@viewportai/daemon 0.5.2 → 0.6.0

package/dist/security/epoch-store.js

@@ -0,0 +1,224 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { configDir } from '../core/config.js';
+import { TEAM_EPOCH_SCHEMA, USER_EPOCH_SCHEMA, } from './epoch-protocol.js';
+const STORE_SCHEMA = 'viewport.local_crypto_epochs/v1';
+export async function getActiveLocalUserEpoch(workspaceId, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    return (store.userEpochs
+        .filter((epoch) => epoch.workspaceId === workspaceId && epoch.status === 'active')
+        .sort((a, b) => b.epoch - a.epoch)[0] ?? null);
+}
+export async function getActiveLocalTeamEpoch(workspaceId, teamId, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    return (store.teamEpochs
+        .filter((epoch) => epoch.workspaceId === workspaceId &&
+        (epoch.teamId === teamId || epoch.platformTeamId === teamId) &&
+        epoch.status === 'active')
+        .sort((a, b) => b.epoch - a.epoch)[0] ?? null);
+}
+export async function listActiveLocalTeamEpochs(workspaceId, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    return store.teamEpochs
+        .filter((epoch) => epoch.workspaceId === workspaceId && epoch.status === 'active')
+        .sort((a, b) => b.epoch - a.epoch);
+}
+export async function getLocalTeamEpochByPlatformId(workspaceId, platformEpochId, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    return (store.teamEpochs.find((epoch) => epoch.workspaceId === workspaceId &&
+        epoch.platformEpochId === platformEpochId &&
+        epoch.status === 'active') ?? null);
+}
+export async function getLocalUserEpochByPlatformId(workspaceId, platformEpochId, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    return (store.userEpochs.find((epoch) => epoch.workspaceId === workspaceId &&
+        epoch.platformEpochId === platformEpochId &&
+        epoch.status === 'active') ?? null);
+}
+export async function getLocalDeviceEnrollment(workspaceId, enrollmentIdOrFingerprint, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    return (store.deviceEnrollments.find((enrollment) => enrollment.workspaceId === workspaceId &&
+        (enrollment.enrollmentId === enrollmentIdOrFingerprint ||
+            enrollment.fingerprint === enrollmentIdOrFingerprint)) ?? null);
+}
+export async function upsertLocalUserEpoch(input, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    const now = new Date().toISOString();
+    for (const epoch of store.userEpochs) {
+        if (epoch.workspaceId === input.workspaceId && epoch.status === 'active') {
+            epoch.status = 'superseded';
+            epoch.updatedAt = now;
+        }
+    }
+    const existing = store.userEpochs.find((epoch) => epoch.workspaceId === input.workspaceId && epoch.fingerprint === input.fingerprint);
+    if (existing) {
+        Object.assign(existing, input, { updatedAt: now });
+        await writeLocalEpochStore(store, home);
+        return existing;
+    }
+    const record = { ...input, createdAt: now, updatedAt: now };
+    store.userEpochs.push(record);
+    await writeLocalEpochStore(store, home);
+    return record;
+}
+export async function upsertLocalTeamEpoch(input, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    const now = new Date().toISOString();
+    for (const epoch of store.teamEpochs) {
+        if (epoch.workspaceId === input.workspaceId &&
+            (epoch.teamId === input.teamId || epoch.platformTeamId === input.platformTeamId) &&
+            epoch.status === 'active') {
+            epoch.status = 'superseded';
+            epoch.updatedAt = now;
+        }
+    }
+    const existing = store.teamEpochs.find((epoch) => epoch.workspaceId === input.workspaceId && epoch.fingerprint === input.fingerprint);
+    if (existing) {
+        Object.assign(existing, input, { updatedAt: now });
+        await writeLocalEpochStore(store, home);
+        return existing;
+    }
+    const record = { ...input, createdAt: now, updatedAt: now };
+    store.teamEpochs.push(record);
+    await writeLocalEpochStore(store, home);
+    return record;
+}
+export async function upsertLocalDeviceEnrollment(input, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    const now = new Date().toISOString();
+    const existing = store.deviceEnrollments.find((enrollment) => enrollment.workspaceId === input.workspaceId &&
+        (enrollment.fingerprint === input.fingerprint ||
