@tearleads/client-sdk 0.1.16 → 0.1.18

package/internal/api-client/principalPolicyRequests.d.ts

@@ -1,4 +1,4 @@
-import type { CommitOrganizationGroupPolicyRequest, OrganizationPrincipalPolicyRequest } from "../validators/request/index.js";
+import type { CommitOrganizationGroupPolicyRequest, CreateOrganizationGroupWithPolicyRequest, DeleteOrganizationGroupRequest, OrganizationPrincipalPolicyRequest } from "../validators/request/index.js";
 import type { PrincipalPolicyBundleResponse } from "../validators/response/index.js";
 import type { BoundedCache } from "./ApiCache.js";
 import type { ApiRequestRuntime } from "./apiRequestRuntime.js";
@@ -550,6 +550,271 @@ export declare class PrincipalPolicyRequests {
             version: number;
         };
     }>>;
+    createResult(organizationId: string, input: CreateOrganizationGroupWithPolicyRequest, options?: RequestResultOptions): Promise<import("./types.js").RequestResult<{
+        group: {
+            createdAt: string;
+            currentState: {
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                stateHash: string;
+                version: number;
+            } | null;
+            groupId: string;
+            isBuiltin: boolean;
+            organizationId: string;
+        };
+        organizationPolicy: {
+            containerMutations: {
+                createdAt: string;
+                manifestHead: {
+                    epoch: number;
+                    manifestHash: string;
+                };
+                organizationId: string;
+                parentId: string | null;
+                referencedPrincipalHeads: {
+                    principalType: "group";
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    stateHash: string;
+                    version: number;
+                }[];
+                updatedAt: string;
+                accessManifest: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                };
+                containerId: string;
+                containerKek: {
+                    accessManifestHash: string;
+                    containerId: string;
+                    containerKeyEpoch: number;
+                    containerKeyEpochId: string;
+                    containerManifestHistory: {
+                        event: {
+                            body: unknown;
+                            event: Record<string, unknown>;
+                            eventHash: string;
+                        };
+                        manifest: Record<string, unknown>;
+                        manifestHash: string;
+                        state: Record<string, unknown>;
+                    }[];
+                    keyEpoch: Record<string, unknown>;
+                    keyEpochHash: string;
+                    keyring: {
+                        containerId: string;
+                        containerKeyEpochId: string;
+                        iv: string;
+                        sealed: string;
+                        sealingSuite: string;
+                        version: number;
+                    } | null;
+                    keyTargetHash: string;
+                    parentContainerKeyEpochId: string | null;
+                    recipientTargets: Record<string, unknown>[];
+                    wraps: Record<string, unknown>[];
+                };
+                systemSlot?: string | null | undefined;
+            }[];
+            currentGrants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            currentMemberEnvelopes: {
+                envelopes: {
+                    kemCipherText: string;
+                    memberKeyFingerprint: string;
+                    userId: string;
+                    wrappedKey: string;
+                }[];
+                epoch: number;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentPayload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentProjection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            currentState: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        };
+    }>>;
+    deleteResult(organizationId: string, groupId: string, input: DeleteOrganizationGroupRequest, options?: RequestResultOptions): Promise<import("./types.js").RequestResult<{
+        deleted: true;
+        groupId: string;
+        organizationPolicy: {
+            containerMutations: {
+                createdAt: string;
+                manifestHead: {
+                    epoch: number;
+                    manifestHash: string;
+                };
+                organizationId: string;
+                parentId: string | null;
+                referencedPrincipalHeads: {
+                    principalType: "group";
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    stateHash: string;
+                    version: number;
+                }[];
+                updatedAt: string;
+                accessManifest: {
+                    event: {
+                        body: unknown;
+                        event: Record<string, unknown>;
+                        eventHash: string;
+                    };
+                    manifest: Record<string, unknown>;
+                    manifestHash: string;
+                    state: Record<string, unknown>;
+                };
+                containerId: string;
+                containerKek: {
+                    accessManifestHash: string;
+                    containerId: string;
+                    containerKeyEpoch: number;
+                    containerKeyEpochId: string;
+                    containerManifestHistory: {
+                        event: {
+                            body: unknown;
+                            event: Record<string, unknown>;
+                            eventHash: string;
+                        };
+                        manifest: Record<string, unknown>;
+                        manifestHash: string;
+                        state: Record<string, unknown>;
+                    }[];
+                    keyEpoch: Record<string, unknown>;
+                    keyEpochHash: string;
+                    keyring: {
+                        containerId: string;
+                        containerKeyEpochId: string;
+                        iv: string;
+                        sealed: string;
+                        sealingSuite: string;
+                        version: number;
+                    } | null;
+                    keyTargetHash: string;
+                    parentContainerKeyEpochId: string | null;
+                    recipientTargets: Record<string, unknown>[];
+                    wraps: Record<string, unknown>[];
+                };
+                systemSlot?: string | null | undefined;
+            }[];
+            currentGrants: {
+                accessLevel: "admin" | "read" | "write";
+                containerId: string;
+            }[];
+            currentMemberEnvelopes: {
+                envelopes: {
+                    kemCipherText: string;
+                    memberKeyFingerprint: string;
+                    userId: string;
+                    wrappedKey: string;
+                }[];
+                epoch: number;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentPayload: {
+                cipherSuite: "aes-256-gcm";
+                ciphertext: string;
+                ciphertextHash: string;
+                createdAt: string;
+                principalId: string;
+                principalType: "group" | "organization";
+                stateHash: string;
+            };
+            currentProjection: {
+                role: "member" | "admin";
+                userId: string;
+            }[];
+            currentState: {
+                createdAt: string;
+                encapsulationPublicKey: string;
+                externalAuthority: {
+                    keyEpoch: number;
+                    keyFingerprint: string;
+                    principalId: string;
+                    principalType: "group";
+                    stateHash: string;
+                    version: number;
+                } | null;
+                grantCount: number;
+                grantRoot: string;
+                keyEpoch: number;
+                keyFingerprint: string;
+                memberCount: number;
+                memberEnvelopesRoot: string;
+                membershipMode: "projection";
+                membershipRoot: string;
+                payloadCiphertextHash: string;
+                prevStateHash: string | null;
+                principalId: string;
+                principalType: "group" | "organization";
+                projectionRoot: string;
+                signature: string;
+                signedAt: string;
+                signerUserId: string;
+                signerUserKeyFingerprint: string;
+                stateHash: string;
+                version: number;
+            };
+        };
+        organizationId: string;
+    }>>;
+    private groupMutation;
     commitResult(organizationId: string, groupId: string, input: CommitOrganizationGroupPolicyRequest, options?: RequestResultOptions): Promise<import("./types.js").RequestResult<{
         groupPolicy: {
             containerMutations: {

package/internal/api-client/principalPolicyRequests.js

@@ -1,8 +1,10 @@
-import { commitOrganizationGroupPolicyOperation, putPrincipalPolicyOperation, } from "../validators/operation/index.js";
+import { commitOrganizationGroupPolicyOperation, createOrganizationGroupOperation, deleteOrganizationGroupOperation, putPrincipalPolicyOperation, } from "../validators/operation/index.js";
 import { principalHistoryRequest } from "./principalHistoryRequest.js";
 import { collectPrincipalPolicyPages, readPrincipalPolicyPages, } from "./principalPolicyPages.js";
 import { readProjectionPolicyHistoryPages } from "./projectionPolicyHistoryPages.js";
 import { dedupedRequest } from "./requestInternals.js";
+import { createOrganizationGroup } from "./routes/organizations/createGroup.js";
+import { deleteOrganizationGroup } from "./routes/organizations/deleteGroup.js";
 import { commitOrganizationGroupPolicy, putPrincipalPolicy, } from "./routes/principals/policy.js";
 export class PrincipalPolicyRequests {
     runtime;
@@ -45,6 +47,46 @@ export class PrincipalPolicyRequests {
             operation: putPrincipalPolicyOperation,
         }).finally(() => this.cache.delete(key));
     }
+    createResult(organizationId, input, options = {}) {
+        return this.groupMutation(organizationId, input.groupId, () => principalHistoryRequest(this.runtime, {
+            path: createOrganizationGroup.path(organizationId),
+            validator: createOrganizationGroup.isResponse,
+            method: createOrganizationGroup.method,
+            body: JSON.stringify(input),
+            options: {
+                expectedPaymentRequiredOrganizationId: organizationId,
+                ...options,
+            },
+            operation: createOrganizationGroupOperation,
+        }));
+    }
+    deleteResult(organizationId, groupId, input, options = {}) {
+        return this.groupMutation(organizationId, groupId, () => principalHistoryRequest(this.runtime, {
+            path: deleteOrganizationGroup.path(organizationId, groupId),
+            validator: deleteOrganizationGroup.isResponse,
+            method: deleteOrganizationGroup.method,
+            body: JSON.stringify(input),
+            options: {
+                expectedPaymentRequiredOrganizationId: organizationId,
+                ...options,
+            },
+            operation: deleteOrganizationGroupOperation,
+        }));
+    }
+    async groupMutation(organizationId, groupId, request) {
+        const groupKey = JSON.stringify(["group", groupId]);
+        const organizationKey = JSON.stringify(["organization", organizationId]);
+        this.cache.delete(groupKey);
+        this.cache.delete(organizationKey);
+        try {
+            return await request();
+        }
+        finally {
+            this.cache.delete(groupKey);
+            this.cache.delete(organizationKey);
+            this.clearWriterProjectionCaches();
+        }
+    }
     async commitResult(organizationId, groupId, input, options = {}) {
         const groupKey = JSON.stringify(["group", groupId]);
         const organizationKey = JSON.stringify(["organization", organizationId]);

