npm - @tearleads/client-sdk - Versions diffs - 0.1.11 → 0.1.14 - Mend

@tearleads/client-sdk 0.1.11 → 0.1.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (144) hide show

package/index.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 export type { AddOrganizationGroupUserInput, BlobInfo, BlobInfoAttachmentKind, BlobInfoDocumentReference, BlobInfoInput, BlobInfoList, BlobInfoSort, BlobInfoSortDirection, BlobInfoSortKey, BrowserLocalKeyringOptions, ClientDatabaseOptions, ContainerContents, ContainerContentsContextValue, ContainerContentsStore, ContainerContentsStoreOptions, ContainerDocumentLinkInput, ContainerDocumentLinks, ContainerDocumentObjectSyncState, ContainerDocumentObjectSyncStatus, ContainerDocumentQueries, ContainerDocumentSidebarRow, ContainerInfo, ContainerInfoInput, ContainerItemRow, ContainerItemSort, ContainerItemSortDirection, ContainerItemSortKey, ContainerNode, ContainerShareAccessLevel, CreateOrganizationOptions, DatabaseListener, DatabaseOptions, DatabaseSnapshot, DatabaseStatus, DeviceFirst, DeviceFirstContainerContents, DocumentAttachmentStatus, DocumentAttachmentUpload, DocumentAttributionRangesInput, DocumentAttributionRangesPage, DocumentContextValue, DocumentInfo, DocumentInfoInput, DocumentList, DocumentSort, DocumentSortDirection, DocumentSortKey, DocumentStore, DocumentSubscriptionOptions, Documents, DocumentsRuntime, DomainScope, FileSaver, Identity, IdentityGenerationResult, IdentityKeyPackage, IdentityListener, IdentityOptions, IdentitySnapshot, ImportedOrganizationUser, IndexedDbLocalKeyringManifestStoreOptions, IndexedDbWrappingKeyKeystoreOptions, LinkDocumentToContainerInput, ListDocumentsInput, LocalKeyPurpose, LocalKeyring, LocalKeyringManifest, LocalKeyringManifestFormat, LocalKeyringManifestStorage, LocalKeyringManifestStore, LocalKeyringOptions, LocalKeyringPinCode, LocalKeyringScope, LocalKeyringSession, LocalOrganizationSummary, LocalProjectionReconciledDelta, LocalProjectionSnapshot, LocalProjectionView, LocalSecretContext, LocalStorageLocalKeyringManifestStoreOptions, Logger, MergeDocumentSummary, MoveDocumentToContainerInput, NetworkListener, NetworkMode, NetworkStatusSource, NormalizedLocalKeyringScope, OpenContainerDocumentInput, OpenDocumentInput, OpenDocumentOptions, OrganizationBilling, OrganizationBillingHistory, OrganizationBillingHistoryEntry, OrganizationBillingManagementUrl, OrganizationBillingView, OrganizationContainerGrant, OrganizationContainerGrants, OrganizationDataUsage, OrganizationDirectory, OrganizationDirectoryAndGroups, OrganizationDirectoryUser, OrganizationGrantRef, OrganizationGroupContainer, OrganizationGroupContainers, OrganizationGroupDetails, OrganizationGroupMember, OrganizationGroupMembers, OrganizationGroupPolicyHistory, OrganizationGroupSummary, OrganizationPolicyGrantChange, OrganizationPolicyGroupChange, OrganizationPolicyHistory, OrganizationPolicyHistoryEntry, OrganizationProfile, Organizations, OrganizationUserDetail, PendingWriteQueueItem, PendingWriteQueueItemStatus, PendingWriteQueueObjectKind, PendingWriteQueueOperation, PendingWriteQueueOperationKind, PendingWriteQueueOperationStatus, PersistedDocumentListener, PinCodeBrowserLocalKeyringOptions, PinCodeWrappingKeyKeystoreOptions, PurgeDocumentInput, PurgeDocumentResult, ReconciliationService, RemoveOrganizationGroupUserInput, ResolvedUserIdentity, SaveFileRequest, SecurityIncident, SecurityIncidentListener, SecurityIncidentObjectKind, SecurityIncidents, Session, SessionContext, SessionCreateOrganizationResult, SessionListener, SessionRecoverOrganizationResult, SessionRegistrationRefusal, SessionRegistrationResult, SessionSnapshot, SetActiveDocumentContainerInput, SetLinkedContainerIdsForDocument, UnlinkDocumentFromContainerInput, UnwrapLocalSecretInput, UserIdentities, UserSession, WrapLocalSecretInput, WrappedLocalSecretEnvelope, WrappedLocalSecretFormat, WrappingKeyHandle, WrappingKeyKeystore, WrappingKeyMaterialStorage, } from "./client/index.js";
-export { type BlobStoreFactory, Blobs, type ClientOptions, createBrowserLocalKeyring, createBrowserLocalKeyringManifestStore, createBrowserNetworkStatusSource, createContainerDocumentObjectSyncState, createDomainScope, createIndexedDbLocalKeyringManifestStore, createIndexedDbWrappingKeyKeystore, createLocalKeyring, createLocalStorageLocalKeyringManifestStore, createMemoryLocalKeyringManifestStore, createMemoryWrappingKeyKeystore, createPinCodeBrowserLocalKeyring, createPinCodeWrappingKeyKeystore, createRevenueCatPurchases, createUnavailableDirectCheckout, createUnavailablePurchases, createWebViewLocalKeyring, Database, DEFAULT_DOCUMENT_ID, type DirectCheckoutAppearance, type DirectCheckoutCapability, type DirectCheckoutConfirmation, type DirectCheckoutSession, DirectCheckoutUnavailableError, decodeLocalKeyringSqliteKey, Events, type EventsListener, type EventsSnapshot, encodeLocalKeyringSqliteKey, enqueueReconciliationForEvents, IDENTITY_KEY_PACKAGE_FORMAT, isPinCodeWrappedLocalSecretEnvelope, LOCAL_KEYRING_MANIFEST_FORMAT, localKeyringScopeKey, Network, normalizeLocalKeyringScope, PurchaseAbortedError, PurchaseAlreadyOwnedError, PurchaseCancelledError, PurchaseIdentityPendingError, PurchaseProviderStalledError, type PurchasesCapability, PurchasesUnavailableError, PurgedOrganizationRecoveryBillingRequiredError, parseLocalKeyringManifest, type RevenueCatBackend, type RevenueCatCustomerInfo, type RevenueCatPackage, type RevenueCatPurchasesConfig, SyncBillingGate, type SyncBillingGateListener, type SyncPurchaseResult, type SyncSubscriptionOption, serializeLocalKeyringManifest, Tearleads, WRAPPED_LOCAL_SECRET_FORMAT, } from "./client/index.js";
+export { type BlobStoreFactory, Blobs, type ClientOptions, createBrowserLocalKeyring, createBrowserLocalKeyringManifestStore, createBrowserNetworkStatusSource, createContainerDocumentObjectSyncState, createDomainScope, createIndexedDbLocalKeyringManifestStore, createIndexedDbWrappingKeyKeystore, createLocalKeyring, createLocalStorageLocalKeyringManifestStore, createMemoryLocalKeyringManifestStore, createMemoryWrappingKeyKeystore, createPinCodeBrowserLocalKeyring, createPinCodeWrappingKeyKeystore, createRevenueCatPurchases, createUnavailableDirectCheckout, createUnavailablePurchases, createWebViewLocalKeyring, Database, DEFAULT_DOCUMENT_ID, type DirectCheckoutAppearance, type DirectCheckoutCapability, type DirectCheckoutConfirmation, type DirectCheckoutSession, DirectCheckoutUnavailableError, decodeLocalKeyringSqliteKey, Events, type EventsListener, type EventsSnapshot, encodeLocalKeyringSqliteKey, enqueueReconciliationForEvents, IDENTITY_KEY_PACKAGE_FORMAT, isPinCodeWrappedLocalSecretEnvelope, LOCAL_KEYRING_MANIFEST_FORMAT, localKeyringScopeKey, Network, normalizeLocalKeyringScope, type PrincipalHistoryKeyProvider, type PrincipalHistoryKeyScope, PurchaseAbortedError, PurchaseAlreadyOwnedError, PurchaseCancelledError, PurchaseIdentityPendingError, PurchaseProviderStalledError, type PurchasesCapability, PurchasesUnavailableError, PurgedOrganizationRecoveryBillingRequiredError, parseLocalKeyringManifest, type RevenueCatBackend, type RevenueCatCustomerInfo, type RevenueCatPackage, type RevenueCatPurchasesConfig, SyncBillingGate, type SyncBillingGateListener, type SyncPurchaseResult, type SyncSubscriptionOption, serializeLocalKeyringManifest, Tearleads, WRAPPED_LOCAL_SECRET_FORMAT, } from "./client/index.js";
 export type { BlobByteSource, BlobByteSourceInput, BlobBytes, BlobStore, DiscoveredDocumentInput, DocumentAttachment, DocumentClientProjectionDefinition, DocumentClientProjectionDeleteInput, DocumentClientProjectionSaveInput, DocumentFieldValidationIssue, DocumentProjection, DocumentProjectorDefinition, DocumentProjectorInput, DocumentProjectorRegistry, DocumentProjectorRegistryInput, DocumentRow, DocumentRowSummary, DocumentSummary, StoredDocumentKind, StoredDocumentState, StructuredDocumentMap, StructuredDocumentShape, StructuredDocumentText, ValidatedDocumentFields, } from "./documents.js";
 export { addDocumentAttachments, blobByteSourceInputLength, createBlobByteSource, createDocumentProjectorRegistry, createDocumentSignerDeviceId, DEFAULT_DOCUMENT_ACCESS_EPOCH, DEFAULT_DOCUMENT_KIND, defaultDocumentProjectorRegistry, deriveStoredDocumentTitle, ensureDocumentAttachmentStructure, getDocumentAttachments, getDocumentClientProjectionTables, getStoredDocumentTypeLabel, getUntitledDocumentTitle, initializeStoredDocumentKind, projectStoredDocumentState, readBlobByteSource, readStoredDocumentState, readStringDocumentField, resolveOpIdAttribution, sameDocumentAttachments, summarizeDocumentContributors, writerByPeerId, writeStoredDocumentFields, } from "./documents.js";
 export type { ContainerContentsSnapshot, ContainerContentsStoreRuntime, ContainerContentsStoreState, ContainerContentsStoreSyncAgent, ContainerContentsStoreSyncState, ContainerState, PurgeOptions, PurgeProgress, } from "./stores/container-contents/index.js";
@@ -16,8 +16,8 @@ export type { DocumentRecord, DocumentSyncContainerRekeyBuilder, DocumentSyncPul
 export { buildMaterializedDocumentCreatePlan, createDocumentProjectionUserKeyResolver, createDocumentsWorkflowRuntime, createRemoteDocument, DOCUMENT_SYNC_TRACE_FRAGMENT, DOCUMENT_SYNC_TRACE_PATTERN, DOCUMENTS_APP_KIND, DocumentRawHistoryUnavailableError, defaultDocumentsPersistence, deletePersistedDocument, isDatabaseUnavailableError, isDocumentSyncUpdateIsolationError, persistedDocumentCreateStateFromResponse, readPullContinuation, syncRemoteDocument, unwrapContainerKekPath, unwrapDocumentContentKeyTarget, validateDocumentSyncUpdateImports, } from "./workflows/documents/index.js";
 export type { OrganizationGroupPolicyHistoryEntry, OrganizationNativePurchaseEligibility, OrganizationPrincipalMemberChange, OrganizationPrincipalMemberChangeType, OrganizationPrincipalPolicyHistory, OrganizationPrincipalPolicyHistoryEntry, ReconcileOrganizationDataUsageInput, } from "./workflows/organizations/index.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, buildOrganizationGroupPolicyHistory, buildOrganizationProfileDocumentPatch, buildRosterProfileDocumentPatch, checkNativePurchaseEligibility, createInitializedRosterProfileDocument, createOrganizationGroup, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, GroupMembershipNameMismatchError, getOrganizationProfileDocumentLocalId, getRosterProfileDocumentLocalId, importOrganizationUser, loadLocalOrganizationDataUsage, loadLocalOrganizationDirectoryAndGroups, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_PROFILE_DOCUMENT_KIND, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, reconcileOrganizationDataUsage, reconcileOrganizationDirectoryAndGroups, removeOrganizationGroupUser, resolveOrganizationBillingView, revokeOrganizationContainerGrant, startOrganizationTrial, subscribeOrganizationReadModelInvalidation, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./workflows/organizations/index.js";
-export type { CacheReferencedPrincipalPoliciesOptions, RecoveredPrincipalPolicyHistory, RecoverPrincipalPolicyHistoryOptions, } from "./workflows/principals/index.js";
-export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, } from "./workflows/principals/index.js";
+export type { CacheReferencedPrincipalPoliciesOptions, RecoveredPrincipalPolicyHistory, RecoveredScopedPrincipalPolicyHistory, RecoverPrincipalPolicyHistoryOptions, RecoverScopedPrincipalPolicyHistoryOptions, } from "./workflows/principals/index.js";
+export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, recoverScopedPrincipalPolicyHistory, } from "./workflows/principals/index.js";
 export type { InitialRootMetadataBootstrap, ProvisionedSystemContainerSpec, RegisterIdentityInput, RegistrationApi, } from "./workflows/registration/index.js";
 export { bootstrapRootContainer, buildInitialOrganizationPolicyRequest, createInitialRootMetadataBootstrap, persistRegistrationBootstrap, registerIdentity, } from "./workflows/registration/index.js";
 export type { RootIdentitiesApi, RootIdentitiesPage, RootIdentitiesQueryInput, RootIdentity, RootIdentityDetail, RootIdentityOrganization, RootIdentitySession, RootRequestOutcome, } from "./workflows/root/index.js";

package/index.js CHANGED Viewed

@@ -7,7 +7,7 @@ export { createContainerContentsDocumentsRuntime, createContainerContentsProject
 export { buildMaterializedContainerRekeyPlan, buildRootContainerCreatePlan, ContainerAuthorAccessError, ContainerKekRepairInaccessibleError, ContainerKekRepairRequiredError, ContainerKeyringOverrideStaleError, ContainerPathTooDeepError, classifyContainerWriteRefusal, containerWriterProjectionFromRekeyPlan, createRemoteContainer, fetchContainerKekLog, GroupShareNameMismatchError, HistoricalWrapUnavailableError, isProjectionVerificationCancelledError, moveRemoteContainer, rebuildKeyringEntriesFromLog, recoverKeyringEntryFromWraps, rekeyRemoteContainer, revokeRemoteContainer, rootContainerWriterProjectionFromCreatePlan, shareRemoteContainer, shareRemoteContainerWithGroup, } from "./workflows/containers/index.js";
 export { buildMaterializedDocumentCreatePlan, createDocumentProjectionUserKeyResolver, createDocumentsWorkflowRuntime, createRemoteDocument, DOCUMENT_SYNC_TRACE_FRAGMENT, DOCUMENT_SYNC_TRACE_PATTERN, DOCUMENTS_APP_KIND, DocumentRawHistoryUnavailableError, defaultDocumentsPersistence, deletePersistedDocument, isDatabaseUnavailableError, isDocumentSyncUpdateIsolationError, persistedDocumentCreateStateFromResponse, readPullContinuation, syncRemoteDocument, unwrapContainerKekPath, unwrapDocumentContentKeyTarget, validateDocumentSyncUpdateImports, } from "./workflows/documents/index.js";
 export { addOrganizationGroupUser, buildInitialGroupPolicyRequest, buildInitialMemberGroupPolicyRequest, buildOrganizationGroupPolicyHistory, buildOrganizationProfileDocumentPatch, buildRosterProfileDocumentPatch, checkNativePurchaseEligibility, createInitializedRosterProfileDocument, createOrganizationGroup, DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME, deriveOrganizationMetadataContainerSystemSlot, deriveOrganizationRosterProfileContainerSystemSlot, GroupMembershipNameMismatchError, getOrganizationProfileDocumentLocalId, getRosterProfileDocumentLocalId, importOrganizationUser, loadLocalOrganizationDataUsage, loadLocalOrganizationDirectoryAndGroups, loadOrganizationBilling, loadOrganizationBillingHistory, loadOrganizationBillingManagementUrl, ORGANIZATION_METADATA_CONTAINER_NAME, ORGANIZATION_PROFILE_DOCUMENT_KIND, ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME, ROSTER_PROFILE_DOCUMENT_KIND, readOrganizationProfileName, reconcileOrganizationDataUsage, reconcileOrganizationDirectoryAndGroups, removeOrganizationGroupUser, resolveOrganizationBillingView, revokeOrganizationContainerGrant, startOrganizationTrial, subscribeOrganizationReadModelInvalidation, updateOrganizationProfile, updateOrganizationRosterEntry, } from "./workflows/organizations/index.js";
-export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, } from "./workflows/principals/index.js";
+export { cacheReferencedPrincipalPolicies, PrincipalPolicyHistoryReadError, recoverPrincipalPolicyHistory, recoverScopedPrincipalPolicyHistory, } from "./workflows/principals/index.js";
 export { bootstrapRootContainer, buildInitialOrganizationPolicyRequest, createInitialRootMetadataBootstrap, persistRegistrationBootstrap, registerIdentity, } from "./workflows/registration/index.js";
 export { listRootDataUsageReport, listRootIdentities, listRootIdentityOrganizations, listRootOrganizationIdentities, listRootOrganizations, loadRootIdentity, loadRootOrganization, loadRootOrganizationDataUsage, } from "./workflows/root/index.js";
 export { clearRemoteSyncState, getDomainSyncCoordinatorSnapshot, getOrCreateDomainSyncCoordinator, hasDomainSyncCoordinatorPendingWork, requestAllDomainSyncLanes, subscribeToDomainSyncCoordinator, waitForDomainSyncCoordinatorToSettle, } from "./workflows/sync/index.js";