+            (input.enrollmentId && enrollment.enrollmentId === input.enrollmentId)));
+    if (existing) {
+        Object.assign(existing, input, { updatedAt: now });
+        await writeLocalEpochStore(store, home);
+        return existing;
+    }
+    const record = { ...input, createdAt: now, updatedAt: now };
+    store.deviceEnrollments.push(record);
+    await writeLocalEpochStore(store, home);
+    return record;
+}
+export async function getLocalPublicEpochPin(input, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    return (store.publicEpochPins
+        .filter((pin) => pin.workspaceId === input.workspaceId &&
+        pin.subjectType === input.subjectType &&
+        pin.subjectId === input.subjectId)
+        .sort((a, b) => b.epoch - a.epoch)[0] ?? null);
+}
+export async function upsertLocalPublicEpochPin(input, home = configDir()) {
+    const store = await readLocalEpochStore(home);
+    const now = new Date().toISOString();
+    const existing = store.publicEpochPins.find((pin) => pin.workspaceId === input.workspaceId &&
+        pin.subjectType === input.subjectType &&
+        pin.subjectId === input.subjectId &&
+        pin.epoch === input.epoch);
+    if (existing) {
+        Object.assign(existing, input, { updatedAt: now });
+        await writeLocalEpochStore(store, home);
+        return existing;
+    }
+    const record = { ...input, createdAt: now, updatedAt: now };
+    store.publicEpochPins.push(record);
+    await writeLocalEpochStore(store, home);
+    return record;
+}
+export function createLocalUserEpochKeyMaterial(input) {
+    const encryption = crypto.generateKeyPairSync('x25519');
+    const signing = crypto.generateKeyPairSync('ed25519');
+    const descriptor = {
+        schema: USER_EPOCH_SCHEMA,
+        workspaceId: input.workspaceId,
+        subjectType: 'user',
+        subjectId: input.userId ?? 'pending-platform-user',
+        epoch: input.epoch ?? 1,
+        encryptionPublicKeyJwk: encryption.publicKey.export({ format: 'jwk' }),
+        signingPublicKeyJwk: signing.publicKey.export({ format: 'jwk' }),
+        previousEpochFingerprint: input.previousEpochFingerprint ?? null,
+        createdAt: new Date().toISOString(),
+    };
+    return {
+        descriptor,
+        encryptionPrivateKeyJwk: encryption.privateKey.export({ format: 'jwk' }),
+        signingPrivateKeyJwk: signing.privateKey.export({ format: 'jwk' }),
+    };
+}
+export function createLocalTeamEpochKeyMaterial(input) {
+    const encryption = crypto.generateKeyPairSync('x25519');
+    const signing = crypto.generateKeyPairSync('ed25519');
+    const descriptor = {
+        schema: TEAM_EPOCH_SCHEMA,
+        workspaceId: input.workspaceId,
+        subjectType: 'team',
+        subjectId: input.teamId,
+        epoch: input.epoch ?? 1,
+        encryptionPublicKeyJwk: encryption.publicKey.export({ format: 'jwk' }),
+        signingPublicKeyJwk: signing.publicKey.export({ format: 'jwk' }),
+        previousEpochFingerprint: input.previousEpochFingerprint ?? null,
+        createdAt: new Date().toISOString(),
+    };
+    return {
+        descriptor,
+        encryptionPrivateKeyJwk: encryption.privateKey.export({ format: 'jwk' }),
+        signingPrivateKeyJwk: signing.privateKey.export({ format: 'jwk' }),
+    };
+}
+export function createLocalDeviceEnrollmentKeyMaterial(input) {
+    const encryption = crypto.generateKeyPairSync('x25519');
+    const signing = crypto.generateKeyPairSync('ed25519');
+    return {
+        enrollment: {
+            workspaceId: input.workspaceId,
+            deviceId: input.deviceId,
+            deviceLabel: input.deviceLabel,
+            encryptionPublicKeyJwk: encryption.publicKey.export({ format: 'jwk' }),
+            encryptionPrivateKeyJwk: encryption.privateKey.export({ format: 'jwk' }),
+            signingPublicKeyJwk: signing.publicKey.export({ format: 'jwk' }),
+            signingPrivateKeyJwk: signing.privateKey.export({ format: 'jwk' }),
+            nonce: input.nonce ?? crypto.randomBytes(24).toString('base64url'),
+        },
+    };
+}
+async function readLocalEpochStore(home = configDir()) {
+    try {
+        const raw = await fs.readFile(localEpochStorePath(home), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.schema !== STORE_SCHEMA || !Array.isArray(parsed.userEpochs)) {
+            throw new Error('Invalid local crypto epoch store.');
+        }
