run402 4.42.0 → 4.43.0

package/sdk/dist/namespaces/gitvault.crypto.d.ts

@@ -27,7 +27,7 @@
  */
 import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
 import { CipherSuite } from "@hpke/core";
-import type { GitvaultAllocation, GitvaultDigestLabel, GitvaultEncryptedObjectKind, GitvaultEncryptionKeypair, GitvaultEnvelopeAad, GitvaultFrameAad, GitvaultKeyEnvelope, GitvaultKeyEnvelopeReceipt, GitvaultObjectKind, GitvaultRecoveryReceipt, GitvaultSealedFrame, GitvaultSealedKeyEnvelope, GitvaultSignedObject, GitvaultSigningKeypair, GitvaultStrictParseReason, GitvaultVaultGenesis } from "./gitvault.types.js";
+import type { GitvaultAllocation, GitvaultDigestLabel, GitvaultEncryptedObjectKind, GitvaultEncryptionKeypair, GitvaultEnvelopeAad, GitvaultFormat, GitvaultFrameAad, GitvaultKeyEnvelope, GitvaultKeyEnvelopeReceipt, GitvaultObjectKind, GitvaultRecoveryReceipt, GitvaultSealedFrame, GitvaultSealedKeyEnvelope, GitvaultSignedObject, GitvaultSigningKeypair, GitvaultStrictParseReason, GitvaultSuite, GitvaultVaultGenesis } from "./gitvault.types.js";
 /** Wire format tag (retained by decision D181 across the product rename). */
 export declare const GITVAULT_FORMAT: "r402s/v0";
 /** The one V0 cryptographic suite. */
@@ -125,6 +125,15 @@ export declare function gitvaultStrictParseReason(error: unknown): GitvaultStric
 export declare function storedBytes(object: GitvaultSignedObject): Uint8Array;
 /** SHA-256 over stored bytes — what every `*_sha256` naming a signed object means. */
 export declare function storedBytesSha256(object: GitvaultSignedObject): string;
+/**
+ * Exported so the rotation producer (D195) can build the SAME
+ * signature-stripped shape `rotation_id`'s own derivation needs
+ * (`sha256(JCS(descriptor minus signature))`) without reaching into this
+ * module's private helper twice under two different names.
+ */
+export declare function gitvaultWithoutSignature<T extends {
+    signature?: unknown;
+}>(object: T): Omit<T, "signature">;
 /** Signature preimage = `"r402s/v0/" + object_kind + "\n" + JCS(object without its single top-level signature)`. */
 export declare function signaturePreimage(objectKind: GitvaultObjectKind, objectWithoutSignature: Record<string, unknown>): Uint8Array;
 export declare function ed25519PublicKey(seed: Uint8Array): Uint8Array;
@@ -166,6 +175,14 @@ export declare function deriveObjectKey(kRepo: Uint8Array, repoId: string, epoch
 /** `K_digest` info = lp("r402s/v0") ‖ lp("r402s-1") ‖ lp(repo_id) ‖ lp(epoch) ‖ lp("digest") ‖ lp(label) ‖ lp("L=32"). */
 export declare function digestKeyInfo(repoId: string, epoch: string, label: GitvaultDigestLabel): Uint8Array;
 export declare function deriveDigestKey(kRepo: Uint8Array, repoId: string, epoch: string, label: GitvaultDigestLabel): Uint8Array;
+/**
+ * The general form `deriveDigestKey` is a fixed-`ikm=K_repo` specialization
+ * of (D195/D198/D200, rev 42): every rev-42 rotation label is keyed by the
+ * SAMPLED epoch key (`K_e` for a rotation, `K_1` for genesis) instead of
+ * `K_repo` — "the value being committed IS the key being distributed"
+ * (protocol-v0.md S1). Same HKDF info construction either way.
+ */
+export declare function deriveDigestKeyFrom(ikm: Uint8Array, repoId: string, epoch: string, label: GitvaultDigestLabel): Uint8Array;
 /** Commitment = HMAC-SHA-256(K_digest(label), JCS(content)), lowercase hex. */
 export declare function keyedCommitment(kDigest: Uint8Array, content: unknown): string;
 /** The `"objectset"` content shape: `{oids:[sorted unique lowercase 40-hex]}`. */
@@ -231,8 +248,17 @@ export declare function openFrameWithAad(kObj: Uint8Array, frame: Uint8Array, aa
 export declare function gitvaultHpkeSuite(): CipherSuite;
 /** HPKE `info` (D188): lp("r402s/v0/envelope") ‖ lp("r402s-1") ‖ lp(lowerhex(SHA-256(recipient raw X25519 pubkey))) ‖ lp(created_by). */
 export declare function envelopeInfo(recipientPublicKeyRaw: Uint8Array, createdBy: string): Uint8Array;
-/** HPKE AAD (D188): JCS of exactly `{repo_id, epoch, recipient_kind:"principal", recipient_fingerprint}`. */
-export declare function envelopeAad(repoId: string, epoch: string, recipientFingerprint: string): GitvaultEnvelopeAad;
+/**
+ * HPKE AAD (D188, discriminated by `rotation_id` presence — D203, rev 42):
+ * `rotation_id` ABSENT (genesis / ADD-workaround envelope) -> the rev-41
+ * four-field form, BYTE-IDENTICAL to every existing golden HPKE digest;
+ * `rotation_id` PRESENT (a rotation-attempt envelope) -> the new five-field
+ * form. Field ORDER in the returned object does not matter (JCS sorts
+ * object members), but `rotation_id` must never be included as an explicit
+ * `null` — the two shapes are genuinely different objects, not one object
+ * with an optional-null member (protocol-v0.md S2).