package/internal/api-client/principalPolicyRequests.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalPolicyRequests.js","sourceRoot":"","sources":["principalPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAQzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,2BAA2B,EAE3B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,OAAO,uBAAuB;IAEf;IACA;IAGA;IALnB,YACmB,OAA0B,EAC1B,KAEhB,EACgB,2BAAuC;QAJvC,YAAO,GAAP,OAAO,CAAmB;QAC1B,UAAK,GAAL,KAAK,CAErB;QACgB,gCAA2B,GAA3B,2BAA2B,CAAY;IACvD,CAAC;IAEJ,WAAW,CACT,MAA8D,EAC9D,UAAkE,EAAE;QAEpE,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CACH,aAAuC,EACvC,WAAmB,EACnB,UAA0C,EAAE;QAE5C,OAAO,wBAAwB,CAC7B,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,GAAG,CACD,aAAuC,EACvC,WAAmB,EACnB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,2BAA2B,CACzB,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,OAAO,EAAE;YACX,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CAAC,GAAG,IAAsD;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC/B,CAAC;IACJ,CAAC;IAED,SAAS,CACP,aAA6B,EAC7B,WAAmB,EACnB,KAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YAC3C,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;YACzD,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,WAAW;gBAClD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,cAAsB,EACtB,OAAe,EACf,KAA2C,EAC3C,UAAgC,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;gBACjE,SAAS,EAAE,6BAA6B,CAAC,UAAU;gBACnD,MAAM,EAAE,6BAA6B,CAAC,MAAM;gBAC5C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC3B,OAAO,EAAE;oBACP,qCAAqC,EAAE,cAAc;oBACrD,GAAG,OAAO;iBACX;gBACD,SAAS,EAAE,sCAAsC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;CACF","sourcesContent":["import {\n  commitOrganizationGroupPolicyOperation,\n  putPrincipalPolicyOperation,\n} from \"@tearleads/validators/operation\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  OrganizationPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { BoundedCache } from \"./ApiCache\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport {\n  collectPrincipalPolicyPages,\n  type PrincipalPolicyPageReadOptions,\n  readPrincipalPolicyPages,\n} from \"./principalPolicyPages\";\nimport { readProjectionPolicyHistoryPages } from \"./projectionPolicyHistoryPages\";\nimport { dedupedRequest } from \"./requestInternals\";\nimport {\n  commitOrganizationGroupPolicy,\n  putPrincipalPolicy,\n} from \"./routes/principals/policy\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport class PrincipalPolicyRequests {\n  constructor(\n    private readonly runtime: ApiRequestRuntime,\n    private readonly cache: BoundedCache<\n      Promise<PrincipalPolicyBundleResponse | null>\n    >,\n    private readonly clearWriterProjectionCaches: () => void,\n  ) {}\n\n  publicPages(\n    source: Parameters<typeof readProjectionPolicyHistoryPages>[1],\n    options: Parameters<typeof readProjectionPolicyHistoryPages>[2] = {},\n  ) {\n    return readProjectionPolicyHistoryPages(this.runtime, source, options);\n  }\n\n  pages(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: PrincipalPolicyPageReadOptions = {},\n  ) {\n    return readPrincipalPolicyPages(\n      this.runtime,\n      principalType,\n      principalId,\n      options,\n    );\n  }\n\n  get(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: RequestResultOptions = {},\n  ) {\n    const request = () =>\n      collectPrincipalPolicyPages(\n        this.runtime,\n        principalType,\n        principalId,\n        options,\n      );\n    const key = JSON.stringify([principalType, principalId]);\n    // Cancellation, reporting and renewal preferences belong to their caller.\n    return Object.keys(options).length > 0\n      ? request()\n      : dedupedRequest(this.cache, key, request);\n  }\n\n  put(...args: Parameters<PrincipalPolicyRequests[\"putResult\"]>) {\n    return this.putResult(...args).then((result) =>\n      result.ok ? result.data : null,\n    );\n  }\n\n  putResult(\n    principalType: \"organization\",\n    principalId: string,\n    input: OrganizationPrincipalPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const key = JSON.stringify([principalType, principalId]);\n    this.cache.delete(key);\n    return principalHistoryRequest(this.runtime, {\n      path: putPrincipalPolicy.path(principalType, principalId),\n      validator: putPrincipalPolicy.isResponse,\n      method: putPrincipalPolicy.method,\n      body: JSON.stringify(input),\n      options: {\n        expectedPaymentRequiredOrganizationId: principalId,\n        ...options,\n      },\n      operation: putPrincipalPolicyOperation,\n    }).finally(() => this.cache.delete(key));\n  }\n\n  async commitResult(\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await principalHistoryRequest(this.runtime, {\n        path: commitOrganizationGroupPolicy.path(organizationId, groupId),\n        validator: commitOrganizationGroupPolicy.isResponse,\n        method: commitOrganizationGroupPolicy.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: commitOrganizationGroupPolicyOperation,\n      });\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n}\n"]}
+{"version":3,"file":"principalPolicyRequests.js","sourceRoot":"","sources":["principalPolicyRequests.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,gCAAgC,EAChC,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,2BAA2B,EAE3B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,OAAO,uBAAuB;IAEf;IACA;IAGA;IALnB,YACmB,OAA0B,EAC1B,KAEhB,EACgB,2BAAuC;QAJvC,YAAO,GAAP,OAAO,CAAmB;QAC1B,UAAK,GAAL,KAAK,CAErB;QACgB,gCAA2B,GAA3B,2BAA2B,CAAY;IACvD,CAAC;IAEJ,WAAW,CACT,MAA8D,EAC9D,UAAkE,EAAE;QAEpE,OAAO,gCAAgC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CACH,aAAuC,EACvC,WAAmB,EACnB,UAA0C,EAAE;QAE5C,OAAO,wBAAwB,CAC7B,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;IACJ,CAAC;IAED,GAAG,CACD,aAAuC,EACvC,WAAmB,EACnB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,2BAA2B,CACzB,IAAI,CAAC,OAAO,EACZ,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,0EAA0E;QAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,OAAO,EAAE;YACX,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,GAAG,CAAC,GAAG,IAAsD;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC/B,CAAC;IACJ,CAAC;IAED,SAAS,CACP,aAA6B,EAC7B,WAAmB,EACnB,KAAyC,EACzC,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YAC3C,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC;YACzD,SAAS,EAAE,kBAAkB,CAAC,UAAU;YACxC,MAAM,EAAE,kBAAkB,CAAC,MAAM;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,WAAW;gBAClD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CACV,cAAsB,EACtB,KAA+C,EAC/C,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC5D,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC;YAClD,SAAS,EAAE,uBAAuB,CAAC,UAAU;YAC7C,MAAM,EAAE,uBAAuB,CAAC,MAAM;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,cAAc;gBACrD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,YAAY,CACV,cAAsB,EACtB,OAAe,EACf,KAAqC,EACrC,UAAgC,EAAE;QAElC,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CACtD,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YAC3D,SAAS,EAAE,uBAAuB,CAAC,UAAU;YAC7C,MAAM,EAAE,uBAAuB,CAAC,MAAM;YACtC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC3B,OAAO,EAAE;gBACP,qCAAqC,EAAE,cAAc;gBACrD,GAAG,OAAO;aACX;YACD,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,cAAsB,EACtB,OAAe,EACf,OAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,cAAsB,EACtB,OAAe,EACf,KAA2C,EAC3C,UAAgC,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,6BAA6B,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;gBACjE,SAAS,EAAE,6BAA6B,CAAC,UAAU;gBACnD,MAAM,EAAE,6BAA6B,CAAC,MAAM;gBAC5C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC3B,OAAO,EAAE;oBACP,qCAAqC,EAAE,cAAc;oBACrD,GAAG,OAAO;iBACX;gBACD,SAAS,EAAE,sCAAsC;aAClD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;CACF","sourcesContent":["import {\n  commitOrganizationGroupPolicyOperation,\n  createOrganizationGroupOperation,\n  deleteOrganizationGroupOperation,\n  putPrincipalPolicyOperation,\n} from \"@tearleads/validators/operation\";\nimport type {\n  CommitOrganizationGroupPolicyRequest,\n  CreateOrganizationGroupWithPolicyRequest,\n  DeleteOrganizationGroupRequest,\n  OrganizationPrincipalPolicyRequest,\n} from \"@tearleads/validators/request\";\nimport type { PrincipalPolicyBundleResponse } from \"@tearleads/validators/response\";\nimport type { BoundedCache } from \"./ApiCache\";\nimport type { ApiRequestRuntime } from \"./apiRequestRuntime\";\nimport { principalHistoryRequest } from \"./principalHistoryRequest\";\nimport {\n  collectPrincipalPolicyPages,\n  type PrincipalPolicyPageReadOptions,\n  readPrincipalPolicyPages,\n} from \"./principalPolicyPages\";\nimport { readProjectionPolicyHistoryPages } from \"./projectionPolicyHistoryPages\";\nimport { dedupedRequest } from \"./requestInternals\";\nimport { createOrganizationGroup } from \"./routes/organizations/createGroup\";\nimport { deleteOrganizationGroup } from \"./routes/organizations/deleteGroup\";\nimport {\n  commitOrganizationGroupPolicy,\n  putPrincipalPolicy,\n} from \"./routes/principals/policy\";\nimport type { RequestResultOptions } from \"./types\";\n\nexport class PrincipalPolicyRequests {\n  constructor(\n    private readonly runtime: ApiRequestRuntime,\n    private readonly cache: BoundedCache<\n      Promise<PrincipalPolicyBundleResponse | null>\n    >,\n    private readonly clearWriterProjectionCaches: () => void,\n  ) {}\n\n  publicPages(\n    source: Parameters<typeof readProjectionPolicyHistoryPages>[1],\n    options: Parameters<typeof readProjectionPolicyHistoryPages>[2] = {},\n  ) {\n    return readProjectionPolicyHistoryPages(this.runtime, source, options);\n  }\n\n  pages(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: PrincipalPolicyPageReadOptions = {},\n  ) {\n    return readPrincipalPolicyPages(\n      this.runtime,\n      principalType,\n      principalId,\n      options,\n    );\n  }\n\n  get(\n    principalType: \"group\" | \"organization\",\n    principalId: string,\n    options: RequestResultOptions = {},\n  ) {\n    const request = () =>\n      collectPrincipalPolicyPages(\n        this.runtime,\n        principalType,\n        principalId,\n        options,\n      );\n    const key = JSON.stringify([principalType, principalId]);\n    // Cancellation, reporting and renewal preferences belong to their caller.\n    return Object.keys(options).length > 0\n      ? request()\n      : dedupedRequest(this.cache, key, request);\n  }\n\n  put(...args: Parameters<PrincipalPolicyRequests[\"putResult\"]>) {\n    return this.putResult(...args).then((result) =>\n      result.ok ? result.data : null,\n    );\n  }\n\n  putResult(\n    principalType: \"organization\",\n    principalId: string,\n    input: OrganizationPrincipalPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const key = JSON.stringify([principalType, principalId]);\n    this.cache.delete(key);\n    return principalHistoryRequest(this.runtime, {\n      path: putPrincipalPolicy.path(principalType, principalId),\n      validator: putPrincipalPolicy.isResponse,\n      method: putPrincipalPolicy.method,\n      body: JSON.stringify(input),\n      options: {\n        expectedPaymentRequiredOrganizationId: principalId,\n        ...options,\n      },\n      operation: putPrincipalPolicyOperation,\n    }).finally(() => this.cache.delete(key));\n  }\n\n  createResult(\n    organizationId: string,\n    input: CreateOrganizationGroupWithPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    return this.groupMutation(organizationId, input.groupId, () =>\n      principalHistoryRequest(this.runtime, {\n        path: createOrganizationGroup.path(organizationId),\n        validator: createOrganizationGroup.isResponse,\n        method: createOrganizationGroup.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: createOrganizationGroupOperation,\n      }),\n    );\n  }\n\n  deleteResult(\n    organizationId: string,\n    groupId: string,\n    input: DeleteOrganizationGroupRequest,\n    options: RequestResultOptions = {},\n  ) {\n    return this.groupMutation(organizationId, groupId, () =>\n      principalHistoryRequest(this.runtime, {\n        path: deleteOrganizationGroup.path(organizationId, groupId),\n        validator: deleteOrganizationGroup.isResponse,\n        method: deleteOrganizationGroup.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: deleteOrganizationGroupOperation,\n      }),\n    );\n  }\n\n  private async groupMutation<T>(\n    organizationId: string,\n    groupId: string,\n    request: () => Promise<T>,\n  ): Promise<T> {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await request();\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n\n  async commitResult(\n    organizationId: string,\n    groupId: string,\n    input: CommitOrganizationGroupPolicyRequest,\n    options: RequestResultOptions = {},\n  ) {\n    const groupKey = JSON.stringify([\"group\", groupId]);\n    const organizationKey = JSON.stringify([\"organization\", organizationId]);\n    this.cache.delete(groupKey);\n    this.cache.delete(organizationKey);\n    try {\n      return await principalHistoryRequest(this.runtime, {\n        path: commitOrganizationGroupPolicy.path(organizationId, groupId),\n        validator: commitOrganizationGroupPolicy.isResponse,\n        method: commitOrganizationGroupPolicy.method,\n        body: JSON.stringify(input),\n        options: {\n          expectedPaymentRequiredOrganizationId: organizationId,\n          ...options,\n        },\n        operation: commitOrganizationGroupPolicyOperation,\n      });\n    } finally {\n      this.cache.delete(groupKey);\n      this.cache.delete(organizationKey);\n      this.clearWriterProjectionCaches();\n    }\n  }\n}\n"]}

