authChallengeSigningBytes,\n CHALLENGE_TTL_SECONDS,\n canonicalAuthOrigin,\n generateChallenge,\n} from \"./challenge\";\nexport type {\n ContentKeyEnvelopeKind,\n ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n ContentKeyEnvelopeError,\n decodeContentKeyEnvelope,\n unwrapContentKey,\n wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n generateKemKeyPair,\n generateKemSeedAndKeyPair,\n ML_KEM1024_CIPHERTEXT_BYTES,\n ML_KEM1024_PUBLIC_KEY_BYTES,\n ML_KEM1024_SECRET_KEY_BYTES,\n ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n decryptGroupMetadata,\n encodeBuiltinGroupMetadata,\n encryptGroupMetadata,\n type GroupMetadata,\n type GroupMetadataKey,\n readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n createIdentitySeedPhrase,\n createIdentitySeedPhraseFromEntropy,\n generateIdentityKeyPairsFromSeedPhrase,\n IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n IDENTITY_SEED_PHRASE_WORDS,\n type IdentitySeedPhraseKeyPairs,\n normalizeIdentitySeedPhrase,\n validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n createIncrementalSha256,\n type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n AccessEvent,\n AccessEventType,\n AccessManifest,\n AccessManifestCheckpoint,\n AccessManifestTransparencyLeaf,\n AccessObjectKind,\n AnyVerifiedAccessManifest,\n AnyVerifiedPrincipalPolicy,\n AttachmentAccessEventBody,\n AttachmentBindAccessEventBody,\n AttachmentDetachAccessEventBody,\n BlobAccessManifest,\n BlobContentKeyTarget,\n ContainerAccessEventBody,\n ContainerAccessKeyState,\n ContainerAccessLevel,\n ContainerAccessManifest,\n ContainerAccessManifestState,\n ContainerAccessStructural,\n ContainerCreateAccessEventBody,\n ContainerDirectGrant,\n ContainerGrantAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerGrantSubjectType,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n ContainerKekRecipientTarget,\n ContainerKekTarget,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerReciteAccessEventBody,\n ContainerRekeyAccessEventBody,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n ContentObjectKind,\n ContentRecordEncryptionSuite,\n ContentRecordNonceDomain,\n DeriveBlobKekTargetsInput,\n DeriveContainerKekRecipientTargetsInput,\n DeriveDocumentKekTargetsInput,\n DocumentAccessEventBody,\n DocumentContentKeyTarget,\n DocumentContentRecordMetadataInput,\n DocumentLinkAccessEventBody,\n DocumentLinkSetManifestState,\n DocumentLinkSetStructural,\n DocumentPurgeAccessEventBody,\n DocumentUnlinkAccessEventBody,\n IdentityStateCheckpoint,\n IdentityStateHead,\n IdentityStateTransparencyLeaf,\n KekRecipientKind,\n KeyingCanonicalJson,\n KeyingHashDomain,\n KeyingLocalCheckpointStore,\n KeyingVerificationCode,\n KeyingVerificationResult,\n ManagedPrincipalKind,\n PrincipalHistoryIndexNode,\n PrincipalPolicyAuthorization,\n PrincipalPolicyBundle,\n PrincipalPolicyCheckpoint,\n PrincipalPolicyCurrent,\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryReferenceProof,\n PrincipalPolicyHistoryVerifier,\n PrincipalPolicyMemberEnvelopes,\n PrincipalPolicyPayload,\n PrincipalPolicySignedState,\n PrincipalPolicySignerPublicKey,\n PrincipalPolicySnapshot,\n PrincipalPolicyStateChainEntry,\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n PrincipalPolicyTransparencyLeaf,\n ReferencedPrincipalHead,\n SignedTransparencyTreeHead,\n TransparencyConsistencyProof,\n TransparencyInclusionProof,\n TransparencyLeaf,\n TransparencyLeafKind,\n TransparencyTreeCheckpoint,\n UnsignedAccessEvent,\n UnsignedTransparencyTreeHead,\n UnsignedWriteHeader,\n VerifiedAccessEvent,\n VerifiedAccessManifest,\n VerifiedAccessManifestCheckpointEvidence,\n VerifiedAccessManifestSnapshot,\n VerifiedAttachmentBinding,\n VerifiedAttachmentDetach,\n VerifiedBlobKekTargets,\n VerifiedContainerAccessManifest,\n VerifiedContainerKekState,\n VerifiedContainerParentEdge,\n VerifiedDocumentKekTargets,\n VerifiedDocumentLinkSetManifest,\n VerifiedDocumentLinkSetSnapshot,\n VerifiedDocumentLinkSetStateEvidence,\n VerifiedIdentityState,\n VerifiedPrincipalPolicy,\n VerifiedPrincipalPolicyCurrent,\n VerifiedPrincipalPolicyHistory,\n VerifiedPrincipalPolicySelection,\n VerifiedPrincipalPolicySnapshot,\n VerifiedTransparencyProof,\n VerifiedTransparencyTreeHead,\n VerifiedWriteHeader,\n VerifyAccessEventInput,\n VerifyAccessManifestInput,\n VerifyAttachmentBindingEventInput,\n VerifyAttachmentDetachEventInput,\n VerifyContainerAccessManifestInput,\n VerifyContainerKekStateInput,\n VerifyContainerParentEdgeInput,\n VerifyDocumentLinkSetManifestInput,\n VerifyDocumentPurgeEventInput,\n VerifyIdentityStateCheckpointInput,\n VerifyPrincipalPolicyBundleInput,\n VerifyPrincipalPolicySnapshotInput,\n VerifySignedTransparencyTreeHeadInput,\n VerifyTransparencyConsistencyProofInput,\n VerifyTransparencyInclusionProofInput,\n VerifyTransparencyProofInput,\n VerifyWriteHeaderInput,\n WriteHeader,\n} from \"./keying\";\nexport {\n ACCESS_MANIFEST_VERIFICATION_REVISION,\n accessManifestCheckpointFromManifest,\n accessManifestTransparencyLeaf,\n assertSealedContainerKekKeyringLength,\n BLOB_CONTENT_KEY_WRAP_SUITE,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n CONTAINER_KEK_KEYRING_SEAL_SUITE,\n CONTAINER_KEK_MATERIAL_ID_PREFIX,\n CONTAINER_KEK_PARENT_WRAP_SUITE,\n CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n CONTAINER_KEK_USER_WRAP_SUITE,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeAccessEventBodyHash,\n computeAccessEventHash,\n computeAccessManifestHash,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContainerAccessKeyTargetHash,\n computeContainerAccessStructuralHash,\n computeContainerDirectGrantRoot,\n computeContainerKekKeyringHash,\n computeContainerKekMaterialId,\n computeContainerKekPredecessorBridgeHash,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n computeContentRecordNonceDomainHash,\n computeDocumentContentKeyTargetHash,\n computeDocumentContentRecordCiphertextHash,\n computeDocumentContentRecordMetadataHash,\n computeDocumentContentRecordPlaintextHash,\n computeDocumentLinkSetGrantRoot,\n computeDocumentLinkSetKeyTargetHash,\n computeDocumentLinkSetStructuralHash,\n computeKeyingDomainHash,\n computeTransparencyLeafHash,\n computeTransparencyMerkleRoot,\n computeWriteHeaderHash,\n createContainerKekPredecessorBridge,\n createPrincipalHistoryIndexProof,\n createPrincipalPolicyHistoryVerifier,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n deriveBlobKekTargets,\n deriveContainerAccessManifest,\n deriveContainerKekRecipientTargets,\n deriveContainerKekWrappingPublicKey,\n deriveDocumentKekTargets,\n deriveDocumentLinkSetManifest,\n derivePrincipalRecipientKeyEpochId,\n documentContentRecordMetadata,\n expectedSealedContainerKekKeyringBytes,\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n identityStateTransparencyLeaf,\n isContainerKekMaterialId,\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n KeyingVerificationError,\n MAX_CONTAINER_KEY_EPOCH,\n MAX_CONTAINER_RECITATION_EPOCH,\n makeVerifiedAccessEvent,\n makeVerifiedBlobKekTargets,\n makeVerifiedContainerAccessManifest,\n makeVerifiedContainerKekState,\n makeVerifiedDocumentKekTargets,\n makeVerifiedDocumentLinkSetManifest,\n makeVerifiedDocumentLinkSetSnapshot,\n makeVerifiedPrincipalPolicy,\n normalizeAttachmentAccessEventBody,\n normalizeContainerAccessEventBody,\n normalizeContainerKekKeyring,\n normalizeContainerKekPredecessorBridge,\n normalizeDocumentAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n openContainerKekKeyring,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n principalPolicyMatchesReference,\n principalPolicyTransparencyLeaf,\n resolveContainerPathUserAccessLevel,\n resolveContainerStatePathUserAccessLevel,\n resolveHistoricalContainerPathUserAccessLevel,\n restorePrincipalPolicyHistoryVerifier,\n sealContainerKekKeyring,\n selectPrincipalPolicyAuthorization,\n serializeKeyingCanonicalJson,\n signAccessEvent,\n signTransparencyTreeHead,\n signWriteHeader,\n unwrapContainerKekParentWrap,\n unwrapContainerKekPredecessorBridge,\n verifyAccessManifest,\n verifyAccessManifestLocalCheckpoint,\n verifyAccessManifestSnapshot,\n verifyAttachmentBindingEvent,\n verifyAttachmentDetachEvent,\n verifyContainerAccessManifest,\n verifyContainerKekKeyringEntry,\n verifyContainerKekState,\n verifyContainerParentEdge,\n verifyDocumentLinkSetManifest,\n verifyDocumentLinkSetSnapshot,\n verifyDocumentPurgeEvent,\n verifyIdentityStateCheckpoint,\n verifyPrincipalPolicyBundle,\n verifyPrincipalPolicyBundleAgainstHistory,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n verifyPrincipalPolicyHistoryReferences,\n verifyPrincipalPolicySnapshot,\n verifySignedAccessEvent,\n verifySignedTransparencyTreeHead,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n verifyTransparencyProof,\n verifyWriteHeader,\n} from \"./keying\";\nexport {\n organizationReplacementAuthorizationPayload,\n organizationReplacementSigningBytes,\n signOrganizationReplacementAuthorization,\n type VerifiedOrganizationReplacementAuthorization,\n verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n computePrincipalContainerGrantRoot,\n normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n computePrincipalMemberEnvelopesRoot,\n normalizePrincipalStateMemberEnvelopes,\n PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n PrincipalPolicyValidationError,\n throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n ManagedRecipientPrincipalType,\n PrincipalContainerGrant,\n PrincipalContainerGrantAccessLevel,\n PrincipalProjectionMember,\n PrincipalProjectionRole,\n PrincipalStateExternalAuthority,\n PrincipalStateHeaderInput,\n PrincipalStateMember,\n PrincipalStateMemberEnvelope,\n PrincipalStateMembershipMode,\n PrincipalStatePayloadCipherSuite,\n PrincipalStateSigningInput,\n SignedPrincipalState,\n UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n buildPrincipalStateSigningInput,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStateHash,\n computePrincipalStatePayloadCiphertextHash,\n derivePrincipalProjectionMembers,\n isManagedRecipientPrincipalType,\n isPrincipalProjectionRole,\n normalizePrincipalProjectionMembers,\n normalizePrincipalStateMembers,\n serializeUnsignedPrincipalState,\n signPrincipalState,\n} from \"./principalState\";\nexport {\n verifySignedPrincipalState,\n verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n captureProjectionHistory,\n type HistoryProjection,\n omitProjectionHistory,\n type RetainedProjectionHistory,\n restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n generateSigningKeyPair,\n generateSigningSeedAndKeyPair,\n ML_DSA87_PUBLIC_KEY_BYTES,\n ML_DSA87_SECRET_KEY_BYTES,\n ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n AES_256_KEY_BYTES,\n AES_GCM_IV_BYTES,\n AES_GCM_TAG_BYTES,\n assertAesGcmIv,\n createAesGcmIv,\n decryptWithDek,\n encryptWithDek,\n} from \"./symmetric\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n BlobEnvelopeHeaderRecord,\n BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n MAX_BLOB_ENVELOPE_HEADER_BYTES,\n parseBlobEnvelopeV2,\n parseBlobEnvelopeV2Header,\n readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n BLOB_CHUNK_SIZE_BYTES,\n BLOB_ENCRYPTED_BYTES_FORMAT,\n BLOB_ENCRYPTED_BYTES_VERSION,\n BLOB_ENVELOPE_MAGIC_BYTES,\n