+        if (!Array.isArray(parsed.teamEpochs))
+            parsed.teamEpochs = [];
+        if (!Array.isArray(parsed.deviceEnrollments))
+            parsed.deviceEnrollments = [];
+        if (!Array.isArray(parsed.publicEpochPins))
+            parsed.publicEpochPins = [];
+        return parsed;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return {
+                schema: STORE_SCHEMA,
+                userEpochs: [],
+                teamEpochs: [],
+                deviceEnrollments: [],
+                publicEpochPins: [],
+            };
+        }
+        throw error;
+    }
+}
+async function writeLocalEpochStore(store, home = configDir()) {
+    const filePath = localEpochStorePath(home);
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.writeFile(filePath, `${JSON.stringify(store, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    await fs.chmod(filePath, 0o600);
+}
+function localEpochStorePath(home = configDir()) {
+    return path.join(home, 'crypto', 'epochs.json');
+}
+//# sourceMappingURL=epoch-store.js.map

package/dist/security/epoch-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"epoch-store.js","sourceRoot":"","sources":["../../src/security/epoch-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,YAAY,GAAG,iCAAiC,CAAC;AAgFvD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CACL,KAAK,CAAC,UAAU;SACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;SACjF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,MAAc,EACd,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CACL,KAAK,CAAC,UAAU;SACb,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC;QAC5D,KAAK,CAAC,MAAM,KAAK,QAAQ,CAC5B;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB,EACnB,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,UAAU;SACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;SACjF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,WAAmB,EACnB,eAAuB,EACvB,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CACL,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,KAAK,CAAC,eAAe,KAAK,eAAe;QACzC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAC5B,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,WAAmB,EACnB,eAAuB,EACvB,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CACL,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW;QACjC,KAAK,CAAC,eAAe,KAAK,eAAe;QACzC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAC5B,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAmB,EACnB,yBAAiC,EACjC,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CACL,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAC1B,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,WAAW;QACtC,CAAC,UAAU,CAAC,YAAY,KAAK,yBAAyB;YACpD,UAAU,CAAC,WAAW,KAAK,yBAAyB,CAAC,CAC1D,IAAI,IAAI,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA4D,EAC5D,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzE,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;YAC5B,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9F,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAyB,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAClF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA4D,EAC5D,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,IACE,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YACvC,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAAC;YAChF,KAAK,CAAC,MAAM,KAAK,QAAQ,EACzB,CAAC;YACD,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;YAC5B,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9F,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAyB,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAClF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAA6D,EAC7D,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAC5C,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC3C,CAAC,KAAK,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC,CAC5E,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAA0B,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACnF,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAIC,EACD,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CACL,KAAK,CAAC,eAAe;SAClB,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACrC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACrC,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CACpC;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA2D,EAC3D,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CACzC