package/internal/crypto/index.d.ts

@@ -20,7 +20,7 @@ export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, type IdentitySeedPhraseKeyPairs, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, type IncrementalSha256, } from "./incrementalSha256.js";
 export type { AccessEvent, AccessEventType, AccessManifest, AccessManifestCheckpoint, AccessManifestTransparencyLeaf, AccessObjectKind, AnyVerifiedAccessManifest, AnyVerifiedPrincipalPolicy, AttachmentAccessEventBody, AttachmentBindAccessEventBody, AttachmentDetachAccessEventBody, BlobAccessManifest, BlobContentKeyTarget, ContainerAccessEventBody, ContainerAccessKeyState, ContainerAccessLevel, ContainerAccessManifest, ContainerAccessManifestState, ContainerAccessStructural, ContainerCreateAccessEventBody, ContainerDirectGrant, ContainerGrantAccessEventBody, ContainerGrantPrincipalHead, ContainerGrantSubjectType, ContainerKekKeyring, ContainerKekKeyringEntry, ContainerKekPredecessorBridge, ContainerKekRecipientTarget, ContainerKekTarget, ContainerKeyEpoch, ContainerKeyWrap, ContainerMoveAccessEventBody, ContainerReciteAccessEventBody, ContainerRekeyAccessEventBody, ContainerRevokeAccessEventBody, ContainerUserRecipientKey, ContentObjectKind, ContentRecordEncryptionSuite, ContentRecordNonceDomain, DeriveBlobKekTargetsInput, DeriveContainerKekRecipientTargetsInput, DeriveDocumentKekTargetsInput, DocumentAccessEventBody, DocumentContentKeyTarget, DocumentContentRecordMetadataInput, DocumentLinkAccessEventBody, DocumentLinkSetManifestState, DocumentLinkSetStructural, DocumentPurgeAccessEventBody, DocumentUnlinkAccessEventBody, IdentityStateCheckpoint, IdentityStateHead, IdentityStateTransparencyLeaf, KekRecipientKind, KeyingCanonicalJson, KeyingHashDomain, KeyingLocalCheckpointStore, KeyingVerificationCode, KeyingVerificationResult, ManagedPrincipalKind, PrincipalHistoryIndexNode, PrincipalPolicyAuthorization, PrincipalPolicyBundle, PrincipalPolicyCheckpoint, PrincipalPolicyCurrent, PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, PrincipalPolicyHistoryInput, PrincipalPolicyHistoryPage, PrincipalPolicyHistoryProgressOptions, PrincipalPolicyHistoryReferenceProof, PrincipalPolicyHistoryVerifier, PrincipalPolicyMemberEnvelopes, PrincipalPolicyPayload, PrincipalPolicySignedState, PrincipalPolicySignerPublicKey, PrincipalPolicySnapshot, PrincipalPolicyStateChainEntry, PrincipalPolicyTransitionMismatch, PrincipalPolicyTransitionMismatchCode, PrincipalPolicyTransparencyLeaf, ReferencedPrincipalHead, SignedTransparencyTreeHead, TransparencyConsistencyProof, TransparencyInclusionProof, TransparencyLeaf, TransparencyLeafKind, TransparencyTreeCheckpoint, UnsignedAccessEvent, UnsignedTransparencyTreeHead, UnsignedWriteHeader, VerifiedAccessEvent, VerifiedAccessManifest, VerifiedAccessManifestCheckpointEvidence, VerifiedAccessManifestSnapshot, VerifiedAttachmentBinding, VerifiedAttachmentDetach, VerifiedBlobKekTargets, VerifiedContainerAccessManifest, VerifiedContainerKekState, VerifiedContainerParentEdge, VerifiedDocumentKekTargets, VerifiedDocumentLinkSetManifest, VerifiedDocumentLinkSetSnapshot, VerifiedDocumentLinkSetStateEvidence, VerifiedIdentityState, VerifiedPrincipalPolicy, VerifiedPrincipalPolicyCurrent, VerifiedPrincipalPolicyHistory, VerifiedPrincipalPolicySelection, VerifiedPrincipalPolicySnapshot, VerifiedTransparencyProof, VerifiedTransparencyTreeHead, VerifiedWriteHeader, VerifyAccessEventInput, VerifyAccessManifestInput, VerifyAttachmentBindingEventInput, VerifyAttachmentDetachEventInput, VerifyContainerAccessManifestInput, VerifyContainerKekStateInput, VerifyContainerParentEdgeInput, VerifyDocumentLinkSetManifestInput, VerifyDocumentPurgeEventInput, VerifyIdentityStateCheckpointInput, VerifyPrincipalPolicyBundleInput, VerifyPrincipalPolicySnapshotInput, VerifySignedTransparencyTreeHeadInput, VerifyTransparencyConsistencyProofInput, VerifyTransparencyInclusionProofInput, VerifyTransparencyProofInput, VerifyWriteHeaderInput, WriteHeader, } from "./keying.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, selectPrincipalPolicyCurrentPredecessorReferences, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, type VerifiedOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js

