npm - @tearleads/client-sdk - Versions diffs - 0.1.15 → 0.1.16 - Mend

@tearleads/client-sdk 0.1.15 → 0.1.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (166) hide show

package/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAiKA,OAAO,EAEL,KAAK,EAEL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,SAAS,EACT,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AA2BlB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAa3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,2BAA2B,EAC3B,8BAA8B,EAC9B,gCAAgC,EAChC,sBAAsB,EACtB,0CAA0C,EAC1C,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// Current SDK contract: unified device-first handles and atomic revision checks.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters and aliases are excluded; see workflows/README.md for host contracts.\nexport type {\n AddOrganizationGroupUserInput,\n BlobInfo,\n BlobInfoAttachmentKind,\n BlobInfoDocumentReference,\n BlobInfoInput,\n BlobInfoList,\n BlobInfoSort,\n BlobInfoSortDirection,\n BlobInfoSortKey,\n BrowserLocalKeyringOptions,\n ClientDatabaseOptions,\n ContainerContents,\n ContainerContentsContextValue,\n ContainerContentsStore,\n ContainerContentsStoreOptions,\n ContainerDocumentLinkInput,\n ContainerDocumentLinks,\n ContainerDocumentObjectSyncState,\n ContainerDocumentObjectSyncStatus,\n ContainerDocumentQueries,\n ContainerDocumentSidebarRow,\n ContainerInfo,\n ContainerInfoInput,\n ContainerItemRow,\n ContainerItemSort,\n ContainerItemSortDirection,\n ContainerItemSortKey,\n ContainerNode,\n ContainerShareAccessLevel,\n CreateOrganizationOptions,\n DatabaseListener,\n DatabaseOptions,\n DatabaseSnapshot,\n DatabaseStatus,\n DeviceFirst,\n DeviceFirstContainerContents,\n DocumentAttachmentStatus,\n DocumentAttachmentUpload,\n DocumentAttributionRangesInput,\n DocumentAttributionRangesPage,\n DocumentContextValue,\n DocumentInfo,\n DocumentInfoInput,\n DocumentList,\n DocumentSort,\n DocumentSortDirection,\n DocumentSortKey,\n DocumentStore,\n DocumentSubscriptionOptions,\n Documents,\n DocumentsRuntime,\n DomainScope,\n FileSaver,\n Identity,\n IdentityGenerationResult,\n IdentityKeyPackage,\n IdentityListener,\n IdentityOptions,\n IdentitySnapshot,\n ImportedOrganizationUser,\n IndexedDbLocalKeyringManifestStoreOptions,\n IndexedDbWrappingKeyKeystoreOptions,\n LinkDocumentToContainerInput,\n ListDocumentsInput,\n LocalKeyPurpose,\n LocalKeyring,\n LocalKeyringManifest,\n LocalKeyringManifestFormat,\n LocalKeyringManifestStorage,\n LocalKeyringManifestStore,\n LocalKeyringOptions,\n LocalKeyringPinCode,\n LocalKeyringScope,\n LocalKeyringSession,\n LocalOrganizationSummary,\n LocalProjectionReconciledDelta,\n LocalProjectionSnapshot,\n LocalProjectionView,\n LocalSecretContext,\n LocalStorageLocalKeyringManifestStoreOptions,\n Logger,\n MergeDocumentSummary,\n MoveDocumentToContainerInput,\n NetworkListener,\n NetworkMode,\n NetworkStatusSource,\n NormalizedLocalKeyringScope,\n OpenContainerDocumentInput,\n OpenDocumentInput,\n OpenDocumentOptions,\n OrganizationBilling,\n OrganizationBillingHistory,\n OrganizationBillingHistoryEntry,\n OrganizationBillingManagementUrl,\n OrganizationBillingView,\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationDataUsage,\n OrganizationDirectory,\n OrganizationDirectoryAndGroups,\n OrganizationDirectoryUser,\n OrganizationGrantRef,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupDetails,\n OrganizationGroupMember,\n OrganizationGroupMembers,\n OrganizationGroupPolicyHistory,\n OrganizationGroupSummary,\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n OrganizationPolicyHistory,\n OrganizationPolicyHistoryEntry,\n OrganizationProfile,\n Organizations,\n OrganizationUserDetail,\n PendingWriteQueueItem,\n PendingWriteQueueItemStatus,\n PendingWriteQueueObjectKind,\n PendingWriteQueueOperation,\n PendingWriteQueueOperationKind,\n PendingWriteQueueOperationStatus,\n // Persistence notifications distinguish placement changes from content saves.\n PersistedDocumentListener,\n PinCodeBrowserLocalKeyringOptions,\n PinCodeWrappingKeyKeystoreOptions,\n PurgeDocumentInput,\n PurgeDocumentResult,\n ReconciliationService,\n RemoveOrganizationGroupUserInput,\n ResolvedUserIdentity,\n SaveFileRequest,\n SecurityIncident,\n SecurityIncidentListener,\n SecurityIncidentObjectKind,\n SecurityIncidents,\n Session,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionListener,\n SessionRecoverOrganizationResult,\n SessionRegistrationRefusal,\n SessionRegistrationResult,\n SessionSnapshot,\n SetActiveDocumentContainerInput,\n SetLinkedContainerIdsForDocument,\n UnlinkDocumentFromContainerInput,\n UnwrapLocalSecretInput,\n UserIdentities,\n UserSession,\n WrapLocalSecretInput,\n WrappedLocalSecretEnvelope,\n WrappedLocalSecretFormat,\n WrappingKeyHandle,\n WrappingKeyKeystore,\n WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n type BlobStoreFactory,\n Blobs,\n type ClientOptions,\n createBrowserLocalKeyring,\n createBrowserLocalKeyringManifestStore,\n createBrowserNetworkStatusSource,\n createContainerDocumentObjectSyncState,\n createDomainScope,\n createIndexedDbLocalKeyringManifestStore,\n createIndexedDbWrappingKeyKeystore,\n createLocalKeyring,\n createLocalStorageLocalKeyringManifestStore,\n createMemoryLocalKeyringManifestStore,\n createMemoryWrappingKeyKeystore,\n createPinCodeBrowserLocalKeyring,\n createPinCodeWrappingKeyKeystore,\n createRevenueCatPurchases,\n createUnavailableDirectCheckout,\n createUnavailablePurchases,\n createWebViewLocalKeyring,\n Database,\n DEFAULT_DOCUMENT_ID,\n type DirectCheckoutAppearance,\n type DirectCheckoutCapability,\n type DirectCheckoutConfirmation,\n type DirectCheckoutSession,\n DirectCheckoutUnavailableError,\n decodeLocalKeyringSqliteKey,\n Events,\n type EventsListener,\n type EventsSnapshot,\n encodeLocalKeyringSqliteKey,\n enqueueReconciliationForEvents,\n IDENTITY_KEY_PACKAGE_FORMAT,\n isPinCodeWrappedLocalSecretEnvelope,\n LOCAL_KEYRING_MANIFEST_FORMAT,\n localKeyringScopeKey,\n Network,\n normalizeLocalKeyringScope,\n type PrincipalHistoryKeyProvider,\n type PrincipalHistoryKeyScope,\n PurchaseAbortedError,\n PurchaseAlreadyOwnedError,\n PurchaseCancelledError,\n PurchaseIdentityPendingError,\n PurchaseProviderStalledError,\n type PurchasesCapability,\n PurchasesUnavailableError,\n PurgedOrganizationRecoveryBillingRequiredError,\n parseLocalKeyringManifest,\n type RevenueCatBackend,\n type RevenueCatCustomerInfo,\n type RevenueCatPackage,\n type RevenueCatPurchasesConfig,\n SyncBillingGate,\n type SyncBillingGateListener,\n type SyncPurchaseResult,\n type SyncSubscriptionOption,\n serializeLocalKeyringManifest,\n Tearleads,\n WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n BlobByteSource,\n BlobByteSourceInput,\n BlobBytes,\n BlobStore,\n DiscoveredDocumentInput,\n DocumentAttachment,\n DocumentClientProjectionDefinition,\n DocumentClientProjectionDeleteInput,\n DocumentClientProjectionSaveInput,\n DocumentFieldValidationIssue,\n DocumentProjection,\n DocumentProjectorDefinition,\n DocumentProjectorInput,\n DocumentProjectorRegistry,\n DocumentProjectorRegistryInput,\n DocumentRow,\n DocumentRowSummary,\n DocumentSummary,\n StoredDocumentKind,\n StoredDocumentState,\n StructuredDocumentMap,\n StructuredDocumentShape,\n StructuredDocumentText,\n ValidatedDocumentFields,\n} from \"./documents\";\nexport {\n addDocumentAttachments,\n blobByteSourceInputLength,\n createBlobByteSource,\n createDocumentProjectorRegistry,\n createDocumentSignerDeviceId,\n DEFAULT_DOCUMENT_ACCESS_EPOCH,\n DEFAULT_DOCUMENT_KIND,\n defaultDocumentProjectorRegistry,\n deriveStoredDocumentTitle,\n ensureDocumentAttachmentStructure,\n getDocumentAttachments,\n getDocumentClientProjectionTables,\n getStoredDocumentTypeLabel,\n getUntitledDocumentTitle,\n initializeStoredDocumentKind,\n projectStoredDocumentState,\n readBlobByteSource,\n readStoredDocumentState,\n readStringDocumentField,\n resolveOpIdAttribution,\n sameDocumentAttachments,\n summarizeDocumentContributors,\n writerByPeerId,\n writeStoredDocumentFields,\n} from \"./documents\";\nexport type {\n ContainerContentsSnapshot,\n ContainerContentsStoreRuntime,\n ContainerContentsStoreState,\n ContainerContentsStoreSyncAgent,\n ContainerContentsStoreSyncState,\n ContainerState,\n PurgeOptions,\n PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n createContainerContentsStore,\n createContainerContentsStoreState,\n createContainerContentsStoreSyncAgent,\n getOrCreateContainerContentsStore,\n isSystemContainerNode,\n requestContainerContentsDocumentPriming,\n subscribeToContainerContentsStore,\n updateContainerContentsSnapshot,\n updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n DocumentSnapshot,\n DocumentStoreFacade,\n DocumentStoreRelinkInput,\n DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n createDocumentStore,\n discardRegisteredDocumentLocalState,\n getOrCreateDocumentStore,\n openDocumentStore,\n requestDomainDocumentSync,\n subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport type {\n EncryptedBlobStoreCipher,\n EncryptedBlobStoreKey,\n EncryptedBlobStoreOptions,\n WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n createBlobStore,\n createEncryptedBlobStore,\n createLazyEncryptedBlobStore,\n createMemoryBlobStore,\n decryptDocumentAttachmentBlob,\n hydrateDocumentAttachmentBlobs,\n purgeOpfsBlobStore,\n uploadDocumentAttachment,\n wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n ContainerContentsRootAdopter,\n ContainerContentsRootAdoptionInput,\n ContainerContentsStoreWorkflowRuntime,\n ContainerContentsWorkflowRuntime,\n // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n // documentQueries variant has a different shape, so it keeps a disambiguating\n // alias on the public surface.\n ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n ContainerSystemSlotDefinition,\n RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n createContainerContentsDocumentsRuntime,\n createContainerContentsProjectionUserKeyResolver,\n createContainerContentsStoreWorkflowRuntime,\n createContainerContentsSyncLane,\n createContainerContentsWorkflowRuntime,\n createContainerParentSyncLane,\n createInitializedContainerMetadataDocument,\n defaultContainerContentsPersistence,\n deriveContainerSystemSlot,\n initializeDocumentLinksSchema,\n listBlobInfo,\n listDocumentLinkedContainerIds,\n loadContainerInfo,\n loadContainerSyncWatermark,\n loadDocumentAttributionRanges,\n loadDocumentInfo,\n replaceDocumentLinks,\n saveContainerSyncWatermark,\n syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n AggregatedContainerKekLog,\n ContainerMutationAuthor,\n ContainerReciteApi,\n ContainerWriteRefusal,\n KeyringRebuildResult,\n MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n buildMaterializedContainerRekeyPlan,\n buildRootContainerCreatePlan,\n ContainerAuthorAccessError,\n ContainerKekRepairInaccessibleError,\n ContainerKekRepairRequiredError,\n ContainerKeyringOverrideStaleError,\n ContainerPathTooDeepError,\n classifyContainerWriteRefusal,\n containerWriterProjectionFromRekeyPlan,\n createRemoteContainer,\n fetchContainerKekLog,\n GroupShareNameMismatchError,\n HistoricalWrapUnavailableError,\n type HistoricalWrapUnavailableReason,\n isProjectionVerificationCancelledError,\n moveRemoteContainer,\n rebuildKeyringEntriesFromLog,\n recoverKeyringEntryFromWraps,\n rekeyRemoteContainer,\n revokeRemoteContainer,\n rootContainerWriterProjectionFromCreatePlan,\n shareRemoteContainer,\n shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n DocumentRecord,\n DocumentSyncContainerRekeyBuilder,\n DocumentSyncPullContinuation,\n DocumentSyncUpdateIsolationError,\n DocumentsPersistence,\n DocumentsWorkflowRuntime,\n DocumentsWorkflowRuntimeInput,\n IncomingDocumentSyncUpdateValidator,\n LocalAttachmentRecord,\n PendingAttachmentRecord,\n PendingUpdateInsert,\n PendingUpdateRecord,\n SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n buildMaterializedDocumentCreatePlan,\n createDocumentProjectionUserKeyResolver,\n createDocumentsWorkflowRuntime,\n createRemoteDocument,\n DOCUMENT_SYNC_TRACE_FRAGMENT,\n DOCUMENT_SYNC_TRACE_PATTERN,\n DOCUMENTS_APP_KIND,\n DocumentRawHistoryUnavailableError,\n defaultDocumentsPersistence,\n deletePersistedDocument,\n isDatabaseUnavailableError,\n isDocumentSyncUpdateIsolationError,\n persistedDocumentCreateStateFromResponse,\n readPullContinuation,\n syncRemoteDocument,\n unwrapContainerKekPath,\n unwrapDocumentContentKeyTarget,\n validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are deliberately absent here. Integration\n// tests that compose low-level runtimes use the testing package subpath.