@tearleads/client-sdk 0.1.11 → 0.1.14

package/internal/crypto/keying/principalPolicyHistoryReferences.d.ts

@@ -11,8 +11,10 @@ export interface PrincipalPolicyHistoryReferenceProof {
  * checked against the private root owned by a local verifier, never a peer's
  * claimed root. Each leaf commits to the exact signed entry already accepted.
  * Replaces the retained selection; the current entry is always included.
+ * A separate checkpoint proof preserves the full 128-citation selection budget.
  */
 export declare function verifyPrincipalPolicyHistoryReferences(input: {
     readonly history: VerifiedPrincipalPolicyHistory;
     readonly references: readonly PrincipalPolicyHistoryReferenceProof[];
+    readonly checkpointReference?: PrincipalPolicyHistoryReferenceProof | undefined;
 }): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>>;

package/internal/crypto/keying/principalPolicyHistoryReferences.js

@@ -21,22 +21,39 @@ function assertProofBudget(references) {
  * checked against the private root owned by a local verifier, never a peer's
  * claimed root. Each leaf commits to the exact signed entry already accepted.
  * Replaces the retained selection; the current entry is always included.
+ * A separate checkpoint proof preserves the full 128-citation selection budget.
  */
 export function verifyPrincipalPolicyHistoryReferences(input) {
     return runVerifier(async () => {
         const history = ownVerifiedPrincipalPolicyHistory(input.history);
         const supplied = input.references;
+        const suppliedCheckpoint = input.checkpointReference;
         assertProofBudget(supplied);
+        if (suppliedCheckpoint !== undefined)
+            assertProofBudget([suppliedCheckpoint]);
         const references = structuredClone(supplied);
+        const checkpoint = structuredClone(suppliedCheckpoint);
         assertProofBudget(references);
-        normalizePrincipalHistoryInput({
+        const scope = {
             principalId: history.currentEntry.state.principalId,
             principalType: history.currentEntry.state.principalType,
+        };
+        normalizePrincipalHistoryInput({
+            ...scope,
             retainedReferences: references.map((item) => item.reference),
         });
+        const selected = [...references];
+        if (checkpoint !== undefined) {
+            assertProofBudget([checkpoint]);
+            normalizePrincipalHistoryInput({
+                ...scope,
+                retainedReferences: [checkpoint.reference],
+            });
+            selected.push(checkpoint);
+        }
         const entries = new Map();
         const treeSize = history.currentEntry.state.version;
-        for (const item of references) {
+        for (const item of selected) {
             const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);
             const proof = normalizeTransparencyInclusionProof(item.proof);
             if (!principalPolicyStateMatchesReference(entry.state, item.reference) ||