@@ -14,7 +14,7 @@ export { decryptGroupMetadata, encodeBuiltinGroupMetadata, encryptGroupMetadata,
 export { bytesToHex, hexToBytes } from "./hex.js";
 export { createIdentitySeedPhrase, createIdentitySeedPhraseFromEntropy, generateIdentityKeyPairsFromSeedPhrase, IDENTITY_SEED_PHRASE_DERIVATION_SUITE, IDENTITY_SEED_PHRASE_ENTROPY_BYTES, IDENTITY_SEED_PHRASE_STRENGTH_BITS, IDENTITY_SEED_PHRASE_WORDS, normalizeIdentitySeedPhrase, validateIdentitySeedPhrase, } from "./identitySeedPhrase.js";
 export { createIncrementalSha256, } from "./incrementalSha256.js";
-export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
+export { ACCESS_MANIFEST_VERIFICATION_REVISION, accessManifestCheckpointFromManifest, accessManifestTransparencyLeaf, assertSealedContainerKekKeyringLength, BLOB_CONTENT_KEY_WRAP_SUITE, CONTAINER_KEK_KEYRING_ENTRY_BYTES, CONTAINER_KEK_KEYRING_FORMAT_VERSION, CONTAINER_KEK_KEYRING_HEADER_BYTES, CONTAINER_KEK_KEYRING_SEAL_SUITE, CONTAINER_KEK_MATERIAL_ID_PREFIX, CONTAINER_KEK_PARENT_WRAP_SUITE, CONTAINER_KEK_PREDECESSOR_WRAP_SUITE, CONTAINER_KEK_USER_WRAP_SUITE, CONTENT_RECORD_ENCRYPTION_SUITE, computeAccessEventBodyHash, computeAccessEventHash, computeAccessManifestHash, computeBlobAccessManifestHash, computeBlobContentKeyTargetHash, computeContainerAccessKeyTargetHash, computeContainerAccessStructuralHash, computeContainerDirectGrantRoot, computeContainerKekKeyringHash, computeContainerKekMaterialId, computeContainerKekPredecessorBridgeHash, computeContainerKekRecipientTargetHash, computeContainerKeyEpochHash, computeContentRecordNonceDomainHash, computeDocumentContentKeyTargetHash, computeDocumentContentRecordCiphertextHash, computeDocumentContentRecordMetadataHash, computeDocumentContentRecordPlaintextHash, computeDocumentLinkSetGrantRoot, computeDocumentLinkSetKeyTargetHash, computeDocumentLinkSetStructuralHash, computeKeyingDomainHash, computeTransparencyLeafHash, computeTransparencyMerkleRoot, computeWriteHeaderHash, createContainerKekPredecessorBridge, createPrincipalHistoryIndexProof, createPrincipalPolicyHistoryVerifier, createTransparencyConsistencyProof, createTransparencyInclusionProof, DOCUMENT_CONTENT_KEY_WRAP_SUITE, deriveBlobKekTargets, deriveContainerAccessManifest, deriveContainerKekRecipientTargets, deriveContainerKekWrappingPublicKey, deriveDocumentKekTargets, deriveDocumentLinkSetManifest, derivePrincipalRecipientKeyEpochId, documentContentRecordMetadata, expectedSealedContainerKekKeyringBytes, getPrincipalPolicyTransitionMismatch, getPrincipalPolicyTransitionMismatchReason, identityStateTransparencyLeaf, isContainerKekMaterialId, isKeyingVerificationCode, KEYING_VERIFICATION_CODES, KeyingVerificationError, MAX_CONTAINER_KEY_EPOCH, MAX_CONTAINER_RECITATION_EPOCH, makeVerifiedAccessEvent, makeVerifiedBlobKekTargets, makeVerifiedContainerAccessManifest, makeVerifiedContainerKekState, makeVerifiedDocumentKekTargets, makeVerifiedDocumentLinkSetManifest, makeVerifiedDocumentLinkSetSnapshot, makeVerifiedPrincipalPolicy, normalizeAttachmentAccessEventBody, normalizeContainerAccessEventBody, normalizeContainerKekKeyring, normalizeContainerKekPredecessorBridge, normalizeDocumentAccessEventBody, normalizeDocumentPurgeAccessEventBody, openContainerKekKeyring, PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT, PRINCIPAL_HISTORY_VERIFICATION_REVISION, principalHistoryIndexLeaf, principalPolicyMatchesReference, principalPolicyTransparencyLeaf, resolveContainerPathUserAccessLevel, resolveContainerStatePathUserAccessLevel, resolveHistoricalContainerPathUserAccessLevel, resolvePrincipalHistoryIndexProof, restorePrincipalPolicyHistoryVerifier, sealContainerKekKeyring, selectPrincipalPolicyAuthorization, selectPrincipalPolicyCurrentPredecessorReferences, serializeKeyingCanonicalJson, signAccessEvent, signTransparencyTreeHead, signWriteHeader, unwrapContainerKekParentWrap, unwrapContainerKekPredecessorBridge, verifyAccessManifest, verifyAccessManifestLocalCheckpoint, verifyAccessManifestSnapshot, verifyAttachmentBindingEvent, verifyAttachmentDetachEvent, verifyContainerAccessManifest, verifyContainerKekKeyringEntry, verifyContainerKekState, verifyContainerParentEdge, verifyDocumentLinkSetManifest, verifyDocumentLinkSetSnapshot, verifyDocumentPurgeEvent, verifyIdentityStateCheckpoint, verifyPrincipalPolicyBundle, verifyPrincipalPolicyBundleAgainstHistory, verifyPrincipalPolicyCheckpoint, verifyPrincipalPolicyCurrent, verifyPrincipalPolicyCurrentMutation, verifyPrincipalPolicyCurrentSuccessor, verifyPrincipalPolicyHistoryReferences, verifyPrincipalPolicySnapshot, verifySignedAccessEvent, verifySignedTransparencyTreeHead, verifyTransparencyConsistencyProof, verifyTransparencyInclusionProof, verifyTransparencyProof, verifyWriteHeader, } from "./keying.js";
 export { organizationReplacementAuthorizationPayload, organizationReplacementSigningBytes, signOrganizationReplacementAuthorization, verifyOrganizationReplacementAuthorization, } from "./organizationReplacement.js";
 export { computePrincipalContainerGrantRoot, normalizePrincipalContainerGrants, } from "./principalContainerGrants.js";
 export { computePrincipalMemberEnvelopesRoot, normalizePrincipalStateMemberEnvelopes, PrincipalMemberEnvelopeValidationError, } from "./principalMemberEnvelopes.js";

