mindoodb 0.0.45 → 0.0.46

package/dist/core/crypto/EntrySignature.d.ts

@@ -30,12 +30,19 @@ import type { StoreEntryAttachmentRef, StoreEntryMetadata } from "../types";
  * Exception — backward-compatible trailing extensions: a strictly trailing,
  * optional block whose absence produces ZERO bytes (so the layout is
  * byte-identical to the prior version for entries that do not carry the new
- * data) does NOT bump this value. The `attachmentRefs` block (see
- * {@link buildEntrySigningBytes}) is such an extension: attachment-free entries —
- * including every entry signed before the field existed — are unaffected and
- * keep verifying.
+ * data) does NOT bump this value. The `attachmentRefs` block and the
+ * `provenance` block (see {@link buildEntrySigningBytes}) are such extensions:
+ * entries without attachments and without provenance — including every entry
+ * signed before those fields existed — are unaffected and keep verifying.
  */
 export declare const ENTRY_SIGNATURE_LAYOUT_VERSION = 1;
+/**
+ * Tag byte introducing the trailing provenance block. Two independent optional
+ * trailing blocks now exist, so the second one is tagged: a verifier rebuilds
+ * the layout rather than parsing it, but the tag makes an accidental collision
+ * between "an attachmentRefs count" and "a provenance block" impossible.
+ */
+export declare const ENTRY_PROVENANCE_BLOCK_TAG = 2;
 /**
  * The exact set of metadata fields bound by an author's `metadataSignature`, in
  * the order they appear in the byte layout.
@@ -59,6 +66,64 @@ export interface EntrySignatureFields {
      * the original v1 signing input and verify unchanged. Treat empty as absent.
      */
     attachmentRefs?: StoreEntryAttachmentRef[];
+    /**
+     * Optional record of the entry this one was copied from (see
+     * {@link EntryProvenance}). Encoded as a tagged, backward-compatible TRAILING
+     * block (see {@link buildEntrySigningBytes}): when absent it contributes ZERO
+     * bytes, so entries that were not produced by a copy keep the original v1
+     * signing input and verify unchanged.
+     *
+     * Binding provenance into the signature is what makes it trustworthy: the
+     * copying user attests to the origin claim, so a relay cannot attach, strip or
+     * rewrite it after the fact.
+     */
+    provenance?: EntryProvenance;
+}
+/**
+ * A verifiable record of where a copied entry came from.
+ *
+ * Written by the `replay` copy strategy, which re-signs every entry as the
+ * copying user and would otherwise lose all trace of the original author. The
+ * record is not a bare claim: it embeds the source entry's own signed field
+ * projection together with the original author's signature over it, so a reader
+ * can rebuild those bytes and verify them against the embedded public key. A
+ * successful verification proves the named author really signed an entry with
+ * this exact `contentHash` — i.e. this exact payload.
+ *
+ * What it does NOT establish is that the key belongs to who it claims to: that
+ * is a directory question, answerable in-tenant and out-of-band across tenants.
+ *
+ * Note that copying a copy nests provenance (the source projection carries its
+ * own provenance, because the original signature only verifies over the exact
+ * bytes that were signed). Chains therefore grow one level per generation of
+ * copying.
+ */
+export interface EntryProvenance {
+    /** Tenant the source entry was read from. */
+    sourceTenantId: string;
+    /** Database (store) id the source entry was read from. */
+    sourceDbId: string;
+    /**
+     * The source entry's signed field projection, verbatim. Rebuilding
+     * {@link buildEntrySigningBytes} over this reproduces exactly the bytes the
+     * original author signed.
+     */
+    source: EntrySignatureFields;
+    /**
+     * The original author's `metadataSignature`, base64-encoded.
+     *
+     * Base64 rather than `Uint8Array` so the whole record is plain JSON and
+     * survives every serializer unchanged — the on-disk store, IndexedDB and the
+     * network transport each hand-encode binary metadata fields one by one, and a
+     * dropped or mangled field here would break the enclosing
+     * `metadataSignature`, which binds this block.
+     *
+     * Absent when the source entry is a legacy v1 entry that predates
+     * `metadataSignature`. The provenance record is then still informative but
+     * not cryptographically verifiable; `verifyEntryProvenance` reports that
+     * distinction explicitly rather than failing.
+     */
+    sourceMetadataSignature?: string;
 }
 /** Options for the version-aware entry-signature verifiers. */
 export interface VerifyEntrySignatureOptions {
@@ -70,6 +135,13 @@ export interface VerifyEntrySignatureOptions {
      */
     requireMetadataSignature?: boolean;
 }
+/**
+ * Decode a standard-base64 string to raw bytes. Kept local so this module stays
+ * free of platform dependencies and usable on both client and server.
+ */
+export declare function base64ToBytes(base64: string): Uint8Array;
+/** Encode raw bytes as a standard-base64 string. Inverse of {@link base64ToBytes}. */
+export declare function bytesToBase64(bytes: Uint8Array): string;
 /**
  * Build the canonical, versioned, length-prefixed byte layout the author signs
  * over.
@@ -91,22 +163,42 @@ export interface VerifyEntrySignatureOptions {
  *  || ( len(attachmentId) || attachmentId
  *       || len(lastChunkId) || lastChunkId
  *       || int64BE(size) ) * (one triple per ref, in array order)
+ *  -- trailing provenance block, PRESENT ONLY IF provenance is set --
+ *  || 0x02                          (ENTRY_PROVENANCE_BLOCK_TAG)
+ *  || len(sourceTenantId)           || sourceTenantId
+ *  || len(sourceDbId)               || sourceDbId
+ *  || len(sourceSigningBytes)       || sourceSigningBytes   (recursive layout)
+ *  || len(sourceMetadataSignature)  || sourceMetadataSignature (raw bytes,
+ *                                      zero-length when absent)
  * ```
  *
- * The attachmentRefs block is a deliberately backward-compatible TRAILING
- * extension: it is appended ONLY when there is at least one ref, so an
- * attachment-free entry (every entry written before this field existed, and
- * every future text-only revision) produces byte-for-byte the same input as the
- * original layout and its existing signature still verifies. This is why the
- * version byte intentionally stays `0x01` and is NOT bumped despite the new
- * field: absence is byte-identical to the prior layout. Callers MUST treat an
- * empty array as absent (the canonicalization in {@link entrySignatureFieldsFromEntry}
- * guarantees this) and emit refs in a stable order (the writer sorts by
- * `attachmentId`) so signing and verification produce identical bytes.
+ * Both trailing blocks are deliberately backward-compatible extensions: each is
+ * appended ONLY when it carries data, so an attachment-free entry that is not a
+ * copy (every entry written before these fields existed, and every ordinary
+ * revision) produces byte-for-byte the same input as the original layout and
+ * its existing signature still verifies. This is why the version byte
+ * intentionally stays `0x01` and is NOT bumped despite the new fields: absence
+ * is byte-identical to the prior layout. Callers MUST treat an empty
+ * `attachmentRefs` array as absent (the canonicalization in
+ * {@link entrySignatureFieldsFromEntry} guarantees this) and emit refs in a
+ * stable order (the writer sorts by `attachmentId`) so signing and verification
+ * produce identical bytes.
+ *
+ * The provenance block embeds the source entry's signing bytes by recursing
+ * into this same function, which is what lets a verifier re-derive the exact
+ * bytes the original author signed.
  */
 export declare function buildEntrySigningBytes(fields: EntrySignatureFields, version?: number): Uint8Array;
 /** Project the signed fields out of an entry's metadata. */
-export declare function entrySignatureFieldsFromEntry(entry: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs">): EntrySignatureFields;
+export declare function entrySignatureFieldsFromEntry(entry: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs"> & {
+    provenance?: EntryProvenance;
+}): EntrySignatureFields;
+/**
+ * Import a PEM-encoded Ed25519 public key for verification. Exported so
+ * provenance verification can check an embedded author key without duplicating
+ * the PEM handling.
+ */
+export declare function importEd25519PublicKeyFromPem(publicKeyPem: string, subtle: SubtleCrypto): Promise<CryptoKey>;
 /**
  * Sign the canonical entry layout with an already-imported Ed25519 private key.
  * Returns the raw signature bytes to store as `metadataSignature`.