\nexport type {\n OrganizationGroupPolicyHistoryEntry,\n OrganizationNativePurchaseEligibility,\n OrganizationPrincipalMemberChange,\n OrganizationPrincipalMemberChangeType,\n OrganizationPrincipalPolicyHistory,\n OrganizationPrincipalPolicyHistoryEntry,\n ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n buildOrganizationGroupPolicyHistory,\n buildOrganizationProfileDocumentPatch,\n buildRosterProfileDocumentPatch,\n checkNativePurchaseEligibility,\n createInitializedRosterProfileDocument,\n createOrganizationGroup,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n GroupMembershipNameMismatchError,\n getOrganizationProfileDocumentLocalId,\n getRosterProfileDocumentLocalId,\n importOrganizationUser,\n loadLocalOrganizationDataUsage,\n loadLocalOrganizationDirectoryAndGroups,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n ROSTER_PROFILE_DOCUMENT_KIND,\n readOrganizationProfileName,\n reconcileOrganizationDataUsage,\n reconcileOrganizationDirectoryAndGroups,\n removeOrganizationGroupUser,\n resolveOrganizationBillingView,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n subscribeOrganizationReadModelInvalidation,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n CacheReferencedPrincipalPoliciesOptions,\n PrincipalHistoryProtectionLease,\n ProjectionPolicyHistoryRecoveryOptions,\n RecoveredPrincipalPolicyHistory,\n RecoveredScopedPrincipalPolicyHistory,\n RecoverPrincipalPolicyHistoryOptions,\n RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n cacheReferencedPrincipalPolicies,\n PrincipalPolicyHistoryReadError,\n recoverPrincipalPolicyHistory,\n recoverProjectionPolicyHistory,\n recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n InitialRootMetadataBootstrap,\n ProvisionedSystemContainerSpec,\n RegisterIdentityInput,\n RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n bootstrapRootContainer,\n buildInitialOrganizationPolicyRequest,\n createInitialRootMetadataBootstrap,\n persistRegistrationBootstrap,\n registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n RootIdentitiesApi,\n RootIdentitiesPage,\n RootIdentitiesQueryInput,\n RootIdentity,\n RootIdentityDetail,\n RootIdentityOrganization,\n RootIdentitySession,\n RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n listRootDataUsageReport,\n listRootIdentities,\n listRootIdentityOrganizations,\n listRootOrganizationIdentities,\n listRootOrganizations,\n loadRootIdentity,\n loadRootOrganization,\n loadRootOrganizationDataUsage,\n type RootDataUsageApi,\n type RootDataUsageReportPage,\n type RootOrganization,\n type RootOrganizationDetail,\n type RootOrganizationIdentitiesPage,\n type RootOrganizationIdentity,\n type RootOrganizationPageQueryInput,\n type RootOrganizationsApi,\n type RootOrganizationsPage,\n type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n ClearRemoteSyncStateResult,\n DomainSyncCoordinator,\n DomainSyncSnapshot,\n RemoteResetInput,\n RemoteResetReplacement,\n SyncIdleOptions,\n SyncLane,\n SyncLaneConfig,\n SyncLaneLastAction,\n SyncLanePhase,\n SyncLaneSnapshot,\n SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n clearRemoteSyncState,\n getDomainSyncCoordinatorSnapshot,\n getOrCreateDomainSyncCoordinator,\n hasDomainSyncCoordinatorPendingWork,\n requestAllDomainSyncLanes,\n subscribeToDomainSyncCoordinator,\n waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAmKA,OAAO,EAEL,KAAK,EAEL,yBAAyB,EACzB,sCAAsC,EACtC,gCAAgC,EAChC,sCAAsC,EACtC,iBAAiB,EACjB,wCAAwC,EACxC,kCAAkC,EAClC,kBAAkB,EAClB,2CAA2C,EAC3C,qCAAqC,EACrC,+BAA+B,EAC/B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,EACzB,+BAA+B,EAC/B,0BAA0B,EAC1B,yBAAyB,EACzB,QAAQ,EACR,mBAAmB,EAKnB,8BAA8B,EAC9B,2BAA2B,EAC3B,MAAM,EAGN,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,oBAAoB,EACpB,OAAO,EACP,0BAA0B,EAG1B,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAE5B,yBAAyB,EACzB,8CAA8C,EAC9C,yBAAyB,EAKzB,eAAe,EAIf,6BAA6B,EAC7B,SAAS,EACT,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AA2BlB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,sBAAsB,EACtB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,cAAc,EACd,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAWrB,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qCAAqC,EACrC,iCAAiC,EACjC,qBAAqB,EACrB,uCAAuC,EACvC,iCAAiC,EACjC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAC;AAOrC,OAAO,EACL,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAa3B,OAAO,EACL,uCAAuC,EACvC,gDAAgD,EAChD,2CAA2C,EAC3C,+BAA+B,EAC/B,sCAAsC,EACtC,6BAA6B,EAC7B,0CAA0C,EAC1C,mCAAmC,EACnC,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,sCAAsC,GACvC,MAAM,gCAAgC,CAAC;AASxC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAE9B,sCAAsC,EACtC,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2CAA2C,EAC3C,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EACL,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,kCAAkC,EAClC,wCAAwC,EACxC,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAiB/B,OAAO,EACL,iCAAiC,EACjC,wBAAwB,EACxB,8BAA8B,EAC9B,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,uBAAuB,EACvB,0CAA0C,EAC1C,6CAA6C,EAC7C,kDAAkD,EAClD,2CAA2C,EAC3C,gCAAgC,EAChC,qCAAqC,EACrC,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,uCAAuC,EACvC,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,6BAA6B,EAC7B,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,uCAAuC,EACvC,iCAAiC,EACjC,2BAA2B,EAC3B,8BAA8B,EAC9B,mCAAmC,EACnC,gCAAgC,EAChC,sBAAsB,EACtB,gCAAgC,EAChC,0CAA0C,EAC1C,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,qCAAqC,EACrC,kCAAkC,EAClC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAWlC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,6BAA6B,GAW9B,MAAM,kBAAkB,CAAC;AAe1B,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,gCAAgC,EAChC,mCAAmC,EACnC,yBAAyB,EACzB,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kBAAkB,CAAC","sourcesContent":["// Current SDK contract: unified device-first handles and atomic revision checks.\n// Authority loaders take exact heads, including cached citations. Obsolete\n// adapters are excluded; authored policy journals survive restart. See workflows/README.md.\nexport type {\n AbandonOrganizationPolicyMutationInput,\n AddOrganizationGroupUserInput,\n BlobInfo,\n BlobInfoAttachmentKind,\n BlobInfoDocumentReference,\n BlobInfoInput,\n BlobInfoList,\n BlobInfoSort,\n BlobInfoSortDirection,\n BlobInfoSortKey,\n BrowserLocalKeyringOptions,\n ClientDatabaseOptions,\n ContainerContents,\n ContainerContentsContextValue,\n ContainerContentsStore,\n ContainerContentsStoreOptions,\n ContainerDocumentLinkInput,\n ContainerDocumentLinks,\n ContainerDocumentObjectSyncState,\n ContainerDocumentObjectSyncStatus,\n ContainerDocumentQueries,\n ContainerDocumentSidebarRow,\n ContainerInfo,\n ContainerInfoInput,\n ContainerItemRow,\n ContainerItemSort,\n ContainerItemSortDirection,\n ContainerItemSortKey,\n ContainerNode,\n ContainerShareAccessLevel,\n CreateOrganizationOptions,\n DatabaseListener,\n DatabaseOptions,\n DatabaseSnapshot,\n DatabaseStatus,\n DeviceFirst,\n DeviceFirstContainerContents,\n DiscardUnreadableOrganizationPolicyMutationInput,\n DocumentAttachmentStatus,\n DocumentAttachmentUpload,\n DocumentAttributionRangesInput,\n DocumentAttributionRangesPage,\n DocumentContextValue,\n DocumentInfo,\n DocumentInfoInput,\n DocumentList,\n DocumentSort,\n DocumentSortDirection,\n DocumentSortKey,\n DocumentStore,\n DocumentSubscriptionOptions,\n Documents,\n DocumentsRuntime,\n DomainScope,\n FileSaver,\n Identity,\n IdentityGenerationResult,\n IdentityKeyPackage,\n IdentityListener,\n IdentityOptions,\n IdentitySnapshot,\n ImportedOrganizationUser,\n IndexedDbLocalKeyringManifestStoreOptions,\n IndexedDbWrappingKeyKeystoreOptions,\n LinkDocumentToContainerInput,\n ListDocumentsInput,\n LocalKeyPurpose,\n LocalKeyring,\n LocalKeyringManifest,\n LocalKeyringManifestFormat,\n LocalKeyringManifestStorage,\n LocalKeyringManifestStore,\n LocalKeyringOptions,\n LocalKeyringPinCode,\n LocalKeyringScope,\n LocalKeyringSession,\n LocalOrganizationSummary,\n LocalProjectionReconciledDelta,\n LocalProjectionSnapshot,\n LocalProjectionView,\n LocalSecretContext,\n LocalStorageLocalKeyringManifestStoreOptions,\n Logger,\n MergeDocumentSummary,\n MoveDocumentToContainerInput,\n NetworkListener,\n NetworkMode,\n NetworkStatusSource,\n NormalizedLocalKeyringScope,\n OpenContainerDocumentInput,\n OpenDocumentInput,\n OpenDocumentOptions,\n OrganizationBilling,\n OrganizationBillingHistory,\n OrganizationBillingHistoryEntry,\n OrganizationBillingManagementUrl,\n OrganizationBillingView,\n OrganizationContainerGrant,\n OrganizationContainerGrants,\n OrganizationDataUsage,\n OrganizationDirectory,\n OrganizationDirectoryAndGroups,\n OrganizationDirectoryUser,\n OrganizationGrantRef,\n OrganizationGroupContainer,\n OrganizationGroupContainers,\n OrganizationGroupDetails,\n OrganizationGroupMember,\n OrganizationGroupMembers,\n OrganizationGroupPolicyHistory,\n OrganizationGroupSummary,\n OrganizationPolicyGrantChange,\n OrganizationPolicyGroupChange,\n OrganizationPolicyHistory,\n OrganizationPolicyHistoryEntry,\n OrganizationProfile,\n Organizations,\n OrganizationUserDetail,\n PendingWriteQueueItem,\n PendingWriteQueueItemStatus,\n PendingWriteQueueObjectKind,\n PendingWriteQueueOperation,\n PendingWriteQueueOperationKind,\n PendingWriteQueueOperationStatus,\n // Persistence notifications distinguish placement changes from content saves.