@tearleads/client-sdk 0.1.14 → 0.1.16

package/internal/api-client/principalPolicyRequests.js

@@ -1,6 +1,7 @@
 import { commitOrganizationGroupPolicyOperation, putPrincipalPolicyOperation, } from "../validators/operation/index.js";
 import { principalHistoryRequest } from "./principalHistoryRequest.js";
 import { collectPrincipalPolicyPages, readPrincipalPolicyPages, } from "./principalPolicyPages.js";
+import { readProjectionPolicyHistoryPages } from "./projectionPolicyHistoryPages.js";
 import { dedupedRequest } from "./requestInternals.js";
 import { commitOrganizationGroupPolicy, putPrincipalPolicy, } from "./routes/principals/policy.js";
 export class PrincipalPolicyRequests {
@@ -12,6 +13,9 @@ export class PrincipalPolicyRequests {
         this.cache = cache;
         this.clearWriterProjectionCaches = clearWriterProjectionCaches;
     }
+    publicPages(source, options = {}) {
+        return readProjectionPolicyHistoryPages(this.runtime, source, options);
+    }
     pages(principalType, principalId, options = {}) {
         return readPrincipalPolicyPages(this.runtime, principalType, principalId, options);
     }
@@ -23,7 +27,10 @@ export class PrincipalPolicyRequests {
             ? request()
             : dedupedRequest(this.cache, key, request);
     }
-    put(principalType, principalId, input, options = {}) {
+    put(...args) {
+        return this.putResult(...args).then((result) => result.ok ? result.data : null);
+    }
+    putResult(principalType, principalId, input, options = {}) {
         const key = JSON.stringify([principalType, principalId]);
         this.cache.delete(key);
         return principalHistoryRequest(this.runtime, {
@@ -36,9 +43,7 @@ export class PrincipalPolicyRequests {
                 ...options,
             },
             operation: putPrincipalPolicyOperation,
-        })
-            .then((result) => (result.ok ? result.data : null))
-            .finally(() => this.cache.delete(key));
+        }).finally(() => this.cache.delete(key));
     }
     async commitResult(organizationId, groupId, input, options = {}) {
         const groupKey = JSON.stringify(["group", groupId]);

package/internal/api-client/principalPolicyRequests.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyRequests.js","sourceRoot":"","sources":["principalPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,2BAA2B,EAE3B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,OAAO,uBAAuB;IAEf;IACA;IAGA;IALnB,YACmB,OAA0B,EAC1B,KAEhB,EACgB,2BAAuC;QAJvC,YAAO,GAAP,OAAO,CAAmB;QAC1B,UAAK,GAAL,KAAK,CAErB;QACgB,gCAA2B,GAA3B,2BAA2B,CAAY;IACvD,CAAC;IAEJ,KAAK,CACH,aAAuC,EACvC,WAAmB,EACnB,UAA0C,EAAE;QAE5C,OAAO,wBAAwB,CAC7B,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,GAAG,CACD,aAAuC,EACvC,WAAmB,EACnB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,2BAA2B,CACzB,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,OAAO,EAAE;YACX,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CACD,aAA6B,EAC7B,WAAmB,EACnB,KAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YAC3C,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;YACzD,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,WAAW;gBAClD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,2BAA2B;SACvC,CAAC;aACC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAClD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,cAAsB,EACtB,OAAe,EACf,KAA2C,EAC3C,UAAgC,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;gBACjE,SAAS,EAAE,6BAA6B,CAAC,UAAU;gBACnD,MAAM,EAAE,6BAA6B,CAAC,MAAM;gBAC5C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC3B,OAAO,EAAE;oBACP,qCAAqC,EAAE,cAAc;oBACrD,GAAG,OAAO;iBACX;gBACD,SAAS,EAAE,sCAAsC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;CACF","sourcesContent":["import {\n  commitOrganizationGroupPolicyOperation,\n  putPrincipalPolicyOperation,\n} from \"@tearleads/validators/operation\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  OrganizationPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { BoundedCache } from \"./ApiCache\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport {\n  collectPrincipalPolicyPages,\n  type PrincipalPolicyPageReadOptions,\n  readPrincipalPolicyPages,\n} from \"./principalPolicyPages\";\nimport { dedupedRequest } from \"./requestInternals\";\nimport {\n  commitOrganizationGroupPolicy,\n  putPrincipalPolicy,\n} from \"./routes/principals/policy\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport class PrincipalPolicyRequests {\n  constructor(\n    private readonly runtime: ApiRequestRuntime,\n    private readonly cache: BoundedCache<\n      Promise<PrincipalPolicyBundleResponse | null>\n    >,\n    private readonly clearWriterProjectionCaches: () => void,\n  ) {}\n\n  pages(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: PrincipalPolicyPageReadOptions = {},\n  ) {\n    return readPrincipalPolicyPages(\n      this.runtime,\n      principalType,\n      principalId,\n      options,\n    );\n  }\n\n  get(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: RequestResultOptions = {},\n  ) {\n    const request = () =>\n      collectPrincipalPolicyPages(\n        this.runtime,\n        principalType,\n        principalId,\n        options,\n      );\n    const key = JSON.stringify([principalType, principalId]);\n    // Cancellation, reporting and renewal preferences belong to their caller.\n    return Object.keys(options).length > 0\n      ? request()\n      : dedupedRequest(this.cache, key, request);\n  }\n\n  put(\n    principalType: \"organization\",\n    principalId: string,\n    input: OrganizationPrincipalPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const key = JSON.stringify([principalType, principalId]);\n    this.cache.delete(key);\n    return principalHistoryRequest(this.runtime, {\n      path: putPrincipalPolicy.path(principalType, principalId),\n      validator: putPrincipalPolicy.isResponse,\n      method: putPrincipalPolicy.method,\n      body: JSON.stringify(input),\n      options: {\n        expectedPaymentRequiredOrganizationId: principalId,\n        ...options,\n      },\n      operation: putPrincipalPolicyOperation,\n    })\n      .then((result) => (result.ok ? result.data : null))\n      .finally(() => this.cache.delete(key));\n  }\n\n  async commitResult(\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await principalHistoryRequest(this.runtime, {\n        path: commitOrganizationGroupPolicy.path(organizationId, groupId),\n        validator: commitOrganizationGroupPolicy.isResponse,\n        method: commitOrganizationGroupPolicy.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: commitOrganizationGroupPolicyOperation,\n      });\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n}\n"]}
+{"version":3,"file":"principalPolicyRequests.js","sourceRoot":"","sources":["principalPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,2BAA2B,EAE3B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,OAAO,uBAAuB;IAEf;IACA;IAGA;IALnB,YACmB,OAA0B,EAC1B,KAEhB,EACgB,2BAAuC;QAJvC,YAAO,GAAP,OAAO,CAAmB;QAC1B,UAAK,GAAL,KAAK,CAErB;QACgB,gCAA2B,GAA3B,2BAA2B,CAAY;IACvD,CAAC;IAEJ,WAAW,CACT,MAA8D,EAC9D,UAAkE,EAAE;QAEpE,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CACH,aAAuC,EACvC,WAAmB,EACnB,UAA0C,EAAE;QAE5C,OAAO,wBAAwB,CAC7B,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,GAAG,CACD,aAAuC,EACvC,WAAmB,EACnB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,2BAA2B,CACzB,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,OAAO,EAAE;YACX,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CAAC,GAAG,IAAsD;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC/B,CAAC;IACJ,CAAC;IAED,SAAS,CACP,aAA6B,EAC7B,WAAmB,EACnB,KAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YAC3C,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;YACzD,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,WAAW;gBAClD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,cAAsB,EACtB,OAAe,EACf,KAA2C,EAC3C,UAAgC,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;gBACjE,SAAS,EAAE,6BAA6B,CAAC,UAAU;gBACnD,MAAM,EAAE,6BAA6B,CAAC,MAAM;gBAC5C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC3B,OAAO,EAAE;oBACP,qCAAqC,EAAE,cAAc;oBACrD,GAAG,OAAO;iBACX;gBACD,SAAS,EAAE,sCAAsC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;CACF","sourcesContent":["import {\n  commitOrganizationGroupPolicyOperation,\n  putPrincipalPolicyOperation,\n} from \"@tearleads/validators/operation\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  OrganizationPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { BoundedCache } from \"./ApiCache\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport {\n  collectPrincipalPolicyPages,\n  type PrincipalPolicyPageReadOptions,\n  readPrincipalPolicyPages,\n} from \"./principalPolicyPages\";\nimport { readProjectionPolicyHistoryPages } from \"./projectionPolicyHistoryPages\";\nimport { dedupedRequest } from \"./requestInternals\";\nimport {\n  commitOrganizationGroupPolicy,\n  putPrincipalPolicy,\n} from \"./routes/principals/policy\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport class PrincipalPolicyRequests {\n  constructor(\n    private readonly runtime: ApiRequestRuntime,\n    private readonly cache: BoundedCache<\n      Promise<PrincipalPolicyBundleResponse | null>\n    >,\n    private readonly clearWriterProjectionCaches: () => void,\n  ) {}\n\n  publicPages(\n    source: Parameters<typeof readProjectionPolicyHistoryPages>[1],\n    options: Parameters<typeof readProjectionPolicyHistoryPages>[2] = {},\n  ) {\n    return readProjectionPolicyHistoryPages(this.runtime, source, options);\n  }\n\n  pages(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: PrincipalPolicyPageReadOptions = {},\n  ) {\n    return readPrincipalPolicyPages(\n      this.runtime,\n      principalType,\n      principalId,\n      options,\n    );\n  }\n\n  get(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: RequestResultOptions = {},\n  ) {\n    const request = () =>\n      collectPrincipalPolicyPages(\n        this.runtime,\n        principalType,\n        principalId,\n        options,\n      );\n    const key = JSON.stringify([principalType, principalId]);\n    // Cancellation, reporting and renewal preferences belong to their caller.\n    return Object.keys(options).length > 0\n      ? request()\n      : dedupedRequest(this.cache, key, request);\n  }\n\n  put(...args: Parameters<PrincipalPolicyRequests[\"putResult\"]>) {\n    return this.putResult(...args).then((result) =>\n      result.ok ? result.data : null,\n    );\n  }\n\n  putResult(\n    principalType: \"organization\",\n    principalId: string,\n    input: OrganizationPrincipalPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const key = JSON.stringify([principalType, principalId]);\n    this.cache.delete(key);\n    return principalHistoryRequest(this.runtime, {\n      path: putPrincipalPolicy.path(principalType, principalId),\n      validator: putPrincipalPolicy.isResponse,\n      method: putPrincipalPolicy.method,\n      body: JSON.stringify(input),\n      options: {\n        expectedPaymentRequiredOrganizationId: principalId,\n        ...options,\n      },\n      operation: putPrincipalPolicyOperation,\n    }).finally(() => this.cache.delete(key));\n  }\n\n  async commitResult(\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await principalHistoryRequest(this.runtime, {\n        path: commitOrganizationGroupPolicy.path(organizationId, groupId),\n        validator: commitOrganizationGroupPolicy.isResponse,\n        method: commitOrganizationGroupPolicy.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: commitOrganizationGroupPolicyOperation,\n      });\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n}\n"]}