@@ -125,6 +217,7 @@ export declare function signEntryMetadata(fields: EntrySignatureFields, signingP
  */
 export declare function verifyEntrySignatureWithImportedKey(entry: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs" | "signature"> & {
     metadataSignature?: Uint8Array;
+    provenance?: EntryProvenance;
 }, encryptedData: Uint8Array, cryptoKey: CryptoKey, subtle: SubtleCrypto, opts?: VerifyEntrySignatureOptions): Promise<boolean>;
 /**
  * Same as {@link verifyEntrySignatureWithImportedKey} but imports the author's
@@ -133,5 +226,6 @@ export declare function verifyEntrySignatureWithImportedKey(entry: Pick<StoreEnt
  */
 export declare function verifyEntrySignatureCrypto(entry: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs" | "signature"> & {
     metadataSignature?: Uint8Array;
+    provenance?: EntryProvenance;
 }, encryptedData: Uint8Array, authorPublicKeyPem: string, subtle: SubtleCrypto, opts?: VerifyEntrySignatureOptions): Promise<boolean>;
 //# sourceMappingURL=EntrySignature.d.ts.map

package/dist/core/crypto/EntrySignature.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EntrySignature.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/EntrySignature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,IAAO,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAC5C;AAED,+DAA+D;AAC/D,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AA6BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,OAAO,GAAE,MAAuC,GAC/C,UAAU,CAmCZ;AAED,4DAA4D;AAC5D,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,CACnB,GACA,oBAAoB,CAiBtB;AAgBD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,oBAAoB,EAC5B,iBAAiB,EAAE,SAAS,EAC5B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,MAAuC,GAC/C,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mCAAmC,CACvD,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,GAChB,WAAW,CACd,GAAG;IAAE,iBAAiB,CAAC,EAAE,UAAU,CAAA;CAAE,EACtC,aAAa,EAAE,UAAU,EACzB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,GAChB,WAAW,CACd,GAAG;IAAE,iBAAiB,CAAC,EAAE,UAAU,CAAA;CAAE,EACtC,aAAa,EAAE,UAAU,EACzB,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CASlB"}
+{"version":3,"file":"EntrySignature.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/EntrySignature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,IAAO,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,IAAO,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,+DAA+D;AAC/D,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOxD;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQvD;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,OAAO,GAAE,MAAuC,GAC/C,UAAU,CAoDZ;AAED,4DAA4D;AAC5D,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,CACnB,GAAG;IAAE,UAAU,CAAC,EAAE,eAAe,CAAA;CAAE,GACnC,oBAAoB,CAkBtB;AAWD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,oBAAoB,EAC5B,iBAAiB,EAAE,SAAS,EAC5B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,MAAuC,GAC/C,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mCAAmC,CACvD,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,GAChB,WAAW,CACd,GAAG;IAAE,iBAAiB,CAAC,EAAE,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,eAAe,CAAA;CAAE,EACpE,aAAa,EAAE,UAAU,EACzB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,GAChB,WAAW,CACd,GAAG;IAAE,iBAAiB,CAAC,EAAE,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,eAAe,CAAA;CAAE,EACpE,aAAa,EAAE,UAAU,EACzB,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,YAAY,EACpB,IAAI,CAAC,EAAE,2BAA2B,GACjC,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/core/crypto/EntrySignature.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENTRY_SIGNATURE_LAYOUT_VERSION = void 0;
+exports.ENTRY_PROVENANCE_BLOCK_TAG = exports.ENTRY_SIGNATURE_LAYOUT_VERSION = void 0;
+exports.base64ToBytes = base64ToBytes;
+exports.bytesToBase64 = bytesToBase64;
 exports.buildEntrySigningBytes = buildEntrySigningBytes;
 exports.entrySignatureFieldsFromEntry = entrySignatureFieldsFromEntry;
+exports.importEd25519PublicKeyFromPem = importEd25519PublicKeyFromPem;
 exports.signEntryMetadata = signEntryMetadata;
 exports.verifyEntrySignatureWithImportedKey = verifyEntrySignatureWithImportedKey;
 exports.verifyEntrySignatureCrypto = verifyEntrySignatureCrypto;
@@ -37,13 +40,42 @@ exports.verifyEntrySignatureCrypto = verifyEntrySignatureCrypto;
  * Exception — backward-compatible trailing extensions: a strictly trailing,
  * optional block whose absence produces ZERO bytes (so the layout is
  * byte-identical to the prior version for entries that do not carry the new
- * data) does NOT bump this value. The `attachmentRefs` block (see
- * {@link buildEntrySigningBytes}) is such an extension: attachment-free entries —
- * including every entry signed before the field existed — are unaffected and
- * keep verifying.
+ * data) does NOT bump this value. The `attachmentRefs` block and the
+ * `provenance` block (see {@link buildEntrySigningBytes}) are such extensions:
+ * entries without attachments and without provenance — including every entry
+ * signed before those fields existed — are unaffected and keep verifying.
  */
 exports.ENTRY_SIGNATURE_LAYOUT_VERSION = 0x01;
+/**
+ * Tag byte introducing the trailing provenance block. Two independent optional
+ * trailing blocks now exist, so the second one is tagged: a verifier rebuilds
+ * the layout rather than parsing it, but the tag makes an accidental collision
+ * between "an attachmentRefs count" and "a provenance block" impossible.
+ */
+exports.ENTRY_PROVENANCE_BLOCK_TAG = 0x02;
 const textEncoder = new TextEncoder();
+/**
+ * Decode a standard-base64 string to raw bytes. Kept local so this module stays
+ * free of platform dependencies and usable on both client and server.
+ */
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/** Encode raw bytes as a standard-base64 string. Inverse of {@link base64ToBytes}. */
+function bytesToBase64(bytes) {
+    let binary = "";
+    // Chunked to stay clear of the argument-count limit on large inputs.
+    const chunkSize = 0x8000;
+    for (let i = 0; i < bytes.length; i += chunkSize) {
+        binary += String.fromCharCode(...bytes.subarray(i, i + chunkSize));
+    }
+    return btoa(binary);
+}
 function pushLengthPrefixed(parts, bytes) {
     const lengthPrefix = new Uint8Array(4);
     new DataView(lengthPrefix.buffer).setUint32(0, bytes.length, false /* big-endian */);
@@ -86,18 +118,30 @@ function pushInt64BE(parts, value) {
  *  || ( len(attachmentId) || attachmentId
  *       || len(lastChunkId) || lastChunkId
  *       || int64BE(size) ) * (one triple per ref, in array order)
+ *  -- trailing provenance block, PRESENT ONLY IF provenance is set --
+ *  || 0x02                          (ENTRY_PROVENANCE_BLOCK_TAG)
+ *  || len(sourceTenantId)           || sourceTenantId
+ *  || len(sourceDbId)               || sourceDbId
+ *  || len(sourceSigningBytes)       || sourceSigningBytes   (recursive layout)
+ *  || len(sourceMetadataSignature)  || sourceMetadataSignature (raw bytes,
+ *                                      zero-length when absent)
  * ```
  *
- * The attachmentRefs block is a deliberately backward-compatible TRAILING
- * extension: it is appended ONLY when there is at least one ref, so an
- * attachment-free entry (every entry written before this field existed, and
- * every future text-only revision) produces byte-for-byte the same input as the
- * original layout and its existing signature still verifies. This is why the
- * version byte intentionally stays `0x01` and is NOT bumped despite the new
- * field: absence is byte-identical to the prior layout. Callers MUST treat an
- * empty array as absent (the canonicalization in {@link entrySignatureFieldsFromEntry}
- * guarantees this) and emit refs in a stable order (the writer sorts by
- * `attachmentId`) so signing and verification produce identical bytes.
+ * Both trailing blocks are deliberately backward-compatible extensions: each is
+ * appended ONLY when it carries data, so an attachment-free entry that is not a
+ * copy (every entry written before these fields existed, and every ordinary
+ * revision) produces byte-for-byte the same input as the original layout and
+ * its existing signature still verifies. This is why the version byte
+ * intentionally stays `0x01` and is NOT bumped despite the new fields: absence
+ * is byte-identical to the prior layout. Callers MUST treat an empty
+ * `attachmentRefs` array as absent (the canonicalization in
+ * {@link entrySignatureFieldsFromEntry} guarantees this) and emit refs in a
+ * stable order (the writer sorts by `attachmentId`) so signing and verification
+ * produce identical bytes.
