@darkbio/crypto 0.18.0 → 0.19.1

package/README.md

@@ -2,6 +2,7 @@
 
 [![npm](https://img.shields.io/npm/v/@darkbio/crypto)](https://www.npmjs.com/package/@darkbio/crypto)
 [![tests](https://github.com/dark-bio/crypto-ts/actions/workflows/ci.yml/badge.svg)](https://github.com/dark-bio/crypto-ts/actions/workflows/ci.yml)
+[![License: BSD-3-Clause](https://img.shields.io/badge/license-BSD--3--Clause-blue.svg)](https://github.com/dark-bio/crypto-ts/blob/main/LICENSE)
 
 This repository is parameter selection and lightweight wrapper around a number of (WASM wrapped) Rust cryptographic libraries. Its purpose isn't to implement primitives, rather to unify the API surface of existing libraries; limited to the tiny subset needed by the Dark Bio project.
 
@@ -18,14 +19,14 @@ The library is opinionated. Parameters and primitives were selected to provide m
     - **xHPKE ([RFC-9180](https://datatracker.ietf.org/doc/html/rfc9180))**: `X-WING`, `HKDF`, `SHA256`, `ChaCha20`, `Poly1305`, `dark-bio-v1:` domain prefix
         - **X-WING ([RFC-DRAFT](https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-kem))**: `MLKEM`, `ECC`
             - **ECC ([RFC-7748](https://datatracker.ietf.org/doc/html/rfc7748))**: `X25519`
-            - **MLKEM([RFC-DRAFT](https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-ikev2-mlkem))**: Security level 3 (`ML-KEM-768`)
+            - **MLKEM ([FIPS-203](https://csrc.nist.gov/pubs/fips/203/final))**: Security level 3 (`ML-KEM-768`)
     - **STREAM (*RFC N/A*, [Rage](https://github.com/str4d/rage))**: `ChaCha20`, `Poly1305`, `16B` tag, `64KB` chunk
 - Key derivation
     - **Argon2 ([RFC-9106](https://datatracker.ietf.org/doc/html/rfc9106))**: `id` variant
     - **HKDF ([RFC-5869](https://datatracker.ietf.org/doc/html/rfc5869))**: `SHA256`
 - Serialization
     - **CBOR² ([RFC-8949](https://datatracker.ietf.org/doc/html/rfc8949))**: restricted to `bool`,`null`, `integer`, `text`, `bytes`, `array`, `map[int]`, `option`
-    - **COSE ([RFC-8152](https://datatracker.ietf.org/doc/html/rfc8152))**: `COSE_Sign1`, `COSE_Encrypt0`, `dark-bio-v1:` domain prefix
+    - **COSE ([RFC-9052](https://datatracker.ietf.org/doc/html/rfc9052))**: `COSE_Sign1`, `COSE_Encrypt0`, `dark-bio-v1:` domain prefix
 - Credential / Attestation
     - **CWT ([RFC-8392](https://datatracker.ietf.org/doc/html/rfc8392))**: `xDSA`, `xHPKE`
         - **EAT ([RFC-9711](https://datatracker.ietf.org/doc/html/rfc9711))**
@@ -34,6 +35,35 @@ The library is opinionated. Parameters and primitives were selected to provide m
 
 *² CBOR encoding and decoding is delegated to [cborg](https://github.com/rvagg/cborg), a full reimplementation in TypeScript being out of scope. To ensure correctness, this package provides a type system. `cbor` codecs declare the shape of a value the way a Rust type deriving `Cbor` does, `cose` and `cwt` functions take values bound to their codec, and the canonical form of every byte crossing the WASM boundary is checked by the Rust validator, which `cbor.verify` also exposes.*
 
+## Quick start
+
+Signatures come from `xdsa`, encryption from `xhpke`, and `cose` wraps both into COSE envelopes using the Dark Bio wire profile. Payloads and authenticated messages are bound to a `cbor` codec, which declares their shape.
+
+```sh
+npm install @darkbio/crypto
+```
+
+COSE signing and verification and xHPKE encryption and decryption use an application domain that both sides must agree on. It is prefixed with `dark-bio-v1:` internally and binds the operation to one purpose. Choose distinct domains for distinct purposes. Raw `xdsa` signatures carry no such application domain, which is why the `cose` envelopes are the recommended entry point.
+
+```ts
+import { cbor, cose, xdsa, xhpke } from "@darkbio/crypto";
+
+// Long term identities, one for signing and one for receiving
+const signer = await xdsa.SecretKey.generate();
+const recipient = await xhpke.SecretKey.generate();
+const domain = new TextEncoder().encode("example");
+
+// A detached signature over a message that travels separately
+const signature = await cose.signDetached(cbor.text.value("payload"), signer, domain);
+await cose.verifyDetached(signature, cbor.text.value("payload"), signer.publicKey(), domain, 60);
+
+// Sign and encrypt a payload to the recipient, then open and verify it back.
+// The second argument is authenticated but must be supplied separately.
+const metadata = cbor.text.value