package/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAiKA,OAAO,EAEL,KAAK,EAEL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,SAAS,EACT,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AA2BlB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAa3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,2BAA2B,EAC3B,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,0CAA0C,EAC1C,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// This is the current SDK contract: unified device-first handles and atomic,\n// revision-checked host adapters. Obsolete aliases and adapter fallbacks are not\n// part of this surface; see workflows/README.md for the required host contract.\nexport type {\n AddOrganizationGroupUserInput,\n BlobInfo,\n BlobInfoAttachmentKind,\n BlobInfoDocumentReference,\n BlobInfoInput,\n BlobInfoList,\n BlobInfoSort,\n BlobInfoSortDirection,\n BlobInfoSortKey,\n BrowserLocalKeyringOptions,\n ClientDatabaseOptions,\n ContainerContents,\n ContainerContentsContextValue,\n ContainerContentsStore,\n ContainerContentsStoreOptions,\n ContainerDocumentLinkInput,\n ContainerDocumentLinks,\n ContainerDocumentObjectSyncState,\n ContainerDocumentObjectSyncStatus,\n ContainerDocumentQueries,\n ContainerDocumentSidebarRow,\n ContainerInfo,\n ContainerInfoInput,\n ContainerItemRow,\n ContainerItemSort,\n ContainerItemSortDirection,\n ContainerItemSortKey,\n ContainerNode,\n ContainerShareAccessLevel,\n CreateOrganizationOptions,\n DatabaseListener,\n DatabaseOptions,\n DatabaseSnapshot,\n DatabaseStatus,\n DeviceFirst,\n DeviceFirstContainerContents,\n DocumentAttachmentStatus,\n DocumentAttachmentUpload,\n DocumentAttributionRangesInput,\n DocumentAttributionRangesPage,\n DocumentContextValue,\n DocumentInfo,\n DocumentInfoInput,\n DocumentList,\n DocumentSort,\n DocumentSortDirection,\n DocumentSortKey,\n DocumentStore,\n DocumentSubscriptionOptions,\n Documents,\n DocumentsRuntime,\n DomainScope,\n FileSaver,\n Identity,\n IdentityGenerationResult,\n IdentityKeyPackage,\n IdentityListener,\n IdentityOptions,\n IdentitySnapshot,\n ImportedOrganizationUser,\n IndexedDbLocalKeyringManifestStoreOptions,\n IndexedDbWrappingKeyKeystoreOptions,\n LinkDocumentToContainerInput,\n ListDocumentsInput,\n LocalKeyPurpose,\n LocalKeyring,\n LocalKeyringManifest,\n LocalKeyringManifestFormat,\n LocalKeyringManifestStorage,\n LocalKeyringManifestStore,\n LocalKeyringOptions,\n LocalKeyringPinCode,\n LocalKeyringScope,\n LocalKeyringSession,\n LocalOrganizationSummary,\n LocalProjectionReconciledDelta,\n LocalProjectionSnapshot,\n LocalProjectionView,\n LocalSecretContext,\n LocalStorageLocalKeyringManifestStoreOptions,\n Logger,\n MergeDocumentSummary,\n MoveDocumentToContainerInput,\n NetworkListener,\n NetworkMode,\n NetworkStatusSource,\n NormalizedLocalKeyringScope,\n OpenContainerDocumentInput,\n OpenDocumentInput,\n OpenDocumentOptions,\n OrganizationBilling,\n OrganizationBillingHistory,\n OrganizationBillingHistoryEntry,\n OrganizationBillingManagementUrl,\n OrganizationBillingView,\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationDataUsage,\n OrganizationDirectory,\n OrganizationDirectoryAndGroups,\n OrganizationDirectoryUser,\n OrganizationGrantRef,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupDetails,\n OrganizationGroupMember,\n OrganizationGroupMembers,\n OrganizationGroupPolicyHistory,\n OrganizationGroupSummary,\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n OrganizationPolicyHistory,\n OrganizationPolicyHistoryEntry,\n OrganizationProfile,\n Organizations,\n OrganizationUserDetail,\n PendingWriteQueueItem,\n PendingWriteQueueItemStatus,\n PendingWriteQueueObjectKind,\n PendingWriteQueueOperation,\n PendingWriteQueueOperationKind,\n PendingWriteQueueOperationStatus,\n // Persistence notifications distinguish placement changes from content saves.\n PersistedDocumentListener,\n PinCodeBrowserLocalKeyringOptions,\n PinCodeWrappingKeyKeystoreOptions,\n PurgeDocumentInput,\n PurgeDocumentResult,\n ReconciliationService,\n RemoveOrganizationGroupUserInput,\n ResolvedUserIdentity,\n SaveFileRequest,\n SecurityIncident,\n SecurityIncidentListener,\n SecurityIncidentObjectKind,\n SecurityIncidents,\n Session,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionListener,\n SessionRecoverOrganizationResult,\n SessionRegistrationRefusal,\n SessionRegistrationResult,\n SessionSnapshot,\n SetActiveDocumentContainerInput,\n SetLinkedContainerIdsForDocument,\n UnlinkDocumentFromContainerInput,\n UnwrapLocalSecretInput,\n UserIdentities,\n UserSession,\n WrapLocalSecretInput,\n WrappedLocalSecretEnvelope,\n WrappedLocalSecretFormat,\n WrappingKeyHandle,\n WrappingKeyKeystore,\n WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n type BlobStoreFactory,\n Blobs,\n type ClientOptions,\n createBrowserLocalKeyring,\n createBrowserLocalKeyringManifestStore,\n createBrowserNetworkStatusSource,\n createContainerDocumentObjectSyncState,\n createDomainScope,\n createIndexedDbLocalKeyringManifestStore,\n createIndexedDbWrappingKeyKeystore,\n createLocalKeyring,\n createLocalStorageLocalKeyringManifestStore,\n createMemoryLocalKeyringManifestStore,\n createMemoryWrappingKeyKeystore,\n createPinCodeBrowserLocalKeyring,\n createPinCodeWrappingKeyKeystore,\n createRevenueCatPurchases,\n createUnavailableDirectCheckout,\n createUnavailablePurchases,\n createWebViewLocalKeyring,\n Database,\n DEFAULT_DOCUMENT_ID,\n type DirectCheckoutAppearance,\n type DirectCheckoutCapability,\n type DirectCheckoutConfirmation,\n type DirectCheckoutSession,\n DirectCheckoutUnavailableError,\n decodeLocalKeyringSqliteKey,\n Events,\n type EventsListener,\n type EventsSnapshot,\n encodeLocalKeyringSqliteKey,\n enqueueReconciliationForEvents,\n IDENTITY_KEY_PACKAGE_FORMAT,\n isPinCodeWrappedLocalSecretEnvelope,\n LOCAL_KEYRING_MANIFEST_FORMAT,\n localKeyringScopeKey,\n Network,\n normalizeLocalKeyringScope,\n PurchaseAbortedError,\n PurchaseAlreadyOwnedError,\n PurchaseCancelledError,\n PurchaseIdentityPendingError,\n PurchaseProviderStalledError,\n type PurchasesCapability,\n PurchasesUnavailableError,\n PurgedOrganizationRecoveryBillingRequiredError,\n parseLocalKeyringManifest,\n type RevenueCatBackend,\n type RevenueCatCustomerInfo,\n type RevenueCatPackage,\n type RevenueCatPurchasesConfig,\n SyncBillingGate,\n type SyncBillingGateListener,\n type SyncPurchaseResult,\n type SyncSubscriptionOption,\n serializeLocalKeyringManifest,\n Tearleads,\n WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n BlobByteSource,\n BlobByteSourceInput,\n BlobBytes,\n BlobStore,\n DiscoveredDocumentInput,\n DocumentAttachment,\n DocumentClientProjectionDefinition,\n DocumentClientProjectionDeleteInput,\n DocumentClientProjectionSaveInput,\n DocumentFieldValidationIssue,\n DocumentProjection,\n DocumentProjectorDefinition,\n DocumentProjectorInput,\n DocumentProjectorRegistry,\n DocumentProjectorRegistryInput,\n DocumentRow,\n DocumentRowSummary,\n DocumentSummary,\n StoredDocumentKind,\n StoredDocumentState,\n StructuredDocumentMap,\n StructuredDocumentShape,\n StructuredDocumentText,\n ValidatedDocumentFields,\n} from \"./documents\";\nexport {\n addDocumentAttachments,\n blobByteSourceInputLength,\n createBlobByteSource,\n createDocumentProjectorRegistry,\n createDocumentSignerDeviceId,\n DEFAULT_DOCUMENT_ACCESS_EPOCH,\n DEFAULT_DOCUMENT_KIND,\n defaultDocumentProjectorRegistry,\n deriveStoredDocumentTitle,\n ensureDocumentAttachmentStructure,\n getDocumentAttachments,\n getDocumentClientProjectionTables,\n getStoredDocumentTypeLabel,\n getUntitledDocumentTitle,\n initializeStoredDocumentKind,\n projectStoredDocumentState,\n readBlobByteSource,\n readStoredDocumentState,\n readStringDocumentField,\n resolveOpIdAttribution,\n sameDocumentAttachments,\n summarizeDocumentContributors,\n writerByPeerId,\n writeStoredDocumentFields,\n} from \"./documents\";\nexport type {\n ContainerContentsSnapshot,\n ContainerContentsStoreRuntime,\n ContainerContentsStoreState,\n ContainerContentsStoreSyncAgent,\n ContainerContentsStoreSyncState,\n ContainerState,\n PurgeOptions,\n PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n createContainerContentsStore,\n createContainerContentsStoreState,\n createContainerContentsStoreSyncAgent,\n getOrCreateContainerContentsStore,\n isSystemContainerNode,\n requestContainerContentsDocumentPriming,\n subscribeToContainerContentsStore,\n updateContainerContentsSnapshot,\n updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n DocumentSnapshot,\n DocumentStoreFacade,\n DocumentStoreRelinkInput,\n DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n createDocumentStore,\n discardRegisteredDocumentLocalState,\n getOrCreateDocumentStore,\n openDocumentStore,\n requestDomainDocumentSync,\n subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport type {\n EncryptedBlobStoreCipher,\n EncryptedBlobStoreKey,\n EncryptedBlobStoreOptions,\n WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n createBlobStore,\n createEncryptedBlobStore,\n createLazyEncryptedBlobStore,\n createMemoryBlobStore,\n decryptDocumentAttachmentBlob,\n hydrateDocumentAttachmentBlobs,\n purgeOpfsBlobStore,\n uploadDocumentAttachment,\n wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n ContainerContentsRootAdopter,\n ContainerContentsRootAdoptionInput,\n ContainerContentsStoreWorkflowRuntime,\n ContainerContentsWorkflowRuntime,\n // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n // documentQueries variant has a different shape, so it keeps a disambiguating\n // alias on the public surface.\n ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n ContainerSystemSlotDefinition,\n RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n createContainerContentsDocumentsRuntime,\n createContainerContentsProjectionUserKeyResolver,\n createContainerContentsStoreWorkflowRuntime,\n createContainerContentsSyncLane,\n createContainerContentsWorkflowRuntime,\n createContainerParentSyncLane,\n createInitializedContainerMetadataDocument,\n defaultContainerContentsPersistence,\n deriveContainerSystemSlot,\n initializeDocumentLinksSchema,\n listBlobInfo,\n listDocumentLinkedContainerIds,\n loadContainerInfo,\n loadContainerSyncWatermark,\n loadDocumentAttributionRanges,\n loadDocumentInfo,\n replaceDocumentLinks,\n saveContainerSyncWatermark,\n syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n AggregatedContainerKekLog,\n ContainerMutationAuthor,\n ContainerReciteApi,\n ContainerWriteRefusal,\n KeyringRebuildResult,\n MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n buildMaterializedContainerRekeyPlan,\n buildRootContainerCreatePlan,\n ContainerAuthorAccessError,\n ContainerKekRepairInaccessibleError,\n ContainerKekRepairRequiredError,\n ContainerKeyringOverrideStaleError,\n ContainerPathTooDeepError,\n classifyContainerWriteRefusal,\n containerWriterProjectionFromRekeyPlan,\n createRemoteContainer,\n fetchContainerKekLog,\n GroupShareNameMismatchError,\n HistoricalWrapUnavailableError,\n type HistoricalWrapUnavailableReason,\n isProjectionVerificationCancelledError,\n moveRemoteContainer,\n rebuildKeyringEntriesFromLog,\n recoverKeyringEntryFromWraps,\n rekeyRemoteContainer,\n revokeRemoteContainer,\n rootContainerWriterProjectionFromCreatePlan,\n shareRemoteContainer,\n shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n DocumentRecord,\n DocumentSyncContainerRekeyBuilder,\n DocumentSyncPullContinuation,\n DocumentSyncUpdateIsolationError,\n DocumentsPersistence,\n DocumentsWorkflowRuntime,\n DocumentsWorkflowRuntimeInput,\n IncomingDocumentSyncUpdateValidator,\n LocalAttachmentRecord,\n PendingAttachmentRecord,\n PendingUpdateInsert,\n PendingUpdateRecord,\n SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n buildMaterializedDocumentCreatePlan,\n createDocumentProjectionUserKeyResolver,\n createDocumentsWorkflowRuntime,\n createRemoteDocument,\n DOCUMENT_SYNC_TRACE_FRAGMENT,\n DOCUMENT_SYNC_TRACE_PATTERN,\n DOCUMENTS_APP_KIND,\n DocumentRawHistoryUnavailableError,\n defaultDocumentsPersistence,\n deletePersistedDocument,\n isDatabaseUnavailableError,\n isDocumentSyncUpdateIsolationError,\n persistedDocumentCreateStateFromResponse,\n readPullContinuation,\n syncRemoteDocument,\n unwrapContainerKekPath,\n unwrapDocumentContentKeyTarget,\n validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are deliberately absent here. Integration\n// tests that compose low-level runtimes use the testing package subpath.\nexport type {\n OrganizationGroupPolicyHistoryEntry,\n OrganizationNativePurchaseEligibility,\n OrganizationPrincipalMemberChange,\n OrganizationPrincipalMemberChangeType,\n OrganizationPrincipalPolicyHistory,\n OrganizationPrincipalPolicyHistoryEntry,\n ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n buildOrganizationGroupPolicyHistory,\n buildOrganizationProfileDocumentPatch,\n buildRosterProfileDocumentPatch,\n checkNativePurchaseEligibility,\n createInitializedRosterProfileDocument,\n createOrganizationGroup,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n GroupMembershipNameMismatchError,\n getOrganizationProfileDocumentLocalId,\n getRosterProfileDocumentLocalId,\n importOrganizationUser,\n loadLocalOrganizationDataUsage,\n loadLocalOrganizationDirectoryAndGroups,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n reconcileOrganizationDataUsage,\n reconcileOrganizationDirectoryAndGroups,\n removeOrganizationGroupUser,\n resolveOrganizationBillingView,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n subscribeOrganizationReadModelInvalidation,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n CacheReferencedPrincipalPoliciesOptions,\n RecoveredPrincipalPolicyHistory,\n RecoverPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n cacheReferencedPrincipalPolicies,\n PrincipalPolicyHistoryReadError,\n recoverPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n InitialRootMetadataBootstrap,\n ProvisionedSystemContainerSpec,\n RegisterIdentityInput,\n RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n bootstrapRootContainer,\n buildInitialOrganizationPolicyRequest,\n createInitialRootMetadataBootstrap,\n persistRegistrationBootstrap,\n registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n RootIdentitiesApi,\n RootIdentitiesPage,\n RootIdentitiesQueryInput,\n RootIdentity,\n RootIdentityDetail,\n RootIdentityOrganization,\n RootIdentitySession,\n RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n listRootDataUsageReport,\n listRootIdentities,\n listRootIdentityOrganizations,\n listRootOrganizationIdentities,\n listRootOrganizations,\n loadRootIdentity,\n loadRootOrganization,\n loadRootOrganizationDataUsage,\n type RootDataUsageApi,\n type RootDataUsageReportPage,\n type RootOrganization,\n type RootOrganizationDetail,\n type RootOrganizationIdentitiesPage,\n type RootOrganizationIdentity,\n type RootOrganizationPageQueryInput,\n type RootOrganizationsApi,\n type RootOrganizationsPage,\n type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n ClearRemoteSyncStateResult,\n DomainSyncCoordinator,\n DomainSyncSnapshot,\n RemoteResetInput,\n RemoteResetReplacement,\n SyncIdleOptions,\n SyncLane,\n SyncLaneConfig,\n SyncLaneLastAction,\n SyncLanePhase,\n SyncLaneSnapshot,\n SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n clearRemoteSyncState,\n getDomainSyncCoordinatorSnapshot,\n getOrCreateDomainSyncCoordinator,\n hasDomainSyncCoordinatorPendingWork,\n requestAllDomainSyncLanes,\n subscribeToDomainSyncCoordinator,\n waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAiKA,OAAO,EAEL,KAAK,EAEL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,SAAS,EACT,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AA2BlB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAa3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,2BAA2B,EAC3B,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,0CAA0C,EAC1C,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// This is the current SDK contract: unified device-first handles and atomic,\n// revision-checked host adapters. Obsolete aliases and adapter fallbacks are not\n// part of this surface; see workflows/README.md for the required host contract.