package/internal/crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,oCAAoC,EACpC,qCAAqC,EACrC,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n  BlobEnvelopeHeaderRecord,\n  BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n  MAX_BLOB_ENVELOPE_HEADER_BYTES,\n  parseBlobEnvelopeV2,\n  parseBlobEnvelopeV2Header,\n  readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n  BLOB_CHUNK_SIZE_BYTES,\n  BLOB_ENCRYPTED_BYTES_FORMAT,\n  BLOB_ENCRYPTED_BYTES_VERSION,\n  BLOB_ENVELOPE_MAGIC_BYTES,\n  BLOB_ENVELOPE_PREFIX_BYTES,\n  blobChunkPlaintextByteLength,\n  computeBlobChunkCount,\n  computeBlobEncryptedByteLength,\n  deriveBlobChunkIv,\n  encodeBlobEnvelopeV2Header,\n  joinBlobPartBytes,\n  MAX_BLOB_CHUNK_COUNT,\n  normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n  AUTH_CHALLENGE_BYTES,\n  AUTH_CHALLENGE_HEX_LENGTH,\n  authChallengeSigningBytes,\n  CHALLENGE_TTL_SECONDS,\n  canonicalAuthOrigin,\n  generateChallenge,\n} from \"./challenge\";\nexport type {\n  ContentKeyEnvelopeKind,\n  ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n  ContentKeyEnvelopeError,\n  decodeContentKeyEnvelope,\n  unwrapContentKey,\n  wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n  generateKemKeyPair,\n  generateKemSeedAndKeyPair,\n  ML_KEM1024_CIPHERTEXT_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  ML_KEM1024_SECRET_KEY_BYTES,\n  ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n  decryptGroupMetadata,\n  encodeBuiltinGroupMetadata,\n  encryptGroupMetadata,\n  type GroupMetadata,\n  type GroupMetadataKey,\n  readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n  createIdentitySeedPhrase,\n  createIdentitySeedPhraseFromEntropy,\n  generateIdentityKeyPairsFromSeedPhrase,\n  IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n  IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n  IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n  IDENTITY_SEED_PHRASE_WORDS,\n  type IdentitySeedPhraseKeyPairs,\n  normalizeIdentitySeedPhrase,\n  validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n  createIncrementalSha256,\n  type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n  AccessEvent,\n  AccessEventType,\n  AccessManifest,\n  AccessManifestCheckpoint,\n  AccessManifestTransparencyLeaf,\n  AccessObjectKind,\n  AnyVerifiedAccessManifest,\n  AnyVerifiedPrincipalPolicy,\n  AttachmentAccessEventBody,\n  AttachmentBindAccessEventBody,\n  AttachmentDetachAccessEventBody,\n  BlobAccessManifest,\n  BlobContentKeyTarget,\n  ContainerAccessEventBody,\n  ContainerAccessKeyState,\n  ContainerAccessLevel,\n  ContainerAccessManifest,\n  ContainerAccessManifestState,\n  ContainerAccessStructural,\n  ContainerCreateAccessEventBody,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerGrantPrincipalHead,\n  ContainerGrantSubjectType,\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerKekPredecessorBridge,\n  ContainerKekRecipientTarget,\n  ContainerKekTarget,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerMoveAccessEventBody,\n  ContainerReciteAccessEventBody,\n  ContainerRekeyAccessEventBody,\n  ContainerRevokeAccessEventBody,\n  ContainerUserRecipientKey,\n  ContentObjectKind,\n  ContentRecordEncryptionSuite,\n  ContentRecordNonceDomain,\n  DeriveBlobKekTargetsInput,\n  DeriveContainerKekRecipientTargetsInput,\n  DeriveDocumentKekTargetsInput,\n  DocumentAccessEventBody,\n  DocumentContentKeyTarget,\n  DocumentContentRecordMetadataInput,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentLinkSetStructural,\n  DocumentPurgeAccessEventBody,\n  DocumentUnlinkAccessEventBody,\n  IdentityStateCheckpoint,\n  IdentityStateHead,\n  IdentityStateTransparencyLeaf,\n  KekRecipientKind,\n  KeyingCanonicalJson,\n  KeyingHashDomain,\n  KeyingLocalCheckpointStore,\n  KeyingVerificationCode,\n  KeyingVerificationResult,\n  ManagedPrincipalKind,\n  PrincipalHistoryIndexNode,\n  PrincipalPolicyAuthorization,\n  PrincipalPolicyBundle,\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyCurrent,\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryReferenceProof,\n  PrincipalPolicyHistoryVerifier,\n  PrincipalPolicyMemberEnvelopes,\n  PrincipalPolicyPayload,\n  PrincipalPolicySignedState,\n  PrincipalPolicySignerPublicKey,\n  PrincipalPolicySnapshot,\n  PrincipalPolicyStateChainEntry,\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n  PrincipalPolicyTransparencyLeaf,\n  ReferencedPrincipalHead,\n  SignedTransparencyTreeHead,\n  TransparencyConsistencyProof,\n  TransparencyInclusionProof,\n  TransparencyLeaf,\n  TransparencyLeafKind,\n  TransparencyTreeCheckpoint,\n  UnsignedAccessEvent,\n  UnsignedTransparencyTreeHead,\n  UnsignedWriteHeader,\n  VerifiedAccessEvent,\n  VerifiedAccessManifest,\n  VerifiedAccessManifestCheckpointEvidence,\n  VerifiedAccessManifestSnapshot,\n  VerifiedAttachmentBinding,\n  VerifiedAttachmentDetach,\n  VerifiedBlobKekTargets,\n  VerifiedContainerAccessManifest,\n  VerifiedContainerKekState,\n  VerifiedContainerParentEdge,\n  VerifiedDocumentKekTargets,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedDocumentLinkSetSnapshot,\n  VerifiedDocumentLinkSetStateEvidence,\n  VerifiedIdentityState,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyHistory,\n  VerifiedPrincipalPolicySelection,\n  VerifiedPrincipalPolicySnapshot,\n  VerifiedTransparencyProof,\n  VerifiedTransparencyTreeHead,\n  VerifiedWriteHeader,\n  VerifyAccessEventInput,\n  VerifyAccessManifestInput,\n  VerifyAttachmentBindingEventInput,\n  VerifyAttachmentDetachEventInput,\n  VerifyContainerAccessManifestInput,\n  VerifyContainerKekStateInput,\n  VerifyContainerParentEdgeInput,\n  VerifyDocumentLinkSetManifestInput,\n  VerifyDocumentPurgeEventInput,\n  VerifyIdentityStateCheckpointInput,\n  VerifyPrincipalPolicyBundleInput,\n  VerifyPrincipalPolicySnapshotInput,\n  VerifySignedTransparencyTreeHeadInput,\n  VerifyTransparencyConsistencyProofInput,\n  VerifyTransparencyInclusionProofInput,\n  VerifyTransparencyProofInput,\n  VerifyWriteHeaderInput,\n  WriteHeader,\n} from \"./keying\";\nexport {\n  ACCESS_MANIFEST_VERIFICATION_REVISION,\n  accessManifestCheckpointFromManifest,\n  accessManifestTransparencyLeaf,\n  assertSealedContainerKekKeyringLength,\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  CONTAINER_KEK_KEYRING_SEAL_SUITE,\n  CONTAINER_KEK_MATERIAL_ID_PREFIX,\n  CONTAINER_KEK_PARENT_WRAP_SUITE,\n  CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n  CONTAINER_KEK_USER_WRAP_SUITE,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeAccessEventBodyHash,\n  computeAccessEventHash,\n  computeAccessManifestHash,\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n  computeContainerAccessKeyTargetHash,\n  computeContainerAccessStructuralHash,\n  computeContainerDirectGrantRoot,\n  computeContainerKekKeyringHash,\n  computeContainerKekMaterialId,\n  computeContainerKekPredecessorBridgeHash,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentKeyTargetHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  computeDocumentContentRecordPlaintextHash,\n  computeDocumentLinkSetGrantRoot,\n  computeDocumentLinkSetKeyTargetHash,\n  computeDocumentLinkSetStructuralHash,\n  computeKeyingDomainHash,\n  computeTransparencyLeafHash,\n  computeTransparencyMerkleRoot,\n  computeWriteHeaderHash,\n  createContainerKekPredecessorBridge,\n  createPrincipalHistoryIndexProof,\n  createPrincipalPolicyHistoryVerifier,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  deriveBlobKekTargets,\n  deriveContainerAccessManifest,\n  deriveContainerKekRecipientTargets,\n  deriveContainerKekWrappingPublicKey,\n  deriveDocumentKekTargets,\n  deriveDocumentLinkSetManifest,\n  derivePrincipalRecipientKeyEpochId,\n  documentContentRecordMetadata,\n  expectedSealedContainerKekKeyringBytes,\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n  identityStateTransparencyLeaf,\n  isContainerKekMaterialId,\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n  KeyingVerificationError,\n  MAX_CONTAINER_KEY_EPOCH,\n  MAX_CONTAINER_RECITATION_EPOCH,\n  makeVerifiedAccessEvent,\n  makeVerifiedBlobKekTargets,\n  makeVerifiedContainerAccessManifest,\n  makeVerifiedContainerKekState,\n  makeVerifiedDocumentKekTargets,\n  makeVerifiedDocumentLinkSetManifest,\n  makeVerifiedDocumentLinkSetSnapshot,\n  makeVerifiedPrincipalPolicy,\n  normalizeAttachmentAccessEventBody,\n  normalizeContainerAccessEventBody,\n  normalizeContainerKekKeyring,\n  normalizeContainerKekPredecessorBridge,\n  normalizeDocumentAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  openContainerKekKeyring,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n  principalHistoryIndexLeaf,\n  principalPolicyMatchesReference,\n  principalPolicyTransparencyLeaf,\n  resolveContainerPathUserAccessLevel,\n  resolveContainerStatePathUserAccessLevel,\n  resolveHistoricalContainerPathUserAccessLevel,\n  resolvePrincipalHistoryIndexProof,\n  restorePrincipalPolicyHistoryVerifier,\n  sealContainerKekKeyring,\n  selectPrincipalPolicyAuthorization,\n  serializeKeyingCanonicalJson,\n  signAccessEvent,\n  signTransparencyTreeHead,\n  signWriteHeader,\n  unwrapContainerKekParentWrap,\n  unwrapContainerKekPredecessorBridge,\n  verifyAccessManifest,\n  