BLOB_ENVELOPE_PREFIX_BYTES,\n blobChunkPlaintextByteLength,\n computeBlobChunkCount,\n computeBlobEncryptedByteLength,\n deriveBlobChunkIv,\n encodeBlobEnvelopeV2Header,\n joinBlobPartBytes,\n MAX_BLOB_CHUNK_COUNT,\n normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n AUTH_CHALLENGE_BYTES,\n AUTH_CHALLENGE_HEX_LENGTH,\n authChallengeSigningBytes,\n CHALLENGE_TTL_SECONDS,\n canonicalAuthOrigin,\n generateChallenge,\n} from \"./challenge\";\nexport type {\n ContentKeyEnvelopeKind,\n ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n ContentKeyEnvelopeError,\n decodeContentKeyEnvelope,\n unwrapContentKey,\n wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n generateKemKeyPair,\n generateKemSeedAndKeyPair,\n ML_KEM1024_CIPHERTEXT_BYTES,\n ML_KEM1024_PUBLIC_KEY_BYTES,\n ML_KEM1024_SECRET_KEY_BYTES,\n ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n decryptGroupMetadata,\n encodeBuiltinGroupMetadata,\n encryptGroupMetadata,\n type GroupMetadata,\n type GroupMetadataKey,\n readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n createIdentitySeedPhrase,\n createIdentitySeedPhraseFromEntropy,\n generateIdentityKeyPairsFromSeedPhrase,\n IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n IDENTITY_SEED_PHRASE_WORDS,\n type IdentitySeedPhraseKeyPairs,\n normalizeIdentitySeedPhrase,\n validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n createIncrementalSha256,\n type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n AccessEvent,\n AccessEventType,\n AccessManifest,\n AccessManifestCheckpoint,\n AccessManifestTransparencyLeaf,\n AccessObjectKind,\n AnyVerifiedAccessManifest,\n AnyVerifiedPrincipalPolicy,\n AttachmentAccessEventBody,\n AttachmentBindAccessEventBody,\n AttachmentDetachAccessEventBody,\n BlobAccessManifest,\n BlobContentKeyTarget,\n ContainerAccessEventBody,\n ContainerAccessKeyState,\n ContainerAccessLevel,\n ContainerAccessManifest,\n ContainerAccessManifestState,\n ContainerAccessStructural,\n ContainerCreateAccessEventBody,\n ContainerDirectGrant,\n ContainerGrantAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerGrantSubjectType,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n ContainerKekRecipientTarget,\n ContainerKekTarget,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerReciteAccessEventBody,\n ContainerRekeyAccessEventBody,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n ContentObjectKind,\n ContentRecordEncryptionSuite,\n ContentRecordNonceDomain,\n DeriveBlobKekTargetsInput,\n DeriveContainerKekRecipientTargetsInput,\n DeriveDocumentKekTargetsInput,\n DocumentAccessEventBody,\n DocumentContentKeyTarget,\n DocumentContentRecordMetadataInput,\n DocumentLinkAccessEventBody,\n DocumentLinkSetManifestState,\n DocumentLinkSetStructural,\n DocumentPurgeAccessEventBody,\n DocumentUnlinkAccessEventBody,\n IdentityStateCheckpoint,\n IdentityStateHead,\n IdentityStateTransparencyLeaf,\n KekRecipientKind,\n KeyingCanonicalJson,\n KeyingHashDomain,\n KeyingLocalCheckpointStore,\n KeyingVerificationCode,\n KeyingVerificationResult,\n ManagedPrincipalKind,\n PrincipalHistoryIndexNode,\n PrincipalPolicyAuthorization,\n PrincipalPolicyBundle,\n PrincipalPolicyCheckpoint,\n PrincipalPolicyCurrent,\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryReferenceProof,\n PrincipalPolicyHistoryVerifier,\n PrincipalPolicyMemberEnvelopes,\n PrincipalPolicyPayload,\n PrincipalPolicySignedState,\n PrincipalPolicySignerPublicKey,\n PrincipalPolicySnapshot,\n PrincipalPolicyStateChainEntry,\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n PrincipalPolicyTransparencyLeaf,\n ReferencedPrincipalHead,\n SignedTransparencyTreeHead,\n TransparencyConsistencyProof,\n TransparencyInclusionProof,\n TransparencyLeaf,\n TransparencyLeafKind,\n TransparencyTreeCheckpoint,\n UnsignedAccessEvent,\n UnsignedTransparencyTreeHead,\n UnsignedWriteHeader,\n VerifiedAccessEvent,\n VerifiedAccessManifest,\n VerifiedAccessManifestCheckpointEvidence,\n VerifiedAccessManifestSnapshot,\n VerifiedAttachmentBinding,\n VerifiedAttachmentDetach,\n VerifiedBlobKekTargets,\n VerifiedContainerAccessManifest,\n VerifiedContainerKekState,\n VerifiedContainerParentEdge,\n VerifiedDocumentKekTargets,\n VerifiedDocumentLinkSetManifest,\n VerifiedDocumentLinkSetSnapshot,\n VerifiedDocumentLinkSetStateEvidence,\n VerifiedIdentityState,\n VerifiedPrincipalPolicy,\n VerifiedPrincipalPolicyCurrent,\n VerifiedPrincipalPolicyHistory,\n VerifiedPrincipalPolicySelection,\n VerifiedPrincipalPolicySnapshot,\n VerifiedTransparencyProof,\n VerifiedTransparencyTreeHead,\n VerifiedWriteHeader,\n VerifyAccessEventInput,\n VerifyAccessManifestInput,\n VerifyAttachmentBindingEventInput,\n VerifyAttachmentDetachEventInput,\n VerifyContainerAccessManifestInput,\n VerifyContainerKekStateInput,\n VerifyContainerParentEdgeInput,\n VerifyDocumentLinkSetManifestInput,\n VerifyDocumentPurgeEventInput,\n VerifyIdentityStateCheckpointInput,\n VerifyPrincipalPolicyBundleInput,\n VerifyPrincipalPolicySnapshotInput,\n VerifySignedTransparencyTreeHeadInput,\n VerifyTransparencyConsistencyProofInput,\n VerifyTransparencyInclusionProofInput,\n VerifyTransparencyProofInput,\n VerifyWriteHeaderInput,\n WriteHeader,\n} from \"./keying\";\nexport {\n ACCESS_MANIFEST_VERIFICATION_REVISION,\n accessManifestCheckpointFromManifest,\n accessManifestTransparencyLeaf,\n assertSealedContainerKekKeyringLength,\n BLOB_CONTENT_KEY_WRAP_SUITE,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n CONTAINER_KEK_KEYRING_SEAL_SUITE,\n CONTAINER_KEK_MATERIAL_ID_PREFIX,\n CONTAINER_KEK_PARENT_WRAP_SUITE,\n CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n CONTAINER_KEK_USER_WRAP_SUITE,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeAccessEventBodyHash,\n computeAccessEventHash,\n computeAccessManifestHash,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContainerAccessKeyTargetHash,\n computeContainerAccessStructuralHash,\n computeContainerDirectGrantRoot,\n computeContainerKekKeyringHash,\n computeContainerKekMaterialId,\n computeContainerKekPredecessorBridgeHash,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n computeContentRecordNonceDomainHash,\n computeDocumentContentKeyTargetHash,\n computeDocumentContentRecordCiphertextHash,\n computeDocumentContentRecordMetadataHash,\n computeDocumentContentRecordPlaintextHash,\n computeDocumentLinkSetGrantRoot,\n computeDocumentLinkSetKeyTargetHash,\n computeDocumentLinkSetStructuralHash,\n computeKeyingDomainHash,\n computeTransparencyLeafHash,\n computeTransparencyMerkleRoot,\n computeWriteHeaderHash,\n createContainerKekPredecessorBridge,\n createPrincipalHistoryIndexProof,\n createPrincipalPolicyHistoryVerifier,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n deriveBlobKekTargets,\n deriveContainerAccessManifest,\n deriveContainerKekRecipientTargets,\n deriveContainerKekWrappingPublicKey,\n deriveDocumentKekTargets,\n deriveDocumentLinkSetManifest,\n derivePrincipalRecipientKeyEpochId,\n documentContentRecordMetadata,\n expectedSealedContainerKekKeyringBytes,\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n identityStateTransparencyLeaf,\n isContainerKekMaterialId,\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n KeyingVerificationError,\n MAX_CONTAINER_KEY_EPOCH,\n MAX_CONTAINER_RECITATION_EPOCH,\n makeVerifiedAccessEvent,\n makeVerifiedBlobKekTargets,\n makeVerifiedContainerAccessManifest,\n makeVerifiedContainerKekState,\n makeVerifiedDocumentKekTargets,\n makeVerifiedDocumentLinkSetManifest,\n makeVerifiedDocumentLinkSetSnapshot,\n makeVerifiedPrincipalPolicy,\n normalizeAttachmentAccessEventBody,\n normalizeContainerAccessEventBody,\n normalizeContainerKekKeyring,\n normalizeContainerKekPredecessorBridge,\n normalizeDocumentAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n openContainerKekKeyring,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n principalHistoryIndexLeaf,\n principalPolicyMatchesReference,\n principalPolicyTransparencyLeaf,\n resolveContainerPathUserAccessLevel,\n resolveContainerStatePathUserAccessLevel,\n resolveHistoricalContainerPathUserAccessLevel,\n resolvePrincipalHistoryIndexProof,\n restorePrincipalPolicyHistoryVerifier,\n sealContainerKekKeyring,\n selectPrincipalPolicyAuthorization,\n serializeKeyingCanonicalJson,\n signAccessEvent,\n signTransparencyTreeHead,\n signWriteHeader,\n unwrapContainerKekParentWrap,\n unwrapContainerKekPredecessorBridge,\n verifyAccessManifest,\n verifyAccessManifestLocalCheckpoint,\n verifyAccessManifestSnapshot,\n verifyAttachmentBindingEvent,\n verifyAttachmentDetachEvent,\n verifyContainerAccessManifest,\n verifyContainerKekKeyringEntry,\n verifyContainerKekState,\n verifyContainerParentEdge,\n verifyDocumentLinkSetManifest,\n verifyDocumentLinkSetSnapshot,\n verifyDocumentPurgeEvent,\n verifyIdentityStateCheckpoint,\n verifyPrincipalPolicyBundle,\n verifyPrincipalPolicyBundleAgainstHistory,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n verifyPrincipalPolicyHistoryReferences,\n verifyPrincipalPolicySnapshot,\n verifySignedAccessEvent,\n verifySignedTransparencyTreeHead,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n verifyTransparencyProof,\n verifyWriteHeader,\n} from \"./keying\";\nexport {\n organizationReplacementAuthorizationPayload,\n organizationReplacementSigningBytes,\n signOrganizationReplacementAuthorization,\n type VerifiedOrganizationReplacementAuthorization,\n verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n computePrincipalContainerGrantRoot,\n normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n computePrincipalMemberEnvelopesRoot,\n normalizePrincipalStateMemberEnvelopes,\n PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n PrincipalPolicyValidationError,\n throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n ManagedRecipientPrincipalType,\n PrincipalContainerGrant,\n PrincipalContainerGrantAccessLevel,\n PrincipalProjectionMember,\n PrincipalProjectionRole,\n PrincipalStateExternalAuthority,\n PrincipalStateHeaderInput,\n PrincipalStateMember,\n PrincipalStateMemberEnvelope,\n PrincipalStateMembershipMode,\n PrincipalStatePayloadCipherSuite,\n PrincipalStateSigningInput,\n SignedPrincipalState,\n UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n buildPrincipalStateSigningInput,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStateHash,\n computePrincipalStatePayloadCiphertextHash,\n derivePrincipalProjectionMembers,\n isManagedRecipientPrincipalType,\n isPrincipalProjectionRole,\n normalizePrincipalProjectionMembers,\n normalizePrincipalStateMembers,\n serializeUnsignedPrincipalState,\n signPrincipalState,\n} from \"./principalState\";\nexport {\n verifySignedPrincipalState,\n verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n captureProjectionHistory,\n type HistoryProjection,\n omitProjectionHistory,\n type RetainedProjectionHistory,\n restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n generateSigningKeyPair,\n generateSigningSeedAndKeyPair,\n ML_DSA87_PUBLIC_KEY_BYTES,\n ML_DSA87_SECRET_KEY_BYTES,\n ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n AES_256_KEY_BYTES,\n AES_GCM_IV_BYTES,\n AES_GCM_TAG_BYTES,\n assertAesGcmIv,\n createAesGcmIv,\n decryptWithDek,\n encryptWithDek,\n} from \"./symmetric\";\n"]}