\nexport type {\n AddOrganizationGroupUserInput,\n BlobInfo,\n BlobInfoAttachmentKind,\n BlobInfoDocumentReference,\n BlobInfoInput,\n BlobInfoList,\n BlobInfoSort,\n BlobInfoSortDirection,\n BlobInfoSortKey,\n BrowserLocalKeyringOptions,\n ClientDatabaseOptions,\n ContainerContents,\n ContainerContentsContextValue,\n ContainerContentsStore,\n ContainerContentsStoreOptions,\n ContainerDocumentLinkInput,\n ContainerDocumentLinks,\n ContainerDocumentObjectSyncState,\n ContainerDocumentObjectSyncStatus,\n ContainerDocumentQueries,\n ContainerDocumentSidebarRow,\n ContainerInfo,\n ContainerInfoInput,\n ContainerItemRow,\n ContainerItemSort,\n ContainerItemSortDirection,\n ContainerItemSortKey,\n ContainerNode,\n ContainerShareAccessLevel,\n CreateOrganizationOptions,\n DatabaseListener,\n DatabaseOptions,\n DatabaseSnapshot,\n DatabaseStatus,\n DeviceFirst,\n DeviceFirstContainerContents,\n DocumentAttachmentStatus,\n DocumentAttachmentUpload,\n DocumentAttributionRangesInput,\n DocumentAttributionRangesPage,\n DocumentContextValue,\n DocumentInfo,\n DocumentInfoInput,\n DocumentList,\n DocumentSort,\n DocumentSortDirection,\n DocumentSortKey,\n DocumentStore,\n DocumentSubscriptionOptions,\n Documents,\n DocumentsRuntime,\n DomainScope,\n FileSaver,\n Identity,\n IdentityGenerationResult,\n IdentityKeyPackage,\n IdentityListener,\n IdentityOptions,\n IdentitySnapshot,\n ImportedOrganizationUser,\n IndexedDbLocalKeyringManifestStoreOptions,\n IndexedDbWrappingKeyKeystoreOptions,\n LinkDocumentToContainerInput,\n ListDocumentsInput,\n LocalKeyPurpose,\n LocalKeyring,\n LocalKeyringManifest,\n LocalKeyringManifestFormat,\n LocalKeyringManifestStorage,\n LocalKeyringManifestStore,\n LocalKeyringOptions,\n LocalKeyringPinCode,\n LocalKeyringScope,\n LocalKeyringSession,\n LocalOrganizationSummary,\n LocalProjectionReconciledDelta,\n LocalProjectionSnapshot,\n LocalProjectionView,\n LocalSecretContext,\n LocalStorageLocalKeyringManifestStoreOptions,\n Logger,\n MergeDocumentSummary,\n MoveDocumentToContainerInput,\n NetworkListener,\n NetworkMode,\n NetworkStatusSource,\n NormalizedLocalKeyringScope,\n OpenContainerDocumentInput,\n OpenDocumentInput,\n OpenDocumentOptions,\n OrganizationBilling,\n OrganizationBillingHistory,\n OrganizationBillingHistoryEntry,\n OrganizationBillingManagementUrl,\n OrganizationBillingView,\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationDataUsage,\n OrganizationDirectory,\n OrganizationDirectoryAndGroups,\n OrganizationDirectoryUser,\n OrganizationGrantRef,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupDetails,\n OrganizationGroupMember,\n OrganizationGroupMembers,\n OrganizationGroupPolicyHistory,\n OrganizationGroupSummary,\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n OrganizationPolicyHistory,\n OrganizationPolicyHistoryEntry,\n OrganizationProfile,\n Organizations,\n OrganizationUserDetail,\n PendingWriteQueueItem,\n PendingWriteQueueItemStatus,\n PendingWriteQueueObjectKind,\n PendingWriteQueueOperation,\n PendingWriteQueueOperationKind,\n PendingWriteQueueOperationStatus,\n // Persistence notifications distinguish placement changes from content saves.\n PersistedDocumentListener,\n PinCodeBrowserLocalKeyringOptions,\n PinCodeWrappingKeyKeystoreOptions,\n PurgeDocumentInput,\n PurgeDocumentResult,\n ReconciliationService,\n RemoveOrganizationGroupUserInput,\n ResolvedUserIdentity,\n SaveFileRequest,\n SecurityIncident,\n SecurityIncidentListener,\n SecurityIncidentObjectKind,\n SecurityIncidents,\n Session,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionListener,\n SessionRecoverOrganizationResult,\n SessionRegistrationRefusal,\n SessionRegistrationResult,\n SessionSnapshot,\n SetActiveDocumentContainerInput,\n SetLinkedContainerIdsForDocument,\n UnlinkDocumentFromContainerInput,\n UnwrapLocalSecretInput,\n UserIdentities,\n UserSession,\n WrapLocalSecretInput,\n WrappedLocalSecretEnvelope,\n WrappedLocalSecretFormat,\n WrappingKeyHandle,\n WrappingKeyKeystore,\n WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n type BlobStoreFactory,\n Blobs,\n type ClientOptions,\n createBrowserLocalKeyring,\n createBrowserLocalKeyringManifestStore,\n createBrowserNetworkStatusSource,\n createContainerDocumentObjectSyncState,\n createDomainScope,\n createIndexedDbLocalKeyringManifestStore,\n createIndexedDbWrappingKeyKeystore,\n createLocalKeyring,\n createLocalStorageLocalKeyringManifestStore,\n createMemoryLocalKeyringManifestStore,\n createMemoryWrappingKeyKeystore,\n createPinCodeBrowserLocalKeyring,\n createPinCodeWrappingKeyKeystore,\n createRevenueCatPurchases,\n createUnavailableDirectCheckout,\n createUnavailablePurchases,\n createWebViewLocalKeyring,\n Database,\n DEFAULT_DOCUMENT_ID,\n type DirectCheckoutAppearance,\n type DirectCheckoutCapability,\n type DirectCheckoutConfirmation,\n type DirectCheckoutSession,\n DirectCheckoutUnavailableError,\n decodeLocalKeyringSqliteKey,\n Events,\n type EventsListener,\n type EventsSnapshot,\n encodeLocalKeyringSqliteKey,\n enqueueReconciliationForEvents,\n IDENTITY_KEY_PACKAGE_FORMAT,\n isPinCodeWrappedLocalSecretEnvelope,\n LOCAL_KEYRING_MANIFEST_FORMAT,\n localKeyringScopeKey,\n Network,\n normalizeLocalKeyringScope,\n type PrincipalHistoryKeyProvider,\n type PrincipalHistoryKeyScope,\n PurchaseAbortedError,\n PurchaseAlreadyOwnedError,\n PurchaseCancelledError,\n PurchaseIdentityPendingError,\n PurchaseProviderStalledError,\n type PurchasesCapability,\n PurchasesUnavailableError,\n PurgedOrganizationRecoveryBillingRequiredError,\n parseLocalKeyringManifest,\n type RevenueCatBackend,\n type RevenueCatCustomerInfo,\n type RevenueCatPackage,\n type RevenueCatPurchasesConfig,\n SyncBillingGate,\n type SyncBillingGateListener,\n type SyncPurchaseResult,\n type SyncSubscriptionOption,\n serializeLocalKeyringManifest,\n Tearleads,\n WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n BlobByteSource,\n BlobByteSourceInput,\n BlobBytes,\n BlobStore,\n DiscoveredDocumentInput,\n DocumentAttachment,\n DocumentClientProjectionDefinition,\n DocumentClientProjectionDeleteInput,\n DocumentClientProjectionSaveInput,\n DocumentFieldValidationIssue,\n DocumentProjection,\n DocumentProjectorDefinition,\n DocumentProjectorInput,\n DocumentProjectorRegistry,\n DocumentProjectorRegistryInput,\n DocumentRow,\n DocumentRowSummary,\n DocumentSummary,\n StoredDocumentKind,\n StoredDocumentState,\n StructuredDocumentMap,\n StructuredDocumentShape,\n StructuredDocumentText,\n ValidatedDocumentFields,\n} from \"./documents\";\nexport {\n addDocumentAttachments,\n blobByteSourceInputLength,\n createBlobByteSource,\n createDocumentProjectorRegistry,\n createDocumentSignerDeviceId,\n DEFAULT_DOCUMENT_ACCESS_EPOCH,\n DEFAULT_DOCUMENT_KIND,\n defaultDocumentProjectorRegistry,\n deriveStoredDocumentTitle,\n ensureDocumentAttachmentStructure,\n getDocumentAttachments,\n getDocumentClientProjectionTables,\n getStoredDocumentTypeLabel,\n getUntitledDocumentTitle,\n initializeStoredDocumentKind,\n projectStoredDocumentState,\n readBlobByteSource,\n readStoredDocumentState,\n readStringDocumentField,\n resolveOpIdAttribution,\n sameDocumentAttachments,\n summarizeDocumentContributors,\n writerByPeerId,\n writeStoredDocumentFields,\n} from \"./documents\";\nexport type {\n ContainerContentsSnapshot,\n ContainerContentsStoreRuntime,\n ContainerContentsStoreState,\n ContainerContentsStoreSyncAgent,\n ContainerContentsStoreSyncState,\n ContainerState,\n PurgeOptions,\n PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n createContainerContentsStore,\n createContainerContentsStoreState,\n createContainerContentsStoreSyncAgent,\n getOrCreateContainerContentsStore,\n isSystemContainerNode,\n requestContainerContentsDocumentPriming,\n subscribeToContainerContentsStore,\n updateContainerContentsSnapshot,\n updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n DocumentSnapshot,\n DocumentStoreFacade,\n DocumentStoreRelinkInput,\n DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n createDocumentStore,\n discardRegisteredDocumentLocalState,\n getOrCreateDocumentStore,\n openDocumentStore,\n requestDomainDocumentSync,\n subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport type {\n EncryptedBlobStoreCipher,\n EncryptedBlobStoreKey,\n EncryptedBlobStoreOptions,\n WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n createBlobStore,\n createEncryptedBlobStore,\n createLazyEncryptedBlobStore,\n createMemoryBlobStore,\n decryptDocumentAttachmentBlob,\n hydrateDocumentAttachmentBlobs,\n purgeOpfsBlobStore,\n uploadDocumentAttachment,\n wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n ContainerContentsRootAdopter,\n ContainerContentsRootAdoptionInput,\n ContainerContentsStoreWorkflowRuntime,\n ContainerContentsWorkflowRuntime,\n // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n // documentQueries variant has a different shape, so it keeps a disambiguating\n // alias on the public surface.\n ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n ContainerSystemSlotDefinition,\n RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n createContainerContentsDocumentsRuntime,\n createContainerContentsProjectionUserKeyResolver,\n createContainerContentsStoreWorkflowRuntime,\n createContainerContentsSyncLane,\n createContainerContentsWorkflowRuntime,\n createContainerParentSyncLane,\n createInitializedContainerMetadataDocument,\n defaultContainerContentsPersistence,\n deriveContainerSystemSlot,\n initializeDocumentLinksSchema,\n listBlobInfo,\n listDocumentLinkedContainerIds,\n loadContainerInfo,\n loadContainerSyncWatermark,\n loadDocumentAttributionRanges,\n loadDocumentInfo,\n replaceDocumentLinks,\n saveContainerSyncWatermark,\n syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n AggregatedContainerKekLog,\n ContainerMutationAuthor,\n ContainerReciteApi,\n ContainerWriteRefusal,\n KeyringRebuildResult,\n MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n buildMaterializedContainerRekeyPlan,\n buildRootContainerCreatePlan,\n ContainerAuthorAccessError,\n ContainerKekRepairInaccessibleError,\n ContainerKekRepairRequiredError,\n ContainerKeyringOverrideStaleError,\n ContainerPathTooDeepError,\n classifyContainerWriteRefusal,\n containerWriterProjectionFromRekeyPlan,\n createRemoteContainer,\n fetchContainerKekLog,\n GroupShareNameMismatchError,\n HistoricalWrapUnavailableError,\n type HistoricalWrapUnavailableReason,\n isProjectionVerificationCancelledError,\n moveRemoteContainer,\n rebuildKeyringEntriesFromLog,\n recoverKeyringEntryFromWraps,\n rekeyRemoteContainer,\n revokeRemoteContainer,\n rootContainerWriterProjectionFromCreatePlan,\n shareRemoteContainer,\n shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n DocumentRecord,\n DocumentSyncContainerRekeyBuilder,\n DocumentSyncPullContinuation,\n DocumentSyncUpdateIsolationError,\n DocumentsPersistence,\n DocumentsWorkflowRuntime,\n DocumentsWorkflowRuntimeInput,\n IncomingDocumentSyncUpdateValidator,\n LocalAttachmentRecord,\n PendingAttachmentRecord,\n PendingUpdateInsert,\n PendingUpdateRecord,\n SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n buildMaterializedDocumentCreatePlan,\n createDocumentProjectionUserKeyResolver,\n createDocumentsWorkflowRuntime,\n createRemoteDocument,\n DOCUMENT_SYNC_TRACE_FRAGMENT,\n DOCUMENT_SYNC_TRACE_PATTERN,\n DOCUMENTS_APP_KIND,\n DocumentRawHistoryUnavailableError,\n defaultDocumentsPersistence,\n deletePersistedDocument,\n isDatabaseUnavailableError,\n isDocumentSyncUpdateIsolationError,\n persistedDocumentCreateStateFromResponse,\n readPullContinuation,\n syncRemoteDocument,\n unwrapContainerKekPath,\n unwrapDocumentContentKeyTarget,\n validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are deliberately absent here. Integration\n// tests that compose low-level runtimes use the testing package subpath.\nexport type {\n OrganizationGroupPolicyHistoryEntry,\n OrganizationNativePurchaseEligibility,\n OrganizationPrincipalMemberChange,\n OrganizationPrincipalMemberChangeType,\n OrganizationPrincipalPolicyHistory,\n OrganizationPrincipalPolicyHistoryEntry,\n ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n buildOrganizationGroupPolicyHistory,\n buildOrganizationProfileDocumentPatch,\n buildRosterProfileDocumentPatch,\n checkNativePurchaseEligibility,\n createInitializedRosterProfileDocument,\n createOrganizationGroup,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n GroupMembershipNameMismatchError,\n getOrganizationProfileDocumentLocalId,\n getRosterProfileDocumentLocalId,\n importOrganizationUser,\n loadLocalOrganizationDataUsage,\n loadLocalOrganizationDirectoryAndGroups,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n reconcileOrganizationDataUsage,\n reconcileOrganizationDirectoryAndGroups,\n removeOrganizationGroupUser,\n resolveOrganizationBillingView,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n subscribeOrganizationReadModelInvalidation,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n CacheReferencedPrincipalPoliciesOptions,\n RecoveredPrincipalPolicyHistory,\n RecoveredScopedPrincipalPolicyHistory,\n RecoverPrincipalPolicyHistoryOptions,\n RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n cacheReferencedPrincipalPolicies,\n PrincipalPolicyHistoryReadError,\n recoverPrincipalPolicyHistory,\n recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n InitialRootMetadataBootstrap,\n ProvisionedSystemContainerSpec,\n RegisterIdentityInput,\n RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n bootstrapRootContainer,\n buildInitialOrganizationPolicyRequest,\n createInitialRootMetadataBootstrap,\n persistRegistrationBootstrap,\n registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n RootIdentitiesApi,\n RootIdentitiesPage,\n RootIdentitiesQueryInput,\n RootIdentity,\n RootIdentityDetail,\n RootIdentityOrganization,\n RootIdentitySession,\n RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n listRootDataUsageReport,\n listRootIdentities,\n listRootIdentityOrganizations,\n listRootOrganizationIdentities,\n listRootOrganizations,\n loadRootIdentity,\n loadRootOrganization,\n loadRootOrganizationDataUsage,\n type RootDataUsageApi,\n type RootDataUsageReportPage,\n type RootOrganization,\n type RootOrganizationDetail,\n type RootOrganizationIdentitiesPage,\n type RootOrganizationIdentity,\n type RootOrganizationPageQueryInput,\n type RootOrganizationsApi,\n type RootOrganizationsPage,\n type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n ClearRemoteSyncStateResult,\n DomainSyncCoordinator,\n DomainSyncSnapshot,\n RemoteResetInput,\n RemoteResetReplacement,\n SyncIdleOptions,\n SyncLane,\n SyncLaneConfig,\n SyncLaneLastAction,\n SyncLanePhase,\n SyncLaneSnapshot,\n SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n clearRemoteSyncState,\n getDomainSyncCoordinatorSnapshot,\n getOrCreateDomainSyncCoordinator,\n hasDomainSyncCoordinatorPendingWork,\n requestAllDomainSyncLanes,\n subscribeToDomainSyncCoordinator,\n waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}