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACrC,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACrC,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACjC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAC5B,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAwB,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACjF,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAK/C;IAKC,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,UAAU,GAAoB;QAClC,MAAM,EAAE,iBAAiB;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,uBAAuB;QAClD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;QACvB,sBAAsB,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;QACnF,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;QAC7E,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,IAAI,IAAI;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,uBAAuB,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;QACrF,oBAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAK/C;IAKC,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,UAAU,GAAoB;QAClC,MAAM,EAAE,iBAAiB;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;QACvB,sBAAsB,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;QACnF,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;QAC7E,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,IAAI,IAAI;QAChE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,uBAAuB,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;QACrF,oBAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAKtD;IAMC,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAO;QACL,UAAU,EAAE;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,sBAAsB,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;YACnF,uBAAuB,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;YACrF,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;YAC7E,oBAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAc;YAC/E,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAI,GAAG,SAAS,EAAE;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAAE,MAAM,CAAC,iBAAiB,GAAG,EAAE,CAAC;QAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAAE,MAAM,CAAC,eAAe,GAAG,EAAE,CAAC;QACxE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO;gBACL,MAAM,EAAE,YAAY;gBACpB,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,EAAE;gBACd,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAsB,EAAE,IAAI,GAAG,SAAS,EAAE;IAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAClE,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAI,GAAG,SAAS,EAAE;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC"}

package/dist/security/epoch-sync.d.ts

@@ -0,0 +1,47 @@
+import { transportFetch, type TlsVerifyMode } from '../cli/network.js';
+import { type LocalTeamCryptoEpoch, type LocalUserCryptoEpoch } from './epoch-store.js';
+import { type EpochTransitionPayload } from './epoch-protocol.js';
+export interface CryptoEpochSyncTarget {
+    workspaceId: string;
+    serverUrl: string;
+    credential: string;
+    tlsVerify?: TlsVerifyMode;
+    caCertPath?: string;
+    tlsPins?: string[];
+}
+export declare function ensureUserCryptoEpoch(options: {
+    target: CryptoEpochSyncTarget;
+    home?: string;
+    fetchImpl?: typeof transportFetch;
+}): Promise<LocalUserCryptoEpoch>;
+export declare function rotateUserCryptoEpoch(options: {
+    target: CryptoEpochSyncTarget;
+    reason: EpochTransitionPayload['reason'];
+    home?: string;
+    fetchImpl?: typeof transportFetch;
+}): Promise<LocalUserCryptoEpoch>;
+export declare function ensureTeamCryptoEpoch(options: {
+    target: CryptoEpochSyncTarget;
+    teamId: string;
+    home?: string;
+    fetchImpl?: typeof transportFetch;
+}): Promise<LocalTeamCryptoEpoch>;
+export declare function rotateTeamCryptoEpoch(options: {
+    target: CryptoEpochSyncTarget;
+    teamId: string;
+    reason: EpochTransitionPayload['reason'];
+    home?: string;
+    fetchImpl?: typeof transportFetch;
+}): Promise<LocalTeamCryptoEpoch>;
+export declare function processPendingCryptoRotationRequests(options: {
+    target: CryptoEpochSyncTarget;
+    home?: string;
+    fetchImpl?: typeof transportFetch;
+}): Promise<{
+    processed: number;
+    userRotations: number;
+    teamRotations: number;
+    teamMemberGrants: number;
+    skipped: number;
+}>;
+//# sourceMappingURL=epoch-sync.d.ts.map