\n PersistedDocumentListener,\n PinCodeBrowserLocalKeyringOptions,\n PinCodeWrappingKeyKeystoreOptions,\n PurgeDocumentInput,\n PurgeDocumentResult,\n ReconciliationService,\n RemoveOrganizationGroupUserInput,\n ResolvedUserIdentity,\n SaveFileRequest,\n SecurityIncident,\n SecurityIncidentListener,\n SecurityIncidentObjectKind,\n SecurityIncidents,\n Session,\n SessionContext,\n SessionCreateOrganizationResult,\n SessionListener,\n SessionRecoverOrganizationResult,\n SessionRegistrationRefusal,\n SessionRegistrationResult,\n SessionSnapshot,\n SetActiveDocumentContainerInput,\n SetLinkedContainerIdsForDocument,\n UnlinkDocumentFromContainerInput,\n UnwrapLocalSecretInput,\n UserIdentities,\n UserSession,\n WrapLocalSecretInput,\n WrappedLocalSecretEnvelope,\n WrappedLocalSecretFormat,\n WrappingKeyHandle,\n WrappingKeyKeystore,\n WrappingKeyMaterialStorage,\n} from \"./client\";\nexport {\n type BlobStoreFactory,\n Blobs,\n type ClientOptions,\n createBrowserLocalKeyring,\n createBrowserLocalKeyringManifestStore,\n createBrowserNetworkStatusSource,\n createContainerDocumentObjectSyncState,\n createDomainScope,\n createIndexedDbLocalKeyringManifestStore,\n createIndexedDbWrappingKeyKeystore,\n createLocalKeyring,\n createLocalStorageLocalKeyringManifestStore,\n createMemoryLocalKeyringManifestStore,\n createMemoryWrappingKeyKeystore,\n createPinCodeBrowserLocalKeyring,\n createPinCodeWrappingKeyKeystore,\n createRevenueCatPurchases,\n createUnavailableDirectCheckout,\n createUnavailablePurchases,\n createWebViewLocalKeyring,\n Database,\n DEFAULT_DOCUMENT_ID,\n type DirectCheckoutAppearance,\n type DirectCheckoutCapability,\n type DirectCheckoutConfirmation,\n type DirectCheckoutSession,\n DirectCheckoutUnavailableError,\n decodeLocalKeyringSqliteKey,\n Events,\n type EventsListener,\n type EventsSnapshot,\n encodeLocalKeyringSqliteKey,\n enqueueReconciliationForEvents,\n IDENTITY_KEY_PACKAGE_FORMAT,\n isPinCodeWrappedLocalSecretEnvelope,\n LOCAL_KEYRING_MANIFEST_FORMAT,\n localKeyringScopeKey,\n Network,\n normalizeLocalKeyringScope,\n type PrincipalHistoryKeyProvider,\n type PrincipalHistoryKeyScope,\n PurchaseAbortedError,\n PurchaseAlreadyOwnedError,\n PurchaseCancelledError,\n PurchaseIdentityPendingError,\n PurchaseProviderStalledError,\n type PurchasesCapability,\n PurchasesUnavailableError,\n PurgedOrganizationRecoveryBillingRequiredError,\n parseLocalKeyringManifest,\n type RevenueCatBackend,\n type RevenueCatCustomerInfo,\n type RevenueCatPackage,\n type RevenueCatPurchasesConfig,\n SyncBillingGate,\n type SyncBillingGateListener,\n type SyncPurchaseResult,\n type SyncSubscriptionOption,\n serializeLocalKeyringManifest,\n Tearleads,\n WRAPPED_LOCAL_SECRET_FORMAT,\n} from \"./client\";\nexport type {\n BlobByteSource,\n BlobByteSourceInput,\n BlobBytes,\n BlobStore,\n DiscoveredDocumentInput,\n DocumentAttachment,\n DocumentClientProjectionDefinition,\n DocumentClientProjectionDeleteInput,\n DocumentClientProjectionSaveInput,\n DocumentFieldValidationIssue,\n DocumentProjection,\n DocumentProjectorDefinition,\n DocumentProjectorInput,\n DocumentProjectorRegistry,\n DocumentProjectorRegistryInput,\n DocumentRow,\n DocumentRowSummary,\n DocumentSummary,\n StoredDocumentKind,\n StoredDocumentState,\n StructuredDocumentMap,\n StructuredDocumentShape,\n StructuredDocumentText,\n ValidatedDocumentFields,\n} from \"./documents\";\nexport {\n addDocumentAttachments,\n blobByteSourceInputLength,\n createBlobByteSource,\n createDocumentProjectorRegistry,\n createDocumentSignerDeviceId,\n DEFAULT_DOCUMENT_ACCESS_EPOCH,\n DEFAULT_DOCUMENT_KIND,\n defaultDocumentProjectorRegistry,\n deriveStoredDocumentTitle,\n ensureDocumentAttachmentStructure,\n getDocumentAttachments,\n getDocumentClientProjectionTables,\n getStoredDocumentTypeLabel,\n getUntitledDocumentTitle,\n initializeStoredDocumentKind,\n projectStoredDocumentState,\n readBlobByteSource,\n readStoredDocumentState,\n readStringDocumentField,\n resolveOpIdAttribution,\n sameDocumentAttachments,\n summarizeDocumentContributors,\n writerByPeerId,\n writeStoredDocumentFields,\n} from \"./documents\";\nexport type {\n ContainerContentsSnapshot,\n ContainerContentsStoreRuntime,\n ContainerContentsStoreState,\n ContainerContentsStoreSyncAgent,\n ContainerContentsStoreSyncState,\n ContainerState,\n PurgeOptions,\n PurgeProgress,\n} from \"./stores/container-contents\";\nexport {\n createContainerContentsStore,\n createContainerContentsStoreState,\n createContainerContentsStoreSyncAgent,\n getOrCreateContainerContentsStore,\n isSystemContainerNode,\n requestContainerContentsDocumentPriming,\n subscribeToContainerContentsStore,\n updateContainerContentsSnapshot,\n updateContainerContentsStoreRuntime,\n} from \"./stores/container-contents\";\nexport type {\n DocumentSnapshot,\n DocumentStoreFacade,\n DocumentStoreRelinkInput,\n DocumentStructuredFieldPatch,\n} from \"./stores/documents\";\nexport {\n createDocumentStore,\n discardRegisteredDocumentLocalState,\n getOrCreateDocumentStore,\n openDocumentStore,\n requestDomainDocumentSync,\n subscribeToPersistedDocuments,\n} from \"./stores/documents\";\nexport type {\n EncryptedBlobStoreCipher,\n EncryptedBlobStoreKey,\n EncryptedBlobStoreOptions,\n WrapEncryptedBlobStoreOptions,\n} from \"./workflows/blobs\";\nexport {\n createBlobStore,\n createEncryptedBlobStore,\n createLazyEncryptedBlobStore,\n createMemoryBlobStore,\n decryptDocumentAttachmentBlob,\n hydrateDocumentAttachmentBlobs,\n purgeOpfsBlobStore,\n uploadDocumentAttachment,\n wrapEncryptedBlobStore,\n} from \"./workflows/blobs\";\nexport type {\n ContainerContentsRootAdopter,\n ContainerContentsRootAdoptionInput,\n ContainerContentsStoreWorkflowRuntime,\n ContainerContentsWorkflowRuntime,\n // Distinct from the canonical `ContainerDocumentLinkInput` (./client); the\n // documentQueries variant has a different shape, so it keeps a disambiguating\n // alias on the public surface.\n ContainerDocumentLinkInput as ContainerDocumentQueriesLinkInput,\n ContainerSystemSlotDefinition,\n RecoveryFolder,\n} from \"./workflows/container-contents\";\nexport {\n createContainerContentsDocumentsRuntime,\n createContainerContentsProjectionUserKeyResolver,\n createContainerContentsStoreWorkflowRuntime,\n createContainerContentsSyncLane,\n createContainerContentsWorkflowRuntime,\n createContainerParentSyncLane,\n createInitializedContainerMetadataDocument,\n defaultContainerContentsPersistence,\n deriveContainerSystemSlot,\n initializeDocumentLinksSchema,\n listBlobInfo,\n listDocumentLinkedContainerIds,\n loadContainerInfo,\n loadContainerSyncWatermark,\n loadDocumentAttributionRanges,\n loadDocumentInfo,\n replaceDocumentLinks,\n saveContainerSyncWatermark,\n syncedContainerDocumentObjectSyncState,\n} from \"./workflows/container-contents\";\nexport type {\n AggregatedContainerKekLog,\n ContainerMutationAuthor,\n ContainerReciteApi,\n ContainerWriteRefusal,\n KeyringRebuildResult,\n MaterializedContainerRekeyPlan,\n} from \"./workflows/containers\";\nexport {\n buildMaterializedContainerRekeyPlan,\n buildRootContainerCreatePlan,\n ContainerAuthorAccessError,\n ContainerKekRepairInaccessibleError,\n ContainerKekRepairRequiredError,\n ContainerKeyringOverrideStaleError,\n ContainerPathTooDeepError,\n classifyContainerWriteRefusal,\n containerWriterProjectionFromRekeyPlan,\n createRemoteContainer,\n fetchContainerKekLog,\n GroupShareNameMismatchError,\n HistoricalWrapUnavailableError,\n type HistoricalWrapUnavailableReason,\n isProjectionVerificationCancelledError,\n moveRemoteContainer,\n rebuildKeyringEntriesFromLog,\n recoverKeyringEntryFromWraps,\n rekeyRemoteContainer,\n revokeRemoteContainer,\n rootContainerWriterProjectionFromCreatePlan,\n shareRemoteContainer,\n shareRemoteContainerWithGroup,\n} from \"./workflows/containers\";\nexport type {\n DocumentRecord,\n DocumentSyncContainerRekeyBuilder,\n DocumentSyncPullContinuation,\n DocumentSyncUpdateIsolationError,\n DocumentsPersistence,\n DocumentsWorkflowRuntime,\n DocumentsWorkflowRuntimeInput,\n IncomingDocumentSyncUpdateValidator,\n LocalAttachmentRecord,\n PendingAttachmentRecord,\n PendingUpdateInsert,\n PendingUpdateRecord,\n SyncRemoteDocumentInput,\n} from \"./workflows/documents\";\nexport {\n buildMaterializedDocumentCreatePlan,\n createDocumentProjectionUserKeyResolver,\n createDocumentsWorkflowRuntime,\n createRemoteDocument,\n DOCUMENT_SYNC_TRACE_FRAGMENT,\n DOCUMENT_SYNC_TRACE_PATTERN,\n DOCUMENTS_APP_KIND,\n DocumentRawHistoryUnavailableError,\n defaultDocumentsPersistence,\n deletePersistedDocument,\n isDatabaseUnavailableError,\n isDocumentSyncUpdateIsolationError,\n persistedDocumentCreateStateFromResponse,\n readPullContinuation,\n syncRemoteDocument,\n unwrapContainerKekPath,\n unwrapDocumentContentKeyTarget,\n validateDocumentSyncUpdateImports,\n} from \"./workflows/documents\";\n// Nominal identity constructors are deliberately absent here. Integration\n// tests that compose low-level runtimes use the testing package subpath.\nexport type {\n AcknowledgedPrincipalCurrentInput,\n AcknowledgedPrincipalCurrentRetirement,\n AuthoredPrincipalMutation,\n OrganizationGroupPolicyHistoryEntry,\n OrganizationNativePurchaseEligibility,\n OrganizationPrincipalMemberChange,\n OrganizationPrincipalMemberChangeType,\n OrganizationPrincipalPolicyHistory,\n OrganizationPrincipalPolicyHistoryEntry,\n PrincipalMutationJournalContext,\n PrincipalMutationJournalScope,\n ReconcileOrganizationDataUsageInput,\n} from \"./workflows/organizations\";\nexport {\n abandonJournaledPrincipalMutation,\n addOrganizationGroupUser,\n buildInitialGroupPolicyRequest,\n buildInitialMemberGroupPolicyRequest,\n buildOrganizationGroupPolicyHistory,\n buildOrganizationProfileDocumentPatch,\n buildRosterProfileDocumentPatch,\n checkNativePurchaseEligibility,\n createInitializedRosterProfileDocument,\n createOrganizationGroup,\n DEFAULT_PERSONAL_ORGANIZATION_PROFILE_NAME,\n deriveOrganizationMetadataContainerSystemSlot,\n deriveOrganizationRosterProfileContainerSystemSlot,\n discardUnreadableJournaledPrincipalMutation,\n GroupMembershipNameMismatchError,\n getOrganizationProfileDocumentLocalId,\n getRosterProfileDocumentLocalId,\n importOrganizationUser,\n loadLocalOrganizationDataUsage,\n loadLocalOrganizationDirectoryAndGroups,\n loadOrganizationBilling,\n loadOrganizationBillingHistory,\n loadOrganizationBillingManagementUrl,\n ORGANIZATION_METADATA_CONTAINER_NAME,\n ORGANIZATION_PROFILE_DOCUMENT_KIND,\n ORGANIZATION_ROSTER_PROFILE_CONTAINER_NAME,\n PendingPrincipalMutationError,\n PrincipalMutationOutcomeUnknownError,\n ROSTER_PROFILE_DOCUMENT_KIND,\n readJournaledPrincipalMutation,\n readOrganizationProfileName,\n reconcileOrganizationDataUsage,\n reconcileOrganizationDirectoryAndGroups,\n recoverJournaledPrincipalMutation,\n removeOrganizationGroupUser,\n resolveOrganizationBillingView,\n retainAcknowledgedPrincipalCurrents,\n revokeOrganizationContainerGrant,\n startOrganizationTrial,\n submitJournaledPrincipalMutation,\n subscribeOrganizationReadModelInvalidation,\n UnreadablePrincipalMutationError,\n updateOrganizationProfile,\n updateOrganizationRosterEntry,\n} from \"./workflows/organizations\";\nexport type {\n CacheReferencedPrincipalPoliciesOptions,\n PrincipalHistoryProtectionLease,\n ProjectionPolicyHistoryRecoveryOptions,\n RecoveredPrincipalPolicyHistory,\n RecoveredScopedPrincipalPolicyHistory,\n RecoverPrincipalPolicyHistoryOptions,\n RecoverScopedPrincipalPolicyHistoryOptions,\n} from \"./workflows/principals\";\nexport {\n cacheReferencedPrincipalPolicies,\n PrincipalPolicyHistoryReadError,\n recoverPrincipalPolicyHistory,\n recoverProjectionPolicyHistory,\n recoverScopedPrincipalPolicyHistory,\n} from \"./workflows/principals\";\nexport type {\n InitialRootMetadataBootstrap,\n ProvisionedSystemContainerSpec,\n RegisterIdentityInput,\n RegistrationApi,\n} from \"./workflows/registration\";\nexport {\n bootstrapRootContainer,\n buildInitialOrganizationPolicyRequest,\n createInitialRootMetadataBootstrap,\n persistRegistrationBootstrap,\n registerIdentity,\n} from \"./workflows/registration\";\nexport type {\n RootIdentitiesApi,\n RootIdentitiesPage,\n RootIdentitiesQueryInput,\n RootIdentity,\n RootIdentityDetail,\n RootIdentityOrganization,\n RootIdentitySession,\n RootRequestOutcome,\n} from \"./workflows/root\";\nexport {\n listRootDataUsageReport,\n listRootIdentities,\n listRootIdentityOrganizations,\n listRootOrganizationIdentities,\n listRootOrganizations,\n loadRootIdentity,\n loadRootOrganization,\n loadRootOrganizationDataUsage,\n type RootDataUsageApi,\n type RootDataUsageReportPage,\n type RootOrganization,\n type RootOrganizationDetail,\n type RootOrganizationIdentitiesPage,\n type RootOrganizationIdentity,\n type RootOrganizationPageQueryInput,\n type RootOrganizationsApi,\n type RootOrganizationsPage,\n type RootOrganizationsQueryInput,\n} from \"./workflows/root\";\nexport type {\n ClearRemoteSyncStateResult,\n DomainSyncCoordinator,\n DomainSyncSnapshot,\n RemoteResetInput,\n RemoteResetReplacement,\n SyncIdleOptions,\n SyncLane,\n SyncLaneConfig,\n SyncLaneLastAction,\n SyncLanePhase,\n SyncLaneSnapshot,\n SyncLaneStatus,\n} from \"./workflows/sync\";\nexport {\n clearRemoteSyncState,\n getDomainSyncCoordinatorSnapshot,\n getOrCreateDomainSyncCoordinator,\n hasDomainSyncCoordinatorPendingWork,\n requestAllDomainSyncLanes,\n subscribeToDomainSyncCoordinator,\n waitForDomainSyncCoordinatorToSettle,\n} from \"./workflows/sync\";\n"]}