package/internal/api-client/principalPolicyPages.d.ts CHANGED Viewed

@@ -10,6 +10,8 @@ export interface PrincipalPolicyPageResume {
 export interface PrincipalPolicyPageReadOptions extends RequestResultOptions {
     /** Select an exact signed head even before its first page has been read. */
     readonly stateHash?: string | undefined;
+    /** Transport offset for a caller-authenticated prefix; requires stateHash. */
+    readonly afterVersion?: number | undefined;
     readonly resume?: PrincipalPolicyPageResume | undefined;
 }
 /** Pull one page at a time; the caller owns verification and durable admission. */

package/internal/api-client/principalPolicyPages.js CHANGED Viewed

@@ -66,12 +66,20 @@ function validPage(page, expected) {
 function preparePrincipalPolicyRead(runtime, principalType, principalId, options) {
     const query = options.stateHash === undefined
         ? {}
-        : { afterVersion: 0, stateHash: options.stateHash };
+        : {
+            afterVersion: options.afterVersion ?? 0,
+            stateHash: options.stateHash,
+        };
     const basePath = getPrincipalPolicy.path(principalType, principalId);
     const failure = (message) => ({
         ok: false,
         failure: pageFailure(runtime, basePath, options, message, null),
     });
+    if (options.afterVersion !== undefined &&
+        (options.stateHash === undefined ||
+            options.resume !== undefined ||
+            !Number.isSafeInteger(options.afterVersion)))
+        return failure("Initial principal history cursor requires one exact head");
     if (!getPrincipalPolicyOperation.query.safeParse(query).success)
         return failure("Invalid requested principal history head");
     const resume = readResume(options.resume);
@@ -82,6 +90,7 @@ function preparePrincipalPolicyRead(runtime, principalType, principalId, options
     return {
         ok: true,
         firstPath: getPrincipalPolicy.path(principalType, principalId, query),
+        afterVersion: options.afterVersion ?? 0,
         resume,
     };
 }
@@ -96,7 +105,7 @@ export async function* readPrincipalPolicyPages(runtime, principalType, principa
     const context = new PrincipalHistoryRequestContext(runtime, "GET", firstPath, options);
     let pinned = resume?.current;
     let pinnedBytes = resume?.bytes;
-    let afterVersion = resume?.afterVersion ?? 0;
+    let afterVersion = resume?.afterVersion ?? position.afterVersion;
     while (true) {
         const path = pinned
             ? getPrincipalPolicy.path(principalType, principalId, {