package/internal/crypto/keying/index.d.ts CHANGED Viewed

@@ -18,7 +18,7 @@ export { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent, verif
 export type { PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, } from "./principalPolicyExternalAuthorityTypes.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
 export type { PrincipalHistoryIndexNode } from "./principalPolicyHistoryIndex.js";
-export { createPrincipalHistoryIndexProof } from "./principalPolicyHistoryIndex.js";
+export { createPrincipalHistoryIndexProof, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "./principalPolicyHistoryIndex.js";
 export { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from "./principalPolicyHistoryPage.js";
 export type { PrincipalPolicyHistoryReferenceProof } from "./principalPolicyHistoryReferences.js";
 export { verifyPrincipalPolicyHistoryReferences } from "./principalPolicyHistoryReferences.js";

package/internal/crypto/keying/index.js CHANGED Viewed

@@ -16,7 +16,7 @@ export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
-export { createPrincipalHistoryIndexProof } from "./principalPolicyHistoryIndex.js";
+export { createPrincipalHistoryIndexProof, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "./principalPolicyHistoryIndex.js";
 export { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from "./principalPolicyHistoryPage.js";
 export { verifyPrincipalPolicyHistoryReferences } from "./principalPolicyHistoryReferences.js";
 export { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from "./principalPolicyHistoryTypes.js";

package/internal/crypto/keying/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,~~EAAE~~,gCAAgC,~~EAAE~~,MAAM,+BAA+B,CAAC;~~AACjF~~,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n assertSealedContainerKekKeyringLength,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n computeContainerKekKeyringHash,\n expectedSealedContainerKekKeyringBytes,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n normalizeContainerKekPredecessorBridge,\n unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n deriveContainerKekWrappingPublicKey,\n unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n type DocumentPurgeAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n type VerifyDocumentPurgeEventInput,\n verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n type PrincipalPolicyCurrent,\n type VerifiedPrincipalPolicyCurrent,\n verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport type {\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n createPrincipalPolicyHistoryVerifier,\n restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport { createPrincipalHistoryIndexProof } from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryVerifier,\n VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n selectPrincipalPolicyAuthorization,\n type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n type VerifyTransparencyConsistencyProofInput,\n type VerifyTransparencyInclusionProofInput,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n computeTransparencyMerkleRoot,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n assertSealedContainerKekKeyringLength,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n computeContainerKekKeyringHash,\n expectedSealedContainerKekKeyringBytes,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n normalizeContainerKekPredecessorBridge,\n unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n deriveContainerKekWrappingPublicKey,\n unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n type DocumentPurgeAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n type VerifyDocumentPurgeEventInput,\n verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n type PrincipalPolicyCurrent,\n type VerifiedPrincipalPolicyCurrent,\n verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport type {\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n createPrincipalPolicyHistoryVerifier,\n restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n createPrincipalHistoryIndexProof,\n principalHistoryIndexLeaf,\n resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryVerifier,\n VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n selectPrincipalPolicyAuthorization,\n type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n type VerifyTransparencyConsistencyProofInput,\n type VerifyTransparencyInclusionProofInput,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n computeTransparencyMerkleRoot,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}

package/internal/crypto/keying/principalPolicyHistoryIndex.d.ts CHANGED Viewed

@@ -17,10 +17,14 @@ interface AppendedPrincipalHistoryIndex {
 }
 export declare function appendPrincipalHistoryIndex(previous: PrincipalHistoryIndexFrontier, states: readonly PrincipalPolicySignedState[]): Promise<AppendedPrincipalHistoryIndex>;
 /** Fetch at most one content-addressed node per level, never a history array. */
-export declare function createPrincipalHistoryIndexProof(input: {
+export declare function resolvePrincipalHistoryIndexProof(input: {
     readonly rootHash: string;
     readonly treeSize: number;
     readonly version: number;
     readonly readNode: (hash: string) => Promise<PrincipalHistoryIndexNode | null>;
-}): Promise<TransparencyInclusionProof>;
+}): Promise<{
+    readonly leafHash: string;
+    readonly proof: TransparencyInclusionProof;
+}>;
+export declare function createPrincipalHistoryIndexProof(input: Parameters<typeof resolvePrincipalHistoryIndexProof>[0]): Promise<TransparencyInclusionProof>;
 export {};

package/internal/crypto/keying/principalPolicyHistoryIndex.js CHANGED Viewed

@@ -63,7 +63,7 @@ export async function appendPrincipalHistoryIndex(previous, states) {
     return { frontier, rootHash, nodes: [...nodes.values()] };
 }
 /** Fetch at most one content-addressed node per level, never a history array. */
-export async function createPrincipalHistoryIndexProof(input) {
+export async function resolvePrincipalHistoryIndexProof(input) {
     const { treeSize, version } = input;
     if (!Number.isSafeInteger(treeSize) ||
         treeSize < 1 ||
@@ -97,10 +97,16 @@ export async function createPrincipalHistoryIndexProof(input) {
         }
     }
     return {
-        version: 1,
-        treeSize,
-        leafIndex: version - 1,
-        auditPath: siblings.reverse(),
+        leafHash: hash,
+        proof: {
+            version: 1,
+            treeSize,
+            leafIndex: version - 1,
+            auditPath: siblings.reverse(),
+        },
     };
 }
+export async function createPrincipalHistoryIndexProof(input) {
+    return (await resolvePrincipalHistoryIndexProof(input)).proof;
+}
 //# sourceMappingURL=principalPolicyHistoryIndex.js.map