package/internal/crypto/index.d.ts CHANGED Viewed

@@ -20,7 +20,7 @@ export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, type IdentitySeedPhraseKeyPairs, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, type IncrementalSha256, } from "./incrementalSha256.js";
 export type { AccessEvent, AccessEventType, AccessManifest, AccessManifestCheckpoint, AccessManifestTransparencyLeaf, AccessObjectKind, AnyVerifiedAccessManifest, AnyVerifiedPrincipalPolicy, AttachmentAccessEventBody, AttachmentBindAccessEventBody, AttachmentDetachAccessEventBody, BlobAccessManifest, BlobContentKeyTarget, ContainerAccessEventBody, ContainerAccessKeyState, ContainerAccessLevel, ContainerAccessManifest, ContainerAccessManifestState, ContainerAccessStructural, ContainerCreateAccessEventBody, ContainerDirectGrant, ContainerGrantAccessEventBody, ContainerGrantPrincipalHead, ContainerGrantSubjectType, ContainerKekKeyring, ContainerKekKeyringEntry, ContainerKekPredecessorBridge, ContainerKekRecipientTarget, ContainerKekTarget, ContainerKeyEpoch, ContainerKeyWrap, ContainerMoveAccessEventBody, ContainerReciteAccessEventBody, ContainerRekeyAccessEventBody, ContainerRevokeAccessEventBody, ContainerUserRecipientKey, ContentObjectKind, ContentRecordEncryptionSuite, ContentRecordNonceDomain, DeriveBlobKekTargetsInput, DeriveContainerKekRecipientTargetsInput, DeriveDocumentKekTargetsInput, DocumentAccessEventBody, DocumentContentKeyTarget, DocumentContentRecordMetadataInput, DocumentLinkAccessEventBody, DocumentLinkSetManifestState, DocumentLinkSetStructural, DocumentPurgeAccessEventBody, DocumentUnlinkAccessEventBody, IdentityStateCheckpoint, IdentityStateHead, IdentityStateTransparencyLeaf, KekRecipientKind, KeyingCanonicalJson, KeyingHashDomain, KeyingLocalCheckpointStore, KeyingVerificationCode, KeyingVerificationResult, ManagedPrincipalKind, PrincipalHistoryIndexNode, PrincipalPolicyAuthorization, PrincipalPolicyBundle, PrincipalPolicyCheckpoint, PrincipalPolicyCurrent, PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, PrincipalPolicyHistoryInput, PrincipalPolicyHistoryPage, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryReferenceProof, PrincipalPolicyHistoryVerifier, PrincipalPolicyMemberEnvelopes, PrincipalPolicyPayload, PrincipalPolicySignedState, PrincipalPolicySignerPublicKey, PrincipalPolicySnapshot, PrincipalPolicyStateChainEntry, PrincipalPolicyTransitionMismatch, PrincipalPolicyTransitionMismatchCode, PrincipalPolicyTransparencyLeaf, ReferencedPrincipalHead, SignedTransparencyTreeHead, TransparencyConsistencyProof, TransparencyInclusionProof, TransparencyLeaf, TransparencyLeafKind, TransparencyTreeCheckpoint, UnsignedAccessEvent, UnsignedTransparencyTreeHead, UnsignedWriteHeader, VerifiedAccessEvent, VerifiedAccessManifest, VerifiedAccessManifestCheckpointEvidence, VerifiedAccessManifestSnapshot, VerifiedAttachmentBinding, VerifiedAttachmentDetach, VerifiedBlobKekTargets, VerifiedContainerAccessManifest, VerifiedContainerKekState, VerifiedContainerParentEdge, VerifiedDocumentKekTargets, VerifiedDocumentLinkSetManifest, VerifiedDocumentLinkSetSnapshot, VerifiedDocumentLinkSetStateEvidence, VerifiedIdentityState, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent, VerifiedPrincipalPolicyHistory, VerifiedPrincipalPolicySelection, VerifiedPrincipalPolicySnapshot, VerifiedTransparencyProof, VerifiedTransparencyTreeHead, VerifiedWriteHeader, VerifyAccessEventInput, VerifyAccessManifestInput, VerifyAttachmentBindingEventInput, VerifyAttachmentDetachEventInput, VerifyContainerAccessManifestInput, VerifyContainerKekStateInput, VerifyContainerParentEdgeInput, VerifyDocumentLinkSetManifestInput, VerifyDocumentPurgeEventInput, VerifyIdentityStateCheckpointInput, VerifyPrincipalPolicyBundleInput, VerifyPrincipalPolicySnapshotInput, VerifySignedTransparencyTreeHeadInput, VerifyTransparencyConsistencyProofInput, VerifyTransparencyInclusionProofInput, VerifyTransparencyProofInput, VerifyWriteHeaderInput, WriteHeader, } from "./keying.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, type VerifiedOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js CHANGED Viewed