+ */
+export declare function envelopeAad(repoId: string, epoch: string, recipientFingerprint: string, rotationId?: string | null): GitvaultEnvelopeAad;
 export interface GitvaultHpkeSealInput {
     recipient_public_key: Uint8Array;
     info: Uint8Array;
@@ -256,7 +282,7 @@ export interface GitvaultHpkeOpenInput {
 /** Single-shot HPKE open; any failure is `GITVAULT_HPKE_OPEN_FAILED` (never garbage plaintext). */
 export declare function hpkeOpen(input: GitvaultHpkeOpenInput): Promise<Uint8Array>;
 export interface GitvaultSealKeyEnvelopeInput {
-    /** The raw 32-byte K_repo — the ENTIRE plaintext. */
+    /** The raw 32-byte secret being distributed — `K_repo`/`K_1` at genesis, `K_e` for a rotation. */
     k_repo: Uint8Array;
     repo_id: string;
     epoch: string;
@@ -265,6 +291,13 @@ export interface GitvaultSealKeyEnvelopeInput {
     /** The creator's signing keypair; its `vk_` fingerprint becomes `created_by`. */
     signer: GitvaultSigningKeypair;
     created_at: string;
+    /**
+     * PRESENT for a rotation-attempt envelope (D195/D196, rev 42): widens the
+     * path to `(repo_id, epoch, rotation_id, recipient_fingerprint)` and the
+     * HPKE AAD to the five-field form. ABSENT/omitted for a genesis/ADD-
+     * workaround envelope — byte-identical to rev 41.
+     */
+    rotation_id?: string | null;
     /** Vector determinism only. */
     ikm_e?: Uint8Array;
 }
@@ -280,7 +313,9 @@ export interface GitvaultOpenKeyEnvelopeInput {
 /**
  * Open a `key_envelope`: exact-scalar checks → signature (strict, domain
  * `key_envelope`) → path identity (recipient fingerprint = ours) → HPKE open
- * with the D188 info/AAD. Returns the raw 32-byte K_repo.
+ * with the D188 info/AAD (widened to the five-field form when the envelope
+ * itself carries `rotation_id` — D195/D203). Returns the raw 32-byte secret
+ * (`K_repo`/`K_1` at genesis, `K_e` for a rotation).
  */
 export declare function openKeyEnvelope(input: GitvaultOpenKeyEnvelopeInput): Promise<Uint8Array>;
 export interface GitvaultBuildGenesisInput {
@@ -344,5 +379,143 @@ export declare function checkAllocation(allocation: GitvaultAllocation, expected
     org_id?: string;
     project_id?: string;
 }, servicePublicKey?: Uint8Array | string): string[];
+/** 16-hex epochs compare/increment as unsigned integers (chain.ts's `nextGeneration`, mirrored). */
+export declare function epochValue(hex16: string): bigint;
+export declare function nextEpoch(hex16: string): string;
+export interface GitvaultIncludedPair {
+    principal_id: string;
+    ek_fingerprint: string;
+}
+/**
+ * D196: `target_partition_digest = SHA-256(JCS({recipient_state_version,
+ * recipient_revocation_version, pin_manifest_version, pin_manifest_sha256,
+ * included: [sorted {principal_id, ek_fingerprint}], excluded_keyless_principal_ids:
+ * [sorted], excluded_unconfirmed_principal_ids: [sorted]}))`. The producer
+ * calls this ONCE to build the value it embeds in both the descriptor
+ * (D195) and the payload (D196); the gateway recomputes the SAME formula
+ * twice server-side and refuses on any disagreement — so a bug here is a
+ * `RECIPIENT_SET_MISMATCH` at admission time, not a silent forgery.
+ */
+export declare function computeTargetPartitionDigest(input: {
+    recipient_state_version: string;
+    recipient_revocation_version: string;
+    pin_manifest_version: string;
+    pin_manifest_sha256: string;
+    included: readonly GitvaultIncludedPair[];
+    excluded_keyless_principal_ids: readonly string[];
+    excluded_unconfirmed_principal_ids: readonly string[];
+}): string;
+/**
+ * D195: `rotation_id = lowerhex(SHA-256(JCS(the complete descriptor object,
+ * MINUS signature)))` — the full 64-hex digest, computed over the descriptor
+ * INCLUDING `attempt_key_commitment` (a field ON the descriptor). Callers
+ * pass the SIGNED descriptor (or the unsigned one — the signature member is
+ * stripped either way, matching the gateway's `computeRotationId`).
+ */
+export declare function computeRotationId(descriptor: Record<string, unknown> & {
+    signature?: unknown;
+}): string;
+/**
+ * D195's `attempt_key_commitment` preimage: the descriptor's OWN fields
+ * minus `attempt_key_commitment` itself (and minus `signature`, which does
+ * not exist yet at this point in the build) — `rotation_id` is never a
+ * member of the descriptor object at all (it is the object's derived path
+ * key), so there is nothing to additionally strip for it. Noncircular by
+ * construction: `attempt_key_commitment` must exist before `rotation_id`
+ * can be computed FROM the complete descriptor.
+ */
+export declare function attemptKeyCommitmentPreimage(descriptorFields: {
+    format: GitvaultFormat;
+    object_kind: "rotation_attempt_descriptor";
+    suite: GitvaultSuite;
+    repo_id: string;
+    base_head_sha256: string;
+    new_epoch: string;
+    recipient_state_version: string;
+    recipient_revocation_version: string;
+    pin_manifest_sha256: string;
+    target_partition_digest: string;
+    client_idempotency_key: string;
+    writer_key_id: string;
+}): Record<string, unknown>;
+/**
+ * D195/§1's `"epoch_rotation_attempt"` commitment: `HMAC-SHA-256(K_digest(
+ * "epoch_rotation_attempt", repo_id, new_epoch), JCS(the descriptor's own
+ * fields minus attempt_key_commitment), ikm=K_e)` — keyed by the SAMPLED
+ * epoch key being distributed, not `K_repo` (D195/D200/§1: "every one keyed
+ * by the SAMPLED epoch key... since the value being committed IS the key
+ * being distributed"). `K_digest`'s own `epoch` parameter is `new_epoch`
+ * (this rotation's OWN epoch) — the natural, and only internally-consistent,
+ * reading of §1's generic formula for a value that is a property of the new
+ * epoch's key; there is no gateway-side computation of this value to cross-
+ * check against (the gateway never sees `K_e`), so this is the SDK's own
+ * considered wire-shape decision, stated here rather than guessed silently.
+ */
+export declare function attemptKeyCommitment(kE: Uint8Array, repoId: string, newEpoch: string, descriptorFields: Parameters<typeof attemptKeyCommitmentPreimage>[0]): string;
+/**
+ * D200/§1's `"epoch_rotation"` commitment: `HMAC-SHA-256(K_digest(
+ * "epoch_rotation", repo_id, new_epoch), JCS({rotation_id, fingerprints:
+ * [sorted pairwise-distinct]}), ikm=K_e)`. Proves a PER-RECIPIENT self-check
+ * only (D200's narrowed claim) — never global set-coherence. A recipient
+ * who opens their own envelope recovers `K_e` + `epoch` (== `new_epoch`)
+ * directly from the envelope itself, so they can recompute this independent
+ * of the descriptor/payload — confirming `new_epoch` is the right `K_digest`
+ * epoch parameter (the same value both the producer and every recipient
+ * arrive at without coordination).