package/internal/crypto/keying/principalPolicyHistoryIndex.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalPolicyHistoryIndex.js","sourceRoot":"","sources":["principalPolicyHistoryIndex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAe5B,MAAM,UAAU,sCAAsC,CACpD,KAAc,EACd,IAAY;IAEZ,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC;QACR,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,EAAE;QAEjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,SAAS,KAAK,CAAC;YACf,CAAC,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAErD,iBAAiB,CACf,eAAe,EACf,oDAAoD,CACrD,CAAC;QACJ,QAAQ,CAAC,IAAI,CACX,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,4BAA4B,CAAC,CACzE,CAAC;QACF,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,CAAC;QACjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAiC;IAEjC,OAAO,uBAAuB,CAAC,yCAAyC,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,QAAgB,EAChB,SAAiB,EACjB,KAA8C;IAE9C,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAuC,EACvC,KAA8C;IAE9C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI;YACf,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAuC,EACvC,MAA6C;IAE7C,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxB,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAOtD;IACC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACpC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC/B,QAAQ,GAAG,CAAC;QACZ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC;QACX,OAAO,GAAG,QAAQ;QAElB,iBAAiB,CACf,eAAe,EACf,iDAAiD,CAClD,CAAC;IACJ,IAAI,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAC7B,iBAAiB,CACf,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;QACJ,MAAM,IAAI,GAAG,cAAc,CACzB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC3B,UAAU,EACV,8BAA8B,CAC/B,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAC1B,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC7B,WAAW,EACX,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI;YACpC,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,CAAC;YACb,QAAQ,IAAI,KAAK,CAAC;YAClB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC;QACtB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import { computeKeyingDomainHash } from \"./canonical\";\nimport { readHashString, throwVerification } from \"./shared\";\nimport {\n computeTransparencyNodeHash,\n largestPowerOfTwoLessThan,\n} from \"./transparencyTree\";\nimport type {\n PrincipalPolicySignedState,\n TransparencyInclusionProof,\n} from \"./types\";\n\n/** Content-addressed, untrusted proof material; the verified root is authority. /\nexport interface PrincipalHistoryIndexNode {\n readonly hash: string;\n readonly leftHash: string;\n readonly rightHash: string;\n}\n\nexport type PrincipalHistoryIndexFrontier = readonly (string \| null)[];\n\nexport function normalizePrincipalHistoryIndexFrontier(\n value: unknown,\n size: number,\n): (string \| null)[] {\n if (\n !Number.isSafeInteger(size) \|\|\n size < 0 \|\|\n !Array.isArray(value) \|\|\n value.length > 53\n )\n throwVerification(\n \"invalid_shape\",\n \"invalid principal history index frontier\",\n );\n const frontier: (string \| null)[] = [];\n let remaining = size;\n for (const item of value) {\n if (\n remaining === 0 \|\|\n (remaining % 2 === 0 ? item !== null : item === null)\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier does not match its size\",\n );\n frontier.push(\n item === null\n ? null\n : readHashString({ hash: item }, \"hash\", \"principal history frontier\"),\n );\n remaining = Math.floor(remaining / 2);\n }\n if (remaining !== 0)\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier is incomplete\",\n );\n return frontier;\n}\n\nexport function principalHistoryIndexLeaf(\n state: PrincipalPolicySignedState,\n): Promise<string> {\n return computeKeyingDomainHash(\"tearleads.keying.principal-history-leaf\", {\n principalType: state.principalType,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n keyFingerprint: state.keyFingerprint,\n stateHash: state.stateHash,\n signature: state.signature,\n });\n}\n\nasync function join(\n leftHash: string,\n rightHash: string,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string> {\n const hash = await computeTransparencyNodeHash(leftHash, rightHash);\n nodes?.set(hash, { hash, leftHash, rightHash });\n return hash;\n}\n\nexport async function principalHistoryIndexRoot(\n frontier: PrincipalHistoryIndexFrontier,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string \| null> {\n let root: string \| null = null;\n for (const hash of frontier) {\n if (hash !== null)\n root = root === null ? hash : await join(hash, root, nodes);\n }\n return root;\n}\n\n/* Build privately; the caller publishes this only with an accepted page. /\ninterface AppendedPrincipalHistoryIndex {\n readonly frontier: PrincipalHistoryIndexFrontier;\n readonly rootHash: string \| null;\n readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\nexport async function appendPrincipalHistoryIndex(\n previous: PrincipalHistoryIndexFrontier,\n states: readonly PrincipalPolicySignedState[],\n): Promise<AppendedPrincipalHistoryIndex> {\n const frontier = [...previous];\n const nodes = new Map<string, PrincipalHistoryIndexNode>();\n for (const state of states) {\n let carry = await principalHistoryIndexLeaf(state);\n let height = 0;\n for (let left = frontier[height]; left; left = frontier[height]) {\n carry = await join(left, carry, nodes);\n frontier[height] = null;\n height += 1;\n }\n frontier[height] = carry;\n }\n const rootHash = await principalHistoryIndexRoot(frontier, nodes);\n return { frontier, rootHash, nodes: [...nodes.values()] };\n}\n\n/* Fetch at most one content-addressed node per level, never a history array. */\nexport async function createPrincipalHistoryIndexProof(input: {\n readonly rootHash: string;\n readonly treeSize: number;\n readonly version: number;\n readonly readNode: (\n hash: string,\n ) => Promise<PrincipalHistoryIndexNode \| null>;\n}): Promise<TransparencyInclusionProof> {\n const { treeSize, version } = input;\n if (\n !Number.isSafeInteger(treeSize) \|\|\n treeSize < 1 \|\|\n !Number.isSafeInteger(version) \|\|\n version < 1 \|\|\n version > treeSize\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history proof version is out of range\",\n );\n let hash = readHashString(input, \"rootHash\", \"principal history proof\");\n let size = treeSize;\n let position = version - 1;\n const siblings: string[] = [];\n while (size > 1) {\n const node = await input.readNode(hash);\n if (!node \|\| node.hash !== hash)\n throwVerification(\n \"missing_dependency\",\n \"principal history index node is missing\",\n );\n const left = readHashString(\n { leftHash: node.leftHash },\n \"leftHash\",\n \"principal history index node\",\n );\n const right = readHashString(\n { rightHash: node.rightHash },\n \"rightHash\",\n \"principal history index node\",\n );\n if ((await join(left, right)) !== hash)\n throwVerification(\n \"hash_mismatch\",\n \"principal history index node hash mismatch\",\n );\n const split = largestPowerOfTwoLessThan(size);\n if (position < split) {\n siblings.push(right);\n hash = left;\n size = split;\n } else {\n siblings.push(left);\n hash = right;\n position -= split;\n size -= split;\n }\n }\n return {\n version: 1,\n treeSize,\n leafIndex: version - 1,\n auditPath: siblings.reverse(),\n };\n}\n"]}
1	+ {"version":3,"file":"principalPolicyHistoryIndex.js","sourceRoot":"","sources":["principalPolicyHistoryIndex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAe5B,MAAM,UAAU,sCAAsC,CACpD,KAAc,EACd,IAAY;IAEZ,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC;QACR,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,EAAE;QAEjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,SAAS,KAAK,CAAC;YACf,CAAC,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAErD,iBAAiB,CACf,eAAe,EACf,oDAAoD,CACrD,CAAC;QACJ,QAAQ,CAAC,IAAI,CACX,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,4BAA4B,CAAC,CACzE,CAAC;QACF,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,CAAC;QACjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAiC;IAEjC,OAAO,uBAAuB,CAAC,yCAAyC,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,QAAgB,EAChB,SAAiB,EACjB,KAA8C;IAE9C,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAuC,EACvC,KAA8C;IAE9C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI;YACf,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAuC,EACvC,MAA6C;IAE7C,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxB,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAOvD;IAIC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACpC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC/B,QAAQ,GAAG,CAAC;QACZ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC;QACX,OAAO,GAAG,QAAQ;QAElB,iBAAiB,CACf,eAAe,EACf,iDAAiD,CAClD,CAAC;IACJ,IAAI,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAC7B,iBAAiB,CACf,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;QACJ,MAAM,IAAI,GAAG,cAAc,CACzB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC3B,UAAU,EACV,8BAA8B,CAC/B,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAC1B,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC7B,WAAW,EACX,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI;YACpC,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,CAAC;YACb,QAAQ,IAAI,KAAK,CAAC;YAClB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE;YACL,OAAO,EAAE,CAAC;YACV,QAAQ;YACR,SAAS,EAAE,OAAO,GAAG,CAAC;YACtB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA8D;IAE9D,OAAO,CAAC,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC","sourcesContent":["import { computeKeyingDomainHash } from \"./canonical\";\nimport { readHashString, throwVerification } from \"./shared\";\nimport {\n computeTransparencyNodeHash,\n largestPowerOfTwoLessThan,\n} from \"./transparencyTree\";\nimport type {\n PrincipalPolicySignedState,\n TransparencyInclusionProof,\n} from \"./types\";\n\n/** Content-addressed, untrusted proof material; the verified root is authority. /\nexport interface PrincipalHistoryIndexNode {\n readonly hash: string;\n readonly leftHash: string;\n readonly rightHash: string;\n}\n\nexport type PrincipalHistoryIndexFrontier = readonly (string \| null)[];\n\nexport function normalizePrincipalHistoryIndexFrontier(\n value: unknown,\n size: number,\n): (string \| null)[] {\n if (\n !Number.isSafeInteger(size) \|\|\n size < 0 \|\|\n !Array.isArray(value) \|\|\n value.length > 53\n )\n throwVerification(\n \"invalid_shape\",\n \"invalid principal history index frontier\",\n );\n const frontier: (string \| null)[] = [];\n let remaining = size;\n for (const item of value) {\n if (\n remaining === 0 \|\|\n (remaining % 2 === 0 ? item !== null : item === null)\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier does not match its size\",\n );\n frontier.push(\n item === null\n ? null\n : readHashString({ hash: item }, \"hash\", \"principal history frontier\"),\n );\n remaining = Math.floor(remaining / 2);\n }\n if (remaining !== 0)\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier is incomplete\",\n );\n return frontier;\n}\n\nexport function principalHistoryIndexLeaf(\n state: PrincipalPolicySignedState,\n): Promise<string> {\n return computeKeyingDomainHash(\"tearleads.keying.principal-history-leaf\", {\n principalType: state.principalType,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n keyFingerprint: state.keyFingerprint,\n stateHash: state.stateHash,\n signature: state.signature,\n });\n}\n\nasync function join(\n leftHash: string,\n rightHash: string,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string> {\n const hash = await computeTransparencyNodeHash(leftHash, rightHash);\n nodes?.set(hash, { hash, leftHash, rightHash });\n return hash;\n}\n\nexport async function principalHistoryIndexRoot(\n frontier: PrincipalHistoryIndexFrontier,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string \| null> {\n let root: string \| null = null;\n for (const hash of frontier) {\n if (hash !== null)\n root = root === null ? hash : await join(hash, root, nodes);\n }\n return root;\n}\n\n/* Build privately; the caller publishes this only with an accepted page. /\ninterface AppendedPrincipalHistoryIndex {\n readonly frontier: PrincipalHistoryIndexFrontier;\n readonly rootHash: string \| null;\n readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\nexport async function appendPrincipalHistoryIndex(\n previous: PrincipalHistoryIndexFrontier,\n states: readonly PrincipalPolicySignedState[],\n): Promise<AppendedPrincipalHistoryIndex> {\n const frontier = [...previous];\n const nodes = new Map<string, PrincipalHistoryIndexNode>();\n for (const state of states) {\n let carry = await principalHistoryIndexLeaf(state);\n let height = 0;\n for (let left = frontier[height]; left; left = frontier[height]) {\n carry = await join(left, carry, nodes);\n frontier[height] = null;\n height += 1;\n }\n frontier[height] = carry;\n }\n const rootHash = await principalHistoryIndexRoot(frontier, nodes);\n return { frontier, rootHash, nodes: [...nodes.values()] };\n}\n\n/* Fetch at most one content-addressed node per level, never a history array. */\nexport async function resolvePrincipalHistoryIndexProof(input: {\n readonly rootHash: string;\n readonly treeSize: number;\n readonly version: number;\n readonly readNode: (\n hash: string,\n ) => Promise<PrincipalHistoryIndexNode \| null>;\n}): Promise<{\n readonly leafHash: string;\n readonly proof: TransparencyInclusionProof;\n}> {\n const { treeSize, version } = input;\n if (\n !Number.isSafeInteger(treeSize) \|\|\n treeSize < 1 \|\|\n !Number.isSafeInteger(version) \|\|\n version < 1 \|\|\n version > treeSize\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history proof version is out of range\",\n );\n let hash = readHashString(input, \"rootHash\", \"principal history proof\");\n let size = treeSize;\n let position = version - 1;\n const siblings: string[] = [];\n while (size > 1) {\n const node = await input.readNode(hash);\n if (!node \|\| node.hash !== hash)\n throwVerification(\n \"missing_dependency\",\n \"principal history index node is missing\",\n );\n const left = readHashString(\n { leftHash: node.leftHash },\n \"leftHash\",\n \"principal history index node\",\n );\n const right = readHashString(\n { rightHash: node.rightHash },\n \"rightHash\",\n \"principal history index node\",\n );\n if ((await join(left, right)) !== hash)\n throwVerification(\n \"hash_mismatch\",\n \"principal history index node hash mismatch\",\n );\n const split = largestPowerOfTwoLessThan(size);\n if (position < split) {\n siblings.push(right);\n hash = left;\n size = split;\n } else {\n siblings.push(left);\n hash = right;\n position -= split;\n size -= split;\n }\n }\n return {\n leafHash: hash,\n proof: {\n version: 1,\n treeSize,\n leafIndex: version - 1,\n auditPath: siblings.reverse(),\n },\n };\n}\n\nexport async function createPrincipalHistoryIndexProof(\n input: Parameters<typeof resolvePrincipalHistoryIndexProof>[0],\n): Promise<TransparencyInclusionProof> {\n return (await resolvePrincipalHistoryIndexProof(input)).proof;\n}\n"]}