package/internal/crypto/keying/principalPolicyHistoryReferences.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyHistoryReferences.js","sourceRoot":"","sources":["principalPolicyHistoryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,GAEnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAe9B,SAAS,iBAAiB,CACxB,UAA2D;IAE3D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,MAAM,GAAG,kCAAkC;QAEtD,iBAAiB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAC1C,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAGtD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;QAClC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9B,8BAA8B,CAAC;YAC7B,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW;YACnD,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa;YACvD,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,QAAQ;gBAC9B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC;gBAE3C,iBAAiB,CACf,iBAAiB,EACjB,4CAA4C,CAC7C,CAAC;YACJ,MAAM,2BAA2B,CAAC;gBAChC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;gBACtD,UAAU,EAAE;oBACV,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,OAAO,CAAC,aAAa;oBAC/B,QAAQ;iBACT;gBACD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,kCAAkC,CAAC;YACxC,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalHistoryIndexLeaf } from \"./principalPolicyHistoryIndex\";\nimport {\n  makeVerifiedPrincipalPolicyHistory,\n  ownVerifiedPrincipalPolicyHistory,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport {\n  assertTransparencyInclusion,\n  normalizeTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n  TransparencyInclusionProof,\n} from \"./types\";\n\n/** Untrusted material to select an entry from a locally verified prefix. */\nexport interface PrincipalPolicyHistoryReferenceProof {\n  readonly reference: ReferencedPrincipalHead;\n  readonly entry: PrincipalPolicyStateChainEntry;\n  readonly proof: TransparencyInclusionProof;\n}\n\nfunction assertProofBudget(\n  references: readonly PrincipalPolicyHistoryReferenceProof[],\n): void {\n  if (\n    !Array.isArray(references) ||\n    references.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throwVerification(\"invalid_shape\", \"too many principal history proofs\");\n  const count = references.length;\n  for (let index = 0; index < count; index += 1) {\n    const path = references[index]?.proof.auditPath;\n    if (!Array.isArray(path) || path.length > 53)\n      throwVerification(\n        \"invalid_shape\",\n        \"principal history proof exceeds its budget\",\n      );\n  }\n}\n\n/**\n * Select new retained references without replaying signatures. Inclusion is\n * checked against the private root owned by a local verifier, never a peer's\n * claimed root. Each leaf commits to the exact signed entry already accepted.\n * Replaces the retained selection; the current entry is always included.\n */\nexport function verifyPrincipalPolicyHistoryReferences(input: {\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly references: readonly PrincipalPolicyHistoryReferenceProof[];\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>> {\n  return runVerifier(async () => {\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const supplied = input.references;\n    assertProofBudget(supplied);\n    const references = structuredClone(supplied);\n    assertProofBudget(references);\n    normalizePrincipalHistoryInput({\n      principalId: history.currentEntry.state.principalId,\n      principalType: history.currentEntry.state.principalType,\n      retainedReferences: references.map((item) => item.reference),\n    });\n    const entries = new Map<number, PrincipalPolicyStateChainEntry>();\n    const treeSize = history.currentEntry.state.version;\n    for (const item of references) {\n      const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);\n      const proof = normalizeTransparencyInclusionProof(item.proof);\n      if (\n        !principalPolicyStateMatchesReference(entry.state, item.reference) ||\n        entry.state.version > treeSize ||\n        proof.leafIndex !== entry.state.version - 1\n      )\n        throwVerification(\n          \"object_mismatch\",\n          \"principal history proof reference mismatch\",\n        );\n      await assertTransparencyInclusion({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        checkpoint: {\n          logId: \"principal-history\",\n          rootHash: history.indexRootHash,\n          treeSize,\n        },\n        proof,\n      });\n      entries.set(entry.state.version, entry);\n    }\n    entries.set(treeSize, history.currentEntry);\n    return makeVerifiedPrincipalPolicyHistory({\n      ...history,\n      retainedEntries: [...entries.values()].sort(\n        (left, right) => left.state.version - right.state.version,\n      ),\n    });\n  });\n}\n"]}
+{"version":3,"file":"principalPolicyHistoryReferences.js","sourceRoot":"","sources":["principalPolicyHistoryReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,kCAAkC,EAClC,iCAAiC,EACjC,kCAAkC,GAEnC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAe9B,SAAS,iBAAiB,CACxB,UAA2D;IAE3D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,MAAM,GAAG,kCAAkC;QAEtD,iBAAiB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAC1C,iBAAiB,CACf,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAMtD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;QAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACrD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,kBAAkB,KAAK,SAAS;YAClC,iBAAiB,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACvD,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG;YACZ,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW;YACnD,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa;SACxD,CAAC;QACF,8BAA8B,CAAC;YAC7B,GAAG,KAAK;YACR,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,iBAAiB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAChC,8BAA8B,CAAC;gBAC7B,GAAG,KAAK;gBACR,kBAAkB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;aAC3C,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;gBAClE,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,QAAQ;gBAC9B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC;gBAE3C,iBAAiB,CACf,iBAAiB,EACjB,4CAA4C,CAC7C,CAAC;YACJ,MAAM,2BAA2B,CAAC;gBAChC,QAAQ,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC;gBACtD,UAAU,EAAE;oBACV,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,OAAO,CAAC,aAAa;oBAC/B,QAAQ;iBACT;gBACD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,kCAAkC,CAAC;YACxC,GAAG,OAAO;YACV,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAC1D;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { normalizePrincipalHistoryInput } from \"./principalPolicyHistoryChecks\";\nimport { principalHistoryIndexLeaf } from \"./principalPolicyHistoryIndex\";\nimport {\n  makeVerifiedPrincipalPolicyHistory,\n  ownVerifiedPrincipalPolicyHistory,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport {\n  assertTransparencyInclusion,\n  normalizeTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n  ReferencedPrincipalHead,\n  TransparencyInclusionProof,\n} from \"./types\";\n\n/** Untrusted material to select an entry from a locally verified prefix. */\nexport interface PrincipalPolicyHistoryReferenceProof {\n  readonly reference: ReferencedPrincipalHead;\n  readonly entry: PrincipalPolicyStateChainEntry;\n  readonly proof: TransparencyInclusionProof;\n}\n\nfunction assertProofBudget(\n  references: readonly PrincipalPolicyHistoryReferenceProof[],\n): void {\n  if (\n    !Array.isArray(references) ||\n    references.length > PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT\n  )\n    throwVerification(\"invalid_shape\", \"too many principal history proofs\");\n  const count = references.length;\n  for (let index = 0; index < count; index += 1) {\n    const path = references[index]?.proof.auditPath;\n    if (!Array.isArray(path) || path.length > 53)\n      throwVerification(\n        \"invalid_shape\",\n        \"principal history proof exceeds its budget\",\n      );\n  }\n}\n\n/**\n * Select new retained references without replaying signatures. Inclusion is\n * checked against the private root owned by a local verifier, never a peer's\n * claimed root. Each leaf commits to the exact signed entry already accepted.\n * Replaces the retained selection; the current entry is always included.\n * A separate checkpoint proof preserves the full 128-citation selection budget.\n */\nexport function verifyPrincipalPolicyHistoryReferences(input: {\n  readonly history: VerifiedPrincipalPolicyHistory;\n  readonly references: readonly PrincipalPolicyHistoryReferenceProof[];\n  readonly checkpointReference?:\n    | PrincipalPolicyHistoryReferenceProof\n    | undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyHistory>> {\n  return runVerifier(async () => {\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const supplied = input.references;\n    const suppliedCheckpoint = input.checkpointReference;\n    assertProofBudget(supplied);\n    if (suppliedCheckpoint !== undefined)\n      assertProofBudget([suppliedCheckpoint]);\n    const references = structuredClone(supplied);\n    const checkpoint = structuredClone(suppliedCheckpoint);\n    assertProofBudget(references);\n    const scope = {\n      principalId: history.currentEntry.state.principalId,\n      principalType: history.currentEntry.state.principalType,\n    };\n    normalizePrincipalHistoryInput({\n      ...scope,\n      retainedReferences: references.map((item) => item.reference),\n    });\n    const selected = [...references];\n    if (checkpoint !== undefined) {\n      assertProofBudget([checkpoint]);\n      normalizePrincipalHistoryInput({\n        ...scope,\n        retainedReferences: [checkpoint.reference],\n      });\n      selected.push(checkpoint);\n    }\n    const entries = new Map<number, PrincipalPolicyStateChainEntry>();\n    const treeSize = history.currentEntry.state.version;\n    for (const item of selected) {\n      const entry = await normalizePrincipalPolicyStateChainEntry(item.entry);\n      const proof = normalizeTransparencyInclusionProof(item.proof);\n      if (\n        !principalPolicyStateMatchesReference(entry.state, item.reference) ||\n        entry.state.version > treeSize ||\n        proof.leafIndex !== entry.state.version - 1\n      )\n        throwVerification(\n          \"object_mismatch\",\n          \"principal history proof reference mismatch\",\n        );\n      await assertTransparencyInclusion({\n        leafHash: await principalHistoryIndexLeaf(entry.state),\n        checkpoint: {\n          logId: \"principal-history\",\n          rootHash: history.indexRootHash,\n          treeSize,\n        },\n        proof,\n      });\n      entries.set(entry.state.version, entry);\n    }\n    entries.set(treeSize, history.currentEntry);\n    return makeVerifiedPrincipalPolicyHistory({\n      ...history,\n      retainedEntries: [...entries.values()].sort(\n        (left, right) => left.state.version - right.state.version,\n      ),\n    });\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.11",
+  "version": "0.1.14",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {
@@ -20,6 +20,9 @@
       "types": "./sqlite.d.ts",
       "default": "./sqlite.js"
     },
+    "./sqlite/worker.js": "./sqlite/worker.js",
+    "./sqlite/sqlite3.wasm": "./sqlite/sqlite3.wasm",
+    "./sqlite/sqlite3-licenses.md": "./sqlite/sqlite3-licenses.md",
     "./testing": {
       "types": "./data/trustedUserIdentity/testFixtures.d.ts",
       "default": "./data/trustedUserIdentity/testFixtures.js"

package/sqlite/sqlite3-licenses.md

@@ -0,0 +1,38 @@
+# SQLite WebAssembly licenses
+
+`dist/jswasm/` holds the SQLite3 Multiple Ciphers WebAssembly build that
+`scripts/buildSqliteMultipleCiphers.sh` downloads. Anything that ships those
+files, or a bundle of them, ships this notice with them.
+
+## SQLite
+
+SQLite and its WebAssembly JavaScript bindings are in the public domain:
+<https://www.sqlite.org/copyright.html>.
+
+## SQLite3 Multiple Ciphers
+
+<https://github.com/utelle/SQLite3MultipleCiphers>
+
+```text
+MIT License
+
+Copyright (c) 2019-2026 Ulrich Telle
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```