verifyAccessManifestLocalCheckpoint,\n  verifyAccessManifestSnapshot,\n  verifyAttachmentBindingEvent,\n  verifyAttachmentDetachEvent,\n  verifyContainerAccessManifest,\n  verifyContainerKekKeyringEntry,\n  verifyContainerKekState,\n  verifyContainerParentEdge,\n  verifyDocumentLinkSetManifest,\n  verifyDocumentLinkSetSnapshot,\n  verifyDocumentPurgeEvent,\n  verifyIdentityStateCheckpoint,\n  verifyPrincipalPolicyBundle,\n  verifyPrincipalPolicyBundleAgainstHistory,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrentMutation,\n  verifyPrincipalPolicyCurrentSuccessor,\n  verifyPrincipalPolicyHistoryReferences,\n  verifyPrincipalPolicySnapshot,\n  verifySignedAccessEvent,\n  verifySignedTransparencyTreeHead,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n  verifyTransparencyProof,\n  verifyWriteHeader,\n} from \"./keying\";\nexport {\n  organizationReplacementAuthorizationPayload,\n  organizationReplacementSigningBytes,\n  signOrganizationReplacementAuthorization,\n  type VerifiedOrganizationReplacementAuthorization,\n  verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n  computePrincipalContainerGrantRoot,\n  normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n  computePrincipalMemberEnvelopesRoot,\n  normalizePrincipalStateMemberEnvelopes,\n  PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n  PrincipalPolicyValidationError,\n  throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n  ManagedRecipientPrincipalType,\n  PrincipalContainerGrant,\n  PrincipalContainerGrantAccessLevel,\n  PrincipalProjectionMember,\n  PrincipalProjectionRole,\n  PrincipalStateExternalAuthority,\n  PrincipalStateHeaderInput,\n  PrincipalStateMember,\n  PrincipalStateMemberEnvelope,\n  PrincipalStateMembershipMode,\n  PrincipalStatePayloadCipherSuite,\n  PrincipalStateSigningInput,\n  SignedPrincipalState,\n  UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n  buildPrincipalStateSigningInput,\n  computePrincipalMembershipRoot,\n  computePrincipalProjectionRoot,\n  computePrincipalStateHash,\n  computePrincipalStatePayloadCiphertextHash,\n  derivePrincipalProjectionMembers,\n  isManagedRecipientPrincipalType,\n  isPrincipalProjectionRole,\n  normalizePrincipalProjectionMembers,\n  normalizePrincipalStateMembers,\n  serializeUnsignedPrincipalState,\n  signPrincipalState,\n} from \"./principalState\";\nexport {\n  verifySignedPrincipalState,\n  verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n  captureProjectionHistory,\n  type HistoryProjection,\n  omitProjectionHistory,\n  type RetainedProjectionHistory,\n  restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n  generateSigningKeyPair,\n  generateSigningSeedAndKeyPair,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SECRET_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n  AES_256_KEY_BYTES,\n  AES_GCM_IV_BYTES,\n  AES_GCM_TAG_BYTES,\n  assertAesGcmIv,\n  createAesGcmIv,\n  decryptWithDek,\n  encryptWithDek,\n} from \"./symmetric\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EAGpB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,mCAAmC,EACnC,sCAAsC,EACtC,qCAAqC,EACrC,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAE1B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAuI7B,OAAO,EACL,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,wCAAwC,EACxC,yCAAyC,EACzC,+BAA+B,EAC/B,mCAAmC,EACnC,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,mCAAmC,EACnC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,gCAAgC,EAChC,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,EAC7B,sCAAsC,EACtC,oCAAoC,EACpC,0CAA0C,EAC1C,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,mCAAmC,EACnC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,mCAAmC,EACnC,2BAA2B,EAC3B,kCAAkC,EAClC,iCAAiC,EACjC,4BAA4B,EAC5B,sCAAsC,EACtC,gCAAgC,EAChC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,wCAAwC,EACxC,6CAA6C,EAC7C,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,kCAAkC,EAClC,iDAAiD,EACjD,4BAA4B,EAC5B,eAAe,EACf,wBAAwB,EACxB,eAAe,EACf,4BAA4B,EAC5B,mCAAmC,EACnC,oBAAoB,EACpB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,yCAAyC,EACzC,+BAA+B,EAC/B,4BAA4B,EAC5B,oCAAoC,EACpC,qCAAqC,EACrC,sCAAsC,EACtC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,gCAAgC,EAChC,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACnC,wCAAwC,EAExC,0CAA0C,GAC3C,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAiB1C,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,8BAA8B,EAC9B,yBAAyB,EACzB,0CAA0C,EAC1C,gCAAgC,EAChC,+BAA+B,EAC/B,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wBAAwB,EAExB,qBAAqB,EAErB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC","sourcesContent":["export { BlobEnvelopeError } from \"./blobEnvelopeError\";\nexport type {\n  BlobEnvelopeHeaderRecord,\n  BlobEnvelopeRecord,\n} from \"./blobEnvelopeReader\";\nexport {\n  MAX_BLOB_ENVELOPE_HEADER_BYTES,\n  parseBlobEnvelopeV2,\n  parseBlobEnvelopeV2Header,\n  readBlobEnvelopeHeaderByteLength,\n} from \"./blobEnvelopeReader\";\nexport type { BlobEnvelopeV2Header } from \"./blobEnvelopeV2\";\nexport {\n  BLOB_CHUNK_SIZE_BYTES,\n  BLOB_ENCRYPTED_BYTES_FORMAT,\n  BLOB_ENCRYPTED_BYTES_VERSION,\n  BLOB_ENVELOPE_MAGIC_BYTES,\n  BLOB_ENVELOPE_PREFIX_BYTES,\n  blobChunkPlaintextByteLength,\n  computeBlobChunkCount,\n  computeBlobEncryptedByteLength,\n  deriveBlobChunkIv,\n  encodeBlobEnvelopeV2Header,\n  joinBlobPartBytes,\n  MAX_BLOB_CHUNK_COUNT,\n  normalizeBlobChunkSize,\n} from \"./blobEnvelopeV2\";\nexport { compareCanonicalStrings } from \"./canonicalOrdering\";\nexport {\n  AUTH_CHALLENGE_BYTES,\n  AUTH_CHALLENGE_HEX_LENGTH,\n  authChallengeSigningBytes,\n  CHALLENGE_TTL_SECONDS,\n  canonicalAuthOrigin,\n  generateChallenge,\n} from \"./challenge\";\nexport type {\n  ContentKeyEnvelopeKind,\n  ContentKeyWrapBinding,\n} from \"./contentKeyEnvelope\";\nexport {\n  ContentKeyEnvelopeError,\n  decodeContentKeyEnvelope,\n  unwrapContentKey,\n  wrapContentKey,\n} from \"./contentKeyEnvelope\";\nexport { decryptAsRecipient } from \"./encapsulation/decryptAsRecipient\";\nexport { encryptForRecipients } from \"./encapsulation/encryptForRecipients\";\nexport type { EncapsulationKeyPair } from \"./encapsulation/generateKeyPair\";\nexport {\n  generateKemKeyPair,\n  generateKemSeedAndKeyPair,\n  ML_KEM1024_CIPHERTEXT_BYTES,\n  ML_KEM1024_PUBLIC_KEY_BYTES,\n  ML_KEM1024_SECRET_KEY_BYTES,\n  ML_KEM1024_SEED_BYTES,\n} from \"./encapsulation/generateKeyPair\";\nexport type { EncryptedEnvelope, RecipientEntry } from \"./encapsulation/types\";\nexport { unwrapDek } from \"./encapsulation/unwrapDek\";\nexport { wrapDekForRecipients } from \"./encapsulation/wrapDek\";\nexport { toFingerprint } from \"./fingerprint\";\nexport {\n  decryptGroupMetadata,\n  encodeBuiltinGroupMetadata,\n  encryptGroupMetadata,\n  type GroupMetadata,\n  type GroupMetadataKey,\n  readGroupMetadata,\n} from \"./groupMetadata\";\nexport { bytesToHex, hexToBytes } from \"./hex\";\nexport {\n  createIdentitySeedPhrase,\n  createIdentitySeedPhraseFromEntropy,\n  generateIdentityKeyPairsFromSeedPhrase,\n  IDENTITY_SEED_PHRASE_DERIVATION_SUITE,\n  IDENTITY_SEED_PHRASE_ENTROPY_BYTES,\n  IDENTITY_SEED_PHRASE_STRENGTH_BITS,\n  IDENTITY_SEED_PHRASE_WORDS,\n  type IdentitySeedPhraseKeyPairs,\n  normalizeIdentitySeedPhrase,\n  validateIdentitySeedPhrase,\n} from \"./identitySeedPhrase\";\nexport {\n  createIncrementalSha256,\n  type IncrementalSha256,\n} from \"./incrementalSha256\";\nexport type {\n  AccessEvent,\n  AccessEventType,\n  AccessManifest,\n  AccessManifestCheckpoint,\n  AccessManifestTransparencyLeaf,\n  AccessObjectKind,\n  AnyVerifiedAccessManifest,\n  AnyVerifiedPrincipalPolicy,\n  AttachmentAccessEventBody,\n  AttachmentBindAccessEventBody,\n  AttachmentDetachAccessEventBody,\n  BlobAccessManifest,\n  BlobContentKeyTarget,\n  ContainerAccessEventBody,\n  ContainerAccessKeyState,\n  ContainerAccessLevel,\n  ContainerAccessManifest,\n  ContainerAccessManifestState,\n  ContainerAccessStructural,\n  ContainerCreateAccessEventBody,\n  ContainerDirectGrant,\n  ContainerGrantAccessEventBody,\n  ContainerGrantPrincipalHead,\n  ContainerGrantSubjectType,\n  ContainerKekKeyring,\n  ContainerKekKeyringEntry,\n  ContainerKekPredecessorBridge,\n  ContainerKekRecipientTarget,\n  ContainerKekTarget,\n  ContainerKeyEpoch,\n  ContainerKeyWrap,\n  ContainerMoveAccessEventBody,\n  ContainerReciteAccessEventBody,\n  ContainerRekeyAccessEventBody,\n  ContainerRevokeAccessEventBody,\n  ContainerUserRecipientKey,\n  ContentObjectKind,\n  ContentRecordEncryptionSuite,\n  ContentRecordNonceDomain,\n  DeriveBlobKekTargetsInput,\n  DeriveContainerKekRecipientTargetsInput,\n  DeriveDocumentKekTargetsInput,\n  DocumentAccessEventBody,\n  DocumentContentKeyTarget,\n  DocumentContentRecordMetadataInput,\n  DocumentLinkAccessEventBody,\n  DocumentLinkSetManifestState,\n  DocumentLinkSetStructural,\n  DocumentPurgeAccessEventBody,\n  DocumentUnlinkAccessEventBody,\n  IdentityStateCheckpoint,\n  IdentityStateHead,\n  IdentityStateTransparencyLeaf,\n  KekRecipientKind,\n  KeyingCanonicalJson,\n  KeyingHashDomain,\n  KeyingLocalCheckpointStore,\n  KeyingVerificationCode,\n  KeyingVerificationResult,\n  ManagedPrincipalKind,\n  PrincipalHistoryIndexNode,\n  