+ */
+export declare function epochRotationKeyCommitment(kE: Uint8Array, repoId: string, newEpoch: string, rotationId: string, fingerprints: readonly string[]): string;
+/**
+ * D198's genesis-specific `"vault_genesis_epoch_key"` commitment — the same
+ * per-recipient-self-check discipline applied to an N-recipient genesis,
+ * with its own noncircular preimage (no `rotation_id` exists at generation
+ * zero). Not built by this SDK's genesis path today (single-recipient
+ * genesis only); exported for vector generation / future N-recipient
+ * genesis support.
+ */
+export declare function genesisEpochKeyCommitment(k1: Uint8Array, repoId: string, fingerprints: readonly string[]): string;
+/**
+ * D195's producer obligation the round-3 review's own decisive witness
+ * forces: "a producer that cannot prove it is resuming its OWN prior
+ * in-flight attempt... MUST mint a fresh `client_idempotency_key`... before
+ * uploading any envelope." The corollary — and what actually PREVENTS the
+ * complementary-path mosaic client-side, before the descriptor's create-only
+ * CAS even gets a chance to catch it server-side — is that a fresh K_e must
+ * never equal any epoch key this client has ever locally held (constant-time
+ * comparison; a match is evidence of a broken CSPRNG or a reused seed, not a
+ * legitimate resume, since a genuine resume reuses the SAME
+ * client_idempotency_key AND therefore builds the identical descriptor, not
+ * merely the same K_e in isolation).
+ */
+export declare function checkFreshEpochKeyAgainstPriorKeys(kE: Uint8Array, priorKeys: Iterable<Uint8Array>): void;
+export type GitvaultHPartitionVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    detail: string;
+};
+/**
+ * D196's pair-level bijection, mirrored client-side as a PRE-SUBMIT
+ * self-check (the gateway's own recomputation under its live desired-state
+ * lock remains the authoritative check — this exists so a client-side
+ * partition bug surfaces as a clear local error instead of a round trip
+ * that ends in `RECIPIENT_SET_MISMATCH`).
+ */
+export declare function checkHPartition(input: {
+    desiredPrincipalIds: ReadonlySet<string>;
+    keyedPrincipalIds: ReadonlySet<string>;
+    pinnedFingerprintOf: ReadonlyMap<string, string>;
+    included: readonly GitvaultIncludedPair[];
+    excludedKeylessPrincipalIds: readonly string[];
+    excludedUnconfirmedPrincipalIds: readonly string[];
+}): GitvaultHPartitionVerdict;
+/** D197's full-map conservation rule: `next_map = prior_map + receipt-authorized additions/replacements`, deletion-by-omission forbidden. */
+export declare function checkPinManifestConservation(prior: readonly {
+    principal_id: string;
+}[], next: readonly {
+    principal_id: string;
+}[]): GitvaultHPartitionVerdict;
+/** The synthetic ledger id a path-addressed `key_envelope` gets — mirrors the gateway's `keyEnvelopeLedgerId` exactly (drift here breaks receipt pairing at upload finalize). */
+export declare function keyEnvelopeLedgerId(epoch: string, fingerprint: string, rotationId: string | null): string;
+export declare function pinManifestLedgerId(pinManifestVersion: string): string;
 export { bytesToHex, hexToBytes };
 //# sourceMappingURL=gitvault.crypto.d.ts.map

package/sdk/dist/namespaces/gitvault.crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitvault.crypto.d.ts","sourceRoot":"","sources":["../../src/namespaces/gitvault.crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH,OAAO,EAAE,UAAU,EAAE,UAAU,EAA4B,MAAM,wBAAwB,CAAC;AAG1F,OAAO,EAAE,WAAW,EAAqC,MAAM,YAAY,CAAC;AAG5E,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAI7B,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAG,UAAmB,CAAC;AACnD,sCAAsC;AACtC,eAAO,MAAM,cAAc,EAAG,SAAkB,CAAC;AACjD,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AACtD,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,EAAG,CAAa,CAAC;AACvD,eAAO,MAAM,uBAAuB,EAAG,IAAa,CAAC;AACrD,iEAAiE;AACjE,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAC9D,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,EAAG,kBAA2B,CAAC;AACvE,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAClE,mDAAmD;AACnD,eAAO,MAAM,4BAA4B,EAAG,mBAA4B,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAC3C,+FAAwG,CAAC;AAE3G;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,EACxC,4FAAqG,CAAC;AAExG,mEAAmE;AACnE,eAAO,MAAM,kCAAkC,QAI6B,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,gDAAgD,EAC3D,kMAAsM,CAAC;AAEzM,oGAAoG;AACpG,eAAO,MAAM,iDAAiD,EAC5D,0LAA8L,CAAC;AAQjM,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AACnD,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,eAAO,MAAM,eAAe,QAAuB,CAAC;AACpD,eAAO,MAAM,0BAA0B,QAAyB,CAAC;AACjE,eAAO,MAAM,sBAAsB,QAA2B,CAAC;AAC/D,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAA0C,CAAC;AAC3E,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,QAA8B,CAAC;AAC/D,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,QACyE,CAAC;AAM5G,yGAAyG;AACzG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,UAAU,CAKxE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD;AAED,oHAAoH;AACpH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ/D;AAED,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,IAAiB,GAAG,MAAM,CAEvE;AAID,iFAAiF;AACjF,wBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAM5C;AAED,+DAA+D;AAC/D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,CAEtD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnD;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAItD;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAyBD,mEAAmE;AACnE,wBAAgB,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAG9C;AAED,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGhD;AA6BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAazD;AAED,yEAAyE;AACzE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAM1F;AAID,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,MAAM,EAAE,oBAAoB,GAAG,UAAU,CAEpE;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAEtE;AAQD,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAK7H;AAID,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAE7D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAO9G;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,WAAW,EAAE,kBAAkB,CAAA;CAAE,EAC9E,sBAAsB,EAAE,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,EACjD,IAAI,EAAE,UAAU,GACf,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAG3B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAW1G;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,EAAE,OAAO,SAAiC,GAAG,IAAI,CAIpJ;AAID,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAElE;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAE9D;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAE9D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,UAA4B,GAAG,sBAAsB,CAGjG;AAED,wBAAgB,yBAAyB,CAAC,UAAU,GAAE,UAA4B,GAAG,yBAAyB,CAG7G;AAID,0HAA0H;AAC1H