+ *
+ * The provenance block embeds the source entry's signing bytes by recursing
+ * into this same function, which is what lets a verifier re-derive the exact
+ * bytes the original author signed.
  */
 function buildEntrySigningBytes(fields, version = exports.ENTRY_SIGNATURE_LAYOUT_VERSION) {
     const parts = [];
@@ -124,6 +168,19 @@ function buildEntrySigningBytes(fields, version = exports.ENTRY_SIGNATURE_LAYOUT
             pushInt64BE(parts, ref.size);
         }
     }
+    // Second trailing block, tagged so it can never be confused with the
+    // attachmentRefs count above. Recurses to embed the source entry's own
+    // signing bytes verbatim.
+    const provenance = fields.provenance;
+    if (provenance) {
+        parts.push(new Uint8Array([exports.ENTRY_PROVENANCE_BLOCK_TAG]));
+        pushString(parts, provenance.sourceTenantId);
+        pushString(parts, provenance.sourceDbId);
+        pushLengthPrefixed(parts, buildEntrySigningBytes(provenance.source, version));
+        pushLengthPrefixed(parts, provenance.sourceMetadataSignature
+            ? base64ToBytes(provenance.sourceMetadataSignature)
+            : new Uint8Array(0));
+    }
     const total = parts.reduce((sum, p) => sum + p.length, 0);
     const out = new Uint8Array(total);
     let offset = 0;
@@ -149,6 +206,7 @@ function entrySignatureFieldsFromEntry(entry) {
         attachmentRefs: entry.attachmentRefs && entry.attachmentRefs.length > 0
             ? entry.attachmentRefs
             : undefined,
+        provenance: entry.provenance,
     };
 }
 /** Convert a PEM-encoded SPKI public key to an ArrayBuffer (dependency-free). */
@@ -157,12 +215,15 @@ function pemToArrayBuffer(pem) {
         .replace("-----BEGIN PUBLIC KEY-----", "")
         .replace("-----END PUBLIC KEY-----", "")
         .replace(/\s/g, "");
-    const binary = atob(base64);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes.buffer;
+    return base64ToBytes(base64).buffer;
+}
+/**
+ * Import a PEM-encoded Ed25519 public key for verification. Exported so
+ * provenance verification can check an embedded author key without duplicating
+ * the PEM handling.
+ */
+function importEd25519PublicKeyFromPem(publicKeyPem, subtle) {
+    return subtle.importKey("spki", pemToArrayBuffer(publicKeyPem), { name: "Ed25519" }, false, ["verify"]);
 }
 /**
  * Sign the canonical entry layout with an already-imported Ed25519 private key.
@@ -204,7 +265,7 @@ async function verifyEntrySignatureWithImportedKey(entry, encryptedData, cryptoK
  * the server's push path) where no key cache is available.
  */
 async function verifyEntrySignatureCrypto(entry, encryptedData, authorPublicKeyPem, subtle, opts) {
-    const cryptoKey = await subtle.importKey("spki", pemToArrayBuffer(authorPublicKeyPem), { name: "Ed25519" }, false, ["verify"]);
+    const cryptoKey = await importEd25519PublicKeyFromPem(authorPublicKeyPem, subtle);
     return verifyEntrySignatureWithImportedKey(entry, encryptedData, cryptoKey, subtle, opts);
 }
 //# sourceMappingURL=EntrySignature.js.map

package/dist/core/crypto/EntrySignature.js.map

@@ -1 +1 @@
-{"version":3,"file":"EntrySignature.js","sourceRoot":"","sources":["../../../src/core/crypto/EntrySignature.ts"],"names":[],"mappings":";;;AA0IA,wDAsCC;AAGD,sEA8BC;AAoBD,8CASC;AAaD,kFAyCC;AAOD,gEA2BC;AApUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;GAYG;AACU,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAsCnD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAiB;IAChE,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB,EAAE,KAAa;IACpD,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB,EAAE,KAAa;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB,EAAE,KAAa;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,sBAAsB,CACpC,MAA4B,EAC5B,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACvC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE7C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACnC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,SAAgB,6BAA6B,CAC3C,KAWC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wEAAwE;QACxE,oEAAoE;QACpE,cAAc,EACZ,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,cAAc;YACtB,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,MAA4B,EAC5B,iBAA4B,EAC5B,MAAoB,EACpB,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAqB,CAAC,CAAC;IACzG,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,mCAAmC,CACvD,KAYsC,EACtC,aAAyB,EACzB,SAAoB,EACpB,MAAoB,EACpB,IAAkC;IAElC,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,KAAK,CAAC,iBAAiB,CAAC,MAAqB,EAC7C,KAAK,CAAC,MAAqB,CAC5B,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,KAAK,CAAC,SAAS,CAAC,MAAqB,EACrC,aAAa,CAAC,MAAqB,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,0BAA0B,CAC9C,KAYsC,EACtC,aAAyB,EACzB,kBAA0B,EAC1B,MAAoB,EACpB,IAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,gBAAgB,CAAC,kBAAkB,CAAC,EACpC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,mCAAmC,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5F,CAAC"}
+{"version":3,"file":"EntrySignature.js","sourceRoot":"","sources":["../../../src/core/crypto/EntrySignature.ts"],"names":[],"mappings":";;;AAsJA,sCAOC;AAGD,sCAQC;AAyED,wDAuDC;AAGD,sEA+BC;AAgBD,sEAWC;AAMD,8CASC;AAaD,kFAyCC;AAOD,gEAqBC;AApcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;GAYG;AACU,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD;;;;;GAKG;AACU,QAAA,0BAA0B,GAAG,IAAI,CAAC;AAiG/C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC;;;GAGG;AACH,SAAgB,aAAa,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,SAAgB,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,qEAAqE;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAiB;IAChE,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB,EAAE,KAAa;IACpD,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB,EAAE,KAAa;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB,EAAE,KAAa;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,SAAgB,sBAAsB,CACpC,MAA4B,EAC5B,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACvC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE7C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACnC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,0BAA0B;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,kCAA0B,CAAC,CAAC,CAAC,CAAC;QACzD,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;QAC7C,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACzC,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,kBAAkB,CAChB,KAAK,EACL,UAAU,CAAC,uBAAuB;YAChC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,uBAAuB,CAAC;YACnD,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,SAAgB,6BAA6B,CAC3C,KAWoC;IAEpC,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wEAAwE;QACxE,oEAAoE;QACpE,cAAc,EACZ,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,cAAc;YACtB,CAAC,CAAC,SAAS;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,MAAqB,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAgB,6BAA6B,CAC3C,YAAoB,EACpB,MAAoB;IAEpB,OAAO,MAAM,CAAC,SAAS,CACrB,MAAM,EACN,gBAAgB,CAAC,YAAY,CAAC,EAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,MAA4B,EAC5B,iBAA4B,EAC5B,MAAoB,EACpB,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAqB,CAAC,CAAC;IACzG,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,mCAAmC,CACvD,KAYoE,EACpE,aAAyB,EACzB,SAAoB,EACpB,MAAoB,EACpB,IAAkC;IAElC,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,KAAK,CAAC,iBAAiB,CAAC,MAAqB,EAC7C,KAAK,CAAC,MAAqB,CAC5B,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,KAAK,CAAC,SAAS,CAAC,MAAqB,EACrC,aAAa,CAAC,MAAqB,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,0BAA0B,CAC9C,KAYoE,EACpE,aAAyB,EACzB,kBAA0B,EAC1B,MAAoB,EACpB,IAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAClF,OAAO,mCAAmC,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5F,CAAC"}

package/dist/core/index.d.ts

@@ -13,6 +13,27 @@ export type { CryptoAdapter } from "./crypto/CryptoAdapter";
 export { RSAEncryption } from "./crypto/RSAEncryption";
 export { MindooDocSigner } from "./crypto/MindooDocSigner";
 export { decryptEncryptedField, getEncryptedFieldKeyId, type EncryptedFieldDecryptor, } from "./crypto/encryptedFields";
+export type { EntryProvenance, EntrySignatureFields, } from "./crypto/EntrySignature";
+/**
+ * Signature-verification primitives.
+ *
+ * Exported so an *outside* party — an evidence-bundle verifier, an auditor's
+ * own tooling — can check MindooDB's claims with the same code that made them,
+ * without a tenant, a server or a key. `verifyEntrySignatureCrypto` needs the
+ * ciphertext only on the legacy path; given a `metadataSignature` it rebuilds
+ * the signed bytes from metadata alone, so an entry chain is verifiable while
+ * disclosing nothing about what any change contained.