package/dist/security/epoch-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"epoch-sync.d.ts","sourceRoot":"","sources":["../../src/security/epoch-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAOL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;CACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2ChC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;CACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2EhC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;CACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiDhC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;CACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgFhC;AAED,wBAAsB,oCAAoC,CAAC,OAAO,EAAE;IAClE,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;CACnC,GAAG,OAAO,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CA6DD"}

package/dist/security/epoch-sync.js

@@ -0,0 +1,371 @@
+import { transportFetch } from '../cli/network.js';
+import { configDir } from '../core/config.js';
+import { createLocalTeamEpochKeyMaterial, createLocalUserEpochKeyMaterial, getActiveLocalTeamEpoch, getActiveLocalUserEpoch, upsertLocalTeamEpoch, upsertLocalUserEpoch, } from './epoch-store.js';
+import { epochTransitionPayload, signEpochTransition, TRUSTED_EDGE_CRYPTO_PROTOCOL_HEADER, TRUSTED_EDGE_CRYPTO_PROTOCOL_VERSION, } from './epoch-protocol.js';
+import { grantTeamEpochToUserEpoch } from './team-epoch-grants.js';
+export async function ensureUserCryptoEpoch(options) {
+    const existing = await getActiveLocalUserEpoch(options.target.workspaceId, options.home);
+    if (existing)
+        return existing;
+    const material = createLocalUserEpochKeyMaterial({
+        workspaceId: options.target.workspaceId,
+        epoch: 1,
+    });
+    const payload = await postJson(options.fetchImpl ?? transportFetch, `${options.target.serverUrl.replace(/\/+$/, '')}/api/runtime/workspaces/${encodeURIComponent(options.target.workspaceId)}/crypto/user-epochs`, {
+        credential: options.target.credential,
+        epoch: 1,
+        encryption_public_key_jwk: material.descriptor.encryptionPublicKeyJwk,
+        signing_public_key_jwk: material.descriptor.signingPublicKeyJwk,
+    }, options.target);
+    const data = objectField(payload, 'data');
+    return upsertLocalUserEpoch({
+        workspaceId: stringField(data, 'workspace_id'),
+        userId: String(numberOrStringField(data, 'user_id')),
+        platformEpochId: stringField(data, 'id'),
+        epoch: numberField(data, 'epoch'),
+        schema: 'viewport.user_crypto_epoch/v1',
+        status: 'active',
+        encryptionPublicKeyJwk: objectField(data, 'encryption_public_key_jwk'),
+        encryptionPrivateKeyJwk: material.encryptionPrivateKeyJwk,
+        signingPublicKeyJwk: objectField(data, 'signing_public_key_jwk'),
+        signingPrivateKeyJwk: material.signingPrivateKeyJwk,
+        fingerprint: stringField(data, 'fingerprint'),
+        previousEpochFingerprint: typeof data.previous_epoch_fingerprint === 'string'
+            ? data.previous_epoch_fingerprint
+            : null,
+    }, options.home ?? configDir());
+}
+export async function rotateUserCryptoEpoch(options) {
+    const previous = await getActiveLocalUserEpoch(options.target.workspaceId, options.home);
+    if (!previous) {
+        throw new Error('Cannot rotate user crypto epoch before an active local epoch exists.');
+    }
+    const material = createLocalUserEpochKeyMaterial({
+        workspaceId: options.target.workspaceId,
+        userId: previous.userId,
+        epoch: previous.epoch + 1,
+        previousEpochFingerprint: previous.fingerprint,
+    });
+    const createdAt = new Date().toISOString();
+    const continuity = signEpochTransition({
+        payload: epochTransitionPayload({
+            from: {
+                schema: previous.schema,
+                workspaceId: previous.workspaceId,
+                subjectType: 'user',
+                subjectId: previous.userId,
+                epoch: previous.epoch,
+                encryptionPublicKeyJwk: previous.encryptionPublicKeyJwk,
+                signingPublicKeyJwk: previous.signingPublicKeyJwk,
+                previousEpochFingerprint: previous.previousEpochFingerprint ?? null,
+                createdAt: previous.createdAt,
+            },
+            to: material.descriptor,
+            reason: options.reason,
+            createdAt,
+        }),
+        signingPrivateKeyJwk: previous.signingPrivateKeyJwk,
+        signedByEpochFingerprint: previous.fingerprint,