package/internal/api-client/principalPolicyPages.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalPolicyPages.js","sourceRoot":"","sources":["principalPolicyPages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAM9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAoBhE,SAAS,gBAAgB,CAAC,IAAiC;IACzD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,aAAuC,EACvC,WAAmB,EACnB,MAAiC,EACjC,SAA6B;IAE7B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAC1C,OAAO,CACL,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,YAAY,IAAI,CAAC;QACxB,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO;QACnC,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA4C;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,KAAK,CAAC,OAAO;YAChB,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;SAC1E,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,OAAO;YACL,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;YAC3C,KAAK,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,IAAiC,EACjC,QAOC;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;IAClC,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IAC9D,OAAO,CACL,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC1D,IAAI,CAAC,YAAY,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QACtD,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAC/B,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC;QACrD,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,YAAY;QAC9C,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO;QACvC,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,KAAK,GAAG,CAAC;YAC1C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC1C,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CACjD;QACD,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YACzC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;YAC/C,CAAC,CAAC,WAAW,GAAG,YAAY;gBAC1B,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;gBAC3C,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,WAAW,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,KAAK,GACT,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;QACpC,EAAE,EAAE,KAAc;QAClB,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;KAChE,CAAC,CAAC;IACH,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QAC7D,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,CAAC,MAAM;YACN,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtE,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC;QACrE,MAAM;KACP,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,wBAAwB,CAC7C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,QAAQ,GAAG,0BAA0B,CACzC,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,OAAO,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,OAAO,EACP,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC;IAC7B,IAAI,WAAW,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,CAAC,CAAC;IAC7C,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE;gBAClD,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;aACzC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI;YACJ,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,2BAA2B;YACtC,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE;YAC5B,aAAa;YACb,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW;YACX,KAAK;YACL,YAAY;SACb,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,CACf,OAAO,EACP,IAAI,EACJ,OAAO,EACP,2DAA2D,EAC3D,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,eAAe,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,KAAK,KAAK,CAAC;QACtB,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC3D,MAAM,MAAM,CAAC;QACb,4EAA4E;QAC5E,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACtC,YAAY,GAAG,gBAAgB,CAAC;IAClC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAA6B;IAE7B,IAAI,OAA+C,CAAC;IACpD,MAAM,cAAc,GAAoD,EAAE,CAAC;IAC3E,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,wBAAwB,CACjD,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,KAAK,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAClB,OAA0B,EAC1B,IAAY,EACZ,OAA6B,EAC7B,OAAe,EACf,MAAqB;IAErB,OAAO,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC;QAC3C,IAAI,EAAE,OAAO;QACb,OAAO;QACP,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { getPrincipalPolicyOperation } from \"@tearleads/validators/operation\";\nimport type {\n PrincipalPolicyBundleResponse,\n PrincipalPolicyPageResponse,\n} from \"@tearleads/validators/response\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport { PrincipalHistoryRequestContext } from \"./principalHistoryRequestContext\";\nimport { getPrincipalPolicy } from \"./routes/principals/policy\";\nimport type { RequestResult, RequestResultOptions } from \"./types\";\n\nexport type PrincipalPolicyPageCurrent = Omit<\n PrincipalPolicyBundleResponse,\n \"previousStates\"\n>;\n\n/** A transport position. Only the caller can authenticate the saved prefix. /\nexport interface PrincipalPolicyPageResume {\n readonly current: PrincipalPolicyPageCurrent;\n readonly afterVersion: number;\n}\n\nexport interface PrincipalPolicyPageReadOptions extends RequestResultOptions {\n /* Select an exact signed head even before its first page has been read. /\n readonly stateHash?: string \| undefined;\n readonly resume?: PrincipalPolicyPageResume \| undefined;\n}\n\nfunction currentArtifacts(page: PrincipalPolicyPageResponse) {\n return {\n currentState: page.currentState,\n currentPayload: page.currentPayload,\n currentProjection: page.currentProjection,\n currentGrants: page.currentGrants,\n currentMemberEnvelopes: page.currentMemberEnvelopes,\n };\n}\n\nfunction validResume(\n principalType: \"group\" \| \"organization\",\n principalId: string,\n resume: PrincipalPolicyPageResume,\n stateHash: string \| undefined,\n): boolean {\n const state = resume.current.currentState;\n return (\n Number.isSafeInteger(resume.afterVersion) &&\n resume.afterVersion >= 0 &&\n resume.afterVersion < state.version &&\n state.principalType === principalType &&\n state.principalId === principalId &&\n (stateHash === undefined \|\| state.stateHash === stateHash)\n );\n}\n\nfunction readResume(input: PrincipalPolicyPageResume \| undefined) {\n if (input === undefined) return undefined;\n try {\n const page = {\n ...input.current,\n previousStates: [],\n historyPage: { afterVersion: input.afterVersion, nextAfterVersion: null },\n };\n if (!getPrincipalPolicy.isResponse(page)) return undefined;\n const current = structuredClone(currentArtifacts(page));\n return {\n current,\n afterVersion: page.historyPage.afterVersion,\n bytes: serializeKeyingCanonicalJson(current),\n };\n } catch {\n return undefined;\n }\n}\n\nfunction validPage(\n page: PrincipalPolicyPageResponse,\n expected: {\n principalType: \"group\" \| \"organization\";\n principalId: string;\n stateHash: string \| undefined;\n pinnedBytes: string \| undefined;\n bytes: string;\n afterVersion: number;\n },\n): boolean {\n const { afterVersion } = expected;\n const lastVersion = afterVersion + page.previousStates.length;\n return (\n page.currentState.principalType === expected.principalType &&\n page.currentState.principalId === expected.principalId &&\n (expected.stateHash === undefined \|\|\n page.currentState.stateHash === expected.stateHash) &&\n (expected.pinnedBytes === undefined \|\|\n expected.bytes === expected.pinnedBytes) &&\n page.historyPage.afterVersion === afterVersion &&\n lastVersion < page.currentState.version &&\n page.previousStates.every(\n ({ state }, index) =>\n state.version === afterVersion + index + 1 &&\n state.principalId === expected.principalId &&\n state.principalType === expected.principalType,\n ) &&\n (page.historyPage.nextAfterVersion === null\n ? lastVersion === page.currentState.version - 1\n : lastVersion > afterVersion &&\n lastVersion < page.currentState.version - 1 &&\n page.historyPage.nextAfterVersion === lastVersion)\n );\n}\n\nfunction preparePrincipalPolicyRead(\n runtime: ApiRequestRuntime,\n principalType: \"group\" \| \"organization\",\n principalId: string,\n options: PrincipalPolicyPageReadOptions,\n) {\n const query =\n options.stateHash === undefined\n ? {}\n : { afterVersion: 0, stateHash: options.stateHash };\n const basePath = getPrincipalPolicy.path(principalType, principalId);\n const failure = (message: string) => ({\n ok: false as const,\n failure: pageFailure(runtime, basePath, options, message, null),\n });\n if (!getPrincipalPolicyOperation.query.safeParse(query).success)\n return failure(\"Invalid requested principal history head\");\n const resume = readResume(options.resume);\n if (\n options.resume !== undefined &&\n (!resume \|\|\n !validResume(principalType, principalId, resume, options.stateHash))\n )\n return failure(\"Invalid saved principal history position\");\n return {\n ok: true as const,\n firstPath: getPrincipalPolicy.path(principalType, principalId, query),\n resume,\n };\n}\n\n/* Pull one page at a time; the caller owns verification and durable admission. /\nexport async function readPrincipalPolicyPages(\n runtime: ApiRequestRuntime,\n principalType: \"group\" \| \"organization\",\n principalId: string,\n options: PrincipalPolicyPageReadOptions,\n): AsyncGenerator<RequestResult<PrincipalPolicyPageResponse>, void> {\n const position = preparePrincipalPolicyRead(\n runtime,\n principalType,\n principalId,\n options,\n );\n if (!position.ok) {\n yield position.failure;\n return;\n }\n const { firstPath, resume } = position;\n const context = new PrincipalHistoryRequestContext(\n runtime,\n \"GET\",\n firstPath,\n options,\n );\n let pinned = resume?.current;\n let pinnedBytes = resume?.bytes;\n let afterVersion = resume?.afterVersion ?? 0;\n while (true) {\n const path = pinned\n ? getPrincipalPolicy.path(principalType, principalId, {\n afterVersion,\n stateHash: pinned.currentState.stateHash,\n })\n : firstPath;\n const result = await principalHistoryRequest(runtime, {\n path,\n validator: getPrincipalPolicy.isResponse,\n method: \"GET\",\n operation: getPrincipalPolicyOperation,\n options,\n context,\n });\n if (!result.ok) {\n yield result;\n return;\n }\n const page = result.data;\n const artifacts = currentArtifacts(page);\n const bytes = serializeKeyingCanonicalJson(artifacts);\n const valid = validPage(page, {\n principalType,\n principalId,\n stateHash: options.stateHash,\n pinnedBytes,\n bytes,\n afterVersion,\n });\n if (!valid) {\n yield pageFailure(\n runtime,\n path,\n options,\n \"Principal history page changed its head, order, or cursor\",\n 200,\n );\n return;\n }\n pinned ??= structuredClone(artifacts);\n pinnedBytes ??= bytes;\n context.afterReadPage();\n const nextAfterVersion = page.historyPage.nextAfterVersion;\n yield result;\n // A page consumer may await verification or storage while its session ends.\n if (context.cancelled()) {\n yield context.failure();\n return;\n }\n if (nextAfterVersion === null) return;\n afterVersion = nextAfterVersion;\n }\n}\n\n/** Full-bundle adapter for consumers that have not adopted durable staging. */\nexport async function collectPrincipalPolicyPages(\n runtime: ApiRequestRuntime,\n principalType: \"group\" \| \"organization\",\n principalId: string,\n options: RequestResultOptions,\n): Promise<PrincipalPolicyBundleResponse \| null> {\n let current: PrincipalPolicyPageCurrent \| undefined;\n const previousStates: PrincipalPolicyBundleResponse[\"previousStates\"] = [];\n for await (const result of readPrincipalPolicyPages(\n runtime,\n principalType,\n principalId,\n options,\n )) {\n if (!result.ok) return null;\n current ??= currentArtifacts(result.data);\n previousStates.push(...result.data.previousStates);\n }\n return current ? { ...current, previousStates } : null;\n}\n\nfunction pageFailure(\n runtime: ApiRequestRuntime,\n path: string,\n options: RequestResultOptions,\n message: string,\n status: number \| null,\n) {\n return runtime.responseRequest.reportFailure({\n kind: \"shape\",\n message,\n method: \"GET\",\n options,\n path,\n status,\n statusText: \"\",\n });\n}\n"]}
1	+ {"version":3,"file":"principalPolicyPages.js","sourceRoot":"","sources":["principalPolicyPages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAM9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAsBhE,SAAS,gBAAgB,CAAC,IAAiC;IACzD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,aAAuC,EACvC,WAAmB,EACnB,MAAiC,EACjC,SAA6B;IAE7B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAC1C,OAAO,CACL,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,YAAY,IAAI,CAAC;QACxB,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO;QACnC,KAAK,CAAC,aAAa,KAAK,aAAa;QACrC,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA4C;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,KAAK,CAAC,OAAO;YAChB,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE;SAC1E,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,OAAO;YACL,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;YAC3C,KAAK,EAAE,4BAA4B,CAAC,OAAO,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,IAAiC,EACjC,QAOC;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;IAClC,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IAC9D,OAAO,CACL,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAC1D,IAAI,CAAC,YAAY,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QACtD,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAC/B,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC;QACrD,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,YAAY;QAC9C,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO;QACvC,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,OAAO,KAAK,YAAY,GAAG,KAAK,GAAG,CAAC;YAC1C,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC1C,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,CACjD;QACD,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YACzC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;YAC/C,CAAC,CAAC,WAAW,GAAG,YAAY;gBAC1B,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC;gBAC3C,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,WAAW,CAAC,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,KAAK,GACT,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;QACpC,EAAE,EAAE,KAAc;QAClB,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;KAChE,CAAC,CAAC;IACH,IACE,OAAO,CAAC,YAAY,KAAK,SAAS;QAClC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YAC9B,OAAO,CAAC,MAAM,KAAK,SAAS;YAC5B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC,0DAA0D,CAAC,CAAC;IAC7E,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QAC7D,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IACE,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,CAAC,MAAM;YACN,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtE,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC;QACrE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;QACvC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,wBAAwB,CAC7C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAAuC;IAEvC,MAAM,QAAQ,GAAG,0BAA0B,CACzC,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,OAAO,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,OAAO,EACP,KAAK,EACL,SAAS,EACT,OAAO,CACR,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC;IAC7B,IAAI,WAAW,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;IACjE,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE;gBAClD,YAAY;gBACZ,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;aACzC,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI;YACJ,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,2BAA2B;YACtC,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE;YAC5B,aAAa;YACb,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW;YACX,KAAK;YACL,YAAY;SACb,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,CACf,OAAO,EACP,IAAI,EACJ,OAAO,EACP,2DAA2D,EAC3D,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,eAAe,CAAC,SAAS,CAAC,CAAC;QACtC,WAAW,KAAK,KAAK,CAAC;QACtB,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC3D,MAAM,MAAM,CAAC;QACb,4EAA4E;QAC5E,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACtC,YAAY,GAAG,gBAAgB,CAAC;IAClC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA0B,EAC1B,aAAuC,EACvC,WAAmB,EACnB,OAA6B;IAE7B,IAAI,OAA+C,CAAC;IACpD,MAAM,cAAc,GAAoD,EAAE,CAAC;IAC3E,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,wBAAwB,CACjD,OAAO,EACP,aAAa,EACb,WAAW,EACX,OAAO,CACR,EAAE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,KAAK,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAClB,OAA0B,EAC1B,IAAY,EACZ,OAA6B,EAC7B,OAAe,EACf,MAAqB;IAErB,OAAO,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC;QAC3C,IAAI,EAAE,OAAO;QACb,OAAO;QACP,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport { getPrincipalPolicyOperation } from \"@tearleads/validators/operation\";\nimport type {\n PrincipalPolicyBundleResponse,\n PrincipalPolicyPageResponse,\n} from \"@tearleads/validators/response\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport { PrincipalHistoryRequestContext } from \"./principalHistoryRequestContext\";\nimport { getPrincipalPolicy } from \"./routes/principals/policy\";\nimport type { RequestResult, RequestResultOptions } from \"./types\";\n\nexport type PrincipalPolicyPageCurrent = Omit<\n PrincipalPolicyBundleResponse,\n \"previousStates\"\n>;\n\n/** A transport position. Only the caller can authenticate the saved prefix. /\nexport interface PrincipalPolicyPageResume {\n readonly current: PrincipalPolicyPageCurrent;\n readonly afterVersion: number;\n}\n\nexport interface PrincipalPolicyPageReadOptions extends RequestResultOptions {\n /* Select an exact signed head even before its first page has been read. /\n readonly stateHash?: string \| undefined;\n /* Transport offset for a caller-authenticated prefix; requires stateHash. /\n readonly afterVersion?: number \| undefined;\n readonly resume?: PrincipalPolicyPageResume \| undefined;\n}\n\nfunction currentArtifacts(page: PrincipalPolicyPageResponse) {\n return {\n currentState: page.currentState,\n currentPayload: page.currentPayload,\n currentProjection: page.currentProjection,\n currentGrants: page.currentGrants,\n currentMemberEnvelopes: page.currentMemberEnvelopes,\n };\n}\n\nfunction validResume(\n principalType: \"group\" \| \"organization\",\n principalId: string,\n resume: PrincipalPolicyPageResume,\n stateHash: string \| undefined,\n): boolean {\n const state = resume.current.currentState;\n return (\n Number.isSafeInteger(resume.afterVersion) &&\n resume.afterVersion >= 0 &&\n resume.afterVersion < state.version &&\n state.principalType === principalType &&\n state.principalId === principalId &&\n (stateHash === undefined \|\| state.stateHash === stateHash)\n );\n}\n\nfunction readResume(input: PrincipalPolicyPageResume \| undefined) {\n if (input === undefined) return undefined;\n try {\n const page = {\n ...input.current,\n previousStates: [],\n historyPage: { afterVersion: input.afterVersion, nextAfterVersion: null },\n };\n if (!getPrincipalPolicy.isResponse(page)) return undefined;\n const current = structuredClone(currentArtifacts(page));\n return {\n current,\n afterVersion: page.historyPage.afterVersion,\n bytes: serializeKeyingCanonicalJson(current),\n };\n } catch {\n return undefined;\n }\n}\n\nfunction validPage(\n page: PrincipalPolicyPageResponse,\n expected: {\n principalType: \"group\" \| \"organization\";\n principalId: string;\n stateHash: string \| undefined;\n pinnedBytes: string \| undefined;\n bytes: string;\n afterVersion: number;\n },\n): boolean {\n const { afterVersion } = expected;\n const lastVersion = afterVersion + page.previousStates.length;\n return (\n page.currentState.principalType === expected.principalType &&\n page.currentState.principalId === expected.principalId &&\n (expected.stateHash === undefined \|\|\n page.currentState.stateHash === expected.stateHash) &&\n (expected.pinnedBytes === undefined \|\|\n expected.bytes === expected.pinnedBytes) &&\n page.historyPage.afterVersion === afterVersion &&\n lastVersion < page.currentState.version &&\n page.previousStates.every(\n ({ state }, index) =>\n state.version === afterVersion + index + 1 &&\n state.principalId === expected.principalId &&\n state.principalType === expected.principalType,\n ) &&\n (page.historyPage.nextAfterVersion === null\n ? lastVersion === page.currentState.version - 1\n : lastVersion > afterVersion &&\n lastVersion < page.currentState.version - 1 &&\n page.historyPage.nextAfterVersion === lastVersion)\n );\n}\n\nfunction preparePrincipalPolicyRead(\n runtime: ApiRequestRuntime,\n principalType: \"group\" \| \"organization\",\n principalId: string,\n options: PrincipalPolicyPageReadOptions,\n) {\n const query =\n options.stateHash === undefined\n ? {}\n : {\n afterVersion: options.afterVersion ?? 0,\n stateHash: options.stateHash,\n };\n const basePath = getPrincipalPolicy.path(principalType, principalId);\n const failure = (message: string) => ({\n ok: false as const,\n failure: pageFailure(runtime, basePath, options, message, null),\n });\n if (\n options.afterVersion !== undefined &&\n (options.stateHash === undefined \|\|\n options.resume !== undefined \|\|\n !Number.isSafeInteger(options.afterVersion))\n )\n return failure(\"Initial principal history cursor requires one exact head\");\n if (!getPrincipalPolicyOperation.query.safeParse(query).success)\n return failure(\"Invalid requested principal history head\");\n const resume = readResume(options.resume);\n if (\n options.resume !== undefined &&\n (!resume \|\|\n !validResume(principalType, principalId, resume, options.stateHash))\n )\n return failure(\"Invalid saved principal history position\");\n return {\n ok: true as const,\n firstPath: getPrincipalPolicy.path(principalType, principalId, query),\n afterVersion: options.afterVersion ?? 0,\n resume,\n };\n}\n\n/* Pull one page at a time; the caller owns verification and durable admission. /\nexport async function readPrincipalPolicyPages(\n runtime: ApiRequestRuntime,\n principalType: \"group\" \| \"organization\",\n principalId: string,\n options: PrincipalPolicyPageReadOptions,\n): AsyncGenerator<RequestResult<PrincipalPolicyPageResponse>, void> {\n const position = preparePrincipalPolicyRead(\n runtime,\n principalType,\n principalId,\n options,\n );\n if (!position.ok) {\n yield position.failure;\n return;\n }\n const { firstPath, resume } = position;\n const context = new PrincipalHistoryRequestContext(\n runtime,\n \"GET\",\n firstPath,\n options,\n );\n let pinned = resume?.current;\n let pinnedBytes = resume?.bytes;\n let afterVersion = resume?.afterVersion ?? position.afterVersion;\n while (true) {\n const path = pinned\n ? getPrincipalPolicy.path(principalType, principalId, {\n afterVersion,\n stateHash: pinned.currentState.stateHash,\n })\n : firstPath;\n const result = await principalHistoryRequest(runtime, {\n path,\n validator: getPrincipalPolicy.isResponse,\n method: \"GET\",\n operation: getPrincipalPolicyOperation,\n options,\n context,\n });\n if (!result.ok) {\n yield result;\n return;\n }\n const page = result.data;\n const artifacts = currentArtifacts(page);\n const bytes = serializeKeyingCanonicalJson(artifacts);\n const valid = validPage(page, {\n principalType,\n principalId,\n stateHash: options.stateHash,\n pinnedBytes,\n bytes,\n afterVersion,\n });\n if (!valid) {\n yield pageFailure(\n runtime,\n path,\n options,\n \"Principal history page changed its head, order, or cursor\",\n 200,\n );\n return;\n }\n pinned ??= structuredClone(artifacts);\n pinnedBytes ??= bytes;\n context.afterReadPage();\n const nextAfterVersion = page.historyPage.nextAfterVersion;\n yield result;\n // A page consumer may await verification or storage while its session ends.\n if (context.cancelled()) {\n yield context.failure();\n return;\n }\n if (nextAfterVersion === null) return;\n afterVersion = nextAfterVersion;\n }\n}\n\n/** Full-bundle adapter for consumers that have not adopted durable staging. */\nexport async function collectPrincipalPolicyPages(\n runtime: ApiRequestRuntime,\n principalType: \"group\" \| \"organization\",\n principalId: string,\n options: RequestResultOptions,\n): Promise<PrincipalPolicyBundleResponse \| null> {\n let current: PrincipalPolicyPageCurrent \| undefined;\n const previousStates: PrincipalPolicyBundleResponse[\"previousStates\"] = [];\n for await (const result of readPrincipalPolicyPages(\n runtime,\n principalType,\n principalId,\n options,\n )) {\n if (!result.ok) return null;\n current ??= currentArtifacts(result.data);\n previousStates.push(...result.data.previousStates);\n }\n return current ? { ...current, previousStates } : null;\n}\n\nfunction pageFailure(\n runtime: ApiRequestRuntime,\n path: string,\n options: RequestResultOptions,\n message: string,\n status: number \| null,\n) {\n return runtime.responseRequest.reportFailure({\n kind: \"shape\",\n message,\n method: \"GET\",\n options,\n path,\n status,\n statusText: \"\",\n });\n}\n"]}

package/internal/crypto/index.d.ts CHANGED Viewed

@@ -20,7 +20,7 @@ export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, type IdentitySeedPhraseKeyPairs, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, type IncrementalSha256, } from "./incrementalSha256.js";
 export type { AccessEvent, AccessEventType, AccessManifest, AccessManifestCheckpoint, AccessManifestTransparencyLeaf, AccessObjectKind, AnyVerifiedAccessManifest, AnyVerifiedPrincipalPolicy, AttachmentAccessEventBody, AttachmentBindAccessEventBody, AttachmentDetachAccessEventBody, BlobAccessManifest, BlobContentKeyTarget, ContainerAccessEventBody, ContainerAccessKeyState, ContainerAccessLevel, ContainerAccessManifest, ContainerAccessManifestState, ContainerAccessStructural, ContainerCreateAccessEventBody, ContainerDirectGrant, ContainerGrantAccessEventBody, ContainerGrantPrincipalHead, ContainerGrantSubjectType, ContainerKekKeyring, ContainerKekKeyringEntry, ContainerKekPredecessorBridge, ContainerKekRecipientTarget, ContainerKekTarget, ContainerKeyEpoch, ContainerKeyWrap, ContainerMoveAccessEventBody, ContainerReciteAccessEventBody, ContainerRekeyAccessEventBody, ContainerRevokeAccessEventBody, ContainerUserRecipientKey, ContentObjectKind, ContentRecordEncryptionSuite, ContentRecordNonceDomain, DeriveBlobKekTargetsInput, DeriveContainerKekRecipientTargetsInput, DeriveDocumentKekTargetsInput, DocumentAccessEventBody, DocumentContentKeyTarget, DocumentContentRecordMetadataInput, DocumentLinkAccessEventBody, DocumentLinkSetManifestState, DocumentLinkSetStructural, DocumentPurgeAccessEventBody, DocumentUnlinkAccessEventBody, IdentityStateCheckpoint, IdentityStateHead, IdentityStateTransparencyLeaf, KekRecipientKind, KeyingCanonicalJson, KeyingHashDomain, KeyingLocalCheckpointStore, KeyingVerificationCode, KeyingVerificationResult, ManagedPrincipalKind, PrincipalHistoryIndexNode, PrincipalPolicyAuthorization, PrincipalPolicyBundle, PrincipalPolicyCheckpoint, PrincipalPolicyCurrent, PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, PrincipalPolicyHistoryInput, PrincipalPolicyHistoryPage, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryReferenceProof, PrincipalPolicyHistoryVerifier, PrincipalPolicyMemberEnvelopes, PrincipalPolicyPayload, PrincipalPolicySignedState, PrincipalPolicySignerPublicKey, PrincipalPolicySnapshot, PrincipalPolicyStateChainEntry, PrincipalPolicyTransitionMismatch, PrincipalPolicyTransitionMismatchCode, PrincipalPolicyTransparencyLeaf, ReferencedPrincipalHead, SignedTransparencyTreeHead, TransparencyConsistencyProof, TransparencyInclusionProof, TransparencyLeaf, TransparencyLeafKind, TransparencyTreeCheckpoint, UnsignedAccessEvent, UnsignedTransparencyTreeHead, UnsignedWriteHeader, VerifiedAccessEvent, VerifiedAccessManifest, VerifiedAccessManifestCheckpointEvidence, VerifiedAccessManifestSnapshot, VerifiedAttachmentBinding, VerifiedAttachmentDetach, VerifiedBlobKekTargets, VerifiedContainerAccessManifest, VerifiedContainerKekState, VerifiedContainerParentEdge, VerifiedDocumentKekTargets, VerifiedDocumentLinkSetManifest, VerifiedDocumentLinkSetSnapshot, VerifiedDocumentLinkSetStateEvidence, VerifiedIdentityState, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent, VerifiedPrincipalPolicyHistory, VerifiedPrincipalPolicySelection, VerifiedPrincipalPolicySnapshot, VerifiedTransparencyProof, VerifiedTransparencyTreeHead, VerifiedWriteHeader, VerifyAccessEventInput, VerifyAccessManifestInput, VerifyAttachmentBindingEventInput, VerifyAttachmentDetachEventInput, VerifyContainerAccessManifestInput, VerifyContainerKekStateInput, VerifyContainerParentEdgeInput, VerifyDocumentLinkSetManifestInput, VerifyDocumentPurgeEventInput, VerifyIdentityStateCheckpointInput, VerifyPrincipalPolicyBundleInput, VerifyPrincipalPolicySnapshotInput, VerifySignedTransparencyTreeHeadInput, VerifyTransparencyConsistencyProofInput, VerifyTransparencyInclusionProofInput, VerifyTransparencyProofInput, VerifyWriteHeaderInput, WriteHeader, } from "./keying.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, type VerifiedOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js CHANGED Viewed