PrincipalPolicyAuthorization,\n  PrincipalPolicyBundle,\n  PrincipalPolicyCheckpoint,\n  PrincipalPolicyCurrent,\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryReferenceProof,\n  PrincipalPolicyHistoryVerifier,\n  PrincipalPolicyMemberEnvelopes,\n  PrincipalPolicyPayload,\n  PrincipalPolicySignedState,\n  PrincipalPolicySignerPublicKey,\n  PrincipalPolicySnapshot,\n  PrincipalPolicyStateChainEntry,\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n  PrincipalPolicyTransparencyLeaf,\n  ReferencedPrincipalHead,\n  SignedTransparencyTreeHead,\n  TransparencyConsistencyProof,\n  TransparencyInclusionProof,\n  TransparencyLeaf,\n  TransparencyLeafKind,\n  TransparencyTreeCheckpoint,\n  UnsignedAccessEvent,\n  UnsignedTransparencyTreeHead,\n  UnsignedWriteHeader,\n  VerifiedAccessEvent,\n  VerifiedAccessManifest,\n  VerifiedAccessManifestCheckpointEvidence,\n  VerifiedAccessManifestSnapshot,\n  VerifiedAttachmentBinding,\n  VerifiedAttachmentDetach,\n  VerifiedBlobKekTargets,\n  VerifiedContainerAccessManifest,\n  VerifiedContainerKekState,\n  VerifiedContainerParentEdge,\n  VerifiedDocumentKekTargets,\n  VerifiedDocumentLinkSetManifest,\n  VerifiedDocumentLinkSetSnapshot,\n  VerifiedDocumentLinkSetStateEvidence,\n  VerifiedIdentityState,\n  VerifiedPrincipalPolicy,\n  VerifiedPrincipalPolicyCurrent,\n  VerifiedPrincipalPolicyHistory,\n  VerifiedPrincipalPolicySelection,\n  VerifiedPrincipalPolicySnapshot,\n  VerifiedTransparencyProof,\n  VerifiedTransparencyTreeHead,\n  VerifiedWriteHeader,\n  VerifyAccessEventInput,\n  VerifyAccessManifestInput,\n  VerifyAttachmentBindingEventInput,\n  VerifyAttachmentDetachEventInput,\n  VerifyContainerAccessManifestInput,\n  VerifyContainerKekStateInput,\n  VerifyContainerParentEdgeInput,\n  VerifyDocumentLinkSetManifestInput,\n  VerifyDocumentPurgeEventInput,\n  VerifyIdentityStateCheckpointInput,\n  VerifyPrincipalPolicyBundleInput,\n  VerifyPrincipalPolicySnapshotInput,\n  VerifySignedTransparencyTreeHeadInput,\n  VerifyTransparencyConsistencyProofInput,\n  VerifyTransparencyInclusionProofInput,\n  VerifyTransparencyProofInput,\n  VerifyWriteHeaderInput,\n  WriteHeader,\n} from \"./keying\";\nexport {\n  ACCESS_MANIFEST_VERIFICATION_REVISION,\n  accessManifestCheckpointFromManifest,\n  accessManifestTransparencyLeaf,\n  assertSealedContainerKekKeyringLength,\n  BLOB_CONTENT_KEY_WRAP_SUITE,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  CONTAINER_KEK_KEYRING_SEAL_SUITE,\n  CONTAINER_KEK_MATERIAL_ID_PREFIX,\n  CONTAINER_KEK_PARENT_WRAP_SUITE,\n  CONTAINER_KEK_PREDECESSOR_WRAP_SUITE,\n  CONTAINER_KEK_USER_WRAP_SUITE,\n  CONTENT_RECORD_ENCRYPTION_SUITE,\n  computeAccessEventBodyHash,\n  computeAccessEventHash,\n  computeAccessManifestHash,\n  computeBlobAccessManifestHash,\n  computeBlobContentKeyTargetHash,\n  computeContainerAccessKeyTargetHash,\n  computeContainerAccessStructuralHash,\n  computeContainerDirectGrantRoot,\n  computeContainerKekKeyringHash,\n  computeContainerKekMaterialId,\n  computeContainerKekPredecessorBridgeHash,\n  computeContainerKekRecipientTargetHash,\n  computeContainerKeyEpochHash,\n  computeContentRecordNonceDomainHash,\n  computeDocumentContentKeyTargetHash,\n  computeDocumentContentRecordCiphertextHash,\n  computeDocumentContentRecordMetadataHash,\n  computeDocumentContentRecordPlaintextHash,\n  computeDocumentLinkSetGrantRoot,\n  computeDocumentLinkSetKeyTargetHash,\n  computeDocumentLinkSetStructuralHash,\n  computeKeyingDomainHash,\n  computeTransparencyLeafHash,\n  computeTransparencyMerkleRoot,\n  computeWriteHeaderHash,\n  createContainerKekPredecessorBridge,\n  createPrincipalHistoryIndexProof,\n  createPrincipalPolicyHistoryVerifier,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n  DOCUMENT_CONTENT_KEY_WRAP_SUITE,\n  deriveBlobKekTargets,\n  deriveContainerAccessManifest,\n  deriveContainerKekRecipientTargets,\n  deriveContainerKekWrappingPublicKey,\n  deriveDocumentKekTargets,\n  deriveDocumentLinkSetManifest,\n  derivePrincipalRecipientKeyEpochId,\n  documentContentRecordMetadata,\n  expectedSealedContainerKekKeyringBytes,\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n  identityStateTransparencyLeaf,\n  isContainerKekMaterialId,\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n  KeyingVerificationError,\n  MAX_CONTAINER_KEY_EPOCH,\n  MAX_CONTAINER_RECITATION_EPOCH,\n  makeVerifiedAccessEvent,\n  makeVerifiedBlobKekTargets,\n  makeVerifiedContainerAccessManifest,\n  makeVerifiedContainerKekState,\n  makeVerifiedDocumentKekTargets,\n  makeVerifiedDocumentLinkSetManifest,\n  makeVerifiedDocumentLinkSetSnapshot,\n  makeVerifiedPrincipalPolicy,\n  normalizeAttachmentAccessEventBody,\n  normalizeContainerAccessEventBody,\n  normalizeContainerKekKeyring,\n  normalizeContainerKekPredecessorBridge,\n  normalizeDocumentAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  openContainerKekKeyring,\n  PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT,\n  PRINCIPAL_HISTORY_VERIFICATION_REVISION,\n  principalHistoryIndexLeaf,\n  principalPolicyMatchesReference,\n  principalPolicyTransparencyLeaf,\n  resolveContainerPathUserAccessLevel,\n  resolveContainerStatePathUserAccessLevel,\n  resolveHistoricalContainerPathUserAccessLevel,\n  resolvePrincipalHistoryIndexProof,\n  restorePrincipalPolicyHistoryVerifier,\n  sealContainerKekKeyring,\n  selectPrincipalPolicyAuthorization,\n  selectPrincipalPolicyCurrentPredecessorReferences,\n  serializeKeyingCanonicalJson,\n  signAccessEvent,\n  signTransparencyTreeHead,\n  signWriteHeader,\n  unwrapContainerKekParentWrap,\n  unwrapContainerKekPredecessorBridge,\n  verifyAccessManifest,\n  verifyAccessManifestLocalCheckpoint,\n  verifyAccessManifestSnapshot,\n  verifyAttachmentBindingEvent,\n  verifyAttachmentDetachEvent,\n  verifyContainerAccessManifest,\n  verifyContainerKekKeyringEntry,\n  verifyContainerKekState,\n  verifyContainerParentEdge,\n  verifyDocumentLinkSetManifest,\n  verifyDocumentLinkSetSnapshot,\n  verifyDocumentPurgeEvent,\n  verifyIdentityStateCheckpoint,\n  verifyPrincipalPolicyBundle,\n  verifyPrincipalPolicyBundleAgainstHistory,\n  verifyPrincipalPolicyCheckpoint,\n  verifyPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrentMutation,\n  verifyPrincipalPolicyCurrentSuccessor,\n  verifyPrincipalPolicyHistoryReferences,\n  verifyPrincipalPolicySnapshot,\n  verifySignedAccessEvent,\n  verifySignedTransparencyTreeHead,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n  verifyTransparencyProof,\n  verifyWriteHeader,\n} from \"./keying\";\nexport {\n  organizationReplacementAuthorizationPayload,\n  organizationReplacementSigningBytes,\n  signOrganizationReplacementAuthorization,\n  type VerifiedOrganizationReplacementAuthorization,\n  verifyOrganizationReplacementAuthorization,\n} from \"./organizationReplacement\";\nexport {\n  computePrincipalContainerGrantRoot,\n  normalizePrincipalContainerGrants,\n} from \"./principalContainerGrants\";\nexport {\n  computePrincipalMemberEnvelopesRoot,\n  normalizePrincipalStateMemberEnvelopes,\n  PrincipalMemberEnvelopeValidationError,\n} from \"./principalMemberEnvelopes\";\nexport type { PrincipalPolicyValidationErrorCode } from \"./principalPolicyValidationError\";\nexport {\n  PrincipalPolicyValidationError,\n  throwPrincipalPolicyValidationError,\n} from \"./principalPolicyValidationError\";\nexport type {\n  ManagedRecipientPrincipalType,\n  PrincipalContainerGrant,\n  PrincipalContainerGrantAccessLevel,\n  PrincipalProjectionMember,\n  PrincipalProjectionRole,\n  PrincipalStateExternalAuthority,\n  PrincipalStateHeaderInput,\n  PrincipalStateMember,\n  PrincipalStateMemberEnvelope,\n  PrincipalStateMembershipMode,\n  PrincipalStatePayloadCipherSuite,\n  PrincipalStateSigningInput,\n  SignedPrincipalState,\n  UnsignedPrincipalState,\n} from \"./principalState\";\nexport {\n  buildPrincipalStateSigningInput,\n  computePrincipalMembershipRoot,\n  computePrincipalProjectionRoot,\n  computePrincipalStateHash,\n  computePrincipalStatePayloadCiphertextHash,\n  derivePrincipalProjectionMembers,\n  isManagedRecipientPrincipalType,\n  isPrincipalProjectionRole,\n  normalizePrincipalProjectionMembers,\n  normalizePrincipalStateMembers,\n  serializeUnsignedPrincipalState,\n  signPrincipalState,\n} from \"./principalState\";\nexport {\n  verifySignedPrincipalState,\n  verifySignedPrincipalStateResult,\n} from \"./principalStateVerification\";\nexport {\n  captureProjectionHistory,\n  type HistoryProjection,\n  omitProjectionHistory,\n  type RetainedProjectionHistory,\n  restoreProjectionHistory,\n} from \"./projectionHistory\";\nexport type { SigningKeyPair } from \"./signing/generateKeyPair\";\nexport {\n  generateSigningKeyPair,\n  generateSigningSeedAndKeyPair,\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SECRET_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n} from \"./signing/generateKeyPair\";\nexport { sign } from \"./signing/sign\";\nexport { verify } from \"./signing/verify\";\nexport type { SymmetricCiphertext } from \"./symmetric\";\nexport {\n  AES_256_KEY_BYTES,\n  AES_GCM_IV_BYTES,\n  AES_GCM_TAG_BYTES,\n  assertAesGcmIv,\n  createAesGcmIv,\n  decryptWithDek,\n  encryptWithDek,\n} from \"./symmetric\";\n"]}