package/internal/api-client/projectionPolicyHistoryPages.d.ts

@@ -0,0 +1,9 @@
+import { type PrincipalPolicyHistorySourceResponse, type PrincipalPolicySnapshotPageResponse } from "../validators/response/index.js";
+import type { ApiRequestRuntime } from "./apiRequestRuntime.js";
+import type { RequestResult, RequestResultOptions } from "./types.js";
+export interface ProjectionPolicyHistoryReadOptions extends RequestResultOptions {
+    /** Only skip a prefix already authenticated by the caller. */
+    readonly afterVersion?: number | undefined;
+}
+/** One bounded public page at a time. Only the caller authenticates its contents. */
+export declare function readProjectionPolicyHistoryPages(runtime: ApiRequestRuntime, input: PrincipalPolicyHistorySourceResponse, options?: ProjectionPolicyHistoryReadOptions): AsyncGenerator<RequestResult<PrincipalPolicySnapshotPageResponse>, void>;

package/internal/api-client/projectionPolicyHistoryPages.js

@@ -0,0 +1,88 @@
+import { serializeKeyingCanonicalJson } from "../crypto/index.js";
+import { getProjectionPolicyHistoryOperation, operationRequestPathWithQuery, } from "../validators/operation/index.js";
+import { isPrincipalPolicySnapshotPageResponse, PrincipalPolicyHistorySourceResponseSchema, } from "../validators/response/index.js";
+import { principalHistoryRequest } from "./principalHistoryRequest.js";
+import { PrincipalHistoryRequestContext } from "./principalHistoryRequestContext.js";
+function validPage(page, source, after) {
+    const head = source.head;
+    const state = page.currentState;
+    const through = after + page.previousStates.length;
+    return (state.principalType === head.principalType &&
+        state.principalId === head.principalId &&
+        state.version === head.version &&
+        state.stateHash === head.stateHash &&
+        state.keyEpoch === head.keyEpoch &&
+        state.keyFingerprint === head.keyFingerprint &&
+        page.historyPage.afterVersion === after &&
+        through < head.version &&
+        page.previousStates.every(({ state: entry }, index) => entry.version === after + index + 1 &&
+            entry.principalType === head.principalType &&
+            entry.principalId === head.principalId) &&
+        (page.historyPage.nextAfterVersion === null
+            ? through === head.version - 1
+            : through > after &&
+                through < head.version - 1 &&
+                page.historyPage.nextAfterVersion === through));
+}
+/** One bounded public page at a time. Only the caller authenticates its contents. */
+export async function* readProjectionPolicyHistoryPages(runtime, input, options = {}) {
+    const parsed = PrincipalPolicyHistorySourceResponseSchema.safeParse(input);
+    let afterVersion = options.afterVersion ?? 0;
+    const invalid = (message, status = null) => runtime.responseRequest.reportFailure({
+        kind: "shape",
+        message,
+        method: "GET",
+        options,
+        path: "/principals/history",
+        status,
+        statusText: "",
+    });
+    if (!parsed.success ||
+        !Number.isSafeInteger(afterVersion) ||
+        afterVersion < 0 ||
+        afterVersion >= parsed.data.head.version) {
+        yield invalid("Invalid projection history source or cursor");
+        return;
+    }
+    const source = structuredClone(parsed.data);
+    const context = new PrincipalHistoryRequestContext(runtime, "GET", "/principals/history", options);
+    let pinnedBytes;
+    while (true) {
+        const path = operationRequestPathWithQuery(getProjectionPolicyHistoryOperation, {}, { grant: source.grant, afterVersion });
+        const result = await principalHistoryRequest(runtime, {
+            path,
+            validator: isPrincipalPolicySnapshotPageResponse,
+            method: "GET",
+            operation: getProjectionPolicyHistoryOperation,
+            options,
+            context,
+        });
+        if (!result.ok) {
+            yield result;
+            return;
+        }
+        const page = result.data;
+        const bytes = serializeKeyingCanonicalJson({
+            currentState: page.currentState,
+            currentProjection: page.currentProjection,
+            currentGrants: page.currentGrants,
+        });
+        if (!validPage(page, source, afterVersion) ||
+            (pinnedBytes !== undefined && bytes !== pinnedBytes)) {
+            yield invalid("Projection history page changed its head, order, or cursor", 200);
+            return;
+        }
+        pinnedBytes ??= bytes;
+        context.afterReadPage();
+        const next = page.historyPage.nextAfterVersion;
+        yield result;
+        if (context.cancelled()) {
+            yield context.failure();
+            return;
+        }
+        if (next === null)
+            return;
+        afterVersion = next;
+    }
+}
+//# sourceMappingURL=projectionPolicyHistoryPages.js.map