@@ -14,7 +14,7 @@ export { decryptGroupMetadata, encodeBuiltinGroupMetadata, encryptGroupMetadata,
 export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, } from "./incrementalSha256.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n BlobEnvelopeHeaderRecord,\n BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n MAX_BLOB_ENVELOPE_HEADER_BYTES,\n parseBlobEnvelopeV2,\n parseBlobEnvelopeV2Header,\n readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n BLOB_CHUNK_SIZE_BYTES,\n BLOB_ENCRYPTED_BYTES_FORMAT,\n BLOB_ENCRYPTED_BYTES_VERSION,\n BLOB_ENVELOPE_MAGIC_BYTES,\n BLOB_ENVELOPE_PREFIX_BYTES,\n blobChunkPlaintextByteLength,\n computeBlobChunkCount,\n computeBlobEncryptedByteLength,\n deriveBlobChunkIv,\n encodeBlobEnvelopeV2Header,\n joinBlobPartBytes,\n MAX_BLOB_CHUNK_COUNT,\n normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n AUTH_CHALLENGE_BYTES,\n AUTH_CHALLENGE_HEX_LENGTH,\n authChallengeSigningBytes,\n CHALLENGE_TTL_SECONDS,\n canonicalAuthOrigin,\n generateChallenge,\n} from \"./challenge\";\nexport type {\n ContentKeyEnvelopeKind,\n ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n ContentKeyEnvelopeError,\n decodeContentKeyEnvelope,\n unwrapContentKey,\n wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n generateKemKeyPair,\n generateKemSeedAndKeyPair,\n ML_KEM1024_CIPHERTEXT_BYTES,\n ML_KEM1024_PUBLIC_KEY_BYTES,\n ML_KEM1024_SECRET_KEY_BYTES,\n ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n decryptGroupMetadata,\n encodeBuiltinGroupMetadata,\n encryptGroupMetadata,\n type GroupMetadata,\n type GroupMetadataKey,\n readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n createIdentitySeedPhrase,\n createIdentitySeedPhraseFromEntropy,\n generateIdentityKeyPairsFromSeedPhrase,\n IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n IDENTITY_SEED_PHRASE_WORDS,\n type IdentitySeedPhraseKeyPairs,\n normalizeIdentitySeedPhrase,\n validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n createIncrementalSha256,\n type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n AccessEvent,\n AccessEventType,\n AccessManifest,\n AccessManifestCheckpoint,\n AccessManifestTransparencyLeaf,\n AccessObjectKind,\n AnyVerifiedAccessManifest,\n AnyVerifiedPrincipalPolicy,\n AttachmentAccessEventBody,\n AttachmentBindAccessEventBody,\n AttachmentDetachAccessEventBody,\n BlobAccessManifest,\n BlobContentKeyTarget,\n ContainerAccessEventBody,\n ContainerAccessKeyState,\n ContainerAccessLevel,\n ContainerAccessManifest,\n ContainerAccessManifestState,\n ContainerAccessStructural,\n ContainerCreateAccessEventBody,\n ContainerDirectGrant,\n ContainerGrantAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerGrantSubjectType,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n ContainerKekRecipientTarget,\n ContainerKekTarget,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerReciteAccessEventBody,\n ContainerRekeyAccessEventBody,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n ContentObjectKind,\n ContentRecordEncryptionSuite,\n ContentRecordNonceDomain,\n DeriveBlobKekTargetsInput,\n DeriveContainerKekRecipientTargetsInput,\n DeriveDocumentKekTargetsInput,\n DocumentAccessEventBody,\n DocumentContentKeyTarget,\n DocumentContentRecordMetadataInput,\n DocumentLinkAccessEventBody,\n DocumentLinkSetManifestState,\n DocumentLinkSetStructural,\n DocumentPurgeAccessEventBody,\n DocumentUnlinkAccessEventBody,\n IdentityStateCheckpoint,\n IdentityStateHead,\n IdentityStateTransparencyLeaf,\n KekRecipientKind,\n KeyingCanonicalJson,\n KeyingHashDomain,\n KeyingLocalCheckpointStore,\n KeyingVerificationCode,\n KeyingVerificationResult,\n ManagedPrincipalKind,\n PrincipalHistoryIndexNode,\n PrincipalPolicyAuthorization,\n PrincipalPolicyBundle,\n PrincipalPolicyCheckpoint,\n PrincipalPolicyCurrent,\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryReferenceProof,\n PrincipalPolicyHistoryVerifier,\n PrincipalPolicyMemberEnvelopes,\n PrincipalPolicyPayload,\n PrincipalPolicySignedState,\n PrincipalPolicySignerPublicKey,\n PrincipalPolicySnapshot,\n PrincipalPolicyStateChainEntry,\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n PrincipalPolicyTransparencyLeaf,\n ReferencedPrincipalHead,\n SignedTransparencyTreeHead,\n TransparencyConsistencyProof,\n TransparencyInclusionProof,\n TransparencyLeaf,\n TransparencyLeafKind,\n TransparencyTreeCheckpoint,\n UnsignedAccessEvent,\n UnsignedTransparencyTreeHead,\n UnsignedWriteHeader,\n VerifiedAccessEvent,\n VerifiedAccessManifest,\n VerifiedAccessManifestCheckpointEvidence,\n VerifiedAccessManifestSnapshot,\n VerifiedAttachmentBinding,\n VerifiedAttachmentDetach,\n VerifiedBlobKekTargets,\n VerifiedContainerAccessManifest,\n VerifiedContainerKekState,\n VerifiedContainerParentEdge,\n VerifiedDocumentKekTargets,\n VerifiedDocumentLinkSetManifest,\n VerifiedDocumentLinkSetSnapshot,\n VerifiedDocumentLinkSetStateEvidence,\n VerifiedIdentityState,\n VerifiedPrincipalPolicy,\n VerifiedPrincipalPolicyCurrent,\n VerifiedPrincipalPolicyHistory,\n VerifiedPrincipalPolicySelection,\n VerifiedPrincipalPolicySnapshot,\n VerifiedTransparencyProof,\n VerifiedTransparencyTreeHead,\n VerifiedWriteHeader,\n VerifyAccessEventInput,\n VerifyAccessManifestInput,\n VerifyAttachmentBindingEventInput,\n VerifyAttachmentDetachEventInput,\n VerifyContainerAccessManifestInput,\n VerifyContainerKekStateInput,\n VerifyContainerParentEdgeInput,\n VerifyDocumentLinkSetManifestInput,\n VerifyDocumentPurgeEventInput,\n VerifyIdentityStateCheckpointInput,\n VerifyPrincipalPolicyBundleInput,\n VerifyPrincipalPolicySnapshotInput,\n VerifySignedTransparencyTreeHeadInput,\n VerifyTransparencyConsistencyProofInput,\n VerifyTransparencyInclusionProofInput,\n VerifyTransparencyProofInput,\n VerifyWriteHeaderInput,\n WriteHeader,\n} from \"./keying\";\nexport {\n ACCESS_MANIFEST_VERIFICATION_REVISION,\n accessManifestCheckpointFromManifest,\n accessManifestTransparencyLeaf,\n assertSealedContainerKekKeyringLength,\n BLOB_CONTENT_KEY_WRAP_SUITE,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n CONTAINER_KEK_KEYRING_SEAL_SUITE,\n CONTAINER_KEK_MATERIAL_ID_PREFIX,\n CONTAINER_KEK_PARENT_WRAP_SUITE,\n CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n CONTAINER_KEK_USER_WRAP_SUITE,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeAccessEventBodyHash,\n computeAccessEventHash,\n computeAccessManifestHash,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContainerAccessKeyTargetHash,\n computeContainerAccessStructuralHash,\n computeContainerDirectGrantRoot,\n computeContainerKekKeyringHash,\n computeContainerKekMaterialId,\n computeContainerKekPredecessorBridgeHash,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n computeContentRecordNonceDomainHash,\n computeDocumentContentKeyTargetHash,\n computeDocumentContentRecordCiphertextHash,\n computeDocumentContentRecordMetadataHash,\n computeDocumentContentRecordPlaintextHash,\n computeDocumentLinkSetGrantRoot,\n computeDocumentLinkSetKeyTargetHash,\n computeDocumentLinkSetStructuralHash,\n computeKeyingDomainHash,\n computeTransparencyLeafHash,\n computeTransparencyMerkleRoot,\n computeWriteHeaderHash,\n createContainerKekPredecessorBridge,\n createPrincipalHistoryIndexProof,\n createPrincipalPolicyHistoryVerifier,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n deriveBlobKekTargets,\n deriveContainerAccessManifest,\n deriveContainerKekRecipientTargets,\n deriveContainerKekWrappingPublicKey,\n deriveDocumentKekTargets,\n deriveDocumentLinkSetManifest,\n derivePrincipalRecipientKeyEpochId,\n documentContentRecordMetadata,\n expectedSealedContainerKekKeyringBytes,\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n identityStateTransparencyLeaf,\n isContainerKekMaterialId,\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n KeyingVerificationError,\n MAX_CONTAINER_KEY_EPOCH,\n MAX_CONTAINER_RECITATION_EPOCH,\n makeVerifiedAccessEvent,\n makeVerifiedBlobKekTargets,\n makeVerifiedContainerAccessManifest,\n makeVerifiedContainerKekState,\n makeVerifiedDocumentKekTargets,\n makeVerifiedDocumentLinkSetManifest,\n makeVerifiedDocumentLinkSetSnapshot,\n makeVerifiedPrincipalPolicy,\n normalizeAttachmentAccessEventBody,\n normalizeContainerAccessEventBody,\n normalizeContainerKekKeyring,\n normalizeContainerKekPredecessorBridge,\n normalizeDocumentAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n openContainerKekKeyring,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n principalPolicyMatchesReference,\n principalPolicyTransparencyLeaf,\n resolveContainerPathUserAccessLevel,\n resolveContainerStatePathUserAccessLevel,\n resolveHistoricalContainerPathUserAccessLevel,\n restorePrincipalPolicyHistoryVerifier,\n sealContainerKekKeyring,\n selectPrincipalPolicyAuthorization,\n serializeKeyingCanonicalJson,\n signAccessEvent,\n signTransparencyTreeHead,\n signWriteHeader,\n unwrapContainerKekParentWrap,\n unwrapContainerKekPredecessorBridge,\n verifyAccessManifest,\n verifyAccessManifestLocalCheckpoint,\n verifyAccessManifestSnapshot,\n verifyAttachmentBindingEvent,\n verifyAttachmentDetachEvent,\n verifyContainerAccessManifest,\n verifyContainerKekKeyringEntry,\n verifyContainerKekState,\n verifyContainerParentEdge,\n verifyDocumentLinkSetManifest,\n verifyDocumentLinkSetSnapshot,\n verifyDocumentPurgeEvent,\n verifyIdentityStateCheckpoint,\n verifyPrincipalPolicyBundle,\n verifyPrincipalPolicyBundleAgainstHistory,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n verifyPrincipalPolicyHistoryReferences,\n verifyPrincipalPolicySnapshot,\n verifySignedAccessEvent,\n verifySignedTransparencyTreeHead,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n verifyTransparencyProof,\n verifyWriteHeader,\n} from \"./keying\";\nexport {\n organizationReplacementAuthorizationPayload,\n organizationReplacementSigningBytes,\n signOrganizationReplacementAuthorization,\n type VerifiedOrganizationReplacementAuthorization,\n verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n computePrincipalContainerGrantRoot,\n normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n computePrincipalMemberEnvelopesRoot,\n normalizePrincipalStateMemberEnvelopes,\n PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n PrincipalPolicyValidationError,\n throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n ManagedRecipientPrincipalType,\n PrincipalContainerGrant,\n PrincipalContainerGrantAccessLevel,\n PrincipalProjectionMember,\n PrincipalProjectionRole,\n PrincipalStateExternalAuthority,\n PrincipalStateHeaderInput,\n PrincipalStateMember,\n PrincipalStateMemberEnvelope,\n PrincipalStateMembershipMode,\n PrincipalStatePayloadCipherSuite,\n PrincipalStateSigningInput,\n SignedPrincipalState,\n UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n buildPrincipalStateSigningInput,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStateHash,\n computePrincipalStatePayloadCiphertextHash,\n derivePrincipalProjectionMembers,\n isManagedRecipientPrincipalType,\n isPrincipalProjectionRole,\n normalizePrincipalProjectionMembers,\n normalizePrincipalStateMembers,\n serializeUnsignedPrincipalState,\n signPrincipalState,\n} from \"./principalState\";\nexport {\n verifySignedPrincipalState,\n verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n captureProjectionHistory,\n type HistoryProjection,\n omitProjectionHistory,\n type RetainedProjectionHistory,\n restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n generateSigningKeyPair,\n generateSigningSeedAndKeyPair,\n ML_DSA87_PUBLIC_KEY_BYTES,\n ML_DSA87_SECRET_KEY_BYTES,\n ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n AES_256_KEY_BYTES,\n AES_GCM_IV_BYTES,\n AES_GCM_TAG_BYTES,\n assertAesGcmIv,\n createAesGcmIv,\n decryptWithDek,\n encryptWithDek,\n} from \"./symmetric\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n BlobEnvelopeHeaderRecord,\n BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n MAX_BLOB_ENVELOPE_HEADER_BYTES,\n parseBlobEnvelopeV2,\n parseBlobEnvelopeV2Header,\n readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n BLOB_CHUNK_SIZE_BYTES,\n BLOB_ENCRYPTED_BYTES_FORMAT,\n BLOB_ENCRYPTED_BYTES_VERSION,\n BLOB_ENVELOPE_MAGIC_BYTES,\n BLOB_ENVELOPE_PREFIX_BYTES,\n blobChunkPlaintextByteLength,\n computeBlobChunkCount,\n computeBlobEncryptedByteLength,\n deriveBlobChunkIv,\n encodeBlobEnvelopeV2Header,\n joinBlobPartBytes,\n MAX_BLOB_CHUNK_COUNT,\n normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n AUTH_CHALLENGE_BYTES,\n AUTH_CHALLENGE_HEX_LENGTH,\n authChallengeSigningBytes,\n CHALLENGE_TTL_SECONDS,\n canonicalAuthOrigin,\n generateChallenge,\n} from \"./challenge\";\nexport type {\n ContentKeyEnvelopeKind,\n ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n ContentKeyEnvelopeError,\n decodeContentKeyEnvelope,\n unwrapContentKey,\n wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n generateKemKeyPair,\n generateKemSeedAndKeyPair,\n ML_KEM1024_CIPHERTEXT_BYTES,\n ML_KEM1024_PUBLIC_KEY_BYTES,\n ML_KEM1024_SECRET_KEY_BYTES,\n ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n decryptGroupMetadata,\n encodeBuiltinGroupMetadata,\n encryptGroupMetadata,\n type GroupMetadata,\n type GroupMetadataKey,\n readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n createIdentitySeedPhrase,\n createIdentitySeedPhraseFromEntropy,\n generateIdentityKeyPairsFromSeedPhrase,\n IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n IDENTITY_SEED_PHRASE_WORDS,\n type IdentitySeedPhraseKeyPairs,\n normalizeIdentitySeedPhrase,\n validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n createIncrementalSha256,\n type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n AccessEvent,\n AccessEventType,\n AccessManifest,\n AccessManifestCheckpoint,\n AccessManifestTransparencyLeaf,\n AccessObjectKind,\n AnyVerifiedAccessManifest,\n AnyVerifiedPrincipalPolicy,\n AttachmentAccessEventBody,\n AttachmentBindAccessEventBody,\n AttachmentDetachAccessEventBody,\n BlobAccessManifest,\n BlobContentKeyTarget,\n ContainerAccessEventBody,\n ContainerAccessKeyState,\n ContainerAccessLevel,\n ContainerAccessManifest,\n ContainerAccessManifestState,\n ContainerAccessStructural,\n ContainerCreateAccessEventBody,\n ContainerDirectGrant,\n ContainerGrantAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerGrantSubjectType,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n ContainerKekRecipientTarget,\n ContainerKekTarget,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerReciteAccessEventBody,\n ContainerRekeyAccessEventBody,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n ContentObjectKind,\n ContentRecordEncryptionSuite,\n ContentRecordNonceDomain,\n DeriveBlobKekTargetsInput,\n DeriveContainerKekRecipientTargetsInput,\n DeriveDocumentKekTargetsInput,\n DocumentAccessEventBody,\n DocumentContentKeyTarget,\n DocumentContentRecordMetadataInput,\n DocumentLinkAccessEventBody,\n DocumentLinkSetManifestState,\n DocumentLinkSetStructural,\n DocumentPurgeAccessEventBody,\n DocumentUnlinkAccessEventBody,\n IdentityStateCheckpoint,\n IdentityStateHead,\n IdentityStateTransparencyLeaf,\n KekRecipientKind,\n KeyingCanonicalJson,\n KeyingHashDomain,\n KeyingLocalCheckpointStore,\n KeyingVerificationCode,\n KeyingVerificationResult,\n ManagedPrincipalKind,\n PrincipalHistoryIndexNode,\n PrincipalPolicyAuthorization,\n PrincipalPolicyBundle,\n PrincipalPolicyCheckpoint,\n PrincipalPolicyCurrent,\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryReferenceProof,\n PrincipalPolicyHistoryVerifier,\n PrincipalPolicyMemberEnvelopes,\n PrincipalPolicyPayload,\n PrincipalPolicySignedState,\n PrincipalPolicySignerPublicKey,\n PrincipalPolicySnapshot,\n PrincipalPolicyStateChainEntry,\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n PrincipalPolicyTransparencyLeaf,\n ReferencedPrincipalHead,\n SignedTransparencyTreeHead,\n TransparencyConsistencyProof,\n TransparencyInclusionProof,\n TransparencyLeaf,\n TransparencyLeafKind,\n TransparencyTreeCheckpoint,\n UnsignedAccessEvent,\n UnsignedTransparencyTreeHead,\n UnsignedWriteHeader,\n VerifiedAccessEvent,\n VerifiedAccessManifest,\n VerifiedAccessManifestCheckpointEvidence,\n VerifiedAccessManifestSnapshot,\n VerifiedAttachmentBinding,\n VerifiedAttachmentDetach,\n VerifiedBlobKekTargets,\n VerifiedContainerAccessManifest,\n VerifiedContainerKekState,\n VerifiedContainerParentEdge,\n VerifiedDocumentKekTargets,\n VerifiedDocumentLinkSetManifest,\n VerifiedDocumentLinkSetSnapshot,\n VerifiedDocumentLinkSetStateEvidence,\n VerifiedIdentityState,\n VerifiedPrincipalPolicy,\n VerifiedPrincipalPolicyCurrent,\n VerifiedPrincipalPolicyHistory,\n VerifiedPrincipalPolicySelection,\n VerifiedPrincipalPolicySnapshot,\n VerifiedTransparencyProof,\n VerifiedTransparencyTreeHead,\n VerifiedWriteHeader,\n VerifyAccessEventInput,\n VerifyAccessManifestInput,\n VerifyAttachmentBindingEventInput,\n VerifyAttachmentDetachEventInput,\n VerifyContainerAccessManifestInput,\n VerifyContainerKekStateInput,\n VerifyContainerParentEdgeInput,\n VerifyDocumentLinkSetManifestInput,\n VerifyDocumentPurgeEventInput,\n VerifyIdentityStateCheckpointInput,\n VerifyPrincipalPolicyBundleInput,\n VerifyPrincipalPolicySnapshotInput,\n VerifySignedTransparencyTreeHeadInput,\n VerifyTransparencyConsistencyProofInput,\n VerifyTransparencyInclusionProofInput,\n VerifyTransparencyProofInput,\n VerifyWriteHeaderInput,\n WriteHeader,\n} from \"./keying\";\nexport {\n ACCESS_MANIFEST_VERIFICATION_REVISION,\n accessManifestCheckpointFromManifest,\n accessManifestTransparencyLeaf,\n assertSealedContainerKekKeyringLength,\n BLOB_CONTENT_KEY_WRAP_SUITE,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n CONTAINER_KEK_KEYRING_SEAL_SUITE,\n CONTAINER_KEK_MATERIAL_ID_PREFIX,\n CONTAINER_KEK_PARENT_WRAP_SUITE,\n CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n CONTAINER_KEK_USER_WRAP_SUITE,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeAccessEventBodyHash,\n computeAccessEventHash,\n computeAccessManifestHash,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContainerAccessKeyTargetHash,\n computeContainerAccessStructuralHash,\n computeContainerDirectGrantRoot,\n computeContainerKekKeyringHash,\n computeContainerKekMaterialId,\n computeContainerKekPredecessorBridgeHash,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n computeContentRecordNonceDomainHash,\n computeDocumentContentKeyTargetHash,\n computeDocumentContentRecordCiphertextHash,\n computeDocumentContentRecordMetadataHash,\n computeDocumentContentRecordPlaintextHash,\n computeDocumentLinkSetGrantRoot,\n computeDocumentLinkSetKeyTargetHash,\n computeDocumentLinkSetStructuralHash,\n computeKeyingDomainHash,\n computeTransparencyLeafHash,\n computeTransparencyMerkleRoot,\n computeWriteHeaderHash,\n createContainerKekPredecessorBridge,\n createPrincipalHistoryIndexProof,\n createPrincipalPolicyHistoryVerifier,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n deriveBlobKekTargets,\n deriveContainerAccessManifest,\n deriveContainerKekRecipientTargets,\n deriveContainerKekWrappingPublicKey,\n deriveDocumentKekTargets,\n deriveDocumentLinkSetManifest,\n derivePrincipalRecipientKeyEpochId,\n documentContentRecordMetadata,\n expectedSealedContainerKekKeyringBytes,\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n identityStateTransparencyLeaf,\n isContainerKekMaterialId,\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n KeyingVerificationError,\n MAX_CONTAINER_KEY_EPOCH,\n MAX_CONTAINER_RECITATION_EPOCH,\n makeVerifiedAccessEvent,\n makeVerifiedBlobKekTargets,\n makeVerifiedContainerAccessManifest,\n makeVerifiedContainerKekState,\n makeVerifiedDocumentKekTargets,\n makeVerifiedDocumentLinkSetManifest,\n makeVerifiedDocumentLinkSetSnapshot,\n makeVerifiedPrincipalPolicy,\n normalizeAttachmentAccessEventBody,\n normalizeContainerAccessEventBody,\n normalizeContainerKekKeyring,\n normalizeContainerKekPredecessorBridge,\n normalizeDocumentAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n openContainerKekKeyring,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n principalHistoryIndexLeaf,\n principalPolicyMatchesReference,\n principalPolicyTransparencyLeaf,\n resolveContainerPathUserAccessLevel,\n resolveContainerStatePathUserAccessLevel,\n resolveHistoricalContainerPathUserAccessLevel,\n resolvePrincipalHistoryIndexProof,\n restorePrincipalPolicyHistoryVerifier,\n sealContainerKekKeyring,\n selectPrincipalPolicyAuthorization,\n serializeKeyingCanonicalJson,\n signAccessEvent,\n signTransparencyTreeHead,\n signWriteHeader,\n unwrapContainerKekParentWrap,\n unwrapContainerKekPredecessorBridge,\n verifyAccessManifest,\n verifyAccessManifestLocalCheckpoint,\n verifyAccessManifestSnapshot,\n verifyAttachmentBindingEvent,\n verifyAttachmentDetachEvent,\n verifyContainerAccessManifest,\n verifyContainerKekKeyringEntry,\n verifyContainerKekState,\n verifyContainerParentEdge,\n verifyDocumentLinkSetManifest,\n verifyDocumentLinkSetSnapshot,\n verifyDocumentPurgeEvent,\n verifyIdentityStateCheckpoint,\n verifyPrincipalPolicyBundle,\n verifyPrincipalPolicyBundleAgainstHistory,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n verifyPrincipalPolicyHistoryReferences,\n verifyPrincipalPolicySnapshot,\n verifySignedAccessEvent,\n verifySignedTransparencyTreeHead,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n verifyTransparencyProof,\n verifyWriteHeader,\n} from \"./keying\";\nexport {\n organizationReplacementAuthorizationPayload,\n organizationReplacementSigningBytes,\n signOrganizationReplacementAuthorization,\n type VerifiedOrganizationReplacementAuthorization,\n verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n computePrincipalContainerGrantRoot,\n normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n computePrincipalMemberEnvelopesRoot,\n normalizePrincipalStateMemberEnvelopes,\n PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n PrincipalPolicyValidationError,\n throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n ManagedRecipientPrincipalType,\n PrincipalContainerGrant,\n PrincipalContainerGrantAccessLevel,\n PrincipalProjectionMember,\n PrincipalProjectionRole,\n PrincipalStateExternalAuthority,\n PrincipalStateHeaderInput,\n PrincipalStateMember,\n PrincipalStateMemberEnvelope,\n PrincipalStateMembershipMode,\n PrincipalStatePayloadCipherSuite,\n PrincipalStateSigningInput,\n SignedPrincipalState,\n UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n buildPrincipalStateSigningInput,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStateHash,\n computePrincipalStatePayloadCiphertextHash,\n derivePrincipalProjectionMembers,\n isManagedRecipientPrincipalType,\n isPrincipalProjectionRole,\n normalizePrincipalProjectionMembers,\n normalizePrincipalStateMembers,\n serializeUnsignedPrincipalState,\n signPrincipalState,\n} from \"./principalState\";\nexport {\n verifySignedPrincipalState,\n verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n captureProjectionHistory,\n type HistoryProjection,\n omitProjectionHistory,\n type RetainedProjectionHistory,\n restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n generateSigningKeyPair,\n generateSigningSeedAndKeyPair,\n ML_DSA87_PUBLIC_KEY_BYTES,\n ML_DSA87_SECRET_KEY_BYTES,\n ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n AES_256_KEY_BYTES,\n AES_GCM_IV_BYTES,\n AES_GCM_TAG_BYTES,\n assertAesGcmIv,\n createAesGcmIv,\n decryptWithDek,\n encryptWithDek,\n} from \"./symmetric\";\n"]}

