Type Alias ReadOptions

List of KASes that may be contacted for a rewrap.

Public (or shared) keys for verifying assertions.

If set, prevents more than this number of concurrent requests to the KAS.

Optionally override client fulfillableObligationFQNs.

Optionally disable checking the allowlist.

Maximum number of segment batches that may be fetched concurrently. Adjust together with segmentBatchSize for expected throughput.

Also derived from the TDF's segment size by default. Setting one of these two does not rescale the other -- the unset one keeps its derived value.

Optionally disable assertion verification.

The platform URL.

Decrypt selected portions of ciphertext: output only length bytes of the decrypted data, starting at byte offset, both non-negative safe integers. As with Blob.slice(offset, offset + length), omitting length reads to the end, a span running past the end stops there, and an offset equal to the size of the decrypted data gives empty output. Unlike Blob.slice, an offset past the end, or a malformed range, throws a DecryptRangeError.

Only the segments needed are fetched and decrypted, and each is checked against the root-signed segment hashes. For the uniform segment layout this SDK writes, that is the covering segments, plus the one before the last when only the last covers the span; a span that reaches the end also reads the last segment, to confirm where the data ends. For any other layout, decryption starts at the first segment. The client's progressHandler reports the encrypted bytes of the segments read.

Maximum number of payload segments to fetch and decrypt per batch. Adjust together with maxConcurrentSegmentBatches for expected throughput.

Defaults to a value derived from the TDF's own segment size, so that segmentBatchSize * maxConcurrentSegmentBatches segments stay inside a fixed byte budget (see derivePrefetchWindow). Raising this raises peak memory in proportion.

The ciphertext source.

Type of key to use for wrapping responses.