package/internal/api-client/projectionPolicyHistoryPages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionPolicyHistoryPages.js","sourceRoot":"","sources":["projectionPolicyHistoryPages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,qCAAqC,EAErC,0CAA0C,GAE3C,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AASlF,SAAS,SAAS,CAChB,IAAyC,EACzC,MAA4C,EAC5C,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACnD,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;QAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAC9B,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QAClC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAChC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC5C,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,KAAK;QACvC,OAAO,GAAG,IAAI,CAAC,OAAO;QACtB,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAC1B,KAAK,CAAC,OAAO,KAAK,KAAK,GAAG,KAAK,GAAG,CAAC;YACnC,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;YAC1C,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CACzC;QACD,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,IAAI;YACzC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,GAAG,CAAC;YAC9B,CAAC,CAAC,OAAO,GAAG,KAAK;gBACf,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC;gBAC1B,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,OAAO,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,gCAAgC,CACrD,OAA0B,EAC1B,KAA2C,EAC3C,UAA8C,EAAE;IAEhD,MAAM,MAAM,GAAG,0CAA0C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3E,IAAI,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,SAAwB,IAAI,EAAE,EAAE,CAChE,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC;QACpC,IAAI,EAAE,OAAO;QACb,OAAO;QACP,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI,EAAE,qBAAqB;QAC3B,MAAM;QACN,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;IACL,IACE,CAAC,MAAM,CAAC,OAAO;QACf,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;QACnC,YAAY,GAAG,CAAC;QAChB,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EACxC,CAAC;QACD,MAAM,OAAO,CAAC,6CAA6C,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,OAAO,EACP,KAAK,EACL,qBAAqB,EACrB,OAAO,CACR,CAAC;IACF,IAAI,WAA+B,CAAC;IACpC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,6BAA6B,CACxC,mCAAmC,EACnC,EAAE,EACF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CACtC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE;YACpD,IAAI;YACJ,SAAS,EAAE,qCAAqC;YAChD,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,mCAAmC;YAC9C,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,4BAA4B,CAAC;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,IACE,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC;YACtC,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,CAAC,EACpD,CAAC;YACD,MAAM,OAAO,CACX,4DAA4D,EAC5D,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QACD,WAAW,KAAK,KAAK,CAAC;QACtB,OAAO,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC/C,MAAM,MAAM,CAAC;QACb,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAC1B,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;AACH,CAAC","sourcesContent":["import { serializeKeyingCanonicalJson } from \"@tearleads/crypto\";\nimport {\n  getProjectionPolicyHistoryOperation,\n  operationRequestPathWithQuery,\n} from \"@tearleads/validators/operation\";\nimport {\n  isPrincipalPolicySnapshotPageResponse,\n  type PrincipalPolicyHistorySourceResponse,\n  PrincipalPolicyHistorySourceResponseSchema,\n  type PrincipalPolicySnapshotPageResponse,\n} from \"@tearleads/validators/response\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport { PrincipalHistoryRequestContext } from \"./principalHistoryRequestContext\";\nimport type { RequestResult, RequestResultOptions } from \"./types\";\n\nexport interface ProjectionPolicyHistoryReadOptions\n  extends RequestResultOptions {\n  /** Only skip a prefix already authenticated by the caller. */\n  readonly afterVersion?: number | undefined;\n}\n\nfunction validPage(\n  page: PrincipalPolicySnapshotPageResponse,\n  source: PrincipalPolicyHistorySourceResponse,\n  after: number,\n): boolean {\n  const head = source.head;\n  const state = page.currentState;\n  const through = after + page.previousStates.length;\n  return (\n    state.principalType === head.principalType &&\n    state.principalId === head.principalId &&\n    state.version === head.version &&\n    state.stateHash === head.stateHash &&\n    state.keyEpoch === head.keyEpoch &&\n    state.keyFingerprint === head.keyFingerprint &&\n    page.historyPage.afterVersion === after &&\n    through < head.version &&\n    page.previousStates.every(\n      ({ state: entry }, index) =>\n        entry.version === after + index + 1 &&\n        entry.principalType === head.principalType &&\n        entry.principalId === head.principalId,\n    ) &&\n    (page.historyPage.nextAfterVersion === null\n      ? through === head.version - 1\n      : through > after &&\n        through < head.version - 1 &&\n        page.historyPage.nextAfterVersion === through)\n  );\n}\n\n/** One bounded public page at a time. Only the caller authenticates its contents. */\nexport async function* readProjectionPolicyHistoryPages(\n  runtime: ApiRequestRuntime,\n  input: PrincipalPolicyHistorySourceResponse,\n  options: ProjectionPolicyHistoryReadOptions = {},\n): AsyncGenerator<RequestResult<PrincipalPolicySnapshotPageResponse>, void> {\n  const parsed = PrincipalPolicyHistorySourceResponseSchema.safeParse(input);\n  let afterVersion = options.afterVersion ?? 0;\n  const invalid = (message: string, status: number | null = null) =>\n    runtime.responseRequest.reportFailure({\n      kind: \"shape\",\n      message,\n      method: \"GET\",\n      options,\n      path: \"/principals/history\",\n      status,\n      statusText: \"\",\n    });\n  if (\n    !parsed.success ||\n    !Number.isSafeInteger(afterVersion) ||\n    afterVersion < 0 ||\n    afterVersion >= parsed.data.head.version\n  ) {\n    yield invalid(\"Invalid projection history source or cursor\");\n    return;\n  }\n  const source = structuredClone(parsed.data);\n  const context = new PrincipalHistoryRequestContext(\n    runtime,\n    \"GET\",\n    \"/principals/history\",\n    options,\n  );\n  let pinnedBytes: string | undefined;\n  while (true) {\n    const path = operationRequestPathWithQuery(\n      getProjectionPolicyHistoryOperation,\n      {},\n      { grant: source.grant, afterVersion },\n    );\n    const result = await principalHistoryRequest(runtime, {\n      path,\n      validator: isPrincipalPolicySnapshotPageResponse,\n      method: \"GET\",\n      operation: getProjectionPolicyHistoryOperation,\n      options,\n      context,\n    });\n    if (!result.ok) {\n      yield result;\n      return;\n    }\n    const page = result.data;\n    const bytes = serializeKeyingCanonicalJson({\n      currentState: page.currentState,\n      currentProjection: page.currentProjection,\n      currentGrants: page.currentGrants,\n    });\n    if (\n      !validPage(page, source, afterVersion) ||\n      (pinnedBytes !== undefined && bytes !== pinnedBytes)\n    ) {\n      yield invalid(\n        \"Projection history page changed its head, order, or cursor\",\n        200,\n      );\n      return;\n    }\n    pinnedBytes ??= bytes;\n    context.afterReadPage();\n    const next = page.historyPage.nextAfterVersion;\n    yield result;\n    if (context.cancelled()) {\n      yield context.failure();\n      return;\n    }\n    if (next === null) return;\n    afterVersion = next;\n  }\n}\n"]}

package/internal/api-client/writerProjectionRequests.js

@@ -0,0 +1,26 @@
+import { getContainerWriterProjectionOperation, getDocumentWriterProjectionOperation, } from "../validators/operation/index.js";
+import { principalHistoryRequest } from "./principalHistoryRequest.js";
+/** Preparation and body deadlines sit inside projection-history negotiation. */
+export function writerProjectionRequests(runtime) {
+    const requestResult = (path, validator, method, body, options, operation) => {
+        if (method === "GET" &&
+            (operation.id === "containers.writerProjection.get" ||
+                operation.id === "documents.writerProjection.get"))
+            return principalHistoryRequest(runtime, {
+                path,
+                validator,
+                method,
+                options: options ?? {},
+                operation: operation.id === "containers.writerProjection.get"
+                    ? getContainerWriterProjectionOperation
+                    : getDocumentWriterProjectionOperation,
+            });
+        return runtime.requestResult(path, validator, method, body, options, operation);
+    };
+    const request = async (...args) => {
+        const result = await requestResult(...args);
+        return result.ok ? result.data : null;
+    };
+    return { request, requestResult };
+}
+//# sourceMappingURL=writerProjectionRequests.js.map

package/internal/api-client/writerProjectionRequests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writerProjectionRequests.js","sourceRoot":"","sources":["writerProjectionRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CAAC,OAA0B;IAIjE,MAAM,aAAa,GAA6B,CAC9C,IAAI,EACJ,SAAS,EACT,MAAM,EACN,IAAI,EACJ,OAAO,EACP,SAAS,EACT,EAAE;QACF,IACE,MAAM,KAAK,KAAK;YAChB,CAAC,SAAS,CAAC,EAAE,KAAK,iCAAiC;gBACjD,SAAS,CAAC,EAAE,KAAK,gCAAgC,CAAC;YAEpD,OAAO,uBAAuB,CAAC,OAAO,EAAE;gBACtC,IAAI;gBACJ,SAAS;gBACT,MAAM;gBACN,OAAO,EAAE,OAAO,IAAI,EAAE;gBACtB,SAAS,EACP,SAAS,CAAC,EAAE,KAAK,iCAAiC;oBAChD,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,oCAAoC;aAC3C,CAAC,CAAC;QACL,OAAO,OAAO,CAAC,aAAa,CAC1B,IAAI,EACJ,SAAS,EACT,MAAM,EACN,IAAI,EACJ,OAAO,EACP,SAAS,CACV,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAuB,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACpC,CAAC","sourcesContent":["import {\n  getContainerWriterProjectionOperation,\n  getDocumentWriterProjectionOperation,\n} from \"@tearleads/validators/operation\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport type { OperationRequestFn, OperationRequestResultFn } from \"./types\";\n\n/** Preparation and body deadlines sit inside projection-history negotiation. */\nexport function writerProjectionRequests(runtime: ApiRequestRuntime): {\n  request: OperationRequestFn;\n  requestResult: OperationRequestResultFn;\n} {\n  const requestResult: OperationRequestResultFn = (\n    path,\n    validator,\n    method,\n    body,\n    options,\n    operation,\n  ) => {\n    if (\n      method === \"GET\" &&\n      (operation.id === \"containers.writerProjection.get\" ||\n        operation.id === \"documents.writerProjection.get\")\n    )\n      return principalHistoryRequest(runtime, {\n        path,\n        validator,\n        method,\n        options: options ?? {},\n        operation:\n          operation.id === \"containers.writerProjection.get\"\n            ? getContainerWriterProjectionOperation\n            : getDocumentWriterProjectionOperation,\n      });\n    return runtime.requestResult(\n      path,\n      validator,\n      method,\n      body,\n      options,\n      operation,\n    );\n  };\n  const request: OperationRequestFn = async (...args) => {\n    const result = await requestResult(...args);\n    return result.ok ? result.data : null;\n  };\n  return { request, requestResult };\n}\n"]}