@@ -14,7 +14,7 @@ export { decryptGroupMetadata, encodeBuiltinGroupMetadata, encryptGroupMetadata,
 export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, } from "./incrementalSha256.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n BlobEnvelopeHeaderRecord,\n BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n MAX_BLOB_ENVELOPE_HEADER_BYTES,\n parseBlobEnvelopeV2,\n parseBlobEnvelopeV2Header,\n readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n BLOB_CHUNK_SIZE_BYTES,\n BLOB_ENCRYPTED_BYTES_FORMAT,\n BLOB_ENCRYPTED_BYTES_VERSION,\n BLOB_ENVELOPE_MAGIC_BYTES,\n BLOB_ENVELOPE_PREFIX_BYTES,\n blobChunkPlaintextByteLength,\n computeBlobChunkCount,\n computeBlobEncryptedByteLength,\n deriveBlobChunkIv,\n encodeBlobEnvelopeV2Header,\n joinBlobPartBytes,\n MAX_BLOB_CHUNK_COUNT,\n normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n AUTH_CHALLENGE_BYTES,\n AUTH_CHALLENGE_HEX_LENGTH,\n authChallengeSigningBytes,\n CHALLENGE_TTL_SECONDS,\n canonicalAuthOrigin,\n generateChallenge,\n} from \"./challenge\";\nexport type {\n ContentKeyEnvelopeKind,\n ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n ContentKeyEnvelopeError,\n decodeContentKeyEnvelope,\n unwrapContentKey,\n wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n generateKemKeyPair,\n generateKemSeedAndKeyPair,\n ML_KEM1024_CIPHERTEXT_BYTES,\n ML_KEM1024_PUBLIC_KEY_BYTES,\n ML_KEM1024_SECRET_KEY_BYTES,\n ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n decryptGroupMetadata,\n encodeBuiltinGroupMetadata,\n encryptGroupMetadata,\n type GroupMetadata,\n type GroupMetadataKey,\n readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n createIdentitySeedPhrase,\n createIdentitySeedPhraseFromEntropy,\n generateIdentityKeyPairsFromSeedPhrase,\n IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n IDENTITY_SEED_PHRASE_WORDS,\n type IdentitySeedPhraseKeyPairs,\n normalizeIdentitySeedPhrase,\n validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n createIncrementalSha256,\n type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n AccessEvent,\n AccessEventType,\n AccessManifest,\n AccessManifestCheckpoint,\n AccessManifestTransparencyLeaf,\n AccessObjectKind,\n AnyVerifiedAccessManifest,\n AnyVerifiedPrincipalPolicy,\n AttachmentAccessEventBody,\n AttachmentBindAccessEventBody,\n AttachmentDetachAccessEventBody,\n BlobAccessManifest,\n BlobContentKeyTarget,\n ContainerAccessEventBody,\n ContainerAccessKeyState,\n ContainerAccessLevel,\n ContainerAccessManifest,\n ContainerAccessManifestState,\n ContainerAccessStructural,\n ContainerCreateAccessEventBody,\n ContainerDirectGrant,\n ContainerGrantAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerGrantSubjectType,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n ContainerKekRecipientTarget,\n ContainerKekTarget,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerReciteAccessEventBody,\n ContainerRekeyAccessEventBody,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n ContentObjectKind,\n ContentRecordEncryptionSuite,\n ContentRecordNonceDomain,\n DeriveBlobKekTargetsInput,\n DeriveContainerKekRecipientTargetsInput,\n DeriveDocumentKekTargetsInput,\n DocumentAccessEventBody,\n DocumentContentKeyTarget,\n DocumentContentRecordMetadataInput,\n DocumentLinkAccessEventBody,\n DocumentLinkSetManifestState,\n DocumentLinkSetStructural,\n DocumentPurgeAccessEventBody,\n DocumentUnlinkAccessEventBody,\n IdentityStateCheckpoint,\n IdentityStateHead,\n IdentityStateTransparencyLeaf,\n KekRecipientKind,\n KeyingCanonicalJson,\n KeyingHashDomain,\n KeyingLocalCheckpointStore,\n KeyingVerificationCode,\n KeyingVerificationResult,\n ManagedPrincipalKind,\n PrincipalHistoryIndexNode,\n PrincipalPolicyAuthorization,\n PrincipalPolicyBundle,\n PrincipalPolicyCheckpoint,\n PrincipalPolicyCurrent,\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryReferenceProof,\n PrincipalPolicyHistoryVerifier,\n PrincipalPolicyMemberEnvelopes,\n PrincipalPolicyPayload,\n PrincipalPolicySignedState,\n PrincipalPolicySignerPublicKey,\n PrincipalPolicySnapshot,\n PrincipalPolicyStateChainEntry,\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n PrincipalPolicyTransparencyLeaf,\n ReferencedPrincipalHead,\n SignedTransparencyTreeHead,\n TransparencyConsistencyProof,\n TransparencyInclusionProof,\n TransparencyLeaf,\n TransparencyLeafKind,\n TransparencyTreeCheckpoint,\n UnsignedAccessEvent,\n UnsignedTransparencyTreeHead,\n UnsignedWriteHeader,\n VerifiedAccessEvent,\n VerifiedAccessManifest,\n VerifiedAccessManifestCheckpointEvidence,\n VerifiedAccessManifestSnapshot,\n VerifiedAttachmentBinding,\n VerifiedAttachmentDetach,\n VerifiedBlobKekTargets,\n VerifiedContainerAccessManifest,\n VerifiedContainerKekState,\n VerifiedContainerParentEdge,\n VerifiedDocumentKekTargets,\n VerifiedDocumentLinkSetManifest,\n VerifiedDocumentLinkSetSnapshot,\n VerifiedDocumentLinkSetStateEvidence,\n VerifiedIdentityState,\n VerifiedPrincipalPolicy,\n VerifiedPrincipalPolicyCurrent,\n VerifiedPrincipalPolicyHistory,\n VerifiedPrincipalPolicySelection,\n VerifiedPrincipalPolicySnapshot,\n VerifiedTransparencyProof,\n VerifiedTransparencyTreeHead,\n VerifiedWriteHeader,\n VerifyAccessEventInput,\n VerifyAccessManifestInput,\n VerifyAttachmentBindingEventInput,\n VerifyAttachmentDetachEventInput,\n VerifyContainerAccessManifestInput,\n VerifyContainerKekStateInput,\n VerifyContainerParentEdgeInput,\n VerifyDocumentLinkSetManifestInput,\n VerifyDocumentPurgeEventInput,\n VerifyIdentityStateCheckpointInput,\n VerifyPrincipalPolicyBundleInput,\n VerifyPrincipalPolicySnapshotInput,\n VerifySignedTransparencyTreeHeadInput,\n VerifyTransparencyConsistencyProofInput,\n VerifyTransparencyInclusionProofInput,\n VerifyTransparencyProofInput,\n VerifyWriteHeaderInput,\n WriteHeader,\n} from \"./keying\";\nexport {\n ACCESS_MANIFEST_VERIFICATION_REVISION,\n accessManifestCheckpointFromManifest,\n accessManifestTransparencyLeaf,\n assertSealedContainerKekKeyringLength,\n BLOB_CONTENT_KEY_WRAP_SUITE,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n CONTAINER_KEK_KEYRING_SEAL_SUITE,\n CONTAINER_KEK_MATERIAL_ID_PREFIX,\n CONTAINER_KEK_PARENT_WRAP_SUITE,\n CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n CONTAINER_KEK_USER_WRAP_SUITE,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeAccessEventBodyHash,\n computeAccessEventHash,\n computeAccessManifestHash,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContainerAccessKeyTargetHash,\n computeContainerAccessStructuralHash,\n computeContainerDirectGrantRoot,\n computeContainerKekKeyringHash,\n computeContainerKekMaterialId,\n computeContainerKekPredecessorBridgeHash,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n computeContentRecordNonceDomainHash,\n computeDocumentContentKeyTargetHash,\n computeDocumentContentRecordCiphertextHash,\n computeDocumentContentRecordMetadataHash,\n computeDocumentContentRecordPlaintextHash,\n computeDocumentLinkSetGrantRoot,\n computeDocumentLinkSetKeyTargetHash,\n computeDocumentLinkSetStructuralHash,\n computeKeyingDomainHash,\n computeTransparencyLeafHash,\n computeTransparencyMerkleRoot,\n computeWriteHeaderHash,\n createContainerKekPredecessorBridge,\n createPrincipalHistoryIndexProof,\n createPrincipalPolicyHistoryVerifier,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n deriveBlobKekTargets,\n deriveContainerAccessManifest,\n deriveContainerKekRecipientTargets,\n deriveContainerKekWrappingPublicKey,\n deriveDocumentKekTargets,\n deriveDocumentLinkSetManifest,\n derivePrincipalRecipientKeyEpochId,\n documentContentRecordMetadata,\n expectedSealedContainerKekKeyringBytes,\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n identityStateTransparencyLeaf,\n isContainerKekMaterialId,\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n KeyingVerificationError,\n MAX_CONTAINER_KEY_EPOCH,\n MAX_CONTAINER_RECITATION_EPOCH,\n makeVerifiedAccessEvent,\n makeVerifiedBlobKekTargets,\n makeVerifiedContainerAccessManifest,\n makeVerifiedContainerKekState,\n makeVerifiedDocumentKekTargets,\n makeVerifiedDocumentLinkSetManifest,\n makeVerifiedDocumentLinkSetSnapshot,\n makeVerifiedPrincipalPolicy,\n normalizeAttachmentAccessEventBody,\n normalizeContainerAccessEventBody,\n normalizeContainerKekKeyring,\n normalizeContainerKekPredecessorBridge,\n normalizeDocumentAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n openContainerKekKeyring,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n principalHistoryIndexLeaf,\n principalPolicyMatchesReference,\n principalPolicyTransparencyLeaf,\n resolveContainerPathUserAccessLevel,\n resolveContainerStatePathUserAccessLevel,\n resolveHistoricalContainerPathUserAccessLevel,\n resolvePrincipalHistoryIndexProof,\n restorePrincipalPolicyHistoryVerifier,\n sealContainerKekKeyring,\n selectPrincipalPolicyAuthorization,\n serializeKeyingCanonicalJson,\n signAccessEvent,\n signTransparencyTreeHead,\n signWriteHeader,\n unwrapContainerKekParentWrap,\n unwrapContainerKekPredecessorBridge,\n verifyAccessManifest,\n verifyAccessManifestLocalCheckpoint,\n verifyAccessManifestSnapshot,\n verifyAttachmentBindingEvent,\n verifyAttachmentDetachEvent,\n verifyContainerAccessManifest,\n verifyContainerKekKeyringEntry,\n verifyContainerKekState,\n verifyContainerParentEdge,\n verifyDocumentLinkSetManifest,\n verifyDocumentLinkSetSnapshot,\n verifyDocumentPurgeEvent,\n verifyIdentityStateCheckpoint,\n verifyPrincipalPolicyBundle,\n verifyPrincipalPolicyBundleAgainstHistory,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n verifyPrincipalPolicyHistoryReferences,\n verifyPrincipalPolicySnapshot,\n verifySignedAccessEvent,\n verifySignedTransparencyTreeHead,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n verifyTransparencyProof,\n verifyWriteHeader,\n} from \"./keying\";\nexport {\n organizationReplacementAuthorizationPayload,\n organizationReplacementSigningBytes,\n signOrganizationReplacementAuthorization,\n type VerifiedOrganizationReplacementAuthorization,\n verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n computePrincipalContainerGrantRoot,\n normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n computePrincipalMemberEnvelopesRoot,\n normalizePrincipalStateMemberEnvelopes,\n PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n PrincipalPolicyValidationError,\n throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n ManagedRecipientPrincipalType,\n PrincipalContainerGrant,\n PrincipalContainerGrantAccessLevel,\n PrincipalProjectionMember,\n PrincipalProjectionRole,\n PrincipalStateExternalAuthority,\n PrincipalStateHeaderInput,\n PrincipalStateMember,\n PrincipalStateMemberEnvelope,\n PrincipalStateMembershipMode,\n PrincipalStatePayloadCipherSuite,\n PrincipalStateSigningInput,\n SignedPrincipalState,\n UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n buildPrincipalStateSigningInput,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStateHash,\n computePrincipalStatePayloadCiphertextHash,\n derivePrincipalProjectionMembers,\n isManagedRecipientPrincipalType,\n isPrincipalProjectionRole,\n normalizePrincipalProjectionMembers,\n normalizePrincipalStateMembers,\n serializeUnsignedPrincipalState,\n signPrincipalState,\n} from \"./principalState\";\nexport {\n verifySignedPrincipalState,\n verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n captureProjectionHistory,\n type HistoryProjection,\n omitProjectionHistory,\n type RetainedProjectionHistory,\n restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n generateSigningKeyPair,\n generateSigningSeedAndKeyPair,\n ML_DSA87_PUBLIC_KEY_BYTES,\n ML_DSA87_SECRET_KEY_BYTES,\n ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n AES_256_KEY_BYTES,\n AES_GCM_IV_BYTES,\n AES_GCM_TAG_BYTES,\n assertAesGcmIv,\n createAesGcmIv,\n decryptWithDek,\n encryptWithDek,\n} from \"./symmetric\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,oCAAoC,EACpC,qCAAqC,EACrC,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n BlobEnvelopeHeaderRecord,\n BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n MAX_BLOB_ENVELOPE_HEADER_BYTES,\n parseBlobEnvelopeV2,\n parseBlobEnvelopeV2Header,\n readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n BLOB_CHUNK_SIZE_BYTES,\n BLOB_ENCRYPTED_BYTES_FORMAT,\n BLOB_ENCRYPTED_BYTES_VERSION,\n BLOB_ENVELOPE_MAGIC_BYTES,\n BLOB_ENVELOPE_PREFIX_BYTES,\n blobChunkPlaintextByteLength,\n computeBlobChunkCount,\n computeBlobEncryptedByteLength,\n deriveBlobChunkIv,\n encodeBlobEnvelopeV2Header,\n joinBlobPartBytes,\n MAX_BLOB_CHUNK_COUNT,\n normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n AUTH_CHALLENGE_BYTES,\n AUTH_CHALLENGE_HEX_LENGTH,\n authChallengeSigningBytes,\n CHALLENGE_TTL_SECONDS,\n canonicalAuthOrigin,\n generateChallenge,\n} from \"./challenge\";\nexport type {\n ContentKeyEnvelopeKind,\n ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n ContentKeyEnvelopeError,\n decodeContentKeyEnvelope,\n unwrapContentKey,\n wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n generateKemKeyPair,\n generateKemSeedAndKeyPair,\n ML_KEM1024_CIPHERTEXT_BYTES,\n ML_KEM1024_PUBLIC_KEY_BYTES,\n ML_KEM1024_SECRET_KEY_BYTES,\n ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n decryptGroupMetadata,\n encodeBuiltinGroupMetadata,\n encryptGroupMetadata,\n type GroupMetadata,\n type GroupMetadataKey,\n readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n createIdentitySeedPhrase,\n createIdentitySeedPhraseFromEntropy,\n generateIdentityKeyPairsFromSeedPhrase,\n IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n IDENTITY_SEED_PHRASE_WORDS,\n type IdentitySeedPhraseKeyPairs,\n normalizeIdentitySeedPhrase,\n validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n createIncrementalSha256,\n type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n AccessEvent,\n AccessEventType,\n AccessManifest,\n AccessManifestCheckpoint,\n AccessManifestTransparencyLeaf,\n AccessObjectKind,\n AnyVerifiedAccessManifest,\n AnyVerifiedPrincipalPolicy,\n AttachmentAccessEventBody,\n AttachmentBindAccessEventBody,\n AttachmentDetachAccessEventBody,\n BlobAccessManifest,\n BlobContentKeyTarget,\n ContainerAccessEventBody,\n ContainerAccessKeyState,\n ContainerAccessLevel,\n ContainerAccessManifest,\n ContainerAccessManifestState,\n ContainerAccessStructural,\n ContainerCreateAccessEventBody,\n ContainerDirectGrant,\n ContainerGrantAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerGrantSubjectType,\n ContainerKekKeyring,\n ContainerKekKeyringEntry,\n ContainerKekPredecessorBridge,\n ContainerKekRecipientTarget,\n ContainerKekTarget,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerMoveAccessEventBody,\n ContainerReciteAccessEventBody,\n ContainerRekeyAccessEventBody,\n ContainerRevokeAccessEventBody,\n ContainerUserRecipientKey,\n ContentObjectKind,\n ContentRecordEncryptionSuite,\n ContentRecordNonceDomain,\n DeriveBlobKekTargetsInput,\n DeriveContainerKekRecipientTargetsInput,\n DeriveDocumentKekTargetsInput,\n DocumentAccessEventBody,\n DocumentContentKeyTarget,\n DocumentContentRecordMetadataInput,\n DocumentLinkAccessEventBody,\n DocumentLinkSetManifestState,\n DocumentLinkSetStructural,\n DocumentPurgeAccessEventBody,\n DocumentUnlinkAccessEventBody,\n IdentityStateCheckpoint,\n IdentityStateHead,\n IdentityStateTransparencyLeaf,\n KekRecipientKind,\n KeyingCanonicalJson,\n KeyingHashDomain,\n KeyingLocalCheckpointStore,\n KeyingVerificationCode,\n KeyingVerificationResult,\n ManagedPrincipalKind,\n PrincipalHistoryIndexNode,\n PrincipalPolicyAuthorization,\n PrincipalPolicyBundle,\n PrincipalPolicyCheckpoint,\n PrincipalPolicyCurrent,\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryReferenceProof,\n PrincipalPolicyHistoryVerifier,\n PrincipalPolicyMemberEnvelopes,\n PrincipalPolicyPayload,\n PrincipalPolicySignedState,\n PrincipalPolicySignerPublicKey,\n PrincipalPolicySnapshot,\n PrincipalPolicyStateChainEntry,\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n PrincipalPolicyTransparencyLeaf,\n ReferencedPrincipalHead,\n SignedTransparencyTreeHead,\n TransparencyConsistencyProof,\n TransparencyInclusionProof,\n TransparencyLeaf,\n TransparencyLeafKind,\n TransparencyTreeCheckpoint,\n UnsignedAccessEvent,\n UnsignedTransparencyTreeHead,\n UnsignedWriteHeader,\n VerifiedAccessEvent,\n VerifiedAccessManifest,\n VerifiedAccessManifestCheckpointEvidence,\n VerifiedAccessManifestSnapshot,\n VerifiedAttachmentBinding,\n VerifiedAttachmentDetach,\n VerifiedBlobKekTargets,\n VerifiedContainerAccessManifest,\n VerifiedContainerKekState,\n VerifiedContainerParentEdge,\n VerifiedDocumentKekTargets,\n VerifiedDocumentLinkSetManifest,\n VerifiedDocumentLinkSetSnapshot,\n VerifiedDocumentLinkSetStateEvidence,\n VerifiedIdentityState,\n VerifiedPrincipalPolicy,\n VerifiedPrincipalPolicyCurrent,\n VerifiedPrincipalPolicyHistory,\n VerifiedPrincipalPolicySelection,\n VerifiedPrincipalPolicySnapshot,\n VerifiedTransparencyProof,\n VerifiedTransparencyTreeHead,\n VerifiedWriteHeader,\n VerifyAccessEventInput,\n VerifyAccessManifestInput,\n VerifyAttachmentBindingEventInput,\n VerifyAttachmentDetachEventInput,\n VerifyContainerAccessManifestInput,\n VerifyContainerKekStateInput,\n VerifyContainerParentEdgeInput,\n VerifyDocumentLinkSetManifestInput,\n VerifyDocumentPurgeEventInput,\n VerifyIdentityStateCheckpointInput,\n VerifyPrincipalPolicyBundleInput,\n VerifyPrincipalPolicySnapshotInput,\n VerifySignedTransparencyTreeHeadInput,\n VerifyTransparencyConsistencyProofInput,\n VerifyTransparencyInclusionProofInput,\n VerifyTransparencyProofInput,\n VerifyWriteHeaderInput,\n WriteHeader,\n} from \"./keying\";\nexport {\n ACCESS_MANIFEST_VERIFICATION_REVISION,\n accessManifestCheckpointFromManifest,\n accessManifestTransparencyLeaf,\n assertSealedContainerKekKeyringLength,\n BLOB_CONTENT_KEY_WRAP_SUITE,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n CONTAINER_KEK_KEYRING_SEAL_SUITE,\n CONTAINER_KEK_MATERIAL_ID_PREFIX,\n CONTAINER_KEK_PARENT_WRAP_SUITE,\n CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n CONTAINER_KEK_USER_WRAP_SUITE,\n CONTENT_RECORD_ENCRYPTION_SUITE,\n computeAccessEventBodyHash,\n computeAccessEventHash,\n computeAccessManifestHash,\n computeBlobAccessManifestHash,\n computeBlobContentKeyTargetHash,\n computeContainerAccessKeyTargetHash,\n computeContainerAccessStructuralHash,\n computeContainerDirectGrantRoot,\n computeContainerKekKeyringHash,\n computeContainerKekMaterialId,\n computeContainerKekPredecessorBridgeHash,\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n computeContentRecordNonceDomainHash,\n computeDocumentContentKeyTargetHash,\n computeDocumentContentRecordCiphertextHash,\n computeDocumentContentRecordMetadataHash,\n computeDocumentContentRecordPlaintextHash,\n computeDocumentLinkSetGrantRoot,\n computeDocumentLinkSetKeyTargetHash,\n computeDocumentLinkSetStructuralHash,\n computeKeyingDomainHash,\n computeTransparencyLeafHash,\n computeTransparencyMerkleRoot,\n computeWriteHeaderHash,\n createContainerKekPredecessorBridge,\n createPrincipalHistoryIndexProof,\n createPrincipalPolicyHistoryVerifier,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n deriveBlobKekTargets,\n deriveContainerAccessManifest,\n deriveContainerKekRecipientTargets,\n deriveContainerKekWrappingPublicKey,\n deriveDocumentKekTargets,\n deriveDocumentLinkSetManifest,\n derivePrincipalRecipientKeyEpochId,\n documentContentRecordMetadata,\n expectedSealedContainerKekKeyringBytes,\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n identityStateTransparencyLeaf,\n isContainerKekMaterialId,\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n KeyingVerificationError,\n MAX_CONTAINER_KEY_EPOCH,\n MAX_CONTAINER_RECITATION_EPOCH,\n makeVerifiedAccessEvent,\n makeVerifiedBlobKekTargets,\n makeVerifiedContainerAccessManifest,\n makeVerifiedContainerKekState,\n makeVerifiedDocumentKekTargets,\n makeVerifiedDocumentLinkSetManifest,\n makeVerifiedDocumentLinkSetSnapshot,\n makeVerifiedPrincipalPolicy,\n normalizeAttachmentAccessEventBody,\n normalizeContainerAccessEventBody,\n normalizeContainerKekKeyring,\n normalizeContainerKekPredecessorBridge,\n normalizeDocumentAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n openContainerKekKeyring,\n PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n principalHistoryIndexLeaf,\n principalPolicyMatchesReference,\n principalPolicyTransparencyLeaf,\n resolveContainerPathUserAccessLevel,\n resolveContainerStatePathUserAccessLevel,\n resolveHistoricalContainerPathUserAccessLevel,\n resolvePrincipalHistoryIndexProof,\n restorePrincipalPolicyHistoryVerifier,\n sealContainerKekKeyring,\n selectPrincipalPolicyAuthorization,\n serializeKeyingCanonicalJson,\n signAccessEvent,\n signTransparencyTreeHead,\n signWriteHeader,\n unwrapContainerKekParentWrap,\n unwrapContainerKekPredecessorBridge,\n verifyAccessManifest,\n verifyAccessManifestLocalCheckpoint,\n verifyAccessManifestSnapshot,\n verifyAttachmentBindingEvent,\n verifyAttachmentDetachEvent,\n verifyContainerAccessManifest,\n verifyContainerKekKeyringEntry,\n verifyContainerKekState,\n verifyContainerParentEdge,\n verifyDocumentLinkSetManifest,\n verifyDocumentLinkSetSnapshot,\n verifyDocumentPurgeEvent,\n verifyIdentityStateCheckpoint,\n verifyPrincipalPolicyBundle,\n verifyPrincipalPolicyBundleAgainstHistory,\n verifyPrincipalPolicyCheckpoint,\n verifyPrincipalPolicyCurrent,\n verifyPrincipalPolicyCurrentMutation,\n verifyPrincipalPolicyCurrentSuccessor,\n verifyPrincipalPolicyHistoryReferences,\n verifyPrincipalPolicySnapshot,\n verifySignedAccessEvent,\n verifySignedTransparencyTreeHead,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n verifyTransparencyProof,\n verifyWriteHeader,\n} from \"./keying\";\nexport {\n organizationReplacementAuthorizationPayload,\n organizationReplacementSigningBytes,\n signOrganizationReplacementAuthorization,\n type VerifiedOrganizationReplacementAuthorization,\n verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n computePrincipalContainerGrantRoot,\n normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n computePrincipalMemberEnvelopesRoot,\n normalizePrincipalStateMemberEnvelopes,\n PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n PrincipalPolicyValidationError,\n throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n ManagedRecipientPrincipalType,\n PrincipalContainerGrant,\n PrincipalContainerGrantAccessLevel,\n PrincipalProjectionMember,\n PrincipalProjectionRole,\n PrincipalStateExternalAuthority,\n PrincipalStateHeaderInput,\n PrincipalStateMember,\n PrincipalStateMemberEnvelope,\n PrincipalStateMembershipMode,\n PrincipalStatePayloadCipherSuite,\n PrincipalStateSigningInput,\n SignedPrincipalState,\n UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n buildPrincipalStateSigningInput,\n computePrincipalMembershipRoot,\n computePrincipalProjectionRoot,\n computePrincipalStateHash,\n computePrincipalStatePayloadCiphertextHash,\n derivePrincipalProjectionMembers,\n isManagedRecipientPrincipalType,\n isPrincipalProjectionRole,\n normalizePrincipalProjectionMembers,\n normalizePrincipalStateMembers,\n serializeUnsignedPrincipalState,\n signPrincipalState,\n} from \"./principalState\";\nexport {\n verifySignedPrincipalState,\n verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n captureProjectionHistory,\n type HistoryProjection,\n omitProjectionHistory,\n type RetainedProjectionHistory,\n restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n generateSigningKeyPair,\n generateSigningSeedAndKeyPair,\n ML_DSA87_PUBLIC_KEY_BYTES,\n ML_DSA87_SECRET_KEY_BYTES,\n ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n AES_256_KEY_BYTES,\n AES_GCM_IV_BYTES,\n AES_GCM_TAG_BYTES,\n assertAesGcmIv,\n createAesGcmIv,\n decryptWithDek,\n encryptWithDek,\n} from \"./symmetric\";\n"]}