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAElI;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAEvJ;AAED,0HAA0H;AAC1H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAEnG;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAExH;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAE7E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAM3E;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAGzE;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAG/E;AAID,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAE9F;AAED,+HAA+H;AAC/H,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,6BAA6B,EAAE,MAAM,GAAG,IAAI,EAC5C,uBAAuB,EAAE,MAAM,GAC9B,UAAU,CAQZ;AAID,gEAAgE;AAChE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAEnI;AAED,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,2BAA2B,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,mBAAmB,CAW5E;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,2BAA2B,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,uJAAuJ;IACvJ,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAanE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,SAAM,GAAG,UAAU,CAWjH;AAMD,iIAAiI;AACjI,wBAAgB,iBAAiB,IAAI,WAAW,CAG/C;AAQD,yIAAyI;AACzI,wBAAgB,YAAY,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAE7F;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,mBAAmB,CAE5G;AAED,MAAM,WAAW,qBAAqB;IACpC,oBAAoB,EAAE,UAAU,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;IAChB,SAAS,EAAE,UAAU,CAAC;IACtB,0HAA0H;IAC1H,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,+DAA+D;AAC/D,wBAAsB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,CAAC,CAOzG;AAED,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,EAAE,UAAU,CAAC;IAClC,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;IAChB,EAAE,EAAE,UAAU,CAAC;CAChB;AAED,mGAAmG;AACnG,wBAAsB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAShF;AAED,MAAM,WAAW,4BAA4B;IAC3C,qDAAqD;IACrD,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,oBAAoB,EAAE,UAAU,CAAC;IACjC,iFAAiF;IACjF,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,2HAA2H;AAC3H,wBAAsB,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAmC7G;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,uHAAuH;IACvH,SAAS,EAAE,yBAAyB,CAAC;IACrC,iGAAiG;IACjG,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,UAAU,CAAC,CAmB9F;AAID,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,sBAAsB,CAAC;IACxC,6BAA6B,EAAE,UAAU,CAAC;IAC1C,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,oBAAoB,CAmBxF;AAED,sHAAsH;AACtH,MAAM,MAAM,6BAA6B,GACrC,gBAAgB,GAChB,gBAAgB,GAChB,gCAAgC,GAChC,eAAe,GACf,sBAAsB,GACtB,sBAAsB,GACtB,yBAAyB,GACzB,uBAAuB,GACvB,uCAAuC,GACvC,4BAA4B,CAAC;AAEjC;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,EAAE,cAAc,CAAC,EAAE,mBAAmB,GAAG,6BAA6B,EAAE,CAmB5I;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,sBAAsB,CAAC;IACxC,6BAA6B,EAAE,UAAU,CAAC;CAC3C;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iCAAiC,GAAG,uBAAuB,CAatG;AAED,MAAM,MAAM,8BAA8B,GACtC,WAAW,GACX,gBAAgB,GAChB,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,6BAA6B,GAC7B,gCAAgC,CAAC;AAErC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,oBAAoB,GAAG,8BAA8B,EAAE,CAWtI;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,MAAM,CAAC;IAAC,8BAA8B,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3J,gBAAgB,CAAC,EAAE,UAAU,GAAG,MAAM,GACrC,MAAM,EAAE,CAeV;AAED,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"gitvault.crypto.d.ts","sourceRoot":"","sources":["../../src/namespaces/gitvault.crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH,OAAO,EAAE,UAAU,EAAE,UAAU,EAA4B,MAAM,wBAAwB,CAAC;AAG1F,OAAO,EAAE,WAAW,EAAqC,MAAM,YAAY,CAAC;AAG5E,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,aAAa,EACb,oBAAoB,EACrB,MAAM,qBAAqB,CAAC;AAI7B,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAG,UAAmB,CAAC;AACnD,sCAAsC;AACtC,eAAO,MAAM,cAAc,EAAG,SAAkB,CAAC;AACjD,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AACtD,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,EAAG,CAAa,CAAC;AACvD,eAAO,MAAM,uBAAuB,EAAG,IAAa,CAAC;AACrD,iEAAiE;AACjE,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAC9D,gEAAgE;AAChE,eAAO,MAAM,2BAA2B,EAAG,kBAA2B,CAAC;AACvE,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAClE,mDAAmD;AACnD,eAAO,MAAM,4BAA4B,EAAG,mBAA4B,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAC3C,+FAAwG,CAAC;AAE3G;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,EACxC,4FAAqG,CAAC;AAExG,mEAAmE;AACnE,eAAO,MAAM,kCAAkC,QAI6B,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,gDAAgD,EAC3D,kMAAsM,CAAC;AAEzM,oGAAoG;AACpG,eAAO,MAAM,iDAAiD,EAC5D,0LAA8L,CAAC;AAQjM,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,kBAAkB,QAAmB,CAAC;AACnD,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,eAAO,MAAM,cAAc,QAAsB,CAAC;AAClD,eAAO,MAAM,eAAe,QAAuB,CAAC;AACpD,eAAO,MAAM,0BAA0B,QAAyB,CAAC;AACjE,eAAO,MAAM,sBAAsB,QAA2B,CAAC;AAC/D,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAA0C,CAAC;AAC3E,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,QAA8B,CAAC;AAC/D,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,QACyE,CAAC;AAM5G,yGAAyG;AACzG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAO3D;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,UAAU,CAKxE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD;AAED,oHAAoH;AACpH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ/D;AAED,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,IAAiB,GAAG,MAAM,CAEvE;AAID,iFAAiF;AACjF,wBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAM5C;AAED,+DAA+D;AAC/D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,CAEtD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnD;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAItD;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAyBD,mEAAmE;AACnE,wBAAgB,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAG9C;AAED,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGhD;AA6BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAazD;AAED,yEAAyE;AACzE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAM1F;AAID,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,MAAM,EAAE,oBAAoB,GAAG,UAAU,CAEpE;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAEtE;AAQD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAE3G;AAED,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAK7H;AAID,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAE7D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAE7E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAO9G;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,WAAW,EAAE,kBAAkB,CAAA;CAAE,EAC9E,sBAAsB,EAAE,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,EACjD,IAAI,EAAE,UAAU,GACf,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAG3B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAW1G;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,EAAE,OAAO,SAAiC,GAAG,IAAI,CAIpJ;AAID,