GroupSecurityProvider
Defined in: packages/core/src/group-security-provider.ts:302
Stateful protocol adapter. A provider owns at most one active group and
crosses the persistence boundary only through encrypted export/import.
Returned records must expose finite own data properties, and returned byte
fields must be genuine unshared Uint8Array snapshots; coordinators detach
them before authentication, comparison, or persistence.
Properties
Section titled “Properties”lifecycleIdentity?
Section titled “lifecycleIdentity?”
readonlyoptionallifecycleIdentity?:object
Defined in: packages/core/src/group-security-provider.ts:309
Stable lifecycle identity shared by every forwarding wrapper over the same mutable provider. When omitted, the provider object itself is used. The token must never change for one provider instance.
protocol
Section titled “protocol”
readonlyprotocol:GroupSecurityProtocol
Defined in: packages/core/src/group-security-provider.ts:303
Methods
Section titled “Methods”applyCommit()
Section titled “applyCommit()”applyCommit(
commit):Promise<GroupSecurityApplyResult>
Defined in: packages/core/src/group-security-provider.ts:362
Received Add/Update credentials must be authenticated before applying.
Parameters
Section titled “Parameters”commit
Section titled “commit”Returns
Section titled “Returns”Promise<GroupSecurityApplyResult>
authenticateKeyPackageMember()
Section titled “authenticateKeyPackageMember()”authenticateKeyPackageMember(
keyPackage):Promise<Uint8Array<ArrayBufferLike>>
Defined in: packages/core/src/group-security-provider.ts:328
Validate the protocol credential carried by a public KeyPackage and derive its authenticated application member identity. This operation must be read-only and must derive the result from provider-validated package contents, never from unauthenticated caller metadata.
Parameters
Section titled “Parameters”keyPackage
Section titled “keyPackage”Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike>>
authenticateKeyPackageRequestCommitment()
Section titled “authenticateKeyPackageRequestCommitment()”authenticateKeyPackageRequestCommitment(
keyPackage):Promise<Uint8Array<ArrayBufferLike>>
Defined in: packages/core/src/group-security-provider.ts:332
Derive the request commitment authenticated by the public KeyPackage.
Parameters
Section titled “Parameters”keyPackage
Section titled “keyPackage”Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike>>
clearGroupState()?
Section titled “clearGroupState()?”
optionalclearGroupState():Promise<void>
Defined in: packages/core/src/group-security-provider.ts:378
Optionally and securely discards an active or partially-created group. Coordinators use this when a fresh provider cannot be checkpointed before bootstrap/restore. Without it, callers must discard that provider instance after an initialization failure.
Returns
Section titled “Returns”Promise<void>
clearKeyPackageState()?
Section titled “clearKeyPackageState()?”
optionalclearKeyPackageState(reference):Promise<void>
Defined in: packages/core/src/group-security-provider.ts:353
Optionally and securely discard one pending KeyPackage after a failed persistence attempt. Without it, callers must discard the provider.
Parameters
Section titled “Parameters”reference
Section titled “reference”Uint8Array
Returns
Section titled “Returns”Promise<void>
createCommit()
Section titled “createCommit()”createCommit(
input):Promise<GroupSecurityCommitResult>
Defined in: packages/core/src/group-security-provider.ts:358
Add/Update packages must authenticate to their matching memberId.
Parameters
Section titled “Parameters”Returns
Section titled “Returns”Promise<GroupSecurityCommitResult>
createGroup()
Section titled “createGroup()”createGroup(
input):Promise<GroupSecurityCreateResult>
Defined in: packages/core/src/group-security-provider.ts:355
Create a group and report the credential-authenticated creator identity.
Parameters
Section titled “Parameters”Returns
Section titled “Returns”Promise<GroupSecurityCreateResult>
createKeyPackage()
Section titled “createKeyPackage()”createKeyPackage(
input):Promise<GroupKeyPackage>
Defined in: packages/core/src/group-security-provider.ts:321
Create a globally one-time reference bound irreversibly to input.groupId.
The same private package must never be exported or consumed for another
group, including after provider restart.
Parameters
Section titled “Parameters”Returns
Section titled “Returns”Promise<GroupKeyPackage>
exportEncryptedKeyPackage()
Section titled “exportEncryptedKeyPackage()”exportEncryptedKeyPackage(
reference,protector):Promise<EncryptedKeyPackageState>
Defined in: packages/core/src/group-security-provider.ts:340
Export the one-time private state for a previously created KeyPackage. Repeated exports of an unconsumed reference must return a byte-identical envelope, allowing an ambiguous durable-write retry to compare safely.
Parameters
Section titled “Parameters”reference
Section titled “reference”Uint8Array
protector
Section titled “protector”Returns
Section titled “Returns”Promise<EncryptedKeyPackageState>
exportEncryptedState()
Section titled “exportEncryptedState()”exportEncryptedState(
protector):Promise<EncryptedGroupState>
Defined in: packages/core/src/group-security-provider.ts:365
Parameters
Section titled “Parameters”protector
Section titled “protector”Returns
Section titled “Returns”Promise<EncryptedGroupState>
exportSecret()
Section titled “exportSecret()”exportSecret(
input):Promise<Uint8Array<ArrayBufferLike>>
Defined in: packages/core/src/group-security-provider.ts:363
Parameters
Section titled “Parameters”Returns
Section titled “Returns”Promise<Uint8Array<ArrayBufferLike>>
getPublicState()
Section titled “getPublicState()”getPublicState():
Promise<GroupSecurityPublicState>
Defined in: packages/core/src/group-security-provider.ts:364
Returns
Section titled “Returns”Promise<GroupSecurityPublicState>
hasActiveGroup()
Section titled “hasActiveGroup()”hasActiveGroup():
Promise<boolean>
Defined in: packages/core/src/group-security-provider.ts:315
Report whether this provider currently owns an active group. This check
must be authoritative: lifecycle uncertainty or storage failure must
reject rather than report false.
Returns
Section titled “Returns”Promise<boolean>
importEncryptedKeyPackage()
Section titled “importEncryptedKeyPackage()”importEncryptedKeyPackage(
state,protector):Promise<GroupKeyPackage>
Defined in: packages/core/src/group-security-provider.ts:345
Restore a pending, not-yet-consumed KeyPackage after restart.
Parameters
Section titled “Parameters”protector
Section titled “protector”Returns
Section titled “Returns”Promise<GroupKeyPackage>
importEncryptedState()
Section titled “importEncryptedState()”importEncryptedState(
state,protector):Promise<GroupSecurityPublicState>
Defined in: packages/core/src/group-security-provider.ts:368
Parameters
Section titled “Parameters”protector
Section titled “protector”Returns
Section titled “Returns”Promise<GroupSecurityPublicState>
joinGroup()
Section titled “joinGroup()”joinGroup(
input):Promise<GroupSecurityPublicState>
Defined in: packages/core/src/group-security-provider.ts:356
Parameters
Section titled “Parameters”Returns
Section titled “Returns”Promise<GroupSecurityPublicState>