package/internal/crypto/keying/principalPolicyHistoryReferences.d.ts CHANGED Viewed

@@ -11,8 +11,10 @@ export interface PrincipalPolicyHistoryReferenceProof {
  * checked against the private root owned by a local verifier, never a peer's
  * claimed root. Each leaf commits to the exact signed entry already accepted.
  * Replaces the retained selection; the current entry is always included.
+ * A separate checkpoint proof preserves the full 128-citation selection budget.
  */
 export declare function verifyPrincipalPolicyHistoryReferences(input: {
     readonly history: VerifiedPrincipalPolicyHistory;
     readonly references: readonly PrincipalPolicyHistoryReferenceProof[];
+    readonly checkpointReference?: PrincipalPolicyHistoryReferenceProof | undefined;
 }): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>>;

package/internal/crypto/keying/principalPolicyHistoryReferences.js CHANGED Viewed

@@ -21,22 +21,39 @@ function assertProofBudget(references) {
  * checked against the private root owned by a local verifier, never a peer's
  * claimed root. Each leaf commits to the exact signed entry already accepted.
  * Replaces the retained selection; the current entry is always included.
+ * A separate checkpoint proof preserves the full 128-citation selection budget.
  */
 export function verifyPrincipalPolicyHistoryReferences(input) {
     return runVerifier(async () => {
         const history = ownVerifiedPrincipalPolicyHistory(input.history);
         const supplied = input.references;
+        const suppliedCheckpoint = input.checkpointReference;
         assertProofBudget(supplied);
+        if (suppliedCheckpoint !== undefined)
+            assertProofBudget([suppliedCheckpoint]);
         const references = structuredClone(supplied);
+        const checkpoint = structuredClone(suppliedCheckpoint);
         assertProofBudget(references);
-        normalizePrincipalHistoryInput({
+        const scope = {
             principalId: history.currentEntry.state.principalId,
             principalType: history.currentEntry.state.principalType,
+        };
+        normalizePrincipalHistoryInput({
+            ...scope,
             retainedReferences: references.map((item) => item.reference),
         });
+        const selected = [...references];
+        if (checkpoint !== undefined) {
+            assertProofBudget([checkpoint]);
+            normalizePrincipalHistoryInput({
+                ...scope,
+                retainedReferences: [checkpoint.reference],
+            });
+            selected.push(checkpoint);
+        }
         const entries = new Map();
         const treeSize = history.currentEntry.state.version;
-        for (const item of references) {
+        for (const item of selected) {
             const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);
             const proof = normalizeTransparencyInclusionProof(item.proof);
             if (!principalPolicyStateMatchesReference(entry.state, item.reference) ||

