{"version":3,"file":"VaultHeader.mjs","names":[],"sources":["../../src/models/VaultHeader.ts"],"sourcesContent":["/**\n * Vault Header Model\n *\n * Based on ZK-Vault spec §5.1\n * Simplified for S3 suite (passphrase-based) initially\n */\n\nexport type SuiteId = 'S3' | 'P1' | 'H1' | string\nexport type AeadAlgorithm = 'AES-256-GCM' | 'XChaCha20-Poly1305'\nexport type PolicyMode = 'any-of' | 'all-of' | 'threshold' | 'passphrase'\n\nexport interface Argon2Params {\n  memory: number // KiB\n  iterations: number\n  parallelism: number\n}\n\nexport interface RecipientWrap {\n  kid: string\n  kem: string\n  ct: string // base64url\n}\n\nexport interface WrapAll {\n  alg: 'HKDF-join'\n  kids: string[]\n  ct: string // base64url\n}\n\nexport interface ThresholdShare {\n  kid: string\n  enc_share: {\n    kem: string\n    ct: string // base64url\n  }\n}\n\nexport interface SignatureData {\n  alg: string\n  pub: string\n  sig: string\n}\n\nexport interface GateExtension {\n  type: 'zk-gate' | 'aa-gate' | string\n  suite: string\n  context: string\n  hint?: string\n}\n\nexport interface VaultHeaderMetadata {\n  createdAt?: string\n  updatedAt?: string\n  tags?: string[]\n  description?: string\n  // Signing-related metadata\n  documentType?: string\n  filename?: string\n  signerConnectionId?: string\n  purpose?: 'signing' | 'signed-response' | string\n  originalVaultId?: string\n  signedAt?: string\n  signatureType?: string\n  receivedFrom?: string\n  receivedAt?: string\n  // Allow additional custom fields\n  [key: string]: unknown\n}\n\n/**\n * Main Vault Header Interface\n */\nexport interface VaultHeader {\n  v: 1\n  suite: SuiteId\n  aead: AeadAlgorithm\n  docId: string\n  vaultId?: string\n  epoch: number\n  nonce: string // base64url\n  kcmp: string // base64url - key commitment\n\n  // S3 suite specific\n  salt?: string // base64url - for Argon2id\n  argon2?: Argon2Params\n\n  // Policy (one of these sets will be present)\n  policy?: {\n    mode: PolicyMode\n    t?: number // threshold\n    n?: number // total shares\n  }\n\n  // Policy-specific fields\n  recipients?: RecipientWrap[] // any-of\n  wrap_all?: WrapAll // all-of\n  shares?: ThresholdShare[] // threshold\n\n  // Optional extensions\n  ext?: GateExtension[]\n  digest?: string // base64url - plaintext hash\n  sig?: SignatureData\n  metadata?: VaultHeaderMetadata\n}\n\n/**\n * Type guards\n */\nexport function isPassphraseVault(header: VaultHeader): boolean {\n  return header.suite === 'S3' && !!header.salt && !!header.argon2\n}\n\nexport function isAnyOfVault(header: VaultHeader): boolean {\n  return header.policy?.mode === 'any-of' && !!header.recipients\n}\n\nexport function isAllOfVault(header: VaultHeader): boolean {\n  return header.policy?.mode === 'all-of' && !!header.wrap_all\n}\n\nexport function isThresholdVault(header: VaultHeader): boolean {\n  return header.policy?.mode === 'threshold' && !!header.shares\n}\n"],"mappings":";;;;AA4GA,SAAgB,kBAAkB,QAA8B;AAC9D,QAAO,OAAO,UAAU,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO;;AAG5D,SAAgB,aAAa,QAA8B;AACzD,QAAO,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,OAAO;;AAGtD,SAAgB,aAAa,QAA8B;AACzD,QAAO,OAAO,QAAQ,SAAS,YAAY,CAAC,CAAC,OAAO;;AAGtD,SAAgB,iBAAiB,QAA8B;AAC7D,QAAO,OAAO,QAAQ,SAAS,eAAe,CAAC,CAAC,OAAO"}