+    });
+    const payload = await postJson(options.fetchImpl ?? transportFetch, `${options.target.serverUrl.replace(/\/+$/, '')}/api/runtime/workspaces/${encodeURIComponent(options.target.workspaceId)}/crypto/user-epochs`, {
+        credential: options.target.credential,
+        epoch: material.descriptor.epoch,
+        encryption_public_key_jwk: material.descriptor.encryptionPublicKeyJwk,
+        signing_public_key_jwk: material.descriptor.signingPublicKeyJwk,
+        previous_epoch_fingerprint: previous.fingerprint,
+        continuity: {
+            payload: continuity.payload,
+            signature: continuity.signature,
+            signed_by_epoch_fingerprint: continuity.signedByEpochFingerprint,
+        },
+    }, options.target);
+    const data = objectField(payload, 'data');
+    return upsertLocalUserEpoch({
+        workspaceId: stringField(data, 'workspace_id'),
+        userId: String(numberOrStringField(data, 'user_id')),
+        platformEpochId: stringField(data, 'id'),
+        epoch: numberField(data, 'epoch'),
+        schema: 'viewport.user_crypto_epoch/v1',
+        status: 'active',
+        encryptionPublicKeyJwk: objectField(data, 'encryption_public_key_jwk'),
+        encryptionPrivateKeyJwk: material.encryptionPrivateKeyJwk,
+        signingPublicKeyJwk: objectField(data, 'signing_public_key_jwk'),
+        signingPrivateKeyJwk: material.signingPrivateKeyJwk,
+        fingerprint: stringField(data, 'fingerprint'),
+        previousEpochFingerprint: typeof data.previous_epoch_fingerprint === 'string'
+            ? data.previous_epoch_fingerprint
+            : null,
+    }, options.home ?? configDir());
+}
+export async function ensureTeamCryptoEpoch(options) {
+    const existing = await getActiveLocalTeamEpoch(options.target.workspaceId, options.teamId, options.home);
+    if (existing)
+        return existing;
+    const material = createLocalTeamEpochKeyMaterial({
+        workspaceId: options.target.workspaceId,
+        teamId: options.teamId,
+        epoch: 1,
+    });
+    const payload = await postJson(options.fetchImpl ?? transportFetch, `${options.target.serverUrl.replace(/\/+$/, '')}/api/runtime/workspaces/${encodeURIComponent(options.target.workspaceId)}/crypto/teams/${encodeURIComponent(options.teamId)}/epochs`, {
+        credential: options.target.credential,
+        epoch: 1,
+        encryption_public_key_jwk: material.descriptor.encryptionPublicKeyJwk,
+        signing_public_key_jwk: material.descriptor.signingPublicKeyJwk,
+    }, options.target);
+    const data = objectField(payload, 'data');
+    return upsertLocalTeamEpoch({
+        workspaceId: stringField(data, 'workspace_id'),
+        teamId: options.teamId,
+        platformTeamId: String(numberOrStringField(data, 'team_id')),
+        platformEpochId: stringField(data, 'id'),
+        epoch: numberField(data, 'epoch'),
+        schema: 'viewport.team_crypto_epoch/v1',
+        status: 'active',
+        encryptionPublicKeyJwk: objectField(data, 'encryption_public_key_jwk'),
+        encryptionPrivateKeyJwk: material.encryptionPrivateKeyJwk,
+        signingPublicKeyJwk: objectField(data, 'signing_public_key_jwk'),
+        signingPrivateKeyJwk: material.signingPrivateKeyJwk,
+        fingerprint: stringField(data, 'fingerprint'),
+        previousEpochFingerprint: typeof data.previous_epoch_fingerprint === 'string'
+            ? data.previous_epoch_fingerprint
+            : null,
+    }, options.home ?? configDir());
+}
+export async function rotateTeamCryptoEpoch(options) {
+    const previous = await getActiveLocalTeamEpoch(options.target.workspaceId, options.teamId, options.home);
+    if (!previous) {
+        throw new Error('Cannot rotate team crypto epoch before an active local team epoch exists.');
+    }
+    const material = createLocalTeamEpochKeyMaterial({
+        workspaceId: options.target.workspaceId,
+        teamId: previous.platformTeamId ?? previous.teamId,
+        epoch: previous.epoch + 1,
+        previousEpochFingerprint: previous.fingerprint,
+    });
+    const createdAt = new Date().toISOString();
+    const continuity = signEpochTransition({
+        payload: epochTransitionPayload({
+            from: {
+                schema: previous.schema,
+                workspaceId: previous.workspaceId,
+                subjectType: 'team',
+                subjectId: previous.platformTeamId ?? previous.teamId,