package/internal/crypto/keying/principalPolicyHistoryReferences.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalPolicyHistoryReferences.js","sourceRoot":"","sources":["principalPolicyHistoryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,GAEnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAe9B,SAAS,iBAAiB,CACxB,UAA2D;IAE3D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,MAAM,GAAG,kCAAkC;QAEtD,iBAAiB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAC1C,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACN,CAAC;AACH,CAAC;AAED~~;;;;;GAKG~~;AACH,MAAM,UAAU,sCAAsC,CAAC,~~KAGtD~~;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;QAClC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9B,~~8BAA8B~~,~~CAAC~~;~~YAC7B~~,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW;YACnD,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa;~~YACvD~~,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,~~UAAU~~,EAAE,CAAC;~~YAC9B~~,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,QAAQ;gBAC9B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC;gBAE3C,iBAAiB,CACf,iBAAiB,EACjB,4CAA4C,CAC7C,CAAC;YACJ,MAAM,2BAA2B,CAAC;gBAChC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;gBACtD,UAAU,EAAE;oBACV,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,OAAO,CAAC,aAAa;oBAC/B,QAAQ;iBACT;gBACD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,kCAAkC,CAAC;YACxC,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalHistoryIndexLeaf } from \"./principalPolicyHistoryIndex\";\nimport {\n makeVerifiedPrincipalPolicyHistory,\n ownVerifiedPrincipalPolicyHistory,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport {\n assertTransparencyInclusion,\n normalizeTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nimport type {\n KeyingVerificationResult,\n PrincipalPolicyStateChainEntry,\n ReferencedPrincipalHead,\n TransparencyInclusionProof,\n} from \"./types\";\n\n/** Untrusted material to select an entry from a locally verified prefix. /\nexport interface PrincipalPolicyHistoryReferenceProof {\n readonly reference: ReferencedPrincipalHead;\n readonly entry: PrincipalPolicyStateChainEntry;\n readonly proof: TransparencyInclusionProof;\n}\n\nfunction assertProofBudget(\n references: readonly PrincipalPolicyHistoryReferenceProof[],\n): void {\n if (\n !Array.isArray(references) \|\|\n references.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n )\n throwVerification(\"invalid_shape\", \"too many principal history proofs\");\n const count = references.length;\n for (let index = 0; index < count; index += 1) {\n const path = references[index]?.proof.auditPath;\n if (!Array.isArray(path) \|\| path.length > 53)\n throwVerification(\n \"invalid_shape\",\n \"principal history proof exceeds its budget\",\n );\n }\n}\n\n/\n Select new retained references without replaying signatures. Inclusion is\n * checked against the private root owned by a local verifier, never a peer's\n * claimed root. Each leaf commits to the exact signed entry already accepted.\n * Replaces the retained selection; the current entry is always included.\n */\nexport function verifyPrincipalPolicyHistoryReferences(input: {\n readonly history: VerifiedPrincipalPolicyHistory;\n readonly references: readonly PrincipalPolicyHistoryReferenceProof[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>> {\n return runVerifier(async () => {\n const history = ownVerifiedPrincipalPolicyHistory(input.history);\n const supplied = input.references;\n assertProofBudget(supplied);\n const references = structuredClone(supplied);\n assertProofBudget(references);\n ~~normalizePrincipalHistoryInput(~~{\n principalId: history.currentEntry.state.principalId,\n principalType: history.currentEntry.state.principalType,\n retainedReferences: references.map((item) => item.reference),\n });\n const entries = new Map<number, PrincipalPolicyStateChainEntry>();\n const treeSize = history.currentEntry.state.version;\n for (const item of ~~references~~) {\n const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);\n const proof = normalizeTransparencyInclusionProof(item.proof);\n if (\n !principalPolicyStateMatchesReference(entry.state, item.reference) \|\|\n entry.state.version > treeSize \|\|\n proof.leafIndex !== entry.state.version - 1\n )\n throwVerification(\n \"object_mismatch\",\n \"principal history proof reference mismatch\",\n );\n await assertTransparencyInclusion({\n leafHash: await principalHistoryIndexLeaf(entry.state),\n checkpoint: {\n logId: \"principal-history\",\n rootHash: history.indexRootHash,\n treeSize,\n },\n proof,\n });\n entries.set(entry.state.version, entry);\n }\n entries.set(treeSize, history.currentEntry);\n return makeVerifiedPrincipalPolicyHistory({\n ...history,\n retainedEntries: [...entries.values()].sort(\n (left, right) => left.state.version - right.state.version,\n ),\n });\n });\n}\n"]}
1	+ {"version":3,"file":"principalPolicyHistoryReferences.js","sourceRoot":"","sources":["principalPolicyHistoryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,GAEnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAe9B,SAAS,iBAAiB,CACxB,UAA2D;IAE3D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,MAAM,GAAG,kCAAkC;QAEtD,iBAAiB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAC1C,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;QAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,kBAAkB,KAAK,SAAS;YAClC,iBAAiB,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACvD,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG;YACZ,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW;YACnD,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa;SACxD,CAAC;QACF,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,iBAAiB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAChC,8BAA8B,CAAC;gBAC7B,GAAG,KAAK;gBACR,kBAAkB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;aAC3C,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,QAAQ;gBAC9B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC;gBAE3C,iBAAiB,CACf,iBAAiB,EACjB,4CAA4C,CAC7C,CAAC;YACJ,MAAM,2BAA2B,CAAC;gBAChC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;gBACtD,UAAU,EAAE;oBACV,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,OAAO,CAAC,aAAa;oBAC/B,QAAQ;iBACT;gBACD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,kCAAkC,CAAC;YACxC,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalHistoryIndexLeaf } from \"./principalPolicyHistoryIndex\";\nimport {\n makeVerifiedPrincipalPolicyHistory,\n ownVerifiedPrincipalPolicyHistory,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport {\n assertTransparencyInclusion,\n normalizeTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nimport type {\n KeyingVerificationResult,\n PrincipalPolicyStateChainEntry,\n ReferencedPrincipalHead,\n TransparencyInclusionProof,\n} from \"./types\";\n\n/** Untrusted material to select an entry from a locally verified prefix. /\nexport interface PrincipalPolicyHistoryReferenceProof {\n readonly reference: ReferencedPrincipalHead;\n readonly entry: PrincipalPolicyStateChainEntry;\n readonly proof: TransparencyInclusionProof;\n}\n\nfunction assertProofBudget(\n references: readonly PrincipalPolicyHistoryReferenceProof[],\n): void {\n if (\n !Array.isArray(references) \|\|\n references.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n )\n throwVerification(\"invalid_shape\", \"too many principal history proofs\");\n const count = references.length;\n for (let index = 0; index < count; index += 1) {\n const path = references[index]?.proof.auditPath;\n if (!Array.isArray(path) \|\| path.length > 53)\n throwVerification(\n \"invalid_shape\",\n \"principal history proof exceeds its budget\",\n );\n }\n}\n\n/\n Select new retained references without replaying signatures. Inclusion is\n * checked against the private root owned by a local verifier, never a peer's\n * claimed root. Each leaf commits to the exact signed entry already accepted.\n * Replaces the retained selection; the current entry is always included.\n * A separate checkpoint proof preserves the full 128-citation selection budget.\n */\nexport function verifyPrincipalPolicyHistoryReferences(input: {\n readonly history: VerifiedPrincipalPolicyHistory;\n readonly references: readonly PrincipalPolicyHistoryReferenceProof[];\n readonly checkpointReference?:\n \| PrincipalPolicyHistoryReferenceProof\n \| undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>> {\n return runVerifier(async () => {\n const history = ownVerifiedPrincipalPolicyHistory(input.history);\n const supplied = input.references;\n const suppliedCheckpoint = input.checkpointReference;\n assertProofBudget(supplied);\n if (suppliedCheckpoint !== undefined)\n assertProofBudget([suppliedCheckpoint]);\n const references = structuredClone(supplied);\n const checkpoint = structuredClone(suppliedCheckpoint);\n assertProofBudget(references);\n const scope = {\n principalId: history.currentEntry.state.principalId,\n principalType: history.currentEntry.state.principalType,\n };\n normalizePrincipalHistoryInput({\n ...scope,\n retainedReferences: references.map((item) => item.reference),\n });\n const selected = [...references];\n if (checkpoint !== undefined) {\n assertProofBudget([checkpoint]);\n normalizePrincipalHistoryInput({\n ...scope,\n retainedReferences: [checkpoint.reference],\n });\n selected.push(checkpoint);\n }\n const entries = new Map<number, PrincipalPolicyStateChainEntry>();\n const treeSize = history.currentEntry.state.version;\n for (const item of selected) {\n const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);\n const proof = normalizeTransparencyInclusionProof(item.proof);\n if (\n !principalPolicyStateMatchesReference(entry.state, item.reference) \|\|\n entry.state.version > treeSize \|\|\n proof.leafIndex !== entry.state.version - 1\n )\n throwVerification(\n \"object_mismatch\",\n \"principal history proof reference mismatch\",\n );\n await assertTransparencyInclusion({\n leafHash: await principalHistoryIndexLeaf(entry.state),\n checkpoint: {\n logId: \"principal-history\",\n rootHash: history.indexRootHash,\n treeSize,\n },\n proof,\n });\n entries.set(entry.state.version, entry);\n }\n entries.set(treeSize, history.currentEntry);\n return makeVerifiedPrincipalPolicyHistory({\n ...history,\n retainedEntries: [...entries.values()].sort(\n (left, right) => left.state.version - right.state.version,\n ),\n });\n });\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/containers/child/create.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GAEpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,4CAA4C,CAAC;AASpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAClD,yBAAyB,CAC1B;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;gBAC9B,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB;gBAC5D,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBACpE,KAAK,EAAE,WAAW;gBAClB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerCreateAccessEventBody,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n type VerifiedPrincipalPolicy,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n buildParentRecipientTargets,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n asContainerManifestBundle,\n getParentCreateContext,\n readContainerState,\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToParent,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n BuildContainerCreatePlanInput,\n ContainerCreatePlan,\n ContainerCreatePlanContext,\n ContainerMutationAuthor,\n CreateRemoteContainerResult,\n MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n nullOnProjectionVerificationCancellation,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport {\n type ContainerCreateRepairState,\n type RemoteContainerCreateInput,\n repairContainerCreateFailure,\n submitRemoteContainerCreate,\n} from \"./createSubmission\";\nimport { containerMutationRequestCore } from \"./mutationRequestCore\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\n\nfunction assertContainerCreatePlanInput(input: {\n containerKey: Uint8Array;\n}): void {\n if (input.containerKey.byteLength !== 32) {\n throw new Error(\"Container KEK material must be 32 bytes\");\n }\n // The child container's organization is derived from the parent projection\n // (see buildContainerCreatePlan), so it always matches the parent by\n // construction — a member writing under another org's shared root is the\n // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse;\n parentProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly VerifiedPrincipalPolicy[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"create\", {\n ...input,\n userRecipientKeys: [],\n }),\n previousManifest: null,\n parentContainerPath: input.parentProjection.path.map(\n asContainerManifestBundle,\n ),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecord(\n input.parentKek,\n \"Container create parent KEK state\",\n ),\n };\n}\n\nasync function resolveContainerCreatePlanContext(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n assertContainerCreatePlanInput(input);\n assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n const containerId = input.containerId ?? crypto.randomUUID();\n\n return {\n ...input,\n containerId,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: await resolveContainerKekEpochId({\n containerId,\n keyEpoch: 1,\n keyMaterial: input.containerKey,\n override: input.containerKeyEpochId,\n }),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parent: getParentCreateContext(input.parentProjection),\n signedAt: input.signedAt ?? new Date().toISOString(),\n };\n}\n\nfunction buildChildContainerCreateBody(\n context: ContainerCreatePlanContext,\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: context.systemSlot ?? null,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId: context.parentProjection.containerId,\n parentManifestHash: context.parent.manifest.manifestHash,\n });\n if (!managedGrant) {\n return baseBody;\n }\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: managedGrant.accessLevel,\n subjectId: managedGrant.principalHead.principalId,\n subjectType: managedGrant.principalHead.principalType,\n },\n ],\n referencedPrincipalHeads: [managedGrant.principalHead],\n };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n context: ContainerCreatePlanContext;\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n manifestHash: string;\n}): Promise<{\n recipientTargets: ContainerKekRecipientTarget[];\n wraps: ContainerKeyWrap[];\n}> {\n const { context, managedGrant, manifestHash } = input;\n const parentPublicKey = readContainerState(\n context.parent.manifest,\n ).containerKeyPublicKey;\n if (!parentPublicKey)\n throw new Error(\"Container parent wrapping public key is missing\");\n const parentWrap = await wrapContainerKeyToParent({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n parentKek: context.parent.kek,\n parentPublicKey,\n });\n const parentTargets = buildParentRecipientTargets(context.parent.kek);\n if (!managedGrant) {\n return { recipientTargets: parentTargets, wraps: [parentWrap] };\n }\n const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n principalEncapsulationPublicKey:\n managedGrant.principalEncapsulationPublicKey,\n principalHead: managedGrant.principalHead,\n });\n return {\n recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n wraps: [parentWrap, managedRecipient.wrap],\n };\n}\n\nexport async function buildContainerCreatePlan(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n const context = await resolveContainerCreatePlanContext(input);\n const parentContainerId = context.parentProjection.containerId;\n const parentManifestHash = context.parent.manifest.manifestHash;\n const managedGrant = input.managedPrincipalGrant;\n const body = buildChildContainerCreateBody(context, managedGrant);\n // The new container belongs to the parent's organization, not the author's.