package/internal/crypto/index.d.ts

@@ -20,7 +20,7 @@ export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, type IdentitySeedPhraseKeyPairs, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, type IncrementalSha256, } from "./incrementalSha256.js";
 export type { AccessEvent, AccessEventType, AccessManifest, AccessManifestCheckpoint, AccessManifestTransparencyLeaf, AccessObjectKind, AnyVerifiedAccessManifest, AnyVerifiedPrincipalPolicy, AttachmentAccessEventBody, AttachmentBindAccessEventBody, AttachmentDetachAccessEventBody, BlobAccessManifest, BlobContentKeyTarget, ContainerAccessEventBody, ContainerAccessKeyState, ContainerAccessLevel, ContainerAccessManifest, ContainerAccessManifestState, ContainerAccessStructural, ContainerCreateAccessEventBody, ContainerDirectGrant, ContainerGrantAccessEventBody, ContainerGrantPrincipalHead, ContainerGrantSubjectType, ContainerKekKeyring, ContainerKekKeyringEntry, ContainerKekPredecessorBridge, ContainerKekRecipientTarget, ContainerKekTarget, ContainerKeyEpoch, ContainerKeyWrap, ContainerMoveAccessEventBody, ContainerReciteAccessEventBody, ContainerRekeyAccessEventBody, ContainerRevokeAccessEventBody, ContainerUserRecipientKey, ContentObjectKind, ContentRecordEncryptionSuite, ContentRecordNonceDomain, DeriveBlobKekTargetsInput, DeriveContainerKekRecipientTargetsInput, DeriveDocumentKekTargetsInput, DocumentAccessEventBody, DocumentContentKeyTarget, DocumentContentRecordMetadataInput, DocumentLinkAccessEventBody, DocumentLinkSetManifestState, DocumentLinkSetStructural, DocumentPurgeAccessEventBody, DocumentUnlinkAccessEventBody, IdentityStateCheckpoint, IdentityStateHead, IdentityStateTransparencyLeaf, KekRecipientKind, KeyingCanonicalJson, KeyingHashDomain, KeyingLocalCheckpointStore, KeyingVerificationCode, KeyingVerificationResult, ManagedPrincipalKind, PrincipalHistoryIndexNode, PrincipalPolicyAuthorization, PrincipalPolicyBundle, PrincipalPolicyCheckpoint, PrincipalPolicyCurrent, PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, PrincipalPolicyHistoryInput, PrincipalPolicyHistoryPage, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryReferenceProof, PrincipalPolicyHistoryVerifier, PrincipalPolicyMemberEnvelopes, PrincipalPolicyPayload, PrincipalPolicySignedState, PrincipalPolicySignerPublicKey, PrincipalPolicySnapshot, PrincipalPolicyStateChainEntry, PrincipalPolicyTransitionMismatch, PrincipalPolicyTransitionMismatchCode, PrincipalPolicyTransparencyLeaf, ReferencedPrincipalHead, SignedTransparencyTreeHead, TransparencyConsistencyProof, TransparencyInclusionProof, TransparencyLeaf, TransparencyLeafKind, TransparencyTreeCheckpoint, UnsignedAccessEvent, UnsignedTransparencyTreeHead, UnsignedWriteHeader, VerifiedAccessEvent, VerifiedAccessManifest, VerifiedAccessManifestCheckpointEvidence, VerifiedAccessManifestSnapshot, VerifiedAttachmentBinding, VerifiedAttachmentDetach, VerifiedBlobKekTargets, VerifiedContainerAccessManifest, VerifiedContainerKekState, VerifiedContainerParentEdge, VerifiedDocumentKekTargets, VerifiedDocumentLinkSetManifest, VerifiedDocumentLinkSetSnapshot, VerifiedDocumentLinkSetStateEvidence, VerifiedIdentityState, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent, VerifiedPrincipalPolicyHistory, VerifiedPrincipalPolicySelection, VerifiedPrincipalPolicySnapshot, VerifiedTransparencyProof, VerifiedTransparencyTreeHead, VerifiedWriteHeader, VerifyAccessEventInput, VerifyAccessManifestInput, VerifyAttachmentBindingEventInput, VerifyAttachmentDetachEventInput, VerifyContainerAccessManifestInput, VerifyContainerKekStateInput, VerifyContainerParentEdgeInput, VerifyDocumentLinkSetManifestInput, VerifyDocumentPurgeEventInput, VerifyIdentityStateCheckpointInput, VerifyPrincipalPolicyBundleInput, VerifyPrincipalPolicySnapshotInput, VerifySignedTransparencyTreeHeadInput, VerifyTransparencyConsistencyProofInput, VerifyTransparencyInclusionProofInput, VerifyTransparencyProofInput, VerifyWriteHeaderInput, WriteHeader, } from "./keying.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, type VerifiedOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js