+                epoch: previous.epoch,
+                encryptionPublicKeyJwk: previous.encryptionPublicKeyJwk,
+                signingPublicKeyJwk: previous.signingPublicKeyJwk,
+                previousEpochFingerprint: previous.previousEpochFingerprint ?? null,
+                createdAt: previous.createdAt,
+            },
+            to: material.descriptor,
+            reason: options.reason,
+            createdAt,
+        }),
+        signingPrivateKeyJwk: previous.signingPrivateKeyJwk,
+        signedByEpochFingerprint: previous.fingerprint,
+    });
+    const payload = await postJson(options.fetchImpl ?? transportFetch, `${options.target.serverUrl.replace(/\/+$/, '')}/api/runtime/workspaces/${encodeURIComponent(options.target.workspaceId)}/crypto/teams/${encodeURIComponent(options.teamId)}/epochs`, {
+        credential: options.target.credential,
+        epoch: material.descriptor.epoch,
+        encryption_public_key_jwk: material.descriptor.encryptionPublicKeyJwk,
+        signing_public_key_jwk: material.descriptor.signingPublicKeyJwk,
+        previous_epoch_fingerprint: previous.fingerprint,
+        continuity: {
+            payload: continuity.payload,
+            signature: continuity.signature,
+            signed_by_epoch_fingerprint: continuity.signedByEpochFingerprint,
+        },
+    }, options.target);
+    const data = objectField(payload, 'data');
+    return upsertLocalTeamEpoch({
+        workspaceId: stringField(data, 'workspace_id'),
+        teamId: options.teamId,
+        platformTeamId: String(numberOrStringField(data, 'team_id')),
+        platformEpochId: stringField(data, 'id'),
+        epoch: numberField(data, 'epoch'),
+        schema: 'viewport.team_crypto_epoch/v1',
+        status: 'active',
+        encryptionPublicKeyJwk: objectField(data, 'encryption_public_key_jwk'),
+        encryptionPrivateKeyJwk: material.encryptionPrivateKeyJwk,
+        signingPublicKeyJwk: objectField(data, 'signing_public_key_jwk'),
+        signingPrivateKeyJwk: material.signingPrivateKeyJwk,
+        fingerprint: stringField(data, 'fingerprint'),
+        previousEpochFingerprint: typeof data.previous_epoch_fingerprint === 'string'
+            ? data.previous_epoch_fingerprint
+            : null,
+    }, options.home ?? configDir());
+}
+export async function processPendingCryptoRotationRequests(options) {
+    const fetchImpl = options.fetchImpl ?? transportFetch;
+    const response = await getJson(fetchImpl, `${runtimeBaseUrl(options.target)}/crypto/rotation-requests`, options.target);
+    const requests = arrayField(response, 'data').map((item) => rotationRequestPayload(item));
+    let userRotations = 0;
+    let teamRotations = 0;
+    let teamMemberGrants = 0;
+    let skipped = 0;
+    for (const request of requests) {
+        if (request.subject_type === 'user') {
+            await rotateUserCryptoEpoch({
+                target: options.target,
+                reason: rotationReason(request.reason),
+                home: options.home,
+                fetchImpl,
+            });
+            userRotations++;
+            continue;
+        }
+        if (request.subject_type === 'team' && request.team_public_id) {
+            const rotated = await rotateTeamCryptoEpoch({
+                target: options.target,
+                teamId: request.team_public_id,
+                reason: rotationReason(request.reason),
+                home: options.home,
+                fetchImpl,
+            });
+            teamRotations++;
+            if (!rotated.platformEpochId) {
+                skipped++;
+                continue;
+            }
+            for (const recipientEpochId of request.recipient_user_crypto_epoch_ids) {
+                await grantTeamEpochToUserEpoch({
+                    target: options.target,
+                    teamCryptoEpochId: rotated.platformEpochId,
+                    recipientUserCryptoEpochId: recipientEpochId,
+                    home: options.home,
+                    fetchImpl,
+                });
+                teamMemberGrants++;
+            }
+            continue;
+        }
+        skipped++;
+    }
+    return {
+        processed: userRotations + teamRotations,
+        userRotations,
+        teamRotations,
+        teamMemberGrants,
+        skipped,
+    };
+}
+function runtimeBaseUrl(target) {