package/internal/crypto/keying/index.d.ts CHANGED Viewed

@@ -15,6 +15,8 @@ export { type DocumentPurgeAccessEventBody, normalizeDocumentPurgeAccessEventBod
 export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent, verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
+export { verifyPrincipalPolicyCurrentMutation } from "./principalPolicyCurrentMutation.js";
+export { verifyPrincipalPolicyCurrentSuccessor } from "./principalPolicyCurrentSuccessor.js";
 export type { PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, } from "./principalPolicyExternalAuthorityTypes.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
 export type { PrincipalHistoryIndexNode } from "./principalPolicyHistoryIndex.js";

package/internal/crypto/keying/index.js CHANGED Viewed

@@ -15,6 +15,8 @@ export { normalizeDocumentPurgeAccessEventBody, verifyDocumentPurgeEvent, } from
 export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
+export { verifyPrincipalPolicyCurrentMutation } from "./principalPolicyCurrentMutation.js";
+export { verifyPrincipalPolicyCurrentSuccessor } from "./principalPolicyCurrentSuccessor.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
 export { createPrincipalHistoryIndexProof, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "./principalPolicyHistoryIndex.js";
 export { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from "./principalPolicyHistoryPage.js";

package/internal/crypto/keying/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;~~AAKlC~~,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n assertSealedContainerKekKeyringLength,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n computeContainerKekKeyringHash,\n expectedSealedContainerKekKeyringBytes,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n normalizeContainerKekPredecessorBridge,\n unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n deriveContainerKekWrappingPublicKey,\n unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n type DocumentPurgeAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n type VerifyDocumentPurgeEventInput,\n verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n type PrincipalPolicyCurrent,\n type VerifiedPrincipalPolicyCurrent,\n verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport type {\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n createPrincipalPolicyHistoryVerifier,\n restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n createPrincipalHistoryIndexProof,\n principalHistoryIndexLeaf,\n resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryVerifier,\n VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n selectPrincipalPolicyAuthorization,\n type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n type VerifyTransparencyConsistencyProofInput,\n type VerifyTransparencyInclusionProofInput,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n computeTransparencyMerkleRoot,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAK1F,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n assertSealedContainerKekKeyringLength,\n CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n CONTAINER_KEK_KEYRING_HEADER_BYTES,\n computeContainerKekKeyringHash,\n expectedSealedContainerKekKeyringBytes,\n normalizeContainerKekKeyring,\n openContainerKekKeyring,\n sealContainerKekKeyring,\n verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n computeContainerKekPredecessorBridgeHash,\n createContainerKekPredecessorBridge,\n normalizeContainerKekPredecessorBridge,\n unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n deriveContainerKekWrappingPublicKey,\n unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n type DocumentPurgeAccessEventBody,\n normalizeDocumentPurgeAccessEventBody,\n type VerifyDocumentPurgeEventInput,\n verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n type PrincipalPolicyCurrent,\n type VerifiedPrincipalPolicyCurrent,\n verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport { verifyPrincipalPolicyCurrentMutation } from \"./principalPolicyCurrentMutation\";\nexport { verifyPrincipalPolicyCurrentSuccessor } from \"./principalPolicyCurrentSuccessor\";\nexport type {\n PrincipalPolicyExternalAuthority,\n PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n createPrincipalPolicyHistoryVerifier,\n restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n createPrincipalHistoryIndexProof,\n principalHistoryIndexLeaf,\n resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n PrincipalPolicyHistoryInput,\n PrincipalPolicyHistoryPage,\n PrincipalPolicyHistoryProgressOptions,\n PrincipalPolicyHistoryVerifier,\n VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n selectPrincipalPolicyAuthorization,\n type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n PrincipalPolicyTransitionMismatch,\n PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n getPrincipalPolicyTransitionMismatch,\n getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n type VerifyTransparencyConsistencyProofInput,\n type VerifyTransparencyInclusionProofInput,\n verifyTransparencyConsistencyProof,\n verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n computeTransparencyMerkleRoot,\n createTransparencyConsistencyProof,\n createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n isKeyingVerificationCode,\n KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}