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAElE;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAE9D;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,YAAY,EAAE,UAAU,GAAG,MAAM,CAE9D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,UAA4B,GAAG,sBAAsB,CAGjG;AAED,wBAAgB,yBAAyB,CAAC,UAAU,GAAE,UAA4B,GAAG,yBAAyB,CAG7G;AAID,0HAA0H;AAC1H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAElI;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAEvJ;AAED,0HAA0H;AAC1H,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAEnG;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAExH;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAE1H;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAE7E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAM3E;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAGzE;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAG/E;AAID,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAE9F;AAED,+HAA+H;AAC/H,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,6BAA6B,EAAE,MAAM,GAAG,IAAI,EAC5C,uBAAuB,EAAE,MAAM,GAC9B,UAAU,CAQZ;AAID,gEAAgE;AAChE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAEnI;AAED,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,2BAA2B,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,mBAAmB,CAW5E;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,2BAA2B,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,uJAAuJ;IACvJ,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAanE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,SAAM,GAAG,UAAU,CAWjH;AAMD,iIAAiI;AACjI,wBAAgB,iBAAiB,IAAI,WAAW,CAG/C;AAQD,yIAAyI;AACzI,wBAAgB,YAAY,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAE7F;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,mBAAmB,CAKxI;AAED,MAAM,WAAW,qBAAqB;IACpC,oBAAoB,EAAE,UAAU,CAAC;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;IAChB,SAAS,EAAE,UAAU,CAAC;IACtB,0HAA0H;IAC1H,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,+DAA+D;AAC/D,wBAAsB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,CAAC,CAOzG;AAED,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,EAAE,UAAU,CAAC;IAClC,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;IAChB,EAAE,EAAE,UAAU,CAAC;CAChB;AAED,mGAAmG;AACnG,wBAAsB,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAShF;AAED,MAAM,WAAW,4BAA4B;IAC3C,kGAAkG;IAClG,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,oBAAoB,EAAE,UAAU,CAAC;IACjC,iFAAiF;IACjF,MAAM,EAAE,sBAAsB,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+BAA+B;IAC/B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,2HAA2H;AAC3H,wBAAsB,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4C7G;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,uHAAuH;IACvH,SAAS,EAAE,yBAAyB,CAAC;IACrC,iGAAiG;IACjG,iBAAiB,EAAE,UAAU,GAAG,MAAM,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,UAAU,CAAC,CAmB9F;AAID,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,sBAAsB,CAAC;IACxC,6BAA6B,EAAE,UAAU,CAAC;IAC1C,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,oBAAoB,CAmBxF;AAED,sHAAsH;AACtH,MAAM,MAAM,6BAA6B,GACrC,gBAAgB,GAChB,gBAAgB,GAChB,gCAAgC,GAChC,eAAe,GACf,sBAAsB,GACtB,sBAAsB,GACtB,yBAAyB,GACzB,uBAAuB,GACvB,uCAAuC,GACvC,4BAA4B,CAAC;AAEjC;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,EAAE,cAAc,CAAC,EAAE,mBAAmB,GAAG,6BAA6B,EAAE,CAmB5I;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,sBAAsB,CAAC;IACxC,6BAA6B,EAAE,UAAU,CAAC;CAC3C;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iCAAiC,GAAG,uBAAuB,CAatG;AAED,MAAM,MAAM,8BAA8B,GACtC,WAAW,GACX,gBAAgB,GAChB,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,6BAA6B,GAC7B,gCAAgC,CAAC;AAErC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,oBAAoB,GAAG,8BAA8B,EAAE,CAWtI;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,MAAM,CAAC;IAAC,8BAA8B,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3J,gBAAgB,CAAC,EAAE,UAAU,GAAG,MAAM,GACrC,MAAM,EAAE,CAeV;AAaD,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAMD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,uBAAuB,EAAE,MAAM,CAAC;IAChC,4BAA4B,EAAE,MAAM,CAAC;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1C,8BAA8B,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,kCAAkC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvD,GAAG,MAAM,CAYT;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAEvG;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,gBAAgB,EAAE;IAC7D,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,6BAA6B,CAAC;IAC3C,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,CAAC;IAChC,4BAA4B,EAAE,MAAM,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAGnK;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAGxJ;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAGjH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kCAAkC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAQxG;AAED,MAAM,MAAM,yBAAyB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,mBAAmB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1C,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD,GAAG,yBAAyB,CAuC5B;AAED,6IAA6I;AAC7I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,EAAE,EAAE,IAAI,EAAE,SAAS;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,yBAAyB,CAW7J;AAED,iLAAiL;AACjL,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEzG;AAED,wBAAgB,mBAAmB,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC"}

package/sdk/dist/namespaces/gitvault.crypto.js

@@ -275,6 +275,15 @@ function withoutSignature(object) {
     void _signature;
     return rest;
 }
+/**
+ * Exported so the rotation producer (D195) can build the SAME
+ * signature-stripped shape `rotation_id`'s own derivation needs
+ * (`sha256(JCS(descriptor minus signature))`) without reaching into this
+ * module's private helper twice under two different names.
+ */
+export function gitvaultWithoutSignature(object) {
+    return withoutSignature(object);
+}
 /** Signature preimage = `"r402s/v0/" + object_kind + "\n" + JCS(object without its single top-level signature)`. */
 export function signaturePreimage(objectKind, objectWithoutSignature) {
     if ("signature" in objectWithoutSignature) {
@@ -372,7 +381,17 @@ export function digestKeyInfo(repoId, epoch, label) {
     return concatBytes(lp(GITVAULT_FORMAT), lp(GITVAULT_SUITE), lp(repoId), lp(epoch), lp("digest"), lp(label), lp("L=32"));
 }
 export function deriveDigestKey(kRepo, repoId, epoch, label) {
-    return hkdf(sha256, kRepo, undefined, digestKeyInfo(repoId, epoch, label), 32);
+    return deriveDigestKeyFrom(kRepo, repoId, epoch, label);
+}
+/**
+ * The general form `deriveDigestKey` is a fixed-`ikm=K_repo` specialization
+ * of (D195/D198/D200, rev 42): every rev-42 rotation label is keyed by the
+ * SAMPLED epoch key (`K_e` for a rotation, `K_1` for genesis) instead of
+ * `K_repo` — "the value being committed IS the key being distributed"
+ * (protocol-v0.md S1). Same HKDF info construction either way.