@@ -14,7 +14,7 @@ export { decryptGroupMetadata, encodeBuiltinGroupMetadata, encryptGroupMetadata,
 export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, } from "./incrementalSha256.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n  BlobEnvelopeHeaderRecord,\n  BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n  MAX_BLOB_ENVELOPE_HEADER_BYTES,\n  parseBlobEnvelopeV2,\n  parseBlobEnvelopeV2Header,\n  readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n  BLOB_CHUNK_SIZE_BYTES,\n  BLOB_ENCRYPTED_BYTES_FORMAT,\n  BLOB_ENCRYPTED_BYTES_VERSION,\n  BLOB_ENVELOPE_MAGIC_BYTES,\n  BLOB_ENVELOPE_PREFIX_BYTES,\n  blobChunkPlaintextByteLength,\n  computeBlobChunkCount,\n  computeBlobEncryptedByteLength,\n  deriveBlobChunkIv,\n  encodeBlobEnvelopeV2Header,\n  joinBlobPartBytes,\n  MAX_BLOB_CHUNK_COUNT,\n  normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n  AUTH_CHALLENGE_BYTES,\n  AUTH_CHALLENGE_HEX_LENGTH,\n  authChallengeSigningBytes,\n  CHALLENGE_TTL_SECONDS,\n  canonicalAuthOrigin,\n  generateChallenge,\n} from \"./challenge\";\nexport type {\n  ContentKeyEnvelopeKind,\n  ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n  ContentKeyEnvelopeError,\n  decodeContentKeyEnvelope,\n  unwrapContentKey,\n  wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n  generateKemKeyPair,\n  generateKemSeedAndKeyPair,\n  ML_KEM1024_CIPHERTEXT_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  ML_KEM1024_SECRET_KEY_BYTES,\n  ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n  decryptGroupMetadata,\n  encodeBuiltinGroupMetadata,\n  encryptGroupMetadata,\n  type GroupMetadata,\n  type GroupMetadataKey,\n  readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n  createIdentitySeedPhrase,\n  createIdentitySeedPhraseFromEntropy,\n  generateIdentityKeyPairsFromSeedPhrase,\n  IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n  IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n  IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n  IDENTITY_SEED_PHRASE_WORDS,\n  type IdentitySeedPhraseKeyPairs,\n  normalizeIdentitySeedPhrase,\n  validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n  createIncrementalSha256,\n  type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n  AccessEvent,\n  AccessEventType,\n  AccessManifest,\n  AccessManifestCheckpoint,\n  AccessManifestTransparencyLeaf,\n  AccessObjectKind,\n  AnyVerifiedAccessManifest,\n  AnyVerifiedPrincipalPolicy,\n  AttachmentAccessEventBody,\n  AttachmentBindAccessEventBody,\n  AttachmentDetachAccessEventBody,\n  BlobAccessManifest,\n  BlobContentKeyTarget,\n  ContainerAccessEventBody,\n  ContainerAccessKeyState,\n  ContainerAccessLevel,\n  ContainerAccessManifest,\n  ContainerAccessManifestState,\n  ContainerAccessStructural,\n  ContainerCreateAccessEventBody,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerGrantPrincipalHead,\n  ContainerGrantSubjectType,\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerKekPredecessorBridge,\n  ContainerKekRecipientTarget,\n  ContainerKekTarget,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerMoveAccessEventBody,\n  ContainerReciteAccessEventBody,\n  ContainerRekeyAccessEventBody,\n  ContainerRevokeAccessEventBody,\n  ContainerUserRecipientKey,\n  ContentObjectKind,\n  ContentRecordEncryptionSuite,\n  ContentRecordNonceDomain,\n  DeriveBlobKekTargetsInput,\n  DeriveContainerKekRecipientTargetsInput,\n  DeriveDocumentKekTargetsInput,\n  DocumentAccessEventBody,\n  DocumentContentKeyTarget,\n  DocumentContentRecordMetadataInput,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentLinkSetStructural,\n  DocumentPurgeAccessEventBody,\n  DocumentUnlinkAccessEventBody,\n  IdentityStateCheckpoint,\n  IdentityStateHead,\n  IdentityStateTransparencyLeaf,\n  KekRecipientKind,\n  KeyingCanonicalJson,\n  KeyingHashDomain,\n  KeyingLocalCheckpointStore,\n  KeyingVerificationCode,\n  KeyingVerificationResult,\n  ManagedPrincipalKind,\n  PrincipalHistoryIndexNode,\n  PrincipalPolicyAuthorization,\n  PrincipalPolicyBundle,\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyCurrent,\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryReferenceProof,\n  PrincipalPolicyHistoryVerifier,\n  PrincipalPolicyMemberEnvelopes,\n  PrincipalPolicyPayload,\n  PrincipalPolicySignedState,\n  PrincipalPolicySignerPublicKey,\n  PrincipalPolicySnapshot,\n  PrincipalPolicyStateChainEntry,\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n  PrincipalPolicyTransparencyLeaf,\n  ReferencedPrincipalHead,\n  SignedTransparencyTreeHead,\n  TransparencyConsistencyProof,\n  TransparencyInclusionProof,\n  TransparencyLeaf,\n  TransparencyLeafKind,\n  TransparencyTreeCheckpoint,\n  UnsignedAccessEvent,\n  UnsignedTransparencyTreeHead,\n  UnsignedWriteHeader,\n  VerifiedAccessEvent,\n  VerifiedAccessManifest,\n  VerifiedAccessManifestCheckpointEvidence,\n  VerifiedAccessManifestSnapshot,\n  VerifiedAttachmentBinding,\n  VerifiedAttachmentDetach,\n  VerifiedBlobKekTargets,\n  VerifiedContainerAccessManifest,\n  VerifiedContainerKekState,\n  VerifiedContainerParentEdge,\n  VerifiedDocumentKekTargets,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedDocumentLinkSetSnapshot,\n  VerifiedDocumentLinkSetStateEvidence,\n  VerifiedIdentityState,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyHistory,\n  VerifiedPrincipalPolicySelection,\n  VerifiedPrincipalPolicySnapshot,\n  VerifiedTransparencyProof,\n  VerifiedTransparencyTreeHead,\n  VerifiedWriteHeader,\n  VerifyAccessEventInput,\n  VerifyAccessManifestInput,\n  VerifyAttachmentBindingEventInput,\n  VerifyAttachmentDetachEventInput,\n  VerifyContainerAccessManifestInput,\n  VerifyContainerKekStateInput,\n  VerifyContainerParentEdgeInput,\n  VerifyDocumentLinkSetManifestInput,\n  VerifyDocumentPurgeEventInput,\n  VerifyIdentityStateCheckpointInput,\n  VerifyPrincipalPolicyBundleInput,\n  VerifyPrincipalPolicySnapshotInput,\n  VerifySignedTransparencyTreeHeadInput,\n  VerifyTransparencyConsistencyProofInput,\n  VerifyTransparencyInclusionProofInput,\n  VerifyTransparencyProofInput,\n  VerifyWriteHeaderInput,\n  WriteHeader,\n} from \"./keying\";\nexport {\n  ACCESS_MANIFEST_VERIFICATION_REVISION,\n  accessManifestCheckpointFromManifest,\n  accessManifestTransparencyLeaf,\n  assertSealedContainerKekKeyringLength,\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  CONTAINER_KEK_KEYRING_SEAL_SUITE,\n  CONTAINER_KEK_MATERIAL_ID_PREFIX,\n  CONTAINER_KEK_PARENT_WRAP_SUITE,\n  CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n  CONTAINER_KEK_USER_WRAP_SUITE,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeAccessEventBodyHash,\n  computeAccessEventHash,\n  computeAccessManifestHash,\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n  computeContainerAccessKeyTargetHash,\n  computeContainerAccessStructuralHash,\n  computeContainerDirectGrantRoot,\n  computeContainerKekKeyringHash,\n  computeContainerKekMaterialId,\n  computeContainerKekPredecessorBridgeHash,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentKeyTargetHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  computeDocumentContentRecordPlaintextHash,\n  computeDocumentLinkSetGrantRoot,\n  computeDocumentLinkSetKeyTargetHash,\n  computeDocumentLinkSetStructuralHash,\n  computeKeyingDomainHash,\n  computeTransparencyLeafHash,\n  computeTransparencyMerkleRoot,\n  computeWriteHeaderHash,\n  createContainerKekPredecessorBridge,\n  createPrincipalHistoryIndexProof,\n  createPrincipalPolicyHistoryVerifier,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  deriveBlobKekTargets,\n  deriveContainerAccessManifest,\n  deriveContainerKekRecipientTargets,\n  deriveContainerKekWrappingPublicKey,\n  deriveDocumentKekTargets,\n  deriveDocumentLinkSetManifest,\n  derivePrincipalRecipientKeyEpochId,\n  documentContentRecordMetadata,\n  expectedSealedContainerKekKeyringBytes,\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n  identityStateTransparencyLeaf,\n  isContainerKekMaterialId,\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n  KeyingVerificationError,\n  MAX_CONTAINER_KEY_EPOCH,\n  MAX_CONTAINER_RECITATION_EPOCH,\n  makeVerifiedAccessEvent,\n  makeVerifiedBlobKekTargets,\n  makeVerifiedContainerAccessManifest,\n  makeVerifiedContainerKekState,\n  makeVerifiedDocumentKekTargets,\n  makeVerifiedDocumentLinkSetManifest,\n  makeVerifiedDocumentLinkSetSnapshot,\n  makeVerifiedPrincipalPolicy,\n  normalizeAttachmentAccessEventBody,\n  normalizeContainerAccessEventBody,\n  normalizeContainerKekKeyring,\n  normalizeContainerKekPredecessorBridge,\n  normalizeDocumentAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  openContainerKekKeyring,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n  principalHistoryIndexLeaf,\n  principalPolicyMatchesReference,\n  principalPolicyTransparencyLeaf,\n  resolveContainerPathUserAccessLevel,\n  resolveContainerStatePathUserAccessLevel,\n  resolveHistoricalContainerPathUserAccessLevel,\n  resolvePrincipalHistoryIndexProof,\n  restorePrincipalPolicyHistoryVerifier,\n  sealContainerKekKeyring,\n  selectPrincipalPolicyAuthorization,\n  serializeKeyingCanonicalJson,\n  signAccessEvent,\n  signTransparencyTreeHead,\n  signWriteHeader,\n  unwrapContainerKekParentWrap,\n  unwrapContainerKekPredecessorBridge,\n  verifyAccessManifest,\n  verifyAccessManifestLocalCheckpoint,\n  verifyAccessManifestSnapshot,\n  verifyAttachmentBindingEvent,\n  verifyAttachmentDetachEvent,\n  verifyContainerAccessManifest,\n  verifyContainerKekKeyringEntry,\n  verifyContainerKekState,\n  verifyContainerParentEdge,\n  verifyDocumentLinkSetManifest,\n  verifyDocumentLinkSetSnapshot,\n  verifyDocumentPurgeEvent,\n  verifyIdentityStateCheckpoint,\n  verifyPrincipalPolicyBundle,\n  verifyPrincipalPolicyBundleAgainstHistory,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n  verifyPrincipalPolicyHistoryReferences,\n  verifyPrincipalPolicySnapshot,\n  verifySignedAccessEvent,\n  verifySignedTransparencyTreeHead,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n  verifyTransparencyProof,\n  verifyWriteHeader,\n} from \"./keying\";\nexport {\n  organizationReplacementAuthorizationPayload,\n  organizationReplacementSigningBytes,\n  signOrganizationReplacementAuthorization,\n  type VerifiedOrganizationReplacementAuthorization,\n  verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n  computePrincipalContainerGrantRoot,\n  normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n  computePrincipalMemberEnvelopesRoot,\n  normalizePrincipalStateMemberEnvelopes,\n  PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n  PrincipalPolicyValidationError,\n  throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n  ManagedRecipientPrincipalType,\n  PrincipalContainerGrant,\n  PrincipalContainerGrantAccessLevel,\n  PrincipalProjectionMember,\n  PrincipalProjectionRole,\n  PrincipalStateExternalAuthority,\n  PrincipalStateHeaderInput,\n  PrincipalStateMember,\n  PrincipalStateMemberEnvelope,\n  PrincipalStateMembershipMode,\n  PrincipalStatePayloadCipherSuite,\n  PrincipalStateSigningInput,\n  SignedPrincipalState,\n  UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n  buildPrincipalStateSigningInput,\n  computePrincipalMembershipRoot,\n  computePrincipalProjectionRoot,\n  computePrincipalStateHash,\n  computePrincipalStatePayloadCiphertextHash,\n  derivePrincipalProjectionMembers,\n  isManagedRecipientPrincipalType,\n  isPrincipalProjectionRole,\n  normalizePrincipalProjectionMembers,\n  normalizePrincipalStateMembers,\n  serializeUnsignedPrincipalState,\n  signPrincipalState,\n} from \"./principalState\";\nexport {\n  verifySignedPrincipalState,\n  verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n  captureProjectionHistory,\n  type HistoryProjection,\n  omitProjectionHistory,\n  type RetainedProjectionHistory,\n  restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n  generateSigningKeyPair,\n  generateSigningSeedAndKeyPair,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SECRET_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n  AES_256_KEY_BYTES,\n  AES_GCM_IV_BYTES,\n  AES_GCM_TAG_BYTES,\n  assertAesGcmIv,\n  createAesGcmIv,\n  decryptWithDek,\n  encryptWithDek,\n} from \"./symmetric\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,oCAAoC,EACpC,qCAAqC,EACrC,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n  BlobEnvelopeHeaderRecord,\n  BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n  MAX_BLOB_ENVELOPE_HEADER_BYTES,\n  parseBlobEnvelopeV2,\n  parseBlobEnvelopeV2Header,\n  readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n  BLOB_CHUNK_SIZE_BYTES,\n  BLOB_ENCRYPTED_BYTES_FORMAT,\n  BLOB_ENCRYPTED_BYTES_VERSION,\n  BLOB_ENVELOPE_MAGIC_BYTES,\n  BLOB_ENVELOPE_PREFIX_BYTES,\n  blobChunkPlaintextByteLength,\n  computeBlobChunkCount,\n  computeBlobEncryptedByteLength,\n  deriveBlobChunkIv,\n  encodeBlobEnvelopeV2Header,\n  joinBlobPartBytes,\n  MAX_BLOB_CHUNK_COUNT,\n  normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n  AUTH_CHALLENGE_BYTES,\n  AUTH_CHALLENGE_HEX_LENGTH,\n  authChallengeSigningBytes,\n  CHALLENGE_TTL_SECONDS,\n  canonicalAuthOrigin,\n  generateChallenge,\n} from \"./challenge\";\nexport type {\n  ContentKeyEnvelopeKind,\n  ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n  ContentKeyEnvelopeError,\n  decodeContentKeyEnvelope,\n  unwrapContentKey,\n  wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n  generateKemKeyPair,\n  generateKemSeedAndKeyPair,\n  ML_KEM1024_CIPHERTEXT_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  ML_KEM1024_SECRET_KEY_BYTES,\n  ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n  decryptGroupMetadata,\n  encodeBuiltinGroupMetadata,\n  encryptGroupMetadata,\n  type GroupMetadata,\n  type GroupMetadataKey,\n  readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n  createIdentitySeedPhrase,\n  createIdentitySeedPhraseFromEntropy,\n  generateIdentityKeyPairsFromSeedPhrase,\n  IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n  IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n  IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n  IDENTITY_SEED_PHRASE_WORDS,\n  type IdentitySeedPhraseKeyPairs,\n  normalizeIdentitySeedPhrase,\n  validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n  createIncrementalSha256,\n  type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n  AccessEvent,\n  AccessEventType,\n  AccessManifest,\n  AccessManifestCheckpoint,\n  AccessManifestTransparencyLeaf,\n  AccessObjectKind,\n  AnyVerifiedAccessManifest,\n  AnyVerifiedPrincipalPolicy,\n  AttachmentAccessEventBody,\n  AttachmentBindAccessEventBody,\n  AttachmentDetachAccessEventBody,\n  BlobAccessManifest,\n  BlobContentKeyTarget,\n  ContainerAccessEventBody,\n  ContainerAccessKeyState,\n  ContainerAccessLevel,\n  ContainerAccessManifest,\n  ContainerAccessManifestState,\n  ContainerAccessStructural,\n  ContainerCreateAccessEventBody,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerGrantPrincipalHead,\n  ContainerGrantSubjectType,\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerKekPredecessorBridge,\n  ContainerKekRecipientTarget,\n  ContainerKekTarget,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerMoveAccessEventBody,\n  ContainerReciteAccessEventBody,\n  ContainerRekeyAccessEventBody,\n  ContainerRevokeAccessEventBody,\n  ContainerUserRecipientKey,\n  ContentObjectKind,\n  ContentRecordEncryptionSuite,\n  ContentRecordNonceDomain,\n  DeriveBlobKekTargetsInput,\n  DeriveContainerKekRecipientTargetsInput,\n  DeriveDocumentKekTargetsInput,\n  DocumentAccessEventBody,\n  DocumentContentKeyTarget,\n  DocumentContentRecordMetadataInput,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentLinkSetStructural,\n  DocumentPurgeAccessEventBody,\n  DocumentUnlinkAccessEventBody,\n  IdentityStateCheckpoint,\n  IdentityStateHead,\n  IdentityStateTransparencyLeaf,\n  KekRecipientKind,\n  KeyingCanonicalJson,\n  KeyingHashDomain,\n  KeyingLocalCheckpointStore,\n  KeyingVerificationCode,\n  KeyingVerificationResult,\n  ManagedPrincipalKind,\n  PrincipalHistoryIndexNode,\n  PrincipalPolicyAuthorization,\n  PrincipalPolicyBundle,\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyCurrent,\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryReferenceProof,\n  PrincipalPolicyHistoryVerifier,\n  PrincipalPolicyMemberEnvelopes,\n  PrincipalPolicyPayload,\n  PrincipalPolicySignedState,\n  PrincipalPolicySignerPublicKey,\n  PrincipalPolicySnapshot,\n  PrincipalPolicyStateChainEntry,\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n  PrincipalPolicyTransparencyLeaf,\n  ReferencedPrincipalHead,\n  SignedTransparencyTreeHead,\n  TransparencyConsistencyProof,\n  TransparencyInclusionProof,\n  TransparencyLeaf,\n  TransparencyLeafKind,\n  TransparencyTreeCheckpoint,\n  UnsignedAccessEvent,\n  UnsignedTransparencyTreeHead,\n  UnsignedWriteHeader,\n  VerifiedAccessEvent,\n  VerifiedAccessManifest,\n  VerifiedAccessManifestCheckpointEvidence,\n  VerifiedAccessManifestSnapshot,\n  VerifiedAttachmentBinding,\n  VerifiedAttachmentDetach,\n  VerifiedBlobKekTargets,\n  VerifiedContainerAccessManifest,\n  VerifiedContainerKekState,\n  VerifiedContainerParentEdge,\n  VerifiedDocumentKekTargets,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedDocumentLinkSetSnapshot,\n  VerifiedDocumentLinkSetStateEvidence,\n  VerifiedIdentityState,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyHistory,\n  VerifiedPrincipalPolicySelection,\n  VerifiedPrincipalPolicySnapshot,\n  VerifiedTransparencyProof,\n  VerifiedTransparencyTreeHead,\n  VerifiedWriteHeader,\n  VerifyAccessEventInput,\n  VerifyAccessManifestInput,\n  VerifyAttachmentBindingEventInput,\n  VerifyAttachmentDetachEventInput,\n  VerifyContainerAccessManifestInput,\n  VerifyContainerKekStateInput,\n  VerifyContainerParentEdgeInput,\n  VerifyDocumentLinkSetManifestInput,\n  VerifyDocumentPurgeEventInput,\n  VerifyIdentityStateCheckpointInput,\n  VerifyPrincipalPolicyBundleInput,\n  VerifyPrincipalPolicySnapshotInput,\n  VerifySignedTransparencyTreeHeadInput,\n  VerifyTransparencyConsistencyProofInput,\n  VerifyTransparencyInclusionProofInput,\n  VerifyTransparencyProofInput,\n  VerifyWriteHeaderInput,\n  WriteHeader,\n} from \"./keying\";\nexport {\n  ACCESS_MANIFEST_VERIFICATION_REVISION,\n  accessManifestCheckpointFromManifest,\n  accessManifestTransparencyLeaf,\n  assertSealedContainerKekKeyringLength,\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  CONTAINER_KEK_KEYRING_SEAL_SUITE,\n  CONTAINER_KEK_MATERIAL_ID_PREFIX,\n  CONTAINER_KEK_PARENT_WRAP_SUITE,\n  CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n  CONTAINER_KEK_USER_WRAP_SUITE,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeAccessEventBodyHash,\n  computeAccessEventHash,\n  computeAccessManifestHash,\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n  computeContainerAccessKeyTargetHash,\n  computeContainerAccessStructuralHash,\n  computeContainerDirectGrantRoot,\n  computeContainerKekKeyringHash,\n  computeContainerKekMaterialId,\n  computeContainerKekPredecessorBridgeHash,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentKeyTargetHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  computeDocumentContentRecordPlaintextHash,\n  computeDocumentLinkSetGrantRoot,\n  computeDocumentLinkSetKeyTargetHash,\n  computeDocumentLinkSetStructuralHash,\n  computeKeyingDomainHash,\n  computeTransparencyLeafHash,\n  computeTransparencyMerkleRoot,\n  computeWriteHeaderHash,\n  createContainerKekPredecessorBridge,\n  createPrincipalHistoryIndexProof,\n  createPrincipalPolicyHistoryVerifier,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  deriveBlobKekTargets,\n  deriveContainerAccessManifest,\n  deriveContainerKekRecipientTargets,\n  deriveContainerKekWrappingPublicKey,\n  deriveDocumentKekTargets,\n  deriveDocumentLinkSetManifest,\n  derivePrincipalRecipientKeyEpochId,\n  documentContentRecordMetadata,\n  expectedSealedContainerKekKeyringBytes,\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n  identityStateTransparencyLeaf,\n  isContainerKekMaterialId,\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n  KeyingVerificationError,\n  MAX_CONTAINER_KEY_EPOCH,\n  MAX_CONTAINER_RECITATION_EPOCH,\n  makeVerifiedAccessEvent,\n  makeVerifiedBlobKekTargets,\n  makeVerifiedContainerAccessManifest,\n  makeVerifiedContainerKekState,\n  makeVerifiedDocumentKekTargets,\n  makeVerifiedDocumentLinkSetManifest,\n  makeVerifiedDocumentLinkSetSnapshot,\n  makeVerifiedPrincipalPolicy,\n  normalizeAttachmentAccessEventBody,\n  normalizeContainerAccessEventBody,\n  normalizeContainerKekKeyring,\n  normalizeContainerKekPredecessorBridge,\n  normalizeDocumentAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  openContainerKekKeyring,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n  principalHistoryIndexLeaf,\n  principalPolicyMatchesReference,\n  principalPolicyTransparencyLeaf,\n  resolveContainerPathUserAccessLevel,\n  resolveContainerStatePathUserAccessLevel,\n  resolveHistoricalContainerPathUserAccessLevel,\n  resolvePrincipalHistoryIndexProof,\n  restorePrincipalPolicyHistoryVerifier,\n  sealContainerKekKeyring,\n  selectPrincipalPolicyAuthorization,\n  serializeKeyingCanonicalJson,\n  signAccessEvent,\n  signTransparencyTreeHead,\n  signWriteHeader,\n  unwrapContainerKekParentWrap,\n  unwrapContainerKekPredecessorBridge,\n  verifyAccessManifest,\n  verifyAccessManifestLocalCheckpoint,\n  verifyAccessManifestSnapshot,\n  verifyAttachmentBindingEvent,\n  verifyAttachmentDetachEvent,\n  verifyContainerAccessManifest,\n  verifyContainerKekKeyringEntry,\n  verifyContainerKekState,\n  verifyContainerParentEdge,\n  verifyDocumentLinkSetManifest,\n  verifyDocumentLinkSetSnapshot,\n  verifyDocumentPurgeEvent,\n  verifyIdentityStateCheckpoint,\n  verifyPrincipalPolicyBundle,\n  verifyPrincipalPolicyBundleAgainstHistory,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrentMutation,\n  verifyPrincipalPolicyCurrentSuccessor,\n  verifyPrincipalPolicyHistoryReferences,\n  verifyPrincipalPolicySnapshot,\n  verifySignedAccessEvent,\n  verifySignedTransparencyTreeHead,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n  verifyTransparencyProof,\n  verifyWriteHeader,\n} from \"./keying\";\nexport {\n  organizationReplacementAuthorizationPayload,\n  organizationReplacementSigningBytes,\n  signOrganizationReplacementAuthorization,\n  type VerifiedOrganizationReplacementAuthorization,\n  verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n  computePrincipalContainerGrantRoot,\n  normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n  computePrincipalMemberEnvelopesRoot,\n  normalizePrincipalStateMemberEnvelopes,\n  PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n  PrincipalPolicyValidationError,\n  throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n  ManagedRecipientPrincipalType,\n  PrincipalContainerGrant,\n  PrincipalContainerGrantAccessLevel,\n  PrincipalProjectionMember,\n  PrincipalProjectionRole,\n  PrincipalStateExternalAuthority,\n  PrincipalStateHeaderInput,\n  PrincipalStateMember,\n  PrincipalStateMemberEnvelope,\n  PrincipalStateMembershipMode,\n  PrincipalStatePayloadCipherSuite,\n  PrincipalStateSigningInput,\n  SignedPrincipalState,\n  UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n  buildPrincipalStateSigningInput,\n  computePrincipalMembershipRoot,\n  computePrincipalProjectionRoot,\n  computePrincipalStateHash,\n  computePrincipalStatePayloadCiphertextHash,\n  derivePrincipalProjectionMembers,\n  isManagedRecipientPrincipalType,\n  isPrincipalProjectionRole,\n  normalizePrincipalProjectionMembers,\n  normalizePrincipalStateMembers,\n  serializeUnsignedPrincipalState,\n  signPrincipalState,\n} from \"./principalState\";\nexport {\n  verifySignedPrincipalState,\n  verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n  captureProjectionHistory,\n  type HistoryProjection,\n  omitProjectionHistory,\n  type RetainedProjectionHistory,\n  restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n  generateSigningKeyPair,\n  generateSigningSeedAndKeyPair,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SECRET_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n  AES_256_KEY_BYTES,\n  AES_GCM_IV_BYTES,\n  AES_GCM_TAG_BYTES,\n  assertAesGcmIv,\n  createAesGcmIv,\n  decryptWithDek,\n  encryptWithDek,\n} from \"./symmetric\";\n"]}