+ */
+export { buildEntrySigningBytes, entrySignatureFieldsFromEntry, importEd25519PublicKeyFromPem, verifyEntrySignatureCrypto, verifyEntrySignatureWithImportedKey, base64ToBytes, bytesToBase64, ENTRY_SIGNATURE_LAYOUT_VERSION, } from "./crypto/EntrySignature";
+export { buildWitnessSigningBytes, verifyWitnessReceipt, witnessFieldsFromEntry, WITNESS_RECEIPT_LAYOUT_VERSION, type StampedWitnessFields, type WitnessReceiptFields, } from "./crypto/WitnessReceipt";
+export { entryTrustedTime, isProvisional } from "./storeEntryTime";
+export { assertAllowedSigningDomain, buildDomainStatementBytes, isAllowedSigningDomain, InvalidSigningDomainError, MAX_DOMAIN_STATEMENT_BYTES, SIGNING_DOMAINS, type SigningDomain, } from "./crypto/DomainStatement";
+export { BROWSER_REACHABLE_TSA, DEFAULT_TIMESTAMP_TIMEOUT_MS, MAX_TIMESTAMP_RESPONSE_BYTES, TIMESTAMP_QUERY_CONTENT_TYPE, TIMESTAMP_REPLY_CONTENT_TYPE, TimestampRequestError, requestTimestampDirect, requestTimestampViaProxy, requestTimestampWithFallback, type ProxyTimestampOptions, type TimestampSource, type TimestampTokenResult, type TimestampWithFallbackOptions, } from "./timestamps/timestampClient";
+export type { CopyDocumentAuthorship, CopyDocumentFailure, CopyDocumentMode, CopyDocumentOptions, CopyDocumentResult, CopyDocumentSelector, CopyDocumentsOptions, CopyDocumentsResult, CopyFeasibility, CopyFeasibilityReason, CopyFeasibilityReasonCode, CopyProgress, CopyProgressPhase, CopyStrategy, } from "./copy/types";
+export { verifyEntryProvenance, type ProvenanceVerification, type ProvenanceVerificationStatus, } from "./copy/provenance";
+export { buildDocHistoryPurgeRequest } from "./copy/copyDocuments";
+export type { FlattenedDocumentProvenance } from "./copy/flatten";
+export type { CopyAdmissionCheck, CopyAdmissionPreflight, } from "./copy/preflight";
 export { KeyBag, type KeyDetail } from "./keys/KeyBag";
 export { encodeMindooURI, decodeMindooURI, isMindooURI, encodeKeyDistributionRequest, decodeKeyDistributionRequest, encodeAppDistributionRequest, decodeAppDistributionRequest, encodeSyncSetupPolicyRequest, decodeSyncSetupPolicyRequest, encodeDocHistoryPurgeRequest, decodeDocHistoryPurgeRequest, type MindooURIType, type DecodedMindooURI, } from "./uri/MindooURI";
 export { SymmetricKeyNotFoundError, DocumentNotFoundError, DocumentDeletedError, isDocumentMissingError, } from "./errors";

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAGA,cAAc,SAAS,CAAC;AACxB,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AAMrC,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG5D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAGvD,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAGlB,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG/F,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,+BAA+B,EAC/B,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,kDAAkD,CAAC;AAGvI,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AACzF,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC5G,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,YAAY,GACb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACpH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,aAAa,EACb,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,sCAAsC,EAC3C,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gCAAgC,EAChC,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,GAC5B,MAAM,mCAAmC,CAAC;AAI3C,cAAc,eAAe,CAAC;AAG9B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,qCAAqC,EAC1C,oBAAoB,EACpB,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,EAChC,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAGA,cAAc,SAAS,CAAC;AACxB,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AAMrC,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG5D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,eAAe,EACf,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,mCAAmC,EACnC,aAAa,EACb,aAAa,EACb,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAC9B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,8BAA8B,CAAC;AAGtC,YAAY,EACV,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,GAClC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EACV,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAGvD,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,EACX,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAGlB,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG/F,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,+BAA+B,EAC/B,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,MAAM,kDAAkD,CAAC;AAGvI,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AACzF,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAC5G,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,YAAY,GACb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACpH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG1E,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,aAAa,EACb,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,YAAY,EACZ,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,sCAAsC,EAC3C,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gCAAgC,EAChC,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,GAC5B,MAAM,mCAAmC,CAAC;AAI3C,cAAc,eAAe,CAAC;AAG9B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,qCAAqC,EAC1C,oBAAoB,EACpB,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,gCAAgC,EAChC,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/core/index.js

@@ -15,9 +15,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeKeyDistributionRequest = exports.encodeKeyDistributionRequest = exports.isMindooURI = exports.decodeMindooURI = exports.encodeMindooURI = exports.KeyBag = exports.getEncryptedFieldKeyId = exports.decryptEncryptedField = exports.MindooDocSigner = exports.RSAEncryption = exports.MindooDBServerAdmin = exports.BaseMindooTenantFactory = exports.BaseMindooTenant = exports.BaseMindooDB = exports.AccessDeniedError = exports.nodeCovering = exports.createGenesisNode = exports.ACL_DOC_HISTORY_PURGE_PREFIX = exports.DOC_HISTORY_PURGE_TYPE = exports.validateDocHistoryPurge = exports.isDocHistoryPurgeDocId = exports.aclDocHistoryPurgeDocId = exports.ACL_SYNC_SETUP_POLICY_PREFIX = exports.SYNC_SETUP_POLICY_MODES = exports.SYNC_SETUP_POLICY_TYPE = exports.validateSyncSetupPolicy = exports.isSyncSetupPolicyDocId = exports.aclSyncSetupPolicyDocId = exports.ACL_APP_DISTRIBUTION_PREFIX = exports.APP_DISTRIBUTION_TYPE = exports.validateAppDistribution = exports.isAppDistributionDocId = exports.aclAppDistributionDocId = exports.PROTECTED_DISTRIBUTION_KEY_IDS = exports.ACL_KEY_DISTRIBUTION_PREFIX = exports.KEY_DISTRIBUTION_TYPE = exports.validateKeyDistribution = exports.isKeyDistributionDocId = exports.aclKeyDistributionDocId = exports.decodeAclIdComponent = exports.encodeAclIdComponent = exports.aclTrustedWitnessDocId = exports.aclRuleDocId = exports.aclDbPolicyDocId = exports.effectivePolicy = exports.RULE_TYPE_TO_DENY_FIELD = exports.RULE_TYPES = exports.DEFAULT_POLICY_DEFAULTS = exports.ACL_DEFAULT_POLICY_DOC_ID = exports.ACCESS_CONTROL_FORM = void 0;
-exports.WithCategories = exports.CategorizationStyle = exports.TotalMode = exports.ColumnSorting = exports.MindooDBVirtualViewDataProvider = exports.VirtualViewDataChange = exports.VirtualViewEntryData = exports.VirtualViewNavigator = exports.VirtualViewColumn = exports.VirtualViewNavigatorBuilder = exports.VirtualViewBuilder = exports.VirtualViewFactory = exports.VirtualView = exports.HttpTransport = exports.ClientNetworkContentAddressedStore = exports.NetworkError = exports.NetworkErrorType = exports.AuthenticationService = exports.InMemoryContentAddressedStoreFactory = exports.InMemoryContentAddressedStore = exports.createQuantizedTimeSource = exports.setSemanticTimeSourceForTesting = exports.semanticNow = exports.computeContentHash = exports.extractDocIdFromEntryId = exports.isAttachmentChunkId = exports.isDocEntryId = exports.parseAttachmentChunkId = exports.parseDocEntryId = exports.generateChunkUuid7 = exports.generateFileUuid7 = exports.generateUniqueAttachmentChunkId = exports.generateAttachmentChunkId = exports.generateDepsFingerprint = exports.generateDocEntryId = exports.matchesDocIdPrefix = exports.generateDocId = exports.CacheManager = exports.EncryptedLocalCacheStore = exports.InMemoryLocalCacheStore = exports.isDocumentMissingError = exports.DocumentDeletedError = exports.DocumentNotFoundError = exports.SymmetricKeyNotFoundError = exports.decodeDocHistoryPurgeRequest = exports.encodeDocHistoryPurgeRequest = exports.decodeSyncSetupPolicyRequest = exports.encodeSyncSetupPolicyRequest = exports.decodeAppDistributionRequest = exports.encodeAppDistributionRequest = void 0;