package/internal/crypto/keying/principalPolicyCurrent.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import { type VerifiedPrincipalPolicyHistory } from "./principalPolicyHistoryTypes.js";
-import { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
 import type { KeyingVerificationResult } from "./types.js";
 export type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
 /**

package/internal/crypto/keying/principalPolicyCurrent.js CHANGED Viewed

@@ -1,9 +1,9 @@
 import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent } from "./principalPolicyCurrentEvidence.js";
 import { ownVerifiedPrincipalPolicyHistory, } from "./principalPolicyHistoryTypes.js";
 import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
 import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
 import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
-import { makeVerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
 import { runVerifier, throwVerification } from "./shared.js";
 // Adapt owned readonly evidence to the mutable arrays in policy result types.
 function mutableEntry(entry) {
@@ -35,7 +35,7 @@ export function verifyPrincipalPolicyCurrent(input) {
             throwVerification("hash_mismatch", "current principal policy does not match verified history");
         await verifyPrincipalPolicyPayload({ bundle: current });
         await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
-        return makeVerifiedPrincipalPolicyCurrent({
+        return issueVerifiedPrincipalPolicyCurrent({
             principalType: entry.state.principalType,
             principalId: entry.state.principalId,
             version: entry.state.version,
@@ -51,7 +51,7 @@ export function verifyPrincipalPolicyCurrent(input) {
                 version: entry.state.version,
                 stateHash: entry.state.stateHash,
             },
-        });
+        }, history.latestAuthority);
     });
 }
 //# sourceMappingURL=principalPolicyCurrent.js.map

package/internal/crypto/keying/principalPolicyCurrent.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"principalPolicyCurrent.js","sourceRoot":"","sources":["principalPolicyCurrent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EACL,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;~~AAClF~~,OAAO,~~EACL,kCAAkC,GAGnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,~~EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAW1D,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAqC;IACzD,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YAClE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;YAElD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,~~kCAAkC~~,~~CAAC~~;~~YACxC~~,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF,CAAC,CAAC;~~IACL~~,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport {\n ownVerifiedPrincipalPolicyHistory,\n type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport {\n ~~makeVerifiedPrincipalPolicyCurrent,\n type~~ PrincipalPolicyCurrent,\n ~~type~~ VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type {\n KeyingVerificationResult,\n PrincipalPolicyStateChainEntry,\n} from \"./types\";\n\nexport type {\n PrincipalPolicyCurrent,\n VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\n\n// Adapt owned readonly evidence to the mutable arrays in policy result types.\nfunction mutableEntry(entry: PrincipalPolicyStateChainEntry) {\n return {\n state: structuredClone(entry.state),\n projection: entry.projection.map((member) => ({ ...member })),\n grants: entry.grants.map((grant) => ({ ...grant })),\n };\n}\n\n/*\n Authenticate current keying artifacts against a prefix already verified by\n * this runtime. The returned history contains only explicitly retained entries.\n */\nexport function verifyPrincipalPolicyCurrent(input: {\n readonly current: PrincipalPolicyCurrent;\n readonly history: VerifiedPrincipalPolicyHistory;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n return runVerifier(async () => {\n const current = structuredClone(input.current);\n const history = ownVerifiedPrincipalPolicyHistory(input.history);\n const expected = history.currentEntry;\n const retained = history.retainedEntries.map(mutableEntry);\n const entry = await normalizePrincipalPolicyStateChainEntry({\n state: current.currentState,\n projection: current.currentProjection,\n grants: current.currentGrants,\n });\n // The state hash commits the signed header, not its signature bytes. Keep\n // both tied to the accepted entry when validating rows read from storage.\n if (\n !principalPolicyStateMatchesReference(entry.state, expected.state) \|\|\n entry.state.signature !== expected.state.signature\n )\n throwVerification(\n \"hash_mismatch\",\n \"current principal policy does not match verified history\",\n );\n await verifyPrincipalPolicyPayload({ bundle: current });\n await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n return ~~makeVerifiedPrincipalPolicyCurrent~~({\n principalType: entry.state.principalType,\n principalId: entry.state.principalId,\n version: entry.state.version,\n keyEpoch: entry.state.keyEpoch,\n stateHash: entry.state.stateHash,\n state: entry.state,\n projection: entry.projection,\n grants: entry.grants,\n retainedHistory: retained,\n checkpoint: {\n principalType: entry.state.principalType,\n principalId: entry.state.principalId,\n version: entry.state.version,\n stateHash: entry.state.stateHash,\n },\n });\n });\n}\n"]}
1	+ {"version":3,"file":"principalPolicyCurrent.js","sourceRoot":"","sources":["principalPolicyCurrent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAKlF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAW1D,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAqC;IACzD,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAG5C;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YAClE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS;YAElD,iBAAiB,CACf,eAAe,EACf,0DAA0D,CAC3D,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,mCAAmC,CACxC;YACE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;YAC5B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;gBACxC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;gBACpC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;gBAC5B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport { issueVerifiedPrincipalPolicyCurrent } from \"./principalPolicyCurrentEvidence\";\nimport {\n ownVerifiedPrincipalPolicyHistory,\n type VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport type {\n PrincipalPolicyCurrent,\n VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type {\n KeyingVerificationResult,\n PrincipalPolicyStateChainEntry,\n} from \"./types\";\n\nexport type {\n PrincipalPolicyCurrent,\n VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\n\n// Adapt owned readonly evidence to the mutable arrays in policy result types.\nfunction mutableEntry(entry: PrincipalPolicyStateChainEntry) {\n return {\n state: structuredClone(entry.state),\n projection: entry.projection.map((member) => ({ ...member })),\n grants: entry.grants.map((grant) => ({ ...grant })),\n };\n}\n\n/*\n Authenticate current keying artifacts against a prefix already verified by\n * this runtime. The returned history contains only explicitly retained entries.\n */\nexport function verifyPrincipalPolicyCurrent(input: {\n readonly current: PrincipalPolicyCurrent;\n readonly history: VerifiedPrincipalPolicyHistory;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n return runVerifier(async () => {\n const current = structuredClone(input.current);\n const history = ownVerifiedPrincipalPolicyHistory(input.history);\n const expected = history.currentEntry;\n const retained = history.retainedEntries.map(mutableEntry);\n const entry = await normalizePrincipalPolicyStateChainEntry({\n state: current.currentState,\n projection: current.currentProjection,\n grants: current.currentGrants,\n });\n // The state hash commits the signed header, not its signature bytes. Keep\n // both tied to the accepted entry when validating rows read from storage.\n if (\n !principalPolicyStateMatchesReference(entry.state, expected.state) \|\|\n entry.state.signature !== expected.state.signature\n )\n throwVerification(\n \"hash_mismatch\",\n \"current principal policy does not match verified history\",\n );\n await verifyPrincipalPolicyPayload({ bundle: current });\n await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n return issueVerifiedPrincipalPolicyCurrent(\n {\n principalType: entry.state.principalType,\n principalId: entry.state.principalId,\n version: entry.state.version,\n keyEpoch: entry.state.keyEpoch,\n stateHash: entry.state.stateHash,\n state: entry.state,\n projection: entry.projection,\n grants: entry.grants,\n retainedHistory: retained,\n checkpoint: {\n principalType: entry.state.principalType,\n principalId: entry.state.principalId,\n version: entry.state.version,\n stateHash: entry.state.stateHash,\n },\n },\n history.latestAuthority,\n );\n });\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentEvidence.js ADDED Viewed

@@ -0,0 +1,16 @@
+import { makeVerifiedPrincipalPolicyCurrent, } from "./principalPolicyTypes.js";
+import { throwVerification } from "./shared.js";
+const issued = new WeakMap();
+/** Keep the verified predecessor and historical authority cursor private. */
+export function issueVerifiedPrincipalPolicyCurrent(value, latestAuthority) {
+    const result = makeVerifiedPrincipalPolicyCurrent(value);
+    issued.set(result, structuredClone({ policy: value, latestAuthority }));
+    return result;
+}
+export function ownVerifiedPrincipalPolicyCurrent(policy) {
+    const snapshot = issued.get(policy);
+    if (!snapshot)
+        throwVerification("invalid_shape", "current policy must come from a local verifier");
+    return structuredClone(snapshot);
+}
+//# sourceMappingURL=principalPolicyCurrentEvidence.js.map

package/internal/crypto/keying/principalPolicyCurrentEvidence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyCurrentEvidence.js","sourceRoot":"","sources":["principalPolicyCurrentEvidence.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,MAAM,MAAM,GAAG,IAAI,OAAO,EAMvB,CAAC;AAEJ,6EAA6E;AAC7E,MAAM,UAAU,mCAAmC,CACjD,KAAmB,EACnB,eAAuD;IAEvD,MAAM,MAAM,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ;QACX,iBAAiB,CACf,eAAe,EACf,gDAAgD,CACjD,CAAC;IACJ,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { PrincipalStateExternalAuthority } from \"../principalState\";\nimport {\n makeVerifiedPrincipalPolicyCurrent,\n type VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { throwVerification } from \"./shared\";\n\ntype CurrentValue = Parameters<typeof makeVerifiedPrincipalPolicyCurrent>[0];\nconst issued = new WeakMap<\n VerifiedPrincipalPolicyCurrent,\n {\n policy: CurrentValue;\n latestAuthority: PrincipalStateExternalAuthority | null;\n }\n>();\n\n/** Keep the verified predecessor and historical authority cursor private. */\nexport function issueVerifiedPrincipalPolicyCurrent(\n value: CurrentValue,\n latestAuthority: PrincipalStateExternalAuthority | null,\n): VerifiedPrincipalPolicyCurrent {\n const result = makeVerifiedPrincipalPolicyCurrent(value);\n issued.set(result, structuredClone({ policy: value, latestAuthority }));\n return result;\n}\n\nexport function ownVerifiedPrincipalPolicyCurrent(\n policy: VerifiedPrincipalPolicyCurrent,\n) {\n const snapshot = issued.get(policy);\n if (!snapshot)\n throwVerification(\n \"invalid_shape\",\n \"current policy must come from a local verifier\",\n );\n return structuredClone(snapshot);\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentMutation.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import type { PrincipalPolicyExternalAuthority } from "./principalPolicyExternalAuthorityTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { KeyingVerificationResult } from "./types.js";
+/** Bind a group's current artifacts and next signer to privately issued evidence. */
+export declare function verifyPrincipalPolicyCurrentMutation(input: {
+    readonly current: PrincipalPolicyCurrent;
+    readonly policy: VerifiedPrincipalPolicyCurrent;
+    readonly signerUserId: string;
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
+}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>>;

package/internal/crypto/keying/principalPolicyCurrentMutation.js ADDED Viewed

@@ -0,0 +1,51 @@
+import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent, ownVerifiedPrincipalPolicyCurrent, } from "./principalPolicyCurrentEvidence.js";
+import { createPrincipalPolicyExternalAuthorityVerifier, externalAuthorityIncludesAdminSigner, verifyPrincipalPolicyExternalAuthorityProgress, } from "./principalPolicyExternalAuthority.js";
+import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
+import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
+import { principalPolicyStateMatchesReference } from "./principalPolicyReference.js";
+import { runVerifier, throwVerification } from "./shared.js";
+/** Bind a group's current artifacts and next signer to privately issued evidence. */
+export function verifyPrincipalPolicyCurrentMutation(input) {
+    return runVerifier(async () => {
+        const prior = ownVerifiedPrincipalPolicyCurrent(input.policy);
+        const current = structuredClone(input.current);
+        const externalAuthority = structuredClone(input.externalAuthority);
+        const signerUserId = input.signerUserId;
+        const entry = await normalizePrincipalPolicyStateChainEntry({
+            state: current.currentState,
+            projection: current.currentProjection,
+            grants: current.currentGrants,
+        });
+        if (!principalPolicyStateMatchesReference(entry.state, prior.policy.state) ||
+            entry.state.signature !== prior.policy.state.signature)
+            throwVerification("hash_mismatch", "current artifacts differ from issued policy evidence");
+        if (entry.state.principalType !== "group")
+            throwVerification("object_mismatch", "group mutation requires a group policy");
+        await verifyPrincipalPolicyPayload({ bundle: current });
+        await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
+        if (!entry.projection.some((member) => member.userId === signerUserId && member.role === "admin")) {
+            const authority = createPrincipalPolicyExternalAuthorityVerifier({
+                authority: externalAuthority,
+            });
+            authority.latestReference = prior.latestAuthority;
+            const next = {
+                state: {
+                    signerUserId,
+                    externalAuthority: externalAuthority?.currentHead ?? null,
+                },
+            };
+            verifyPrincipalPolicyExternalAuthorityProgress({
+                entry: next,
+                verifier: authority,
+            });
+            if (!externalAuthorityIncludesAdminSigner({
+                entry: next,
+                verifier: authority,
+            }))
+                throwVerification("unauthorized", "group mutation signer is not an authority admin");
+        }
+        return issueVerifiedPrincipalPolicyCurrent(prior.policy, prior.latestAuthority);
+    });
+}
+//# sourceMappingURL=principalPolicyCurrentMutation.js.map