+ */
+export function deriveDigestKeyFrom(ikm, repoId, epoch, label) {
+    return hkdf(sha256, ikm, undefined, digestKeyInfo(repoId, epoch, label), 32);
 }
 /** Commitment = HMAC-SHA-256(K_digest(label), JCS(content)), lowercase hex. */
 export function keyedCommitment(kDigest, content) {
@@ -485,8 +504,20 @@ function toArrayBuffer(bytes) {
 export function envelopeInfo(recipientPublicKeyRaw, createdBy) {
     return concatBytes(lp(GITVAULT_ENVELOPE_INFO_LABEL), lp(GITVAULT_SUITE), lp(sha256Hex(recipientPublicKeyRaw)), lp(createdBy));
 }
-/** HPKE AAD (D188): JCS of exactly `{repo_id, epoch, recipient_kind:"principal", recipient_fingerprint}`. */
-export function envelopeAad(repoId, epoch, recipientFingerprint) {
+/**
+ * HPKE AAD (D188, discriminated by `rotation_id` presence — D203, rev 42):
+ * `rotation_id` ABSENT (genesis / ADD-workaround envelope) -> the rev-41
+ * four-field form, BYTE-IDENTICAL to every existing golden HPKE digest;
+ * `rotation_id` PRESENT (a rotation-attempt envelope) -> the new five-field
+ * form. Field ORDER in the returned object does not matter (JCS sorts
+ * object members), but `rotation_id` must never be included as an explicit
+ * `null` — the two shapes are genuinely different objects, not one object
+ * with an optional-null member (protocol-v0.md S2).
+ */
+export function envelopeAad(repoId, epoch, recipientFingerprint, rotationId) {
+    if (rotationId) {
+        return { repo_id: repoId, epoch, rotation_id: rotationId, recipient_kind: "principal", recipient_fingerprint: recipientFingerprint };
+    }
     return { repo_id: repoId, epoch, recipient_kind: "principal", recipient_fingerprint: recipientFingerprint };
 }
 /** Single-shot HPKE seal (Base mode) returning `{enc, ct}`. */
@@ -518,10 +549,11 @@ export async function sealKeyEnvelope(input) {
         fail("GITVAULT_BAD_TIMESTAMP", "created_at is not an RFC 3339 UTC ms timestamp", "sealing r402s/v0 key envelope");
     const createdBy = vkFingerprint(input.signer.public_key);
     const recipientFingerprint = ekFingerprint(input.recipient_public_key);
+    const rotationId = input.rotation_id ?? null;
     const { enc, ct } = await hpkeSeal({
         recipient_public_key: input.recipient_public_key,
         info: envelopeInfo(input.recipient_public_key, createdBy),
-        aad: jcs(envelopeAad(input.repo_id, input.epoch, recipientFingerprint)),
+        aad: jcs(envelopeAad(input.repo_id, input.epoch, recipientFingerprint, rotationId)),
         plaintext: input.k_repo,
         ikm_e: input.ikm_e,
     });
@@ -537,6 +569,7 @@ export async function sealKeyEnvelope(input) {
         ct: toBase64url(ct),
         created_by: createdBy,
         created_at: input.created_at,
+        ...(rotationId ? { rotation_id: rotationId } : {}),
     };
     const envelope = signGitvaultObject(unsigned, input.signer.seed);
     const bytes = storedBytes(envelope);
@@ -546,13 +579,22 @@ export async function sealKeyEnvelope(input) {
         stored_bytes: bytes,
         stored_bytes_sha256: hash,
         size_bytes: String(bytes.length),
-        receipt: { object_kind: "key_envelope", epoch: input.epoch, recipient_fingerprint: recipientFingerprint, stored_bytes_sha256: hash, size_bytes: String(bytes.length) },
+        receipt: {
+            object_kind: "key_envelope",
+            epoch: input.epoch,
+            recipient_fingerprint: recipientFingerprint,
+            stored_bytes_sha256: hash,
+            size_bytes: String(bytes.length),
+            ...(rotationId ? { rotation_id: rotationId } : {}),
+        },
     };
 }
 /**
  * Open a `key_envelope`: exact-scalar checks → signature (strict, domain
  * `key_envelope`) → path identity (recipient fingerprint = ours) → HPKE open
- * with the D188 info/AAD. Returns the raw 32-byte K_repo.
+ * with the D188 info/AAD (widened to the five-field form when the envelope
+ * itself carries `rotation_id` — D195/D203). Returns the raw 32-byte secret
+ * (`K_repo`/`K_1` at genesis, `K_e` for a rotation).
  */
 export async function openKeyEnvelope(input) {
     const env = input.envelope;
@@ -568,7 +610,7 @@ export async function openKeyEnvelope(input) {
         recipient_private_key: input.recipient.private_key,
         enc: fromBase64url(env.enc, "enc"),
         info: envelopeInfo(input.recipient.public_key, env.created_by),
-        aad: jcs(envelopeAad(env.repo_id, env.epoch, env.recipient_fingerprint)),
+        aad: jcs(envelopeAad(env.repo_id, env.epoch, env.recipient_fingerprint, env.rotation_id ?? null)),
         ct: fromBase64url(env.ct, "ct"),
     });
     if (kRepo.length !== 32)
@@ -715,5 +757,222 @@ export function checkAllocation(allocation, expected, servicePublicKey) {
         problems.push("signature");
     return problems;
 }
+// ─── Epoch rotation (D193-D203, rev 42, change gitvault-human-envelopes) ───
+//
+// Pure, isomorphic math shared by the producer (Node-only, gitvault-
+// publication.ts's `rotateEpoch`, which has the live desired-recipient
+// state + local keystore this module cannot see) and by vector generation.
+// Every formula here MIRRORS the gateway's own pure functions in
+// `packages/gateway/src/services/gitvault/epoch-rotation.ts` byte-for-byte
+// (same field order is irrelevant — JCS sorts — but the SAME field SET and
+// the SAME preimage construction is load-bearing: a drift here would build
+// a descriptor/payload the gateway's own re-derivation refuses).