-exports.sanitizeExtractionConfig = exports.EXTRACTION_SETUP_FIELD = exports.DEFAULT_FULLTEXT_MAX_FIELD_BYTES = exports.FULLTEXT_INDEX_FORMAT_VERSION = exports.FULLTEXT_ATTACHMENT_FIELD = exports.FULLTEXT_SETUP_FIELD = exports.extractFulltextFields = exports.collectPlainText = exports.computeFulltextConfigFingerprint = exports.sanitizeFulltextConfig = exports.resolveFulltextConfig = exports.createTokenizer = exports.MiniSearchAdapter = exports.DocumentFullTextIndex = exports.ATTACHMENTS_FIELD = exports.SUMMARY_SETUP_FIELD = exports.DB_SETUP_DOC_ID = exports.DEFAULT_SUMMARY_MAX_VALUE_BYTES = exports.isFieldPathCovered = exports.getSummaryFieldValue = exports.extractSummaryFields = exports.sanitizeSummaryConfig = exports.computeSummaryConfigFingerprint = exports.resolveSummaryConfig = exports.SummaryVirtualViewDataProvider = exports.DocumentSummaryStore = exports.queryViewAcross = exports.createEphemeralSummaryView = exports.EphemeralSummaryView = exports.MindooQueryError = exports.executeQueryLive = exports.executeQuery = exports.filterExpressionToDocumentFilter = exports.collectSummaryFallbackReasons = exports.createViewDataProvider = exports.SelectedOnly = exports.WithDocuments = void 0;
+exports.base64ToBytes = exports.verifyEntrySignatureWithImportedKey = exports.verifyEntrySignatureCrypto = exports.importEd25519PublicKeyFromPem = exports.entrySignatureFieldsFromEntry = exports.buildEntrySigningBytes = exports.getEncryptedFieldKeyId = exports.decryptEncryptedField = exports.MindooDocSigner = exports.RSAEncryption = exports.MindooDBServerAdmin = exports.BaseMindooTenantFactory = exports.BaseMindooTenant = exports.BaseMindooDB = exports.AccessDeniedError = exports.nodeCovering = exports.createGenesisNode = exports.ACL_DOC_HISTORY_PURGE_PREFIX = exports.DOC_HISTORY_PURGE_TYPE = exports.validateDocHistoryPurge = exports.isDocHistoryPurgeDocId = exports.aclDocHistoryPurgeDocId = exports.ACL_SYNC_SETUP_POLICY_PREFIX = exports.SYNC_SETUP_POLICY_MODES = exports.SYNC_SETUP_POLICY_TYPE = exports.validateSyncSetupPolicy = exports.isSyncSetupPolicyDocId = exports.aclSyncSetupPolicyDocId = exports.ACL_APP_DISTRIBUTION_PREFIX = exports.APP_DISTRIBUTION_TYPE = exports.validateAppDistribution = exports.isAppDistributionDocId = exports.aclAppDistributionDocId = exports.PROTECTED_DISTRIBUTION_KEY_IDS = exports.ACL_KEY_DISTRIBUTION_PREFIX = exports.KEY_DISTRIBUTION_TYPE = exports.validateKeyDistribution = exports.isKeyDistributionDocId = exports.aclKeyDistributionDocId = exports.decodeAclIdComponent = exports.encodeAclIdComponent = exports.aclTrustedWitnessDocId = exports.aclRuleDocId = exports.aclDbPolicyDocId = exports.effectivePolicy = exports.RULE_TYPE_TO_DENY_FIELD = exports.RULE_TYPES = exports.DEFAULT_POLICY_DEFAULTS = exports.ACL_DEFAULT_POLICY_DOC_ID = exports.ACCESS_CONTROL_FORM = void 0;
+exports.generateUniqueAttachmentChunkId = exports.generateAttachmentChunkId = exports.generateDepsFingerprint = exports.generateDocEntryId = exports.matchesDocIdPrefix = exports.generateDocId = exports.CacheManager = exports.EncryptedLocalCacheStore = exports.InMemoryLocalCacheStore = exports.isDocumentMissingError = exports.DocumentDeletedError = exports.DocumentNotFoundError = exports.SymmetricKeyNotFoundError = exports.decodeDocHistoryPurgeRequest = exports.encodeDocHistoryPurgeRequest = exports.decodeSyncSetupPolicyRequest = exports.encodeSyncSetupPolicyRequest = exports.decodeAppDistributionRequest = exports.encodeAppDistributionRequest = exports.decodeKeyDistributionRequest = exports.encodeKeyDistributionRequest = exports.isMindooURI = exports.decodeMindooURI = exports.encodeMindooURI = exports.KeyBag = exports.buildDocHistoryPurgeRequest = exports.verifyEntryProvenance = exports.requestTimestampWithFallback = exports.requestTimestampViaProxy = exports.requestTimestampDirect = exports.TimestampRequestError = exports.TIMESTAMP_REPLY_CONTENT_TYPE = exports.TIMESTAMP_QUERY_CONTENT_TYPE = exports.MAX_TIMESTAMP_RESPONSE_BYTES = exports.DEFAULT_TIMESTAMP_TIMEOUT_MS = exports.BROWSER_REACHABLE_TSA = exports.SIGNING_DOMAINS = exports.MAX_DOMAIN_STATEMENT_BYTES = exports.InvalidSigningDomainError = exports.isAllowedSigningDomain = exports.buildDomainStatementBytes = exports.assertAllowedSigningDomain = exports.isProvisional = exports.entryTrustedTime = exports.WITNESS_RECEIPT_LAYOUT_VERSION = exports.witnessFieldsFromEntry = exports.verifyWitnessReceipt = exports.buildWitnessSigningBytes = exports.ENTRY_SIGNATURE_LAYOUT_VERSION = exports.bytesToBase64 = void 0;
+exports.isFieldPathCovered = exports.getSummaryFieldValue = exports.extractSummaryFields = exports.sanitizeSummaryConfig = exports.computeSummaryConfigFingerprint = exports.resolveSummaryConfig = exports.SummaryVirtualViewDataProvider = exports.DocumentSummaryStore = exports.queryViewAcross = exports.createEphemeralSummaryView = exports.EphemeralSummaryView = exports.MindooQueryError = exports.executeQueryLive = exports.executeQuery = exports.filterExpressionToDocumentFilter = exports.collectSummaryFallbackReasons = exports.createViewDataProvider = exports.SelectedOnly = exports.WithDocuments = exports.WithCategories = exports.CategorizationStyle = exports.TotalMode = exports.ColumnSorting = exports.MindooDBVirtualViewDataProvider = exports.VirtualViewDataChange = exports.VirtualViewEntryData = exports.VirtualViewNavigator = exports.VirtualViewColumn = exports.VirtualViewNavigatorBuilder = exports.VirtualViewBuilder = exports.VirtualViewFactory = exports.VirtualView = exports.HttpTransport = exports.ClientNetworkContentAddressedStore = exports.NetworkError = exports.NetworkErrorType = exports.AuthenticationService = exports.InMemoryContentAddressedStoreFactory = exports.InMemoryContentAddressedStore = exports.createQuantizedTimeSource = exports.setSemanticTimeSourceForTesting = exports.semanticNow = exports.computeContentHash = exports.extractDocIdFromEntryId = exports.isAttachmentChunkId = exports.isDocEntryId = exports.parseAttachmentChunkId = exports.parseDocEntryId = exports.generateChunkUuid7 = exports.generateFileUuid7 = void 0;
+exports.sanitizeExtractionConfig = exports.EXTRACTION_SETUP_FIELD = exports.DEFAULT_FULLTEXT_MAX_FIELD_BYTES = exports.FULLTEXT_INDEX_FORMAT_VERSION = exports.FULLTEXT_ATTACHMENT_FIELD = exports.FULLTEXT_SETUP_FIELD = exports.extractFulltextFields = exports.collectPlainText = exports.computeFulltextConfigFingerprint = exports.sanitizeFulltextConfig = exports.resolveFulltextConfig = exports.createTokenizer = exports.MiniSearchAdapter = exports.DocumentFullTextIndex = exports.ATTACHMENTS_FIELD = exports.SUMMARY_SETUP_FIELD = exports.DB_SETUP_DOC_ID = exports.DEFAULT_SUMMARY_MAX_VALUE_BYTES = void 0;
 // Types
 __exportStar(require("./types"), exports);
 __exportStar(require("./databaseIdValidation"), exports);
@@ -81,6 +82,56 @@ Object.defineProperty(exports, "MindooDocSigner", { enumerable: true, get: funct
 var encryptedFields_1 = require("./crypto/encryptedFields");
 Object.defineProperty(exports, "decryptEncryptedField", { enumerable: true, get: function () { return encryptedFields_1.decryptEncryptedField; } });
 Object.defineProperty(exports, "getEncryptedFieldKeyId", { enumerable: true, get: function () { return encryptedFields_1.getEncryptedFieldKeyId; } });
+/**
+ * Signature-verification primitives.