package/internal/crypto/keying/index.d.ts CHANGED Viewed

@@ -18,7 +18,7 @@ export { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent, verif
 export type { PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, } from "./principalPolicyExternalAuthorityTypes.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
 export type { PrincipalHistoryIndexNode } from "./principalPolicyHistoryIndex.js";
-export { createPrincipalHistoryIndexProof } from "./principalPolicyHistoryIndex.js";
+export { createPrincipalHistoryIndexProof, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "./principalPolicyHistoryIndex.js";
 export { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from "./principalPolicyHistoryPage.js";
 export type { PrincipalPolicyHistoryReferenceProof } from "./principalPolicyHistoryReferences.js";
 export { verifyPrincipalPolicyHistoryReferences } from "./principalPolicyHistoryReferences.js";

package/internal/crypto/keying/index.js CHANGED Viewed

@@ -16,7 +16,7 @@ export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
-export { createPrincipalHistoryIndexProof } from "./principalPolicyHistoryIndex.js";
+export { createPrincipalHistoryIndexProof, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "./principalPolicyHistoryIndex.js";
 export { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from "./principalPolicyHistoryPage.js";
 export { verifyPrincipalPolicyHistoryReferences } from "./principalPolicyHistoryReferences.js";
 export { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from "./principalPolicyHistoryTypes.js";

package/internal/crypto/keying/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,~~EAAE~~,gCAAgC,~~EAAE~~,MAAM,+BAA+B,CAAC;~~AACjF~~,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n assertSealedContainerKekKeyringLength,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n computeContainerKekKeyringHash,\n expectedSealedContainerKekKeyringBytes,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n normalizeContainerKekPredecessorBridge,\n unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n deriveContainerKekWrappingPublicKey,\n unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n type DocumentPurgeAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n type VerifyDocumentPurgeEventInput,\n verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n type PrincipalPolicyCurrent,\n type VerifiedPrincipalPolicyCurrent,\n verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport type {\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n createPrincipalPolicyHistoryVerifier,\n restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport { createPrincipalHistoryIndexProof } from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryVerifier,\n VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n selectPrincipalPolicyAuthorization,\n type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n type VerifyTransparencyConsistencyProofInput,\n type VerifyTransparencyInclusionProofInput,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n computeTransparencyMerkleRoot,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n assertSealedContainerKekKeyringLength,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n computeContainerKekKeyringHash,\n expectedSealedContainerKekKeyringBytes,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n normalizeContainerKekPredecessorBridge,\n unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n deriveContainerKekWrappingPublicKey,\n unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n type DocumentPurgeAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n type VerifyDocumentPurgeEventInput,\n verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n type PrincipalPolicyCurrent,\n type VerifiedPrincipalPolicyCurrent,\n verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport type {\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n createPrincipalPolicyHistoryVerifier,\n restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n createPrincipalHistoryIndexProof,\n principalHistoryIndexLeaf,\n resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryVerifier,\n VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n selectPrincipalPolicyAuthorization,\n type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n type VerifyTransparencyConsistencyProofInput,\n type VerifyTransparencyInclusionProofInput,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n computeTransparencyMerkleRoot,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}

package/internal/crypto/keying/principalPolicyHistoryIndex.d.ts CHANGED Viewed

@@ -17,10 +17,14 @@ interface AppendedPrincipalHistoryIndex {
 }
 export declare function appendPrincipalHistoryIndex(previous: PrincipalHistoryIndexFrontier, states: readonly PrincipalPolicySignedState[]): Promise<AppendedPrincipalHistoryIndex>;
 /** Fetch at most one content-addressed node per level, never a history array. */
-export declare function createPrincipalHistoryIndexProof(input: {
+export declare function resolvePrincipalHistoryIndexProof(input: {
     readonly rootHash: string;
     readonly treeSize: number;
     readonly version: number;
     readonly readNode: (hash: string) => Promise<PrincipalHistoryIndexNode | null>;
-}): Promise<TransparencyInclusionProof>;
+}): Promise<{
+    readonly leafHash: string;
+    readonly proof: TransparencyInclusionProof;
+}>;
+export declare function createPrincipalHistoryIndexProof(input: Parameters<typeof resolvePrincipalHistoryIndexProof>[0]): Promise<TransparencyInclusionProof>;
 export {};