+/** 16-hex epochs compare/increment as unsigned integers (chain.ts's `nextGeneration`, mirrored). */
+export function epochValue(hex16) {
+    return BigInt("0x" + hex16);
+}
+export function nextEpoch(hex16) {
+    return (epochValue(hex16) + 1n).toString(16).padStart(16, "0");
+}
+function sortedDistinct(xs) {
+    return [...new Set(xs)].sort();
+}
+/**
+ * D196: `target_partition_digest = SHA-256(JCS({recipient_state_version,
+ * recipient_revocation_version, pin_manifest_version, pin_manifest_sha256,
+ * included: [sorted {principal_id, ek_fingerprint}], excluded_keyless_principal_ids:
+ * [sorted], excluded_unconfirmed_principal_ids: [sorted]}))`. The producer
+ * calls this ONCE to build the value it embeds in both the descriptor
+ * (D195) and the payload (D196); the gateway recomputes the SAME formula
+ * twice server-side and refuses on any disagreement — so a bug here is a
+ * `RECIPIENT_SET_MISMATCH` at admission time, not a silent forgery.
+ */
+export function computeTargetPartitionDigest(input) {
+    const includedSorted = [...input.included].sort((a, b) => (a.principal_id < b.principal_id ? -1 : a.principal_id > b.principal_id ? 1 : 0));
+    const body = {
+        recipient_state_version: input.recipient_state_version,
+        recipient_revocation_version: input.recipient_revocation_version,
+        pin_manifest_version: input.pin_manifest_version,
+        pin_manifest_sha256: input.pin_manifest_sha256,
+        included: includedSorted.map((p) => ({ principal_id: p.principal_id, ek_fingerprint: p.ek_fingerprint })),
+        excluded_keyless_principal_ids: sortedDistinct(input.excluded_keyless_principal_ids),
+        excluded_unconfirmed_principal_ids: sortedDistinct(input.excluded_unconfirmed_principal_ids),
+    };
+    return sha256Hex(jcs(body));
+}
+/**
+ * D195: `rotation_id = lowerhex(SHA-256(JCS(the complete descriptor object,
+ * MINUS signature)))` — the full 64-hex digest, computed over the descriptor
+ * INCLUDING `attempt_key_commitment` (a field ON the descriptor). Callers
+ * pass the SIGNED descriptor (or the unsigned one — the signature member is
+ * stripped either way, matching the gateway's `computeRotationId`).
+ */
+export function computeRotationId(descriptor) {
+    return sha256Hex(jcs(gitvaultWithoutSignature(descriptor)));
+}
+/**
+ * D195's `attempt_key_commitment` preimage: the descriptor's OWN fields
+ * minus `attempt_key_commitment` itself (and minus `signature`, which does
+ * not exist yet at this point in the build) — `rotation_id` is never a
+ * member of the descriptor object at all (it is the object's derived path
+ * key), so there is nothing to additionally strip for it. Noncircular by
+ * construction: `attempt_key_commitment` must exist before `rotation_id`
+ * can be computed FROM the complete descriptor.
+ */
+export function attemptKeyCommitmentPreimage(descriptorFields) {
+    return { ...descriptorFields };
+}
+/**
+ * D195/§1's `"epoch_rotation_attempt"` commitment: `HMAC-SHA-256(K_digest(
+ * "epoch_rotation_attempt", repo_id, new_epoch), JCS(the descriptor's own
+ * fields minus attempt_key_commitment), ikm=K_e)` — keyed by the SAMPLED
+ * epoch key being distributed, not `K_repo` (D195/D200/§1: "every one keyed
+ * by the SAMPLED epoch key... since the value being committed IS the key
+ * being distributed"). `K_digest`'s own `epoch` parameter is `new_epoch`
+ * (this rotation's OWN epoch) — the natural, and only internally-consistent,
+ * reading of §1's generic formula for a value that is a property of the new
+ * epoch's key; there is no gateway-side computation of this value to cross-
+ * check against (the gateway never sees `K_e`), so this is the SDK's own
+ * considered wire-shape decision, stated here rather than guessed silently.
+ */
+export function attemptKeyCommitment(kE, repoId, newEpoch, descriptorFields) {
+    const kDigest = deriveDigestKeyFrom(kE, repoId, newEpoch, "epoch_rotation_attempt");
+    return keyedCommitment(kDigest, attemptKeyCommitmentPreimage(descriptorFields));
+}
+/**
+ * D200/§1's `"epoch_rotation"` commitment: `HMAC-SHA-256(K_digest(
+ * "epoch_rotation", repo_id, new_epoch), JCS({rotation_id, fingerprints:
+ * [sorted pairwise-distinct]}), ikm=K_e)`. Proves a PER-RECIPIENT self-check
+ * only (D200's narrowed claim) — never global set-coherence. A recipient
+ * who opens their own envelope recovers `K_e` + `epoch` (== `new_epoch`)
+ * directly from the envelope itself, so they can recompute this independent
+ * of the descriptor/payload — confirming `new_epoch` is the right `K_digest`
+ * epoch parameter (the same value both the producer and every recipient
+ * arrive at without coordination).
+ */
+export function epochRotationKeyCommitment(kE, repoId, newEpoch, rotationId, fingerprints) {
+    const kDigest = deriveDigestKeyFrom(kE, repoId, newEpoch, "epoch_rotation");
+    return keyedCommitment(kDigest, { rotation_id: rotationId, fingerprints: sortedDistinct(fingerprints) });
+}
+/**
+ * D198's genesis-specific `"vault_genesis_epoch_key"` commitment — the same
+ * per-recipient-self-check discipline applied to an N-recipient genesis,
+ * with its own noncircular preimage (no `rotation_id` exists at generation
+ * zero). Not built by this SDK's genesis path today (single-recipient
+ * genesis only); exported for vector generation / future N-recipient
+ * genesis support.
+ */
+export function genesisEpochKeyCommitment(k1, repoId, fingerprints) {
+    const kDigest = deriveDigestKeyFrom(k1, repoId, GITVAULT_GENESIS_EPOCH, "vault_genesis_epoch_key");
+    return keyedCommitment(kDigest, { repo_id: repoId, generation: GITVAULT_GENESIS_GENERATION, epoch: GITVAULT_GENESIS_EPOCH, fingerprints: sortedDistinct(fingerprints) });
+}
+/**
+ * D195's producer obligation the round-3 review's own decisive witness
+ * forces: "a producer that cannot prove it is resuming its OWN prior
+ * in-flight attempt... MUST mint a fresh `client_idempotency_key`... before
+ * uploading any envelope." The corollary — and what actually PREVENTS the
+ * complementary-path mosaic client-side, before the descriptor's create-only
+ * CAS even gets a chance to catch it server-side — is that a fresh K_e must
+ * never equal any epoch key this client has ever locally held (constant-time
+ * comparison; a match is evidence of a broken CSPRNG or a reused seed, not a
+ * legitimate resume, since a genuine resume reuses the SAME
+ * client_idempotency_key AND therefore builds the identical descriptor, not
+ * merely the same K_e in isolation).