+ *
+ * Exported so an *outside* party — an evidence-bundle verifier, an auditor's
+ * own tooling — can check MindooDB's claims with the same code that made them,
+ * without a tenant, a server or a key. `verifyEntrySignatureCrypto` needs the
+ * ciphertext only on the legacy path; given a `metadataSignature` it rebuilds
+ * the signed bytes from metadata alone, so an entry chain is verifiable while
+ * disclosing nothing about what any change contained.
+ */
+var EntrySignature_1 = require("./crypto/EntrySignature");
+Object.defineProperty(exports, "buildEntrySigningBytes", { enumerable: true, get: function () { return EntrySignature_1.buildEntrySigningBytes; } });
+Object.defineProperty(exports, "entrySignatureFieldsFromEntry", { enumerable: true, get: function () { return EntrySignature_1.entrySignatureFieldsFromEntry; } });
+Object.defineProperty(exports, "importEd25519PublicKeyFromPem", { enumerable: true, get: function () { return EntrySignature_1.importEd25519PublicKeyFromPem; } });
+Object.defineProperty(exports, "verifyEntrySignatureCrypto", { enumerable: true, get: function () { return EntrySignature_1.verifyEntrySignatureCrypto; } });
+Object.defineProperty(exports, "verifyEntrySignatureWithImportedKey", { enumerable: true, get: function () { return EntrySignature_1.verifyEntrySignatureWithImportedKey; } });
+Object.defineProperty(exports, "base64ToBytes", { enumerable: true, get: function () { return EntrySignature_1.base64ToBytes; } });
+Object.defineProperty(exports, "bytesToBase64", { enumerable: true, get: function () { return EntrySignature_1.bytesToBase64; } });
+Object.defineProperty(exports, "ENTRY_SIGNATURE_LAYOUT_VERSION", { enumerable: true, get: function () { return EntrySignature_1.ENTRY_SIGNATURE_LAYOUT_VERSION; } });
+var WitnessReceipt_1 = require("./crypto/WitnessReceipt");
+Object.defineProperty(exports, "buildWitnessSigningBytes", { enumerable: true, get: function () { return WitnessReceipt_1.buildWitnessSigningBytes; } });
+Object.defineProperty(exports, "verifyWitnessReceipt", { enumerable: true, get: function () { return WitnessReceipt_1.verifyWitnessReceipt; } });
+Object.defineProperty(exports, "witnessFieldsFromEntry", { enumerable: true, get: function () { return WitnessReceipt_1.witnessFieldsFromEntry; } });
+Object.defineProperty(exports, "WITNESS_RECEIPT_LAYOUT_VERSION", { enumerable: true, get: function () { return WitnessReceipt_1.WITNESS_RECEIPT_LAYOUT_VERSION; } });
+var storeEntryTime_1 = require("./storeEntryTime");
+Object.defineProperty(exports, "entryTrustedTime", { enumerable: true, get: function () { return storeEntryTime_1.entryTrustedTime; } });
+Object.defineProperty(exports, "isProvisional", { enumerable: true, get: function () { return storeEntryTime_1.isProvisional; } });
+// Domain-separated statement signing (approval / counter-signature seals).
+var DomainStatement_1 = require("./crypto/DomainStatement");
+Object.defineProperty(exports, "assertAllowedSigningDomain", { enumerable: true, get: function () { return DomainStatement_1.assertAllowedSigningDomain; } });
+Object.defineProperty(exports, "buildDomainStatementBytes", { enumerable: true, get: function () { return DomainStatement_1.buildDomainStatementBytes; } });
+Object.defineProperty(exports, "isAllowedSigningDomain", { enumerable: true, get: function () { return DomainStatement_1.isAllowedSigningDomain; } });
+Object.defineProperty(exports, "InvalidSigningDomainError", { enumerable: true, get: function () { return DomainStatement_1.InvalidSigningDomainError; } });
+Object.defineProperty(exports, "MAX_DOMAIN_STATEMENT_BYTES", { enumerable: true, get: function () { return DomainStatement_1.MAX_DOMAIN_STATEMENT_BYTES; } });
+Object.defineProperty(exports, "SIGNING_DOMAINS", { enumerable: true, get: function () { return DomainStatement_1.SIGNING_DOMAINS; } });
+// RFC 3161 timestamp transport (direct browser call + server proxy fallback).
+var timestampClient_1 = require("./timestamps/timestampClient");
+Object.defineProperty(exports, "BROWSER_REACHABLE_TSA", { enumerable: true, get: function () { return timestampClient_1.BROWSER_REACHABLE_TSA; } });
+Object.defineProperty(exports, "DEFAULT_TIMESTAMP_TIMEOUT_MS", { enumerable: true, get: function () { return timestampClient_1.DEFAULT_TIMESTAMP_TIMEOUT_MS; } });
+Object.defineProperty(exports, "MAX_TIMESTAMP_RESPONSE_BYTES", { enumerable: true, get: function () { return timestampClient_1.MAX_TIMESTAMP_RESPONSE_BYTES; } });
+Object.defineProperty(exports, "TIMESTAMP_QUERY_CONTENT_TYPE", { enumerable: true, get: function () { return timestampClient_1.TIMESTAMP_QUERY_CONTENT_TYPE; } });
+Object.defineProperty(exports, "TIMESTAMP_REPLY_CONTENT_TYPE", { enumerable: true, get: function () { return timestampClient_1.TIMESTAMP_REPLY_CONTENT_TYPE; } });