package/internal/crypto/keying/index.d.ts

@@ -15,6 +15,8 @@ export { type DocumentPurgeAccessEventBody, normalizeDocumentPurgeAccessEventBod
 export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent, verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
+export { verifyPrincipalPolicyCurrentMutation } from "./principalPolicyCurrentMutation.js";
+export { verifyPrincipalPolicyCurrentSuccessor } from "./principalPolicyCurrentSuccessor.js";
 export type { PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, } from "./principalPolicyExternalAuthorityTypes.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
 export type { PrincipalHistoryIndexNode } from "./principalPolicyHistoryIndex.js";

package/internal/crypto/keying/index.js

@@ -15,6 +15,8 @@ export { normalizeDocumentPurgeAccessEventBody, verifyDocumentPurgeEvent, } from
 export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
+export { verifyPrincipalPolicyCurrentMutation } from "./principalPolicyCurrentMutation.js";
+export { verifyPrincipalPolicyCurrentSuccessor } from "./principalPolicyCurrentSuccessor.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
 export { createPrincipalHistoryIndexProof, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "./principalPolicyHistoryIndex.js";
 export { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from "./principalPolicyHistoryPage.js";

package/internal/crypto/keying/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n  assertSealedContainerKekKeyringLength,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  computeContainerKekKeyringHash,\n  expectedSealedContainerKekKeyringBytes,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n  verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  normalizeContainerKekPredecessorBridge,\n  unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n  type DocumentPurgeAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  type VerifyDocumentPurgeEventInput,\n  verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n  createPrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n  createPrincipalHistoryIndexProof,\n  principalHistoryIndexLeaf,\n  resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n  type VerifyTransparencyConsistencyProofInput,\n  type VerifyTransparencyInclusionProofInput,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n  computeTransparencyMerkleRoot,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAK1F,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n  assertSealedContainerKekKeyringLength,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  computeContainerKekKeyringHash,\n  expectedSealedContainerKekKeyringBytes,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n  verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  normalizeContainerKekPredecessorBridge,\n  unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n  type DocumentPurgeAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  type VerifyDocumentPurgeEventInput,\n  verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport { verifyPrincipalPolicyCurrentMutation } from \"./principalPolicyCurrentMutation\";\nexport { verifyPrincipalPolicyCurrentSuccessor } from \"./principalPolicyCurrentSuccessor\";\nexport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n  createPrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n  createPrincipalHistoryIndexProof,\n  principalHistoryIndexLeaf,\n  resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n  type VerifyTransparencyConsistencyProofInput,\n  type VerifyTransparencyInclusionProofInput,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n  computeTransparencyMerkleRoot,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}

package/internal/crypto/keying/principalPolicyCurrent.d.ts

@@ -1,5 +1,5 @@
 import { type VerifiedPrincipalPolicyHistory } from "./principalPolicyHistoryTypes.js";
-import { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
 import type { KeyingVerificationResult } from "./types.js";
 export type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
 /**

package/internal/crypto/keying/principalPolicyCurrent.js

@@ -1,9 +1,9 @@
 import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent } from "./principalPolicyCurrentEvidence.js";
 import { ownVerifiedPrincipalPolicyHistory, } from "./principalPolicyHistoryTypes.js";
 import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
 import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
 import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
-import { makeVerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
 import { runVerifier, throwVerification } from "./shared.js";
 // Adapt owned readonly evidence to the mutable arrays in policy result types.
 function mutableEntry(entry) {
@@ -35,7 +35,7 @@ export function verifyPrincipalPolicyCurrent(input) {
             throwVerification("hash_mismatch", "current principal policy does not match verified history");
         await verifyPrincipalPolicyPayload({ bundle: current });
         await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
-        return makeVerifiedPrincipalPolicyCurrent({
+        return issueVerifiedPrincipalPolicyCurrent({
             principalType: entry.state.principalType,
             principalId: entry.state.principalId,
             version: entry.state.version,
@@ -51,7 +51,7 @@ export function verifyPrincipalPolicyCurrent(input) {
                 version: entry.state.version,
                 stateHash: entry.state.stateHash,
             },
-        });
+        }, history.latestAuthority);
     });
 }
 //# sourceMappingURL=principalPolicyCurrent.js.map