+ */
+export function checkFreshEpochKeyAgainstPriorKeys(kE, priorKeys) {
+    if (kE.length !== 32)
+        fail("GITVAULT_BAD_KEY", "a freshly sampled K_e must be 32 bytes", "sampling a fresh epoch key");
+    const fresh = bytesToHex(kE);
+    for (const prior of priorKeys) {
+        if (bytesToHex(prior) === fresh) {
+            fail("GITVAULT_EPOCH_KEY_NOT_FRESH", "the freshly sampled K_e equals a prior epoch key already held locally — refusing to seal under it", "sampling a fresh epoch key");
+        }
+    }
+}
+/**
+ * D196's pair-level bijection, mirrored client-side as a PRE-SUBMIT
+ * self-check (the gateway's own recomputation under its live desired-state
+ * lock remains the authoritative check — this exists so a client-side
+ * partition bug surfaces as a clear local error instead of a round trip
+ * that ends in `RECIPIENT_SET_MISMATCH`).
+ */
+export function checkHPartition(input) {
+    const includedIds = input.included.map((p) => p.principal_id);
+    const includedFps = input.included.map((p) => p.ek_fingerprint);
+    if (new Set(includedIds).size !== includedIds.length)
+        return { ok: false, detail: "envelopes[].principal_id are not pairwise-distinct" };
+    if (new Set(includedFps).size !== includedFps.length)
+        return { ok: false, detail: "envelopes[].envelope.recipient_fingerprint are not pairwise-distinct" };
+    if (new Set(input.excludedKeylessPrincipalIds).size !== input.excludedKeylessPrincipalIds.length)
+        return { ok: false, detail: "excluded_keyless_principal_ids are not pairwise-distinct" };
+    if (new Set(input.excludedUnconfirmedPrincipalIds).size !== input.excludedUnconfirmedPrincipalIds.length)
+        return { ok: false, detail: "excluded_unconfirmed_principal_ids are not pairwise-distinct" };
+    const partition = new Map();
+    for (const id of includedIds) {
+        if (partition.has(id))
+            return { ok: false, detail: `principal ${id} appears more than once across the partition` };
+        partition.set(id, "included");
+    }
+    for (const id of input.excludedKeylessPrincipalIds) {
+        if (partition.has(id))
+            return { ok: false, detail: `principal ${id} appears more than once across the partition` };
+        partition.set(id, "keyless");
+    }
+    for (const id of input.excludedUnconfirmedPrincipalIds) {
+        if (partition.has(id))
+            return { ok: false, detail: `principal ${id} appears more than once across the partition` };
+        partition.set(id, "unconfirmed");
+    }
+    if (partition.size !== input.desiredPrincipalIds.size)
+        return { ok: false, detail: `partition covers ${partition.size} principals; H has ${input.desiredPrincipalIds.size}` };
+    for (const id of partition.keys())
+        if (!input.desiredPrincipalIds.has(id))
+            return { ok: false, detail: `principal ${id} is not in the current desired-recipient set H` };
+    for (const id of input.desiredPrincipalIds)
+        if (!partition.has(id))
+            return { ok: false, detail: `principal ${id} in H is named by neither envelopes[] nor either exclusion array` };
+    for (const pair of input.included) {
+        if (!input.keyedPrincipalIds.has(pair.principal_id))
+            return { ok: false, detail: `included principal ${pair.principal_id} has no enrolled key` };
+        const pinned = input.pinnedFingerprintOf.get(pair.principal_id);
+        if (pinned === undefined)
+            return { ok: false, detail: `included principal ${pair.principal_id} has no live pin-manifest entry` };
+        if (pinned !== pair.ek_fingerprint)
+            return { ok: false, detail: `included principal ${pair.principal_id}'s envelope fingerprint does not match the effective pin manifest's binding` };
+    }
+    for (const id of input.excludedKeylessPrincipalIds) {
+        if (input.keyedPrincipalIds.has(id))
+            return { ok: false, detail: `excluded-keyless principal ${id} actually has an enrolled key` };
+    }
+    for (const id of input.excludedUnconfirmedPrincipalIds) {
+        if (!input.keyedPrincipalIds.has(id))
+            return { ok: false, detail: `excluded-unconfirmed principal ${id} is keyless, not unconfirmed` };
+        if (input.pinnedFingerprintOf.has(id))
+            return { ok: false, detail: `excluded-unconfirmed principal ${id} actually has a live pin-manifest entry` };
+    }
+    return { ok: true };
+}
+/** D197's full-map conservation rule: `next_map = prior_map + receipt-authorized additions/replacements`, deletion-by-omission forbidden. */
+export function checkPinManifestConservation(prior, next) {
+    const nextIds = new Set(next.map((p) => p.principal_id));
+    for (const p of prior) {
+        if (!nextIds.has(p.principal_id))
+            return { ok: false, detail: `principal ${p.principal_id} present in the predecessor manifest is missing from the successor — deletion by omission is forbidden in V0` };
+    }
+    const seen = new Set();
+    for (const p of next) {
+        if (seen.has(p.principal_id))
+            return { ok: false, detail: `principal ${p.principal_id} appears more than once in the manifest` };
+        seen.add(p.principal_id);
+    }
+    return { ok: true };
+}
+/** The synthetic ledger id a path-addressed `key_envelope` gets — mirrors the gateway's `keyEnvelopeLedgerId` exactly (drift here breaks receipt pairing at upload finalize). */
+export function keyEnvelopeLedgerId(epoch, fingerprint, rotationId) {
+    return rotationId ? `key_envelope:${epoch}:${rotationId}:${fingerprint}` : `key_envelope:${epoch}:${fingerprint}`;
+}
+export function pinManifestLedgerId(pinManifestVersion) {
+    return `recipient_pin_manifest:${pinManifestVersion}`;
+}
 export { bytesToHex, hexToBytes };
 //# sourceMappingURL=gitvault.crypto.js.map