+Object.defineProperty(exports, "TimestampRequestError", { enumerable: true, get: function () { return timestampClient_1.TimestampRequestError; } });
+Object.defineProperty(exports, "requestTimestampDirect", { enumerable: true, get: function () { return timestampClient_1.requestTimestampDirect; } });
+Object.defineProperty(exports, "requestTimestampViaProxy", { enumerable: true, get: function () { return timestampClient_1.requestTimestampViaProxy; } });
+Object.defineProperty(exports, "requestTimestampWithFallback", { enumerable: true, get: function () { return timestampClient_1.requestTimestampWithFallback; } });
+var provenance_1 = require("./copy/provenance");
+Object.defineProperty(exports, "verifyEntryProvenance", { enumerable: true, get: function () { return provenance_1.verifyEntryProvenance; } });
+var copyDocuments_1 = require("./copy/copyDocuments");
+Object.defineProperty(exports, "buildDocHistoryPurgeRequest", { enumerable: true, get: function () { return copyDocuments_1.buildDocHistoryPurgeRequest; } });
 // Keys
 var KeyBag_1 = require("./keys/KeyBag");
 Object.defineProperty(exports, "KeyBag", { enumerable: true, get: function () { return KeyBag_1.KeyBag; } });

package/dist/core/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":";AAAA,iCAAiC;;;;;;;;;;;;;;;;;;;AAEjC,QAAQ;AACR,0CAAwB;AACxB,yDAAuC;AACvC,uDAAqC;AAErC,6EAA6E;AAC7E,+EAA+E;AAC/E,iDAAiD;AACjD,qEAAqE;AACrE,+CAgE+B;AA/D7B,4GAAA,mBAAmB,OAAA;AACnB,kHAAA,yBAAyB,OAAA;AACzB,gHAAA,uBAAuB,OAAA;AACvB,mGAAA,UAAU,OAAA;AACV,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AACf,yGAAA,gBAAgB,OAAA;AAChB,qGAAA,YAAY,OAAA;AACZ,+GAAA,sBAAsB,OAAA;AACtB,6GAAA,oBAAoB,OAAA;AACpB,6GAAA,oBAAoB,OAAA;AACpB,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,8GAAA,qBAAqB,OAAA;AACrB,oHAAA,2BAA2B,OAAA;AAC3B,uHAAA,8BAA8B,OAAA;AAC9B,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,8GAAA,qBAAqB,OAAA;AACrB,oHAAA,2BAA2B,OAAA;AAC3B,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,qHAAA,4BAA4B,OAAA;AAC5B,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,qHAAA,4BAA4B,OAAA;AAgC9B,yEAM4C;AAL1C,uHAAA,iBAAiB,OAAA;AACjB,kHAAA,YAAY,OAAA;AAKd,uEAAsE;AAA7D,sHAAA,iBAAiB,OAAA;AAK1B,eAAe;AACf,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,qEAAoE;AAA3D,kIAAA,uBAAuB,OAAA;AAEhC,6DAO+B;AAN7B,0HAAA,mBAAmB,OAAA;AAUrB,wDAAuD;AAA9C,8GAAA,aAAa,OAAA;AACtB,4DAA2D;AAAlD,kHAAA,eAAe,OAAA;AACxB,4DAIkC;AAHhC,wHAAA,qBAAqB,OAAA;AACrB,yHAAA,sBAAsB,OAAA;AAIxB,OAAO;AACP,wCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAEf,MAAM;AACN,6CAcyB;AAbvB,4GAAA,eAAe,OAAA;AACf,4GAAA,eAAe,OAAA;AACf,wGAAA,WAAW,OAAA;AACX,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAK9B,SAAS;AACT,mCAKkB;AAJhB,mHAAA,yBAAyB,OAAA;AACzB,+GAAA,qBAAqB,OAAA;AACrB,8GAAA,oBAAoB,OAAA;AACpB,gHAAA,sBAAsB,OAAA;AAKxB,2DAAkE;AAAzD,0HAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,oIAAA,wBAAwB,OAAA;AACjC,qDAA+F;AAAtF,4GAAA,YAAY,OAAA;AAErB,YAAY;AACZ,iCAkBiB;AAjBf,sGAAA,aAAa,OAAA;AACb,2GAAA,kBAAkB,OAAA;AAClB,2GAAA,kBAAkB,OAAA;AAClB,gHAAA,uBAAuB,OAAA;AACvB,kHAAA,yBAAyB,OAAA;AACzB,wHAAA,+BAA+B,OAAA;AAC/B,0GAAA,iBAAiB,OAAA;AACjB,2GAAA,kBAAkB,OAAA;AAClB,wGAAA,eAAe,OAAA;AACf,+GAAA,sBAAsB,OAAA;AACtB,qGAAA,YAAY,OAAA;AACZ,4GAAA,mBAAmB,OAAA;AACnB,gHAAA,uBAAuB,OAAA;AACvB,2GAAA,kBAAkB,OAAA;AAClB,oGAAA,WAAW,OAAA;AACX,wHAAA,+BAA+B,OAAA;AAC/B,kHAAA,yBAAyB,OAAA;AAmB3B,kGAAuI;AAA9H,8IAAA,6BAA6B,OAAA;AAAE,qJAAA,oCAAoC,OAAA;AAE5E,UAAU;AACV,0FAAyF;AAAhF,8HAAA,qBAAqB,OAAA;AAE9B,0DAU0C;AAFxC,yGAAA,gBAAgB,OAAA;AAChB,qGAAA,YAAY,OAAA;AAEd,qHAAoH;AAA3G,wJAAA,kCAAkC,OAAA;AAC3C,2EAA0E;AAAjE,8GAAA,aAAa,OAAA;AAEtB,2BAA2B;AAC3B,wDAyBiC;AAxB/B,2GAAA,WAAW,OAAA;AACX,kHAAA,kBAAkB,OAAA;AAClB,kHAAA,kBAAkB,OAAA;AAClB,2HAAA,2BAA2B,OAAA;AAC3B,iHAAA,iBAAiB,OAAA;AACjB,oHAAA,oBAAoB,OAAA;AACpB,oHAAA,oBAAoB,OAAA;AACpB,qHAAA,qBAAqB,OAAA;AACrB,+HAAA,+BAA+B,OAAA;AAC/B,6GAAA,aAAa,OAAA;AACb,yGAAA,SAAS,OAAA;AACT,mHAAA,mBAAmB,OAAA;AACnB,8GAAA,cAAc,OAAA;AACd,6GAAA,aAAa,OAAA;AACb,4GAAA,YAAY,OAAA;AAYd,qEAAqE;AACrE,8CAA8C;AAC9C,4EAO2C;AANzC,gIAAA,sBAAsB,OAAA;AACtB,uIAAA,6BAA6B,OAAA;AAC7B,0IAAA,gCAAgC,OAAA;AAMlC,qEAAqE;AACrE,uDAAuD;AACvD,gDAA8B;AAE9B,uDAAuD;AACvD,iCAkBiB;AAjBf,qGAAA,YAAY,OAAA;AACZ,yGAAA,gBAAgB,OAAA;AAChB,yGAAA,gBAAgB,OAAA;AAChB,6GAAA,oBAAoB,OAAA;AACpB,mHAAA,0BAA0B,OAAA;AAC1B,wGAAA,eAAe,OAAA;AAcjB,8DAA8D;AAC9D,8CAmB4B;AAlB1B,+GAAA,oBAAoB,OAAA;AACpB,yHAAA,8BAA8B,OAAA;AAE9B,+GAAA,oBAAoB,OAAA;AACpB,0HAAA,+BAA+B,OAAA;AAC/B,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,+GAAA,oBAAoB,OAAA;AACpB,6GAAA,kBAAkB,OAAA;AAClB,0HAAA,+BAA+B,OAAA;AAC/B,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,4GAAA,iBAAiB,OAAA;AAQnB,4EAA4E;AAC5E,gDAqB6B;AApB3B,iHAAA,qBAAqB,OAAA;AACrB,6GAAA,iBAAiB,OAAA;AACjB,2GAAA,eAAe,OAAA;AACf,iHAAA,qBAAqB,OAAA;AACrB,kHAAA,sBAAsB,OAAA;AACtB,4HAAA,gCAAgC,OAAA;AAChC,4GAAA,gBAAgB,OAAA;AAChB,iHAAA,qBAAqB,OAAA;AACrB,gHAAA,oBAAoB,OAAA;AACpB,qHAAA,yBAAyB,OAAA;AACzB,yHAAA,6BAA6B,OAAA;AAC7B,4HAAA,gCAAgC,OAAA;AAWlC,yEAAyE;AACzE,8EAA8E;AAC9E,4CAI4B;AAH1B,+GAAA,sBAAsB,OAAA;AACtB,iHAAA,wBAAwB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":";AAAA,iCAAiC;;;;;;;;;;;;;;;;;;;;AAEjC,QAAQ;AACR,0CAAwB;AACxB,yDAAuC;AACvC,uDAAqC;AAErC,6EAA6E;AAC7E,+EAA+E;AAC/E,iDAAiD;AACjD,qEAAqE;AACrE,+CAgE+B;AA/D7B,4GAAA,mBAAmB,OAAA;AACnB,kHAAA,yBAAyB,OAAA;AACzB,gHAAA,uBAAuB,OAAA;AACvB,mGAAA,UAAU,OAAA;AACV,gHAAA,uBAAuB,OAAA;AACvB,wGAAA,eAAe,OAAA;AACf,yGAAA,gBAAgB,OAAA;AAChB,qGAAA,YAAY,OAAA;AACZ,+GAAA,sBAAsB,OAAA;AACtB,6GAAA,oBAAoB,OAAA;AACpB,6GAAA,oBAAoB,OAAA;AACpB,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,8GAAA,qBAAqB,OAAA;AACrB,oHAAA,2BAA2B,OAAA;AAC3B,uHAAA,8BAA8B,OAAA;AAC9B,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,8GAAA,qBAAqB,OAAA;AACrB,oHAAA,2BAA2B,OAAA;AAC3B,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,qHAAA,4BAA4B,OAAA;AAC5B,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,gHAAA,uBAAuB,OAAA;AACvB,+GAAA,sBAAsB,OAAA;AACtB,qHAAA,4BAA4B,OAAA;AAgC9B,yEAM4C;AAL1C,uHAAA,iBAAiB,OAAA;AACjB,kHAAA,YAAY,OAAA;AAKd,uEAAsE;AAA7D,sHAAA,iBAAiB,OAAA;AAK1B,eAAe;AACf,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,qEAAoE;AAA3D,kIAAA,uBAAuB,OAAA;AAEhC,6DAO+B;AAN7B,0HAAA,mBAAmB,OAAA;AAUrB,wDAAuD;AAA9C,8GAAA,aAAa,OAAA;AACtB,4DAA2D;AAAlD,kHAAA,eAAe,OAAA;AACxB,4DAIkC;AAHhC,wHAAA,qBAAqB,OAAA;AACrB,yHAAA,sBAAsB,OAAA;AAQxB;;;;;;;;;GASG;AACH,0DASiC;AAR/B,wHAAA,sBAAsB,OAAA;AACtB,+HAAA,6BAA6B,OAAA;AAC7B,+HAAA,6BAA6B,OAAA;AAC7B,4HAAA,0BAA0B,OAAA;AAC1B,qIAAA,mCAAmC,OAAA;AACnC,+GAAA,aAAa,OAAA;AACb,+GAAA,aAAa,OAAA;AACb,gIAAA,8BAA8B,OAAA;AAEhC,0DAOiC;AAN/B,0HAAA,wBAAwB,OAAA;AACxB,sHAAA,oBAAoB,OAAA;AACpB,wHAAA,sBAAsB,OAAA;AACtB,gIAAA,8BAA8B,OAAA;AAIhC,mDAAmE;AAA1D,kHAAA,gBAAgB,OAAA;AAAE,+GAAA,aAAa,OAAA;AAExC,2EAA2E;AAC3E,4DAQkC;AAPhC,6HAAA,0BAA0B,OAAA;AAC1B,4HAAA,yBAAyB,OAAA;AACzB,yHAAA,sBAAsB,OAAA;AACtB,4HAAA,yBAAyB,OAAA;AACzB,6HAAA,0BAA0B,OAAA;AAC1B,kHAAA,eAAe,OAAA;AAIjB,8EAA8E;AAC9E,gEAcsC;AAbpC,wHAAA,qBAAqB,OAAA;AACrB,+HAAA,4BAA4B,OAAA;AAC5B,+HAAA,4BAA4B,OAAA;AAC5B,+HAAA,4BAA4B,OAAA;AAC5B,+HAAA,4BAA4B,OAAA;AAC5B,wHAAA,qBAAqB,OAAA;AACrB,yHAAA,sBAAsB,OAAA;AACtB,2HAAA,wBAAwB,OAAA;AACxB,+HAAA,4BAA4B,OAAA;AAwB9B,gDAI2B;AAHzB,mHAAA,qBAAqB,OAAA;AAIvB,sDAAmE;AAA1D,4HAAA,2BAA2B,OAAA;AAOpC,OAAO;AACP,wCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAEf,MAAM;AACN,6CAcyB;AAbvB,4GAAA,eAAe,OAAA;AACf,4GAAA,eAAe,OAAA;AACf,wGAAA,WAAW,OAAA;AACX,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAC5B,yHAAA,4BAA4B,OAAA;AAK9B,SAAS;AACT,mCAKkB;AAJhB,mHAAA,yBAAyB,OAAA;AACzB,+GAAA,qBAAqB,OAAA;AACrB,8GAAA,oBAAoB,OAAA;AACpB,gHAAA,sBAAsB,OAAA;AAKxB,2DAAkE;AAAzD,0HAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,oIAAA,wBAAwB,OAAA;AACjC,qDAA+F;AAAtF,4GAAA,YAAY,OAAA;AAErB,YAAY;AACZ,iCAkBiB;AAjBf,sGAAA,aAAa,OAAA;AACb,2GAAA,kBAAkB,OAAA;AAClB,2GAAA,kBAAkB,OAAA;AAClB,gHAAA,uBAAuB,OAAA;AACvB,kHAAA,yBAAyB,OAAA;AACzB,wHAAA,+BAA+B,OAAA;AAC/B,0GAAA,iBAAiB,OAAA;AACjB,2GAAA,kBAAkB,OAAA;AAClB,wGAAA,eAAe,OAAA;AACf,+GAAA,sBAAsB,OAAA;AACtB,qGAAA,YAAY,OAAA;AACZ,4GAAA,mBAAmB,OAAA;AACnB,gHAAA,uBAAuB,OAAA;AACvB,2GAAA,kBAAkB,OAAA;AAClB,oGAAA,WAAW,OAAA;AACX,wHAAA,+BAA+B,OAAA;AAC/B,kHAAA,yBAAyB,OAAA;AAmB3B,kGAAuI;AAA9H,8IAAA,6BAA6B,OAAA;AAAE,qJAAA,oCAAoC,OAAA;AAE5E,UAAU;AACV,0FAAyF;AAAhF,8HAAA,qBAAqB,OAAA;AAE9B,0DAU0C;AAFxC,yGAAA,gBAAgB,OAAA;AAChB,qGAAA,YAAY,OAAA;AAEd,qHAAoH;AAA3G,wJAAA,kCAAkC,OAAA;AAC3C,2EAA0E;AAAjE,8GAAA,aAAa,OAAA;AAEtB,2BAA2B;AAC3B,wDAyBiC;AAxB/B,2GAAA,WAAW,OAAA;AACX,kHAAA,kBAAkB,OAAA;AAClB,kHAAA,kBAAkB,OAAA;AAClB,2HAAA,2BAA2B,OAAA;AAC3B,iHAAA,iBAAiB,OAAA;AACjB,oHAAA,oBAAoB,OAAA;AACpB,oHAAA,oBAAoB,OAAA;AACpB,qHAAA,qBAAqB,OAAA;AACrB,+HAAA,+BAA+B,OAAA;AAC/B,6GAAA,aAAa,OAAA;AACb,yGAAA,SAAS,OAAA;AACT,mHAAA,mBAAmB,OAAA;AACnB,8GAAA,cAAc,OAAA;AACd,6GAAA,aAAa,OAAA;AACb,4GAAA,YAAY,OAAA;AAYd,qEAAqE;AACrE,8CAA8C;AAC9C,4EAO2C;AANzC,gIAAA,sBAAsB,OAAA;AACtB,uIAAA,6BAA6B,OAAA;AAC7B,0IAAA,gCAAgC,OAAA;AAMlC,qEAAqE;AACrE,uDAAuD;AACvD,gDAA8B;AAE9B,uDAAuD;AACvD,iCAkBiB;AAjBf,qGAAA,YAAY,OAAA;AACZ,yGAAA,gBAAgB,OAAA;AAChB,yGAAA,gBAAgB,OAAA;AAChB,6GAAA,oBAAoB,OAAA;AACpB,mHAAA,0BAA0B,OAAA;AAC1B,wGAAA,eAAe,OAAA;AAcjB,8DAA8D;AAC9D,8CAmB4B;AAlB1B,+GAAA,oBAAoB,OAAA;AACpB,yHAAA,8BAA8B,OAAA;AAE9B,+GAAA,oBAAoB,OAAA;AACpB,0HAAA,+BAA+B,OAAA;AAC/B,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,+GAAA,oBAAoB,OAAA;AACpB,6GAAA,kBAAkB,OAAA;AAClB,0HAAA,+BAA+B,OAAA;AAC/B,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,4GAAA,iBAAiB,OAAA;AAQnB,4EAA4E;AAC5E,gDAqB6B;AApB3B,iHAAA,qBAAqB,OAAA;AACrB,6GAAA,iBAAiB,OAAA;AACjB,2GAAA,eAAe,OAAA;AACf,iHAAA,qBAAqB,OAAA;AACrB,kHAAA,sBAAsB,OAAA;AACtB,4HAAA,gCAAgC,OAAA;AAChC,4GAAA,gBAAgB,OAAA;AAChB,iHAAA,qBAAqB,OAAA;AACrB,gHAAA,oBAAoB,OAAA;AACpB,qHAAA,yBAAyB,OAAA;AACzB,yHAAA,6BAA6B,OAAA;AAC7B,4HAAA,gCAAgC,OAAA;AAWlC,yEAAyE;AACzE,8EAA8E;AAC9E,4CAI4B;AAH1B,+GAAA,sBAAsB,OAAA;AACtB,iHAAA,wBAAwB,OAAA"}