+    return `${target.serverUrl.replace(/\/+$/, '')}/api/runtime/workspaces/${encodeURIComponent(target.workspaceId)}`;
+}
+async function getJson(fetchImpl, url, transportOptions) {
+    const requestUrl = new URL(url);
+    requestUrl.searchParams.set('credential', transportOptions.credential);
+    const response = await fetchImpl(requestUrl.toString(), {
+        method: 'GET',
+        headers: trustedEdgeCryptoHeaders(),
+        timeoutMs: 5_000,
+        tlsVerify: transportOptions.tlsVerify,
+        caCertPath: transportOptions.caCertPath,
+        tlsPins: transportOptions.tlsPins,
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) {
+        const message = payload && typeof payload === 'object' && 'message' in payload
+            ? String(payload.message)
+            : `${response.status} ${response.statusText}`;
+        throw new Error(`Crypto rotation sync failed: ${message}`);
+    }
+    return payload;
+}
+function rotationRequestPayload(value) {
+    const data = objectValue(value);
+    const subjectType = stringField(data, 'subject_type');
+    if (subjectType !== 'user' && subjectType !== 'team') {
+        throw new Error(`Unsupported crypto rotation subject: ${subjectType}`);
+    }
+    const recipients = data.recipient_user_crypto_epoch_ids;
+    return {
+        id: stringField(data, 'id'),
+        subject_type: subjectType,
+        subject_id: stringField(data, 'subject_id'),
+        team_public_id: typeof data.team_public_id === 'string' ? data.team_public_id : null,
+        reason: stringField(data, 'reason'),
+        recipient_user_crypto_epoch_ids: Array.isArray(recipients)
+            ? recipients.map((item) => String(item))
+            : [],
+    };
+}
+function rotationReason(value) {
+    if (value === 'device_revoked' ||
+        value === 'member_added' ||
+        value === 'member_revoked' ||
+        value === 'manual_rotation' ||
+        value === 'recovery') {
+        return value;
+    }
+    return 'manual_rotation';
+}
+async function postJson(fetchImpl, url, body, transportOptions = {}) {
+    const response = await fetchImpl(url, {
+        method: 'POST',
+        headers: trustedEdgeCryptoHeaders({ 'content-type': 'application/json' }),
+        body: JSON.stringify(body),
+        timeoutMs: 5_000,
+        tlsVerify: transportOptions.tlsVerify,
+        caCertPath: transportOptions.caCertPath,
+        tlsPins: transportOptions.tlsPins,
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) {
+        const message = payload && typeof payload === 'object' && 'message' in payload
+            ? String(payload.message)
+            : `${response.status} ${response.statusText}`;
+        throw new Error(`Crypto epoch sync failed: ${message}`);
+    }
+    return payload;
+}
+function trustedEdgeCryptoHeaders(extra = {}) {
+    return {
+        accept: 'application/json',
+        [TRUSTED_EDGE_CRYPTO_PROTOCOL_HEADER]: TRUSTED_EDGE_CRYPTO_PROTOCOL_VERSION,
+        ...extra,
+    };
+}
+function objectField(value, field) {
+    const object = objectValue(value);
+    const child = object[field];
+    if (!child || typeof child !== 'object' || Array.isArray(child)) {
+        throw new Error(`Crypto epoch response did not include ${field}`);
+    }
+    return child;
+}
+function objectValue(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Expected response object.');
+    }
+    return value;
+}
+function arrayField(value, field) {
+    const object = objectValue(value);
+    const child = object[field];
+    if (!Array.isArray(child)) {
+        throw new Error(`Crypto epoch response did not include ${field} array.`);
+    }
+    return child;
+}
+function stringField(value, field) {
+    const child = value[field];
+    if (typeof child !== 'string' || child.trim().length === 0) {
+        throw new Error(`Crypto epoch response did not include ${field}`);
+    }
+    return child;
+}
+function numberField(value, field) {
+    const child = value[field];
+    if (typeof child !== 'number') {
+        throw new Error(`Crypto epoch response did not include numeric ${field}`);
+    }
+    return child;
+}
+function numberOrStringField(value, field) {
+    const child = value[field];
+    if (typeof child !== 'number' && typeof child !== 'string') {
+        throw new Error(`Crypto epoch response did not include ${field}`);
+    }
+    return child;
+}
+//# sourceMappingURL=epoch-sync.js.map