package/internal/crypto/keying/principalPolicyCurrentMutation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyCurrentMutation.js","sourceRoot":"","sources":["principalPolicyCurrentMutation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8CAA8C,EAC9C,oCAAoC,EACpC,8CAA8C,GAC/C,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAKlF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG1D,qFAAqF;AACrF,MAAM,UAAU,oCAAoC,CAAC,KAKpD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,KAAK,GAAG,iCAAiC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,iBAAiB,GAAG,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,uCAAuC,CAAC;YAC1D,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QACH,IACE,CAAC,oCAAoC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACtE,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS;YAEtD,iBAAiB,CACf,eAAe,EACf,sDAAsD,CACvD,CAAC;QACJ,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,OAAO;YACvC,iBAAiB,CACf,iBAAiB,EACjB,wCAAwC,CACzC,CAAC;QACJ,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CACpB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CACtE,EACD,CAAC;YACD,MAAM,SAAS,GAAG,8CAA8C,CAAC;gBAC/D,SAAS,EAAE,iBAAiB;aAC7B,CAAC,CAAC;YACH,SAAS,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;YAClD,MAAM,IAAI,GAAG;gBACX,KAAK,EAAE;oBACL,YAAY;oBACZ,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,IAAI,IAAI;iBAC1D;aACF,CAAC;YACF,8CAA8C,CAAC;gBAC7C,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,SAAS;aACpB,CAAC,CAAC;YACH,IACE,CAAC,oCAAoC,CAAC;gBACpC,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,SAAS;aACpB,CAAC;gBAEF,iBAAiB,CACf,cAAc,EACd,iDAAiD,CAClD,CAAC;QACN,CAAC;QACD,OAAO,mCAAmC,CACxC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,eAAe,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport {\n issueVerifiedPrincipalPolicyCurrent,\n ownVerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrentEvidence\";\nimport {\n createPrincipalPolicyExternalAuthorityVerifier,\n externalAuthorityIncludesAdminSigner,\n verifyPrincipalPolicyExternalAuthorityProgress,\n} from \"./principalPolicyExternalAuthority\";\nimport type { PrincipalPolicyExternalAuthority } from \"./principalPolicyExternalAuthorityTypes\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport { principalPolicyStateMatchesReference } from \"./principalPolicyReference\";\nimport type {\n PrincipalPolicyCurrent,\n VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier, throwVerification } from \"./shared\";\nimport type { KeyingVerificationResult } from \"./types\";\n\n/** Bind a group's current artifacts and next signer to privately issued evidence. */\nexport function verifyPrincipalPolicyCurrentMutation(input: {\n readonly current: PrincipalPolicyCurrent;\n readonly policy: VerifiedPrincipalPolicyCurrent;\n readonly signerUserId: string;\n readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n return runVerifier(async () => {\n const prior = ownVerifiedPrincipalPolicyCurrent(input.policy);\n const current = structuredClone(input.current);\n const externalAuthority = structuredClone(input.externalAuthority);\n const signerUserId = input.signerUserId;\n const entry = await normalizePrincipalPolicyStateChainEntry({\n state: current.currentState,\n projection: current.currentProjection,\n grants: current.currentGrants,\n });\n if (\n !principalPolicyStateMatchesReference(entry.state, prior.policy.state) ||\n entry.state.signature !== prior.policy.state.signature\n )\n throwVerification(\n \"hash_mismatch\",\n \"current artifacts differ from issued policy evidence\",\n );\n if (entry.state.principalType !== \"group\")\n throwVerification(\n \"object_mismatch\",\n \"group mutation requires a group policy\",\n );\n await verifyPrincipalPolicyPayload({ bundle: current });\n await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n if (\n !entry.projection.some(\n (member) => member.userId === signerUserId && member.role === \"admin\",\n )\n ) {\n const authority = createPrincipalPolicyExternalAuthorityVerifier({\n authority: externalAuthority,\n });\n authority.latestReference = prior.latestAuthority;\n const next = {\n state: {\n signerUserId,\n externalAuthority: externalAuthority?.currentHead ?? null,\n },\n };\n verifyPrincipalPolicyExternalAuthorityProgress({\n entry: next,\n verifier: authority,\n });\n if (\n !externalAuthorityIncludesAdminSigner({\n entry: next,\n verifier: authority,\n })\n )\n throwVerification(\n \"unauthorized\",\n \"group mutation signer is not an authority admin\",\n );\n }\n return issueVerifiedPrincipalPolicyCurrent(\n prior.policy,\n prior.latestAuthority,\n );\n });\n}\n"]}

package/internal/crypto/keying/principalPolicyCurrentSuccessor.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import type { PrincipalPolicyExternalAuthority } from "./principalPolicyExternalAuthorityTypes.js";
+import type { PrincipalPolicyCurrent, VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { KeyingVerificationResult, PrincipalPolicySignerPublicKey } from "./types.js";
+/** Verify one successor of locally verified current evidence, retaining only that pair. */
+export declare function verifyPrincipalPolicyCurrentSuccessor(input: {
+    readonly previous: VerifiedPrincipalPolicyCurrent;
+    readonly current: PrincipalPolicyCurrent;
+    readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];
+    readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;
+}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>>;

package/internal/crypto/keying/principalPolicyCurrentSuccessor.js ADDED Viewed

@@ -0,0 +1,60 @@
+import { normalizePrincipalPolicyStateChainEntry } from "./principalPolicyChainEntry.js";
+import { issueVerifiedPrincipalPolicyCurrent, ownVerifiedPrincipalPolicyCurrent, } from "./principalPolicyCurrentEvidence.js";
+import { verifyPrincipalHistoryPage } from "./principalPolicyHistoryPage.js";
+import { verifyPrincipalPolicyMemberEnvelopes } from "./principalPolicyMemberEnvelopes.js";
+import { verifyPrincipalPolicyPayload } from "./principalPolicyPayload.js";
+import { runVerifier } from "./shared.js";
+/** Verify one successor of locally verified current evidence, retaining only that pair. */
+export function verifyPrincipalPolicyCurrentSuccessor(input) {
+    return runVerifier(async () => {
+        const prior = ownVerifiedPrincipalPolicyCurrent(input.previous);
+        const current = structuredClone(input.current);
+        const signerPublicKeys = structuredClone(input.signerPublicKeys);
+        const externalAuthority = structuredClone(input.externalAuthority);
+        const previous = await normalizePrincipalPolicyStateChainEntry({
+            state: prior.policy.state,
+            projection: prior.policy.projection,
+            grants: prior.policy.grants,
+        });
+        const checked = await verifyPrincipalHistoryPage({
+            principalId: prior.policy.principalId,
+            principalType: prior.policy.principalType,
+            previous,
+            latestAuthority: prior.latestAuthority,
+            references: [],
+            checkpoint: null,
+            page: {
+                entries: [
+                    {
+                        state: current.currentState,
+                        projection: current.currentProjection,
+                        grants: current.currentGrants,
+                    },
+                ],
+                signerPublicKeys,
+                ...(externalAuthority ? { externalAuthority } : {}),
+            },
+        });
+        await verifyPrincipalPolicyPayload({ bundle: current });
+        await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });
+        const { state, projection, grants } = checked.last;
+        return issueVerifiedPrincipalPolicyCurrent({
+            principalId: state.principalId,
+            principalType: state.principalType,
+            version: state.version,
+            keyEpoch: state.keyEpoch,
+            stateHash: state.stateHash,
+            state,
+            projection,
+            grants,
+            retainedHistory: [previous, checked.last],
+            checkpoint: {
+                principalId: state.principalId,
+                principalType: state.principalType,
+                version: state.version,
+                stateHash: state.stateHash,
+            },
+        }, checked.latestAuthority);
+    });
+}
+//# sourceMappingURL=principalPolicyCurrentSuccessor.js.map

package/internal/crypto/keying/principalPolicyCurrentSuccessor.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"principalPolicyCurrentSuccessor.js","sourceRoot":"","sources":["principalPolicyCurrentSuccessor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EACL,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAKxE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAMvC,2FAA2F;AAC3F,MAAM,UAAU,qCAAqC,CAAC,KAKrD;IACC,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,KAAK,GAAG,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,iBAAiB,GAAG,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,uCAAuC,CAAC;YAC7D,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;YAC/C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;YACzC,QAAQ;YACR,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE;gBACJ,OAAO,EAAE;oBACP;wBACE,KAAK,EAAE,OAAO,CAAC,YAAY;wBAC3B,UAAU,EAAE,OAAO,CAAC,iBAAiB;wBACrC,MAAM,EAAE,OAAO,CAAC,aAAa;qBAC9B;iBACF;gBACD,gBAAgB;gBAChB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,MAAM,oCAAoC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QACnD,OAAO,mCAAmC,CACxC;YACE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,UAAU;YACV,MAAM;YACN,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;YACzC,UAAU,EAAE;gBACV,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { normalizePrincipalPolicyStateChainEntry } from \"./principalPolicyChainEntry\";\nimport {\n issueVerifiedPrincipalPolicyCurrent,\n ownVerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrentEvidence\";\nimport type { PrincipalPolicyExternalAuthority } from \"./principalPolicyExternalAuthorityTypes\";\nimport { verifyPrincipalHistoryPage } from \"./principalPolicyHistoryPage\";\nimport { verifyPrincipalPolicyMemberEnvelopes } from \"./principalPolicyMemberEnvelopes\";\nimport { verifyPrincipalPolicyPayload } from \"./principalPolicyPayload\";\nimport type {\n PrincipalPolicyCurrent,\n VerifiedPrincipalPolicyCurrent,\n} from \"./principalPolicyTypes\";\nimport { runVerifier } from \"./shared\";\nimport type {\n KeyingVerificationResult,\n PrincipalPolicySignerPublicKey,\n} from \"./types\";\n\n/** Verify one successor of locally verified current evidence, retaining only that pair. */\nexport function verifyPrincipalPolicyCurrentSuccessor(input: {\n readonly previous: VerifiedPrincipalPolicyCurrent;\n readonly current: PrincipalPolicyCurrent;\n readonly signerPublicKeys: readonly PrincipalPolicySignerPublicKey[];\n readonly externalAuthority?: PrincipalPolicyExternalAuthority | undefined;\n}): Promise<KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>> {\n return runVerifier(async () => {\n const prior = ownVerifiedPrincipalPolicyCurrent(input.previous);\n const current = structuredClone(input.current);\n const signerPublicKeys = structuredClone(input.signerPublicKeys);\n const externalAuthority = structuredClone(input.externalAuthority);\n const previous = await normalizePrincipalPolicyStateChainEntry({\n state: prior.policy.state,\n projection: prior.policy.projection,\n grants: prior.policy.grants,\n });\n const checked = await verifyPrincipalHistoryPage({\n principalId: prior.policy.principalId,\n principalType: prior.policy.principalType,\n previous,\n latestAuthority: prior.latestAuthority,\n references: [],\n checkpoint: null,\n page: {\n entries: [\n {\n state: current.currentState,\n projection: current.currentProjection,\n grants: current.currentGrants,\n },\n ],\n signerPublicKeys,\n ...(externalAuthority ? { externalAuthority } : {}),\n },\n });\n await verifyPrincipalPolicyPayload({ bundle: current });\n await verifyPrincipalPolicyMemberEnvelopes({ bundle: current });\n const { state, projection, grants } = checked.last;\n return issueVerifiedPrincipalPolicyCurrent(\n {\n principalId: state.principalId,\n principalType: state.principalType,\n version: state.version,\n keyEpoch: state.keyEpoch,\n stateHash: state.stateHash,\n state,\n projection,\n grants,\n retainedHistory: [previous, checked.last],\n checkpoint: {\n principalId: state.principalId,\n principalType: state.principalType,\n version: state.version,\n stateHash: state.stateHash,\n },\n },\n checked.latestAuthority,\n );\n });\n}\n"]}

package/internal/crypto/keying/principalPolicyHistory.js CHANGED Viewed

@@ -118,7 +118,10 @@ class PrincipalPolicyHistoryVerifierImpl {
                     stateHash: state.stateHash,
                 },
             });
-            return { ok: true, value: makeVerifiedPrincipalPolicyHistory(owned) };
+            return {
+                ok: true,
+                value: makeVerifiedPrincipalPolicyHistory(owned, this.#latestAuthority),
+            };
         }
         catch (error) {
             return toVerificationResult(error);