\n // A member writing under another org's shared root mints a container owned by\n // that org; the author only supplies the signer identity.\n const organizationId = context.parentProjection.organizationId;\n const { event, eventHash } = await signContainerCreateEvent({\n author: context.author,\n body,\n containerId: context.containerId,\n eventId: context.eventId,\n organizationId,\n parentPath: context.parentProjection.path,\n signedAt: context.signedAt,\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: context.systemSlot ?? null,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n directGrants: body.directGrants,\n eventHash,\n metadataDocumentId: context.metadataDocumentId,\n organizationId,\n parentContainerId,\n parentManifestHash,\n referencedPrincipalHeads: body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n });\n const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n context,\n managedGrant,\n manifestHash,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n return {\n body,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId,\n parentManifestHash,\n recipientTargets,\n request: buildContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n parentKek: context.parent.kek,\n parentProjection: context.parentProjection,\n principalPolicies: context.principalPolicies ?? [],\n wraps,\n }),\n state,\n wraps,\n };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n input: {\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql?: ExecSql \| undefined;\n managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n metadataDocumentId?: string \| undefined;\n systemSlot?: string \| null \| undefined;\n parentProjection: ContainerWriterProjectionResponse;\n parentSecretKey: Uint8Array;\n signedAt?: string \| undefined;\n // Fetches the parent path's referenced principal policies on demand when\n // they are not cached locally — lets a member create under another org's\n // shared root without having first hydrated that org's group policy.\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n const containerKey =\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n const parentKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.parentProjection,\n secretKey: input.parentSecretKey,\n ...projectionVerificationOptions(input),\n });\n const parent = getParentCreateContext(input.parentProjection);\n requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n // Checked on the path verification just accepted, never on the raw response.\n assertContainerChildPathFits(input.parentProjection.path);\n const principalPolicies = input.resolveProjectionUserKey\n ? await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.parentProjection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n })\n : [];\n if (input.resolveProjectionUserKey) {\n assertContainerAuthorAccess({\n author: {\n ...input.author,\n organizationId: input.parentProjection.organizationId,\n },\n projection: input.parentProjection,\n principalPolicies,\n minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n });\n }\n const plan = await buildContainerCreatePlan({\n author: input.author,\n containerId: input.containerId,\n containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n eventId: input.eventId,\n managedPrincipalGrant: input.managedPrincipalGrant,\n metadataDocumentId: input.metadataDocumentId,\n systemSlot: input.systemSlot,\n parentProjection: input.parentProjection,\n principalPolicies,\n signedAt: input.signedAt,\n });\n\n return {\n containerKey,\n plan,\n };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n readonly containerId: string;\n readonly containerKey: Uint8Array;\n readonly eventId: string;\n readonly metadataDocumentId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly request: RemoteContainerCreateInput;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly signedAt: string;\n}): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n let parentProjection = input.parentProjection;\n const repairState: ContainerCreateRepairState = {\n didRepairStaleParent: false,\n policyRepairs: new PrincipalPolicyRepairBudget(),\n };\n for (;;) {\n const materializedPlan = await buildMaterializedContainerCreatePlan({\n author: input.request.author,\n containerId: input.containerId,\n containerKey: input.containerKey,\n containerKeyEpochId: input.request.containerKeyEpochId,\n eventId: input.eventId,\n execSql: input.request.execSql,\n metadataDocumentId: input.metadataDocumentId,\n parentProjection,\n parentSecretKey: input.request.parentSecretKey,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.request.stillCurrent,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n });\n const submitted = await submitRemoteContainerCreate({\n apiClient: input.request.apiClient,\n plan: materializedPlan.plan,\n stillCurrent: input.request.stillCurrent,\n });\n if (!submitted) return null;\n if (!submitted.ok) {\n const repair = await repairContainerCreateFailure({\n apiClient: input.request.apiClient,\n execSql: input.request.execSql,\n failure: submitted,\n parentContainerId: input.request.parentContainerId,\n parentProjection,\n reportSecurityIncident: input.request.reportSecurityIncident,\n resolveTrustedUserIdentity: input.request.resolveTrustedUserIdentity,\n state: repairState,\n stillCurrent: input.request.stillCurrent,\n });\n if (repair.kind === \"retry\") {\n parentProjection = repair.parentProjection;\n continue;\n }\n if (repair.kind === \"unavailable\") {\n return null;\n }\n submitted.report();\n return null;\n }\n const acknowledged = await acknowledgeContainerMutation({\n execSql: input.request.execSql,\n plan: materializedPlan.plan,\n response: submitted.response,\n stillCurrent: input.request.stillCurrent,\n });\n return {\n acknowledged,\n result: {\n containerKey: materializedPlan.containerKey,\n containerId: submitted.response.containerId,\n metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n plan: materializedPlan.plan,\n response: submitted.response,\n },\n };\n }\n}\n\nasync function createRemoteContainerOutcome(\n input: RemoteContainerCreateInput,\n): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container create\",\n );\n const parentProjection =\n input.parentProjection ??\n (await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n ));\n if (!parentProjection) {\n return null;\n }\n return nullOnProjectionVerificationCancellation(() =>\n createRemoteContainerWithRepairs({\n containerId: input.containerId ?? crypto.randomUUID(),\n containerKey:\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parentProjection,\n request: input,\n resolveProjectionUserKey,\n signedAt: input.signedAt ?? new Date().toISOString(),\n }),\n );\n}\n\nexport async function createRemoteContainer(\n input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult \| null> {\n const outcome = await createRemoteContainerOutcome(input);\n return outcome?.acknowledged && input.stillCurrent?.() !== false\n ? outcome.result\n : null;\n}\n"]}
1	+ {"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,GACpC,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,kCAAkC,EAClC,wBAAwB,GACzB,MAAM,4CAA4C,CAAC;AASpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qDAAqD,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAEL,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EACL,iDAAiD,EACjD,wCAAwC,EACxC,gCAAgC,GACjC,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAGL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,SAAS,8BAA8B,CAAC,KAEvC;IACC,IAAI,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;AAC/E,CAAC;AAED,SAAS,2BAA2B,CAAC,KAUpC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,QAAQ,EAAE;YACxC,GAAG,KAAK;YACR,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAClD,yBAAyB,CAC1B;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,mBAAmB,CACjC,KAAK,CAAC,SAAS,EACf,mCAAmC,CACpC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,KAAoC;IAEpC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACtC,6BAA6B,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAE7D,OAAO;QACL,GAAG,KAAK;QACR,WAAW;QACX,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;SAChC,CAAC;QACF,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;YACpD,WAAW;YACX,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,OAAmC,EACnC,YAAoE;IAEpE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,CAAC,WAAW;QACvD,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;KACzD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,SAAS,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW;gBACjD,WAAW,EAAE,YAAY,CAAC,aAAa,CAAC,aAAa;aACtD;SACF;QACD,wBAAwB,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+DAA+D;AAC/D,KAAK,UAAU,kCAAkC,CAAC,KAIjD;IAIC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CACxB,CAAC,qBAAqB,CAAC;IACxB,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC;QAChE,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B;QAC9C,aAAa,EAAE,YAAY,CAAC,aAAa;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,eAAe,CAAC;QACtE,KAAK,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;IAC/D,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACjD,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClE,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI;QACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc;QACd,iBAAiB;QACjB,kBAAkB;QAClB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;KACxD,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB;KAClE,CAAC,CAAC;IACH,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,kCAAkC,CAAC;QAC3E,OAAO;QACP,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,OAAO,EAAE,2BAA2B,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;YAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,KAmBiC;IAEjC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;QAClC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,GAAG,6BAA6B,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,mBAAmB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzE,6EAA6E;IAC7E,4BAA4B,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,KAAK,CAAC,wBAAwB;QACtD,CAAC,CAAC,MAAM,iDAAiD,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;SACvE,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,2BAA2B,CAAC;YAC1B,MAAM,EAAE;gBACN,GAAG,KAAK,CAAC,MAAM;gBACf,cAAc,EAAE,KAAK,CAAC,gBAAgB,CAAC,cAAc;aACtD;YACD,UAAU,EAAE,KAAK,CAAC,gBAAgB;YAClC,iBAAiB;YACjB,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACpD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,IAAI;KACL,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,4CAA4C,EAAE,MAAM,oBAAoB,CAAC;AAElF,KAAK,UAAU,gCAAgC,CAAC,KAS/C;IAIC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAA+B;QAC9C,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,MAAM,oCAAoC,CAAC;YAClE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;YACxC,+BAA+B,EAC7B,KAAK,CAAC,OAAO,CAAC,+BAA+B;SAChD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;YAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;gBAC9B,OAAO,EAAE,SAAS;gBAClB,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;gBAClD,gBAAgB;gBAChB,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB;gBAC5D,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;gBACpE,KAAK,EAAE,WAAW;gBAClB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;aACzC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAC3C,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;SACzC,CAAC,CAAC;QACH,OAAO;YACL,YAAY;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAC3C,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,CAAC,kBAAkB;gBAC5D,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,KAAiC;IAKjC,MAAM,wBAAwB,GAAG,gCAAgC,CAC/D,KAAK,CAAC,wBAAwB,EAC9B,yBAAyB,CAC1B,CAAC;IACF,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,4BAA4B,CACjD,KAAK,CAAC,iBAAiB,CACxB,CAAC,CAAC;IACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,gCAAgC,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE;QACrD,YAAY,EACV,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,UAAU,EAAE;QACnE,gBAAgB;QAChB,OAAO,EAAE,KAAK;QACd,wBAAwB;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,OAAO,EAAE,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAC9D,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerCreateAccessEventBody,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n} from \"@tearleads/crypto\";\nimport type { ContainerMutationRequest } from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { assertContainerAuthorAccess } from \"../../../data/containers/shared/authorAccess\";\nimport { assertContainerChildPathFits } from \"../../../data/containers/shared/containerPathLimits\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n buildParentRecipientTargets,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport { acknowledgeContainerMutation } from \"../../../data/containers/shared/mutationAcknowledgement\";\nimport {\n asContainerManifestBundle,\n getParentCreateContext,\n readContainerState,\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToParent,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n BuildContainerCreatePlanInput,\n ContainerCreatePlan,\n ContainerCreatePlanContext,\n ContainerMutationAuthor,\n CreateRemoteContainerResult,\n MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport { assertContainerKekPathCurrent } from \"../../../data/documents/shared/containerKekCurrency\";\nimport { unwrapContainerKekPath } from \"../../../data/documents/shared/projection\";\nimport {\n type ProjectionVerificationOptions,\n projectionVerificationOptions,\n} from \"../../../data/documents/shared/types\";\nimport { readCanonicalRecord } from \"../../../data/keyingCanonicalJson\";\nimport type {\n ProjectionUserKeyResolver,\n ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n nullOnProjectionVerificationCancellation,\n requireProjectionUserKeyResolver,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport { PrincipalPolicyRepairBudget } from \"../../principals/policyRepairBudget\";\nimport {\n type ContainerCreateRepairState,\n type RemoteContainerCreateInput,\n repairContainerCreateFailure,\n submitRemoteContainerCreate,\n} from \"./createSubmission\";\nimport { containerMutationRequestCore } from \"./mutationRequestCore\";\nimport { requireUnwrappedKek } from \"./rotationContext\";\n\nfunction assertContainerCreatePlanInput(input: {\n containerKey: Uint8Array;\n}): void {\n if (input.containerKey.byteLength !