package/internal/crypto/keying/principalPolicyCurrent.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyCurrent.js","sourceRoot":"","sources":["principalPolicyCurrent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EACL,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EACL,kCAAkC,GAGnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAW1D,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAqC;IACzD,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YAClE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;YAElD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,kCAAkC,CAAC;YACxC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport {\n  ownVerifiedPrincipalPolicyHistory,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport {\n  makeVerifiedPrincipalPolicyCurrent,\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n} from \"./types\";\n\nexport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\n\n// Adapt owned readonly evidence to the mutable arrays in policy result types.\nfunction mutableEntry(entry: PrincipalPolicyStateChainEntry) {\n  return {\n    state: structuredClone(entry.state),\n    projection: entry.projection.map((member) => ({ ...member })),\n    grants: entry.grants.map((grant) => ({ ...grant })),\n  };\n}\n\n/**\n * Authenticate current keying artifacts against a prefix already verified by\n * this runtime. The returned history contains only explicitly retained entries.\n */\nexport function verifyPrincipalPolicyCurrent(input: {\n  readonly current: PrincipalPolicyCurrent;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n  return runVerifier(async () => {\n    const current = structuredClone(input.current);\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const expected = history.currentEntry;\n    const retained = history.retainedEntries.map(mutableEntry);\n    const entry = await normalizePrincipalPolicyStateChainEntry({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n    // The state hash commits the signed header, not its signature bytes. Keep\n    // both tied to the accepted entry when validating rows read from storage.\n    if (\n      !principalPolicyStateMatchesReference(entry.state, expected.state) ||\n      entry.state.signature !== expected.state.signature\n    )\n      throwVerification(\n        \"hash_mismatch\",\n        \"current principal policy does not match verified history\",\n      );\n    await verifyPrincipalPolicyPayload({ bundle: current });\n    await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n    return makeVerifiedPrincipalPolicyCurrent({\n      principalType: entry.state.principalType,\n      principalId: entry.state.principalId,\n      version: entry.state.version,\n      keyEpoch: entry.state.keyEpoch,\n      stateHash: entry.state.stateHash,\n      state: entry.state,\n      projection: entry.projection,\n      grants: entry.grants,\n      retainedHistory: retained,\n      checkpoint: {\n        principalType: entry.state.principalType,\n        principalId: entry.state.principalId,\n        version: entry.state.version,\n        stateHash: entry.state.stateHash,\n      },\n    });\n  });\n}\n"]}
+{"version":3,"file":"principalPolicyCurrent.js","sourceRoot":"","sources":["principalPolicyCurrent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAKlF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAW1D,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAqC;IACzD,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YAClE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;YAElD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,mCAAmC,CACxC;YACE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { issueVerifiedPrincipalPolicyCurrent } from \"./principalPolicyCurrentEvidence\";\nimport {\n  ownVerifiedPrincipalPolicyHistory,\n  type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type {\n  KeyingVerificationResult,\n  PrincipalPolicyStateChainEntry,\n} from \"./types\";\n\nexport type {\n  PrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\n\n// Adapt owned readonly evidence to the mutable arrays in policy result types.\nfunction mutableEntry(entry: PrincipalPolicyStateChainEntry) {\n  return {\n    state: structuredClone(entry.state),\n    projection: entry.projection.map((member) => ({ ...member })),\n    grants: entry.grants.map((grant) => ({ ...grant })),\n  };\n}\n\n/**\n * Authenticate current keying artifacts against a prefix already verified by\n * this runtime. The returned history contains only explicitly retained entries.\n */\nexport function verifyPrincipalPolicyCurrent(input: {\n  readonly current: PrincipalPolicyCurrent;\n  readonly history: VerifiedPrincipalPolicyHistory;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n  return runVerifier(async () => {\n    const current = structuredClone(input.current);\n    const history = ownVerifiedPrincipalPolicyHistory(input.history);\n    const expected = history.currentEntry;\n    const retained = history.retainedEntries.map(mutableEntry);\n    const entry = await normalizePrincipalPolicyStateChainEntry({\n      state: current.currentState,\n      projection: current.currentProjection,\n      grants: current.currentGrants,\n    });\n    // The state hash commits the signed header, not its signature bytes. Keep\n    // both tied to the accepted entry when validating rows read from storage.\n    if (\n      !principalPolicyStateMatchesReference(entry.state, expected.state) ||\n      entry.state.signature !== expected.state.signature\n    )\n      throwVerification(\n        \"hash_mismatch\",\n        \"current principal policy does not match verified history\",\n      );\n    await verifyPrincipalPolicyPayload({ bundle: current });\n    await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n    return issueVerifiedPrincipalPolicyCurrent(\n      {\n        principalType: entry.state.principalType,\n        principalId: entry.state.principalId,\n        version: entry.state.version,\n        keyEpoch: entry.state.keyEpoch,\n        stateHash: entry.state.stateHash,\n        state: entry.state,\n        projection: entry.projection,\n        grants: entry.grants,\n        retainedHistory: retained,\n        checkpoint: {\n          principalType: entry.state.principalType,\n          principalId: entry.state.principalId,\n          version: entry.state.version,\n          stateHash: entry.state.stateHash,\n        },\n      },\n      history.latestAuthority,\n    );\n  });\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentEvidence.js

@@ -0,0 +1,16 @@
+import { makeVerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
+import { throwVerification } from "./shared.js";
+const issued = new WeakMap();
+/** Keep the verified predecessor and historical authority cursor private. */
+export function issueVerifiedPrincipalPolicyCurrent(value, latestAuthority) {
+    const result = makeVerifiedPrincipalPolicyCurrent(value);
+    issued.set(result, structuredClone({ policy: value, latestAuthority }));
+    return result;
+}
+export function ownVerifiedPrincipalPolicyCurrent(policy) {
+    const snapshot = issued.get(policy);
+    if (!snapshot)
+        throwVerification("invalid_shape", "current policy must come from a local verifier");
+    return structuredClone(snapshot);
+}
+//# sourceMappingURL=principalPolicyCurrentEvidence.js.map

package/internal/crypto/keying/principalPolicyCurrentEvidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principalPolicyCurrentEvidence.js","sourceRoot":"","sources":["principalPolicyCurrentEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,MAAM,MAAM,GAAG,IAAI,OAAO,EAMvB,CAAC;AAEJ,6EAA6E;AAC7E,MAAM,UAAU,mCAAmC,CACjD,KAAmB,EACnB,eAAuD;IAEvD,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ;QACX,iBAAiB,CACf,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { PrincipalStateExternalAuthority } from \"../principalState\";\nimport {\n  makeVerifiedPrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { throwVerification } from \"./shared\";\n\ntype CurrentValue = Parameters<typeof makeVerifiedPrincipalPolicyCurrent>[0];\nconst issued = new WeakMap<\n  VerifiedPrincipalPolicyCurrent,\n  {\n    policy: CurrentValue;\n    latestAuthority: PrincipalStateExternalAuthority | null;\n  }\n>();\n\n/** Keep the verified predecessor and historical authority cursor private. */\nexport function issueVerifiedPrincipalPolicyCurrent(\n  value: CurrentValue,\n  latestAuthority: PrincipalStateExternalAuthority | null,\n): VerifiedPrincipalPolicyCurrent {\n  const result = makeVerifiedPrincipalPolicyCurrent(value);\n  issued.set(result, structuredClone({ policy: value, latestAuthority }));\n  return result;\n}\n\nexport function ownVerifiedPrincipalPolicyCurrent(\n  policy: VerifiedPrincipalPolicyCurrent,\n) {\n  const snapshot = issued.get(policy);\n  if (!snapshot)\n    throwVerification(\n      \"invalid_shape\",\n      \"current policy must come from a local verifier\",\n    );\n  return structuredClone(snapshot);\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentMutation.d.ts

@@ -0,0 +1,10 @@
+import type { PrincipalPolicyExternalAuthority } from "./principalPolicyExternalAuthorityTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { KeyingVerificationResult } from "./types.js";
+/** Bind a group's current artifacts and next signer to privately issued evidence. */
+export declare function verifyPrincipalPolicyCurrentMutation(input: {
+    readonly current: PrincipalPolicyCurrent;
+    readonly policy: VerifiedPrincipalPolicyCurrent;
+    readonly signerUserId: string;
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
+}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>>;

package/internal/crypto/keying/principalPolicyCurrentMutation.js

@@ -0,0 +1,51 @@
+import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent, ownVerifiedPrincipalPolicyCurrent, } from "./principalPolicyCurrentEvidence.js";
+import { createPrincipalPolicyExternalAuthorityVerifier, externalAuthorityIncludesAdminSigner, verifyPrincipalPolicyExternalAuthorityProgress, } from "./principalPolicyExternalAuthority.js";
+import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
+import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
+import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
+import { runVerifier, throwVerification } from "./shared.js";
+/** Bind a group's current artifacts and next signer to privately issued evidence. */
+export function verifyPrincipalPolicyCurrentMutation(input) {
+    return runVerifier(async () => {
+        const prior = ownVerifiedPrincipalPolicyCurrent(input.policy);
+        const current = structuredClone(input.current);
+        const externalAuthority = structuredClone(input.externalAuthority);
+        const signerUserId = input.signerUserId;
+        const entry = await normalizePrincipalPolicyStateChainEntry({
+            state: current.currentState,
+            projection: current.currentProjection,
+            grants: current.currentGrants,
+        });
+        if (!principalPolicyStateMatchesReference(entry.state, prior.policy.state) ||
+            entry.state.signature !== prior.policy.state.signature)
+            throwVerification("hash_mismatch", "current artifacts differ from issued policy evidence");
+        if (entry.state.principalType !== "group")
+            throwVerification("object_mismatch", "group mutation requires a group policy");
+        await verifyPrincipalPolicyPayload({ bundle: current });
+        await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
+        if (!entry.projection.some((member) => member.userId === signerUserId && member.role === "admin")) {
+            const authority = createPrincipalPolicyExternalAuthorityVerifier({
+                authority: externalAuthority,
+            });
+            authority.latestReference = prior.latestAuthority;
+            const next = {
+                state: {
+                    signerUserId,
+                    externalAuthority: externalAuthority?.currentHead ?? null,
+                },
+            };
+            verifyPrincipalPolicyExternalAuthorityProgress({
+                entry: next,
+                verifier: authority,
+            });
+            if (!externalAuthorityIncludesAdminSigner({
+                entry: next,
+                verifier: authority,
+            }))
+                throwVerification("unauthorized", "group mutation signer is not an authority admin");
+        }
+        return issueVerifiedPrincipalPolicyCurrent(prior.policy, prior.latestAuthority);
+    });
+}
+//# sourceMappingURL=principalPolicyCurrentMutation.js.map