package/internal/crypto/keying/principalPolicyHistoryIndex.js CHANGED Viewed

@@ -63,7 +63,7 @@ export async function appendPrincipalHistoryIndex(previous, states) {
     return { frontier, rootHash, nodes: [...nodes.values()] };
 }
 /** Fetch at most one content-addressed node per level, never a history array. */
-export async function createPrincipalHistoryIndexProof(input) {
+export async function resolvePrincipalHistoryIndexProof(input) {
     const { treeSize, version } = input;
     if (!Number.isSafeInteger(treeSize) ||
         treeSize < 1 ||
@@ -97,10 +97,16 @@ export async function createPrincipalHistoryIndexProof(input) {
         }
     }
     return {
-        version: 1,
-        treeSize,
-        leafIndex: version - 1,
-        auditPath: siblings.reverse(),
+        leafHash: hash,
+        proof: {
+            version: 1,
+            treeSize,
+            leafIndex: version - 1,
+            auditPath: siblings.reverse(),
+        },
     };
 }
+export async function createPrincipalHistoryIndexProof(input) {
+    return (await resolvePrincipalHistoryIndexProof(input)).proof;
+}
 //# sourceMappingURL=principalPolicyHistoryIndex.js.map

package/internal/crypto/keying/principalPolicyHistoryIndex.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalPolicyHistoryIndex.js","sourceRoot":"","sources":["principalPolicyHistoryIndex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAe5B,MAAM,UAAU,sCAAsC,CACpD,KAAc,EACd,IAAY;IAEZ,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC;QACR,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,EAAE;QAEjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,SAAS,KAAK,CAAC;YACf,CAAC,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAErD,iBAAiB,CACf,eAAe,EACf,oDAAoD,CACrD,CAAC;QACJ,QAAQ,CAAC,IAAI,CACX,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,4BAA4B,CAAC,CACzE,CAAC;QACF,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,CAAC;QACjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAiC;IAEjC,OAAO,uBAAuB,CAAC,yCAAyC,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,QAAgB,EAChB,SAAiB,EACjB,KAA8C;IAE9C,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAuC,EACvC,KAA8C;IAE9C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI;YACf,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAuC,EACvC,MAA6C;IAE7C,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxB,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAOtD;IACC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACpC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC/B,QAAQ,GAAG,CAAC;QACZ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC;QACX,OAAO,GAAG,QAAQ;QAElB,iBAAiB,CACf,eAAe,EACf,iDAAiD,CAClD,CAAC;IACJ,IAAI,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAC7B,iBAAiB,CACf,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;QACJ,MAAM,IAAI,GAAG,cAAc,CACzB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC3B,UAAU,EACV,8BAA8B,CAC/B,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAC1B,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC7B,WAAW,EACX,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI;YACpC,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,CAAC;YACb,QAAQ,IAAI,KAAK,CAAC;YAClB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,QAAQ;QACR,SAAS,EAAE,OAAO,GAAG,CAAC;QACtB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import { computeKeyingDomainHash } from \"./canonical\";\nimport { readHashString, throwVerification } from \"./shared\";\nimport {\n computeTransparencyNodeHash,\n largestPowerOfTwoLessThan,\n} from \"./transparencyTree\";\nimport type {\n PrincipalPolicySignedState,\n TransparencyInclusionProof,\n} from \"./types\";\n\n/** Content-addressed, untrusted proof material; the verified root is authority. /\nexport interface PrincipalHistoryIndexNode {\n readonly hash: string;\n readonly leftHash: string;\n readonly rightHash: string;\n}\n\nexport type PrincipalHistoryIndexFrontier = readonly (string \| null)[];\n\nexport function normalizePrincipalHistoryIndexFrontier(\n value: unknown,\n size: number,\n): (string \| null)[] {\n if (\n !Number.isSafeInteger(size) \|\|\n size < 0 \|\|\n !Array.isArray(value) \|\|\n value.length > 53\n )\n throwVerification(\n \"invalid_shape\",\n \"invalid principal history index frontier\",\n );\n const frontier: (string \| null)[] = [];\n let remaining = size;\n for (const item of value) {\n if (\n remaining === 0 \|\|\n (remaining % 2 === 0 ? item !== null : item === null)\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier does not match its size\",\n );\n frontier.push(\n item === null\n ? null\n : readHashString({ hash: item }, \"hash\", \"principal history frontier\"),\n );\n remaining = Math.floor(remaining / 2);\n }\n if (remaining !== 0)\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier is incomplete\",\n );\n return frontier;\n}\n\nexport function principalHistoryIndexLeaf(\n state: PrincipalPolicySignedState,\n): Promise<string> {\n return computeKeyingDomainHash(\"tearleads.keying.principal-history-leaf\", {\n principalType: state.principalType,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n keyFingerprint: state.keyFingerprint,\n stateHash: state.stateHash,\n signature: state.signature,\n });\n}\n\nasync function join(\n leftHash: string,\n rightHash: string,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string> {\n const hash = await computeTransparencyNodeHash(leftHash, rightHash);\n nodes?.set(hash, { hash, leftHash, rightHash });\n return hash;\n}\n\nexport async function principalHistoryIndexRoot(\n frontier: PrincipalHistoryIndexFrontier,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string \| null> {\n let root: string \| null = null;\n for (const hash of frontier) {\n if (hash !== null)\n root = root === null ? hash : await join(hash, root, nodes);\n }\n return root;\n}\n\n/* Build privately; the caller publishes this only with an accepted page. /\ninterface AppendedPrincipalHistoryIndex {\n readonly frontier: PrincipalHistoryIndexFrontier;\n readonly rootHash: string \| null;\n readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\nexport async function appendPrincipalHistoryIndex(\n previous: PrincipalHistoryIndexFrontier,\n states: readonly PrincipalPolicySignedState[],\n): Promise<AppendedPrincipalHistoryIndex> {\n const frontier = [...previous];\n const nodes = new Map<string, PrincipalHistoryIndexNode>();\n for (const state of states) {\n let carry = await principalHistoryIndexLeaf(state);\n let height = 0;\n for (let left = frontier[height]; left; left = frontier[height]) {\n carry = await join(left, carry, nodes);\n frontier[height] = null;\n height += 1;\n }\n frontier[height] = carry;\n }\n const rootHash = await principalHistoryIndexRoot(frontier, nodes);\n return { frontier, rootHash, nodes: [...nodes.values()] };\n}\n\n/* Fetch at most one content-addressed node per level, never a history array. */\nexport async function createPrincipalHistoryIndexProof(input: {\n readonly rootHash: string;\n readonly treeSize: number;\n readonly version: number;\n readonly readNode: (\n hash: string,\n ) => Promise<PrincipalHistoryIndexNode \| null>;\n}): Promise<TransparencyInclusionProof> {\n const { treeSize, version } = input;\n if (\n !Number.isSafeInteger(treeSize) \|\|\n treeSize < 1 \|\|\n !Number.isSafeInteger(version) \|\|\n version < 1 \|\|\n version > treeSize\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history proof version is out of range\",\n );\n let hash = readHashString(input, \"rootHash\", \"principal history proof\");\n let size = treeSize;\n let position = version - 1;\n const siblings: string[] = [];\n while (size > 1) {\n const node = await input.readNode(hash);\n if (!node \|\| node.hash !== hash)\n throwVerification(\n \"missing_dependency\",\n \"principal history index node is missing\",\n );\n const left = readHashString(\n { leftHash: node.leftHash },\n \"leftHash\",\n \"principal history index node\",\n );\n const right = readHashString(\n { rightHash: node.rightHash },\n \"rightHash\",\n \"principal history index node\",\n );\n if ((await join(left, right)) !== hash)\n throwVerification(\n \"hash_mismatch\",\n \"principal history index node hash mismatch\",\n );\n const split = largestPowerOfTwoLessThan(size);\n if (position < split) {\n siblings.push(right);\n hash = left;\n size = split;\n } else {\n siblings.push(left);\n hash = right;\n position -= split;\n size -= split;\n }\n }\n return {\n version: 1,\n treeSize,\n leafIndex: version - 1,\n auditPath: siblings.reverse(),\n };\n}\n"]}
1	+ {"version":3,"file":"principalPolicyHistoryIndex.js","sourceRoot":"","sources":["principalPolicyHistoryIndex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAe5B,MAAM,UAAU,sCAAsC,CACpD,KAAc,EACd,IAAY;IAEZ,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC;QACR,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,EAAE;QAEjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,SAAS,KAAK,CAAC;YACf,CAAC,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAErD,iBAAiB,CACf,eAAe,EACf,oDAAoD,CACrD,CAAC;QACJ,QAAQ,CAAC,IAAI,CACX,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,4BAA4B,CAAC,CACzE,CAAC;QACF,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,CAAC;QACjB,iBAAiB,CACf,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAiC;IAEjC,OAAO,uBAAuB,CAAC,yCAAyC,EAAE;QACxE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,QAAgB,EAChB,SAAiB,EACjB,KAA8C;IAE9C,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAuC,EACvC,KAA8C;IAE9C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI;YACf,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAuC,EACvC,MAA6C;IAE7C,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxB,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAOvD;IAIC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACpC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAC/B,QAAQ,GAAG,CAAC;QACZ,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC;QACX,OAAO,GAAG,QAAQ;QAElB,iBAAiB,CACf,eAAe,EACf,iDAAiD,CAClD,CAAC;IACJ,IAAI,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAC7B,iBAAiB,CACf,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;QACJ,MAAM,IAAI,GAAG,cAAc,CACzB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAC3B,UAAU,EACV,8BAA8B,CAC/B,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAC1B,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC7B,WAAW,EACX,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI;YACpC,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,CAAC;YACb,QAAQ,IAAI,KAAK,CAAC;YAClB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE;YACL,OAAO,EAAE,CAAC;YACV,QAAQ;YACR,SAAS,EAAE,OAAO,GAAG,CAAC;YACtB,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAA8D;IAE9D,OAAO,CAAC,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC","sourcesContent":["import { computeKeyingDomainHash } from \"./canonical\";\nimport { readHashString, throwVerification } from \"./shared\";\nimport {\n computeTransparencyNodeHash,\n largestPowerOfTwoLessThan,\n} from \"./transparencyTree\";\nimport type {\n PrincipalPolicySignedState,\n TransparencyInclusionProof,\n} from \"./types\";\n\n/** Content-addressed, untrusted proof material; the verified root is authority. /\nexport interface PrincipalHistoryIndexNode {\n readonly hash: string;\n readonly leftHash: string;\n readonly rightHash: string;\n}\n\nexport type PrincipalHistoryIndexFrontier = readonly (string \| null)[];\n\nexport function normalizePrincipalHistoryIndexFrontier(\n value: unknown,\n size: number,\n): (string \| null)[] {\n if (\n !Number.isSafeInteger(size) \|\|\n size < 0 \|\|\n !Array.isArray(value) \|\|\n value.length > 53\n )\n throwVerification(\n \"invalid_shape\",\n \"invalid principal history index frontier\",\n );\n const frontier: (string \| null)[] = [];\n let remaining = size;\n for (const item of value) {\n if (\n remaining === 0 \|\|\n (remaining % 2 === 0 ? item !== null : item === null)\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier does not match its size\",\n );\n frontier.push(\n item === null\n ? null\n : readHashString({ hash: item }, \"hash\", \"principal history frontier\"),\n );\n remaining = Math.floor(remaining / 2);\n }\n if (remaining !== 0)\n throwVerification(\n \"invalid_shape\",\n \"principal history frontier is incomplete\",\n );\n return frontier;\n}\n\nexport function principalHistoryIndexLeaf(\n state: PrincipalPolicySignedState,\n): Promise<string> {\n return computeKeyingDomainHash(\"tearleads.keying.principal-history-leaf\", {\n principalType: state.principalType,\n principalId: state.principalId,\n version: state.version,\n keyEpoch: state.keyEpoch,\n keyFingerprint: state.keyFingerprint,\n stateHash: state.stateHash,\n signature: state.signature,\n });\n}\n\nasync function join(\n leftHash: string,\n rightHash: string,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string> {\n const hash = await computeTransparencyNodeHash(leftHash, rightHash);\n nodes?.set(hash, { hash, leftHash, rightHash });\n return hash;\n}\n\nexport async function principalHistoryIndexRoot(\n frontier: PrincipalHistoryIndexFrontier,\n nodes?: Map<string, PrincipalHistoryIndexNode>,\n): Promise<string \| null> {\n let root: string \| null = null;\n for (const hash of frontier) {\n if (hash !== null)\n root = root === null ? hash : await join(hash, root, nodes);\n }\n return root;\n}\n\n/* Build privately; the caller publishes this only with an accepted page. /\ninterface AppendedPrincipalHistoryIndex {\n readonly frontier: PrincipalHistoryIndexFrontier;\n readonly rootHash: string \| null;\n readonly nodes: readonly PrincipalHistoryIndexNode[];\n}\n\nexport async function appendPrincipalHistoryIndex(\n previous: PrincipalHistoryIndexFrontier,\n states: readonly PrincipalPolicySignedState[],\n): Promise<AppendedPrincipalHistoryIndex> {\n const frontier = [...previous];\n const nodes = new Map<string, PrincipalHistoryIndexNode>();\n for (const state of states) {\n let carry = await principalHistoryIndexLeaf(state);\n let height = 0;\n for (let left = frontier[height]; left; left = frontier[height]) {\n carry = await join(left, carry, nodes);\n frontier[height] = null;\n height += 1;\n }\n frontier[height] = carry;\n }\n const rootHash = await principalHistoryIndexRoot(frontier, nodes);\n return { frontier, rootHash, nodes: [...nodes.values()] };\n}\n\n/* Fetch at most one content-addressed node per level, never a history array. */\nexport async function resolvePrincipalHistoryIndexProof(input: {\n readonly rootHash: string;\n readonly treeSize: number;\n readonly version: number;\n readonly readNode: (\n hash: string,\n ) => Promise<PrincipalHistoryIndexNode \| null>;\n}): Promise<{\n readonly leafHash: string;\n readonly proof: TransparencyInclusionProof;\n}> {\n const { treeSize, version } = input;\n if (\n !Number.isSafeInteger(treeSize) \|\|\n treeSize < 1 \|\|\n !Number.isSafeInteger(version) \|\|\n version < 1 \|\|\n version > treeSize\n )\n throwVerification(\n \"invalid_shape\",\n \"principal history proof version is out of range\",\n );\n let hash = readHashString(input, \"rootHash\", \"principal history proof\");\n let size = treeSize;\n let position = version - 1;\n const siblings: string[] = [];\n while (size > 1) {\n const node = await input.readNode(hash);\n if (!node \|\| node.hash !== hash)\n throwVerification(\n \"missing_dependency\",\n \"principal history index node is missing\",\n );\n const left = readHashString(\n { leftHash: node.leftHash },\n \"leftHash\",\n \"principal history index node\",\n );\n const right = readHashString(\n { rightHash: node.rightHash },\n \"rightHash\",\n \"principal history index node\",\n );\n if ((await join(left, right)) !== hash)\n throwVerification(\n \"hash_mismatch\",\n \"principal history index node hash mismatch\",\n );\n const split = largestPowerOfTwoLessThan(size);\n if (position < split) {\n siblings.push(right);\n hash = left;\n size = split;\n } else {\n siblings.push(left);\n hash = right;\n position -= split;\n size -= split;\n }\n }\n return {\n leafHash: hash,\n proof: {\n version: 1,\n treeSize,\n leafIndex: version - 1,\n auditPath: siblings.reverse(),\n },\n };\n}\n\nexport async function createPrincipalHistoryIndexProof(\n input: Parameters<typeof resolvePrincipalHistoryIndexProof>[0],\n): Promise<TransparencyInclusionProof> {\n return (await resolvePrincipalHistoryIndexProof(input)).proof;\n}\n"]}