== 32) {\n throw new Error(\"Container KEK material must be 32 bytes\");\n }\n // The child container's organization is derived from the parent projection\n // (see buildContainerCreatePlan), so it always matches the parent by\n // construction — a member writing under another org's shared root is the\n // expected case, not an error. The author supplies only the signer identity.\n}\n\nfunction buildContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse;\n parentProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"create\", {\n ...input,\n userRecipientKeys: [],\n }),\n previousManifest: null,\n parentContainerPath: input.parentProjection.path.map(\n asContainerManifestBundle,\n ),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecord(\n input.parentKek,\n \"Container create parent KEK state\",\n ),\n };\n}\n\nasync function resolveContainerCreatePlanContext(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlanContext> {\n assertContainerCreatePlanInput(input);\n assertContainerKekPathCurrent(input.parentProjection.containerKeks);\n const containerId = input.containerId ?? crypto.randomUUID();\n\n return {\n ...input,\n containerId,\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId,\n keyMaterial: input.containerKey,\n }),\n containerKeyEpochId: await resolveContainerKekEpochId({\n containerId,\n keyEpoch: 1,\n keyMaterial: input.containerKey,\n override: input.containerKeyEpochId,\n }),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parent: getParentCreateContext(input.parentProjection),\n signedAt: input.signedAt ?? new Date().toISOString(),\n };\n}\n\nfunction buildChildContainerCreateBody(\n context: ContainerCreatePlanContext,\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"],\n): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: context.systemSlot ?? null,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId: context.parentProjection.containerId,\n parentManifestHash: context.parent.manifest.manifestHash,\n });\n if (!managedGrant) {\n return baseBody;\n }\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: managedGrant.accessLevel,\n subjectId: managedGrant.principalHead.principalId,\n subjectType: managedGrant.principalHead.principalType,\n },\n ],\n referencedPrincipalHeads: [managedGrant.principalHead],\n };\n}\n\n// A managed-principal grant adds a second recipient: the group/organization key\n// wrap alongside the parent-inheritance wrap. The server derives both targets\n// (parent inheritance + directGrant) and requires exactly one wrap each; target\n// order is irrelevant since the key-target hash is normalized.\nasync function buildChildContainerWrapsAndTargets(input: {\n context: ContainerCreatePlanContext;\n managedGrant: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n manifestHash: string;\n}): Promise<{\n recipientTargets: ContainerKekRecipientTarget[];\n wraps: ContainerKeyWrap[];\n}> {\n const { context, managedGrant, manifestHash } = input;\n const parentPublicKey = readContainerState(\n context.parent.manifest,\n ).containerKeyPublicKey;\n if (!parentPublicKey)\n throw new Error(\"Container parent wrapping public key is missing\");\n const parentWrap = await wrapContainerKeyToParent({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n parentKek: context.parent.kek,\n parentPublicKey,\n });\n const parentTargets = buildParentRecipientTargets(context.parent.kek);\n if (!managedGrant) {\n return { recipientTargets: parentTargets, wraps: [parentWrap] };\n }\n const managedRecipient = await wrapContainerKeyToManagedPrincipal({\n containerKey: context.containerKey,\n containerKeyEpochId: context.containerKeyEpochId,\n manifestHash,\n principalEncapsulationPublicKey:\n managedGrant.principalEncapsulationPublicKey,\n principalHead: managedGrant.principalHead,\n });\n return {\n recipientTargets: [...parentTargets, managedRecipient.recipientTarget],\n wraps: [parentWrap, managedRecipient.wrap],\n };\n}\n\nexport async function buildContainerCreatePlan(\n input: BuildContainerCreatePlanInput,\n): Promise<ContainerCreatePlan> {\n const context = await resolveContainerCreatePlanContext(input);\n const parentContainerId = context.parentProjection.containerId;\n const parentManifestHash = context.parent.manifest.manifestHash;\n const managedGrant = input.managedPrincipalGrant;\n const body = buildChildContainerCreateBody(context, managedGrant);\n // The new container belongs to the parent's organization, not the author's.\n // A member writing under another org's shared root mints a container owned by\n // that org; the author only supplies the signer identity.\n const organizationId = context.parentProjection.organizationId;\n const { event, eventHash } = await signContainerCreateEvent({\n author: context.author,\n body,\n containerId: context.containerId,\n eventId: context.eventId,\n organizationId,\n parentPath: context.parentProjection.path,\n signedAt: context.signedAt,\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: context.systemSlot ?? null,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n containerKeyPublicKey: context.containerKeyPublicKey,\n directGrants: body.directGrants,\n eventHash,\n metadataDocumentId: context.metadataDocumentId,\n organizationId,\n parentContainerId,\n parentManifestHash,\n referencedPrincipalHeads: body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: context.parent.kek.containerKeyEpochId,\n });\n const { recipientTargets, wraps } = await buildChildContainerWrapsAndTargets({\n context,\n managedGrant,\n manifestHash,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n return {\n body,\n containerId: context.containerId,\n containerKeyEpochId: context.containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: context.metadataDocumentId,\n parentContainerId,\n parentManifestHash,\n recipientTargets,\n request: buildContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n parentKek: context.parent.kek,\n parentProjection: context.parentProjection,\n principalPolicies: context.principalPolicies ?? [],\n wraps,\n }),\n state,\n wraps,\n };\n}\n\nexport async function buildMaterializedContainerCreatePlan(\n input: {\n author: ContainerMutationAuthor;\n containerId?: string \| undefined;\n containerKey?: Uint8Array \| undefined;\n containerKeyEpochId?: string \| undefined;\n eventId?: string \| undefined;\n execSql?: ExecSql \| undefined;\n managedPrincipalGrant?: BuildContainerCreatePlanInput[\"managedPrincipalGrant\"];\n metadataDocumentId?: string \| undefined;\n systemSlot?: string \| null \| undefined;\n parentProjection: ContainerWriterProjectionResponse;\n parentSecretKey: Uint8Array;\n signedAt?: string \| undefined;\n // Fetches the parent path's referenced principal policies on demand when\n // they are not cached locally — lets a member create under another org's\n // shared root without having first hydrated that org's group policy.\n warmReferencedPrincipalPolicies?:\n \| ReferencedPrincipalPolicyWarmer\n \| undefined;\n } & ProjectionVerificationOptions,\n): Promise<MaterializedContainerCreatePlan> {\n const containerKey =\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32));\n\n const parentKeksByEpochId = await unwrapContainerKekPath({\n execSql: input.execSql,\n projection: input.parentProjection,\n secretKey: input.parentSecretKey,\n ...projectionVerificationOptions(input),\n });\n const parent = getParentCreateContext(input.parentProjection);\n requireUnwrappedKek(parentKeksByEpochId, parent.kek, \"Container parent\");\n // Checked on the path verification just accepted, never on the raw response.\n assertContainerChildPathFits(input.parentProjection.path);\n const principalPolicies = input.resolveProjectionUserKey\n ? await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n projection: input.parentProjection,\n resolveUserKey: input.resolveProjectionUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n })\n : [];\n if (input.resolveProjectionUserKey) {\n assertContainerAuthorAccess({\n author: {\n ...input.author,\n organizationId: input.parentProjection.organizationId,\n },\n projection: input.parentProjection,\n principalPolicies,\n minimumAccess: input.systemSlot ? \"admin\" : \"write\",\n });\n }\n const plan = await buildContainerCreatePlan({\n author: input.author,\n containerId: input.containerId,\n containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n eventId: input.eventId,\n managedPrincipalGrant: input.managedPrincipalGrant,\n metadataDocumentId: input.metadataDocumentId,\n systemSlot: input.systemSlot,\n parentProjection: input.parentProjection,\n principalPolicies,\n signedAt: input.signedAt,\n });\n\n return {\n containerKey,\n plan,\n };\n}\n\nexport { childContainerWriterProjectionFromCreatePlan } from \"./createProjection\";\n\nasync function createRemoteContainerWithRepairs(input: {\n readonly containerId: string;\n readonly containerKey: Uint8Array;\n readonly eventId: string;\n readonly metadataDocumentId: string;\n readonly parentProjection: ContainerWriterProjectionResponse;\n readonly request: RemoteContainerCreateInput;\n readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n readonly signedAt: string;\n}): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n let parentProjection = input.parentProjection;\n const repairState: ContainerCreateRepairState = {\n didRepairStaleParent: false,\n policyRepairs: new PrincipalPolicyRepairBudget(),\n };\n for (;;) {\n const materializedPlan = await buildMaterializedContainerCreatePlan({\n author: input.request.author,\n containerId: input.containerId,\n containerKey: input.containerKey,\n containerKeyEpochId: input.request.containerKeyEpochId,\n eventId: input.eventId,\n execSql: input.request.execSql,\n metadataDocumentId: input.metadataDocumentId,\n parentProjection,\n parentSecretKey: input.request.parentSecretKey,\n resolveProjectionUserKey: input.resolveProjectionUserKey,\n signedAt: input.signedAt,\n stillCurrent: input.request.stillCurrent,\n warmReferencedPrincipalPolicies:\n input.request.warmReferencedPrincipalPolicies,\n });\n const submitted = await submitRemoteContainerCreate({\n apiClient: input.request.apiClient,\n plan: materializedPlan.plan,\n stillCurrent: input.request.stillCurrent,\n });\n if (!submitted) return null;\n if (!submitted.ok) {\n const repair = await repairContainerCreateFailure({\n apiClient: input.request.apiClient,\n execSql: input.request.execSql,\n failure: submitted,\n parentContainerId: input.request.parentContainerId,\n parentProjection,\n reportSecurityIncident: input.request.reportSecurityIncident,\n resolveTrustedUserIdentity: input.request.resolveTrustedUserIdentity,\n state: repairState,\n stillCurrent: input.request.stillCurrent,\n });\n if (repair.kind === \"retry\") {\n parentProjection = repair.parentProjection;\n continue;\n }\n if (repair.kind === \"unavailable\") {\n return null;\n }\n submitted.report();\n return null;\n }\n const acknowledged = await acknowledgeContainerMutation({\n execSql: input.request.execSql,\n plan: materializedPlan.plan,\n response: submitted.response,\n stillCurrent: input.request.stillCurrent,\n });\n return {\n acknowledged,\n result: {\n containerKey: materializedPlan.containerKey,\n containerId: submitted.response.containerId,\n metadataDocumentId: materializedPlan.plan.metadataDocumentId,\n plan: materializedPlan.plan,\n response: submitted.response,\n },\n };\n }\n}\n\nasync function createRemoteContainerOutcome(\n input: RemoteContainerCreateInput,\n): Promise<{\n readonly acknowledged: boolean;\n readonly result: CreateRemoteContainerResult;\n} \| null> {\n const resolveProjectionUserKey = requireProjectionUserKeyResolver(\n input.resolveProjectionUserKey,\n \"Remote container create\",\n );\n const parentProjection =\n input.parentProjection ??\n (await input.apiClient.getContainerWriterProjection(\n input.parentContainerId,\n ));\n if (!parentProjection) {\n return null;\n }\n return nullOnProjectionVerificationCancellation(() =>\n createRemoteContainerWithRepairs({\n containerId: input.containerId ?? crypto.randomUUID(),\n containerKey:\n input.containerKey ?? crypto.getRandomValues(new Uint8Array(32)),\n eventId: input.eventId ?? crypto.randomUUID(),\n metadataDocumentId: input.metadataDocumentId ?? crypto.randomUUID(),\n parentProjection,\n request: input,\n resolveProjectionUserKey,\n signedAt: input.signedAt ?? new Date().toISOString(),\n }),\n );\n}\n\nexport async function createRemoteContainer(\n input: RemoteContainerCreateInput,\n): Promise<CreateRemoteContainerResult \| null> {\n const outcome = await createRemoteContainerOutcome(input);\n return outcome?.acknowledged && input.stillCurrent?.() !== false\n ? outcome.result\n : null;\n}\n"]}