package/internal/crypto/keying/index.d.ts

@@ -16,6 +16,7 @@ export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { type PrincipalPolicyCurrent, type VerifiedPrincipalPolicyCurrent, verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
 export { verifyPrincipalPolicyCurrentMutation } from "./principalPolicyCurrentMutation.js";
+export { selectPrincipalPolicyCurrentPredecessorReferences } from "./principalPolicyCurrentPredecessorReferences.js";
 export { verifyPrincipalPolicyCurrentSuccessor } from "./principalPolicyCurrentSuccessor.js";
 export type { PrincipalPolicyExternalAuthority, PrincipalPolicyExternalAuthorityState, } from "./principalPolicyExternalAuthorityTypes.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";

package/internal/crypto/keying/index.js

@@ -16,6 +16,7 @@ export * from "./principalPolicy.js";
 export { verifyPrincipalPolicyBundleAgainstHistory } from "./principalPolicyBundleHistory.js";
 export { verifyPrincipalPolicyCurrent, } from "./principalPolicyCurrent.js";
 export { verifyPrincipalPolicyCurrentMutation } from "./principalPolicyCurrentMutation.js";
+export { selectPrincipalPolicyCurrentPredecessorReferences } from "./principalPolicyCurrentPredecessorReferences.js";
 export { verifyPrincipalPolicyCurrentSuccessor } from "./principalPolicyCurrentSuccessor.js";
 export { createPrincipalPolicyHistoryVerifier, restorePrincipalPolicyHistoryVerifier, } from "./principalPolicyHistory.js";
 export { createPrincipalHistoryIndexProof, principalHistoryIndexLeaf, resolvePrincipalHistoryIndexProof, } from "./principalPolicyHistoryIndex.js";

package/internal/crypto/keying/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAK1F,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n  assertSealedContainerKekKeyringLength,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  computeContainerKekKeyringHash,\n  expectedSealedContainerKekKeyringBytes,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n  verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  normalizeContainerKekPredecessorBridge,\n  unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n  type DocumentPurgeAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  type VerifyDocumentPurgeEventInput,\n  verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport { verifyPrincipalPolicyCurrentMutation } from \"./principalPolicyCurrentMutation\";\nexport { verifyPrincipalPolicyCurrentSuccessor } from \"./principalPolicyCurrentSuccessor\";\nexport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n  createPrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n  createPrincipalHistoryIndexProof,\n  principalHistoryIndexLeaf,\n  resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n  type VerifyTransparencyConsistencyProofInput,\n  type VerifyTransparencyInclusionProofInput,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n  computeTransparencyMerkleRoot,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qCAAqC,EAAE,MAAM,sCAAsC,CAAC;AAC7F,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qCAAqC,EACrC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,sCAAsC,EACtC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wCAAwC,EACxC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wCAAwC,EAAE,MAAM,uBAAuB,CAAC;AACjF,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,qCAAqC,EAErC,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAGL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,iDAAiD,EAAE,MAAM,+CAA+C,CAAC;AAClH,OAAO,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAK1F,OAAO,EACL,oCAAoC,EACpC,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uCAAuC,EAAE,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sCAAsC,EAAE,MAAM,oCAAoC,CAAC;AAQ5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EACL,kCAAkC,GAEnC,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,oCAAoC,EACpC,0CAA0C,GAC3C,MAAM,6BAA6B,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAGL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from \"./accessEvent\";\nexport * from \"./accessManifestSnapshot\";\nexport { ACCESS_MANIFEST_VERIFICATION_REVISION } from \"./accessManifestVerificationRevision\";\nexport * from \"./canonical\";\nexport * from \"./checkpoints\";\nexport * from \"./containerAccess\";\nexport { MAX_CONTAINER_RECITATION_EPOCH } from \"./containerAccessReciteBody\";\nexport * from \"./containerKek\";\nexport {\n  assertSealedContainerKekKeyringLength,\n  CONTAINER_KEK_KEYRING_ENTRY_BYTES,\n  CONTAINER_KEK_KEYRING_FORMAT_VERSION,\n  CONTAINER_KEK_KEYRING_HEADER_BYTES,\n  computeContainerKekKeyringHash,\n  expectedSealedContainerKekKeyringBytes,\n  normalizeContainerKekKeyring,\n  openContainerKekKeyring,\n  sealContainerKekKeyring,\n  verifyContainerKekKeyringEntry,\n} from \"./containerKekKeyring\";\nexport {\n  computeContainerKekPredecessorBridgeHash,\n  createContainerKekPredecessorBridge,\n  normalizeContainerKekPredecessorBridge,\n  unwrapContainerKekPredecessorBridge,\n} from \"./containerKekPredecessor\";\nexport {\n  deriveContainerKekWrappingPublicKey,\n  unwrapContainerKekParentWrap,\n} from \"./containerKekWrapping\";\nexport { resolveContainerStatePathUserAccessLevel } from \"./containerPathAccess\";\nexport * from \"./documentAccess\";\nexport {\n  type DocumentPurgeAccessEventBody,\n  normalizeDocumentPurgeAccessEventBody,\n  type VerifyDocumentPurgeEventInput,\n  verifyDocumentPurgeEvent,\n} from \"./documentPurge\";\nexport * from \"./principalPolicy\";\nexport { verifyPrincipalPolicyBundleAgainstHistory } from \"./principalPolicyBundleHistory\";\nexport {\n  type PrincipalPolicyCurrent,\n  type VerifiedPrincipalPolicyCurrent,\n  verifyPrincipalPolicyCurrent,\n} from \"./principalPolicyCurrent\";\nexport { verifyPrincipalPolicyCurrentMutation } from \"./principalPolicyCurrentMutation\";\nexport { selectPrincipalPolicyCurrentPredecessorReferences } from \"./principalPolicyCurrentPredecessorReferences\";\nexport { verifyPrincipalPolicyCurrentSuccessor } from \"./principalPolicyCurrentSuccessor\";\nexport type {\n  PrincipalPolicyExternalAuthority,\n  PrincipalPolicyExternalAuthorityState,\n} from \"./principalPolicyExternalAuthorityTypes\";\nexport {\n  createPrincipalPolicyHistoryVerifier,\n  restorePrincipalPolicyHistoryVerifier,\n} from \"./principalPolicyHistory\";\nexport type { PrincipalHistoryIndexNode } from \"./principalPolicyHistoryIndex\";\nexport {\n  createPrincipalHistoryIndexProof,\n  principalHistoryIndexLeaf,\n  resolvePrincipalHistoryIndexProof,\n} from \"./principalPolicyHistoryIndex\";\nexport { PRINCIPAL_HISTORY_VERIFICATION_REVISION } from \"./principalPolicyHistoryPage\";\nexport type { PrincipalPolicyHistoryReferenceProof } from \"./principalPolicyHistoryReferences\";\nexport { verifyPrincipalPolicyHistoryReferences } from \"./principalPolicyHistoryReferences\";\nexport type {\n  PrincipalPolicyHistoryInput,\n  PrincipalPolicyHistoryPage,\n  PrincipalPolicyHistoryProgressOptions,\n  PrincipalPolicyHistoryVerifier,\n  VerifiedPrincipalPolicyHistory,\n} from \"./principalPolicyHistoryTypes\";\nexport { PRINCIPAL_HISTORY_PAGE_ENTRY_LIMIT } from \"./principalPolicyHistoryTypes\";\nexport {\n  selectPrincipalPolicyAuthorization,\n  type VerifiedPrincipalPolicySelection,\n} from \"./principalPolicySelection\";\nexport type {\n  PrincipalPolicyTransitionMismatch,\n  PrincipalPolicyTransitionMismatchCode,\n} from \"./principalPolicyTransition\";\nexport {\n  getPrincipalPolicyTransitionMismatch,\n  getPrincipalPolicyTransitionMismatchReason,\n} from \"./principalPolicyTransition\";\nexport * from \"./transparency\";\nexport {\n  type VerifyTransparencyConsistencyProofInput,\n  type VerifyTransparencyInclusionProofInput,\n  verifyTransparencyConsistencyProof,\n  verifyTransparencyInclusionProof,\n} from \"./transparencyProofs\";\nexport {\n  computeTransparencyMerkleRoot,\n  createTransparencyConsistencyProof,\n  createTransparencyInclusionProof,\n} from \"./transparencyTree\";\nexport * from \"./types\";\nexport {\n  isKeyingVerificationCode,\n  KEYING_VERIFICATION_CODES,\n} from \"./verificationError\";\nexport * from \"./writeHeader\";\n"]}

package/internal/crypto/keying/principalPolicyCurrentPredecessorReferences.d.ts

@@ -0,0 +1,8 @@
+import type { VerifiedPrincipalPolicyCurrent } from "./principalPolicyTypes.js";
+import type { KeyingVerificationResult, ReferencedPrincipalHead } from "./types.js";
+/** Carry selected authenticated citations across one privately verified successor. */
+export declare function selectPrincipalPolicyCurrentPredecessorReferences(input: {
+    readonly current: VerifiedPrincipalPolicyCurrent;
+    readonly predecessor: VerifiedPrincipalPolicyCurrent;
+    readonly references: readonly ReferencedPrincipalHead[];
+}): KeyingVerificationResult<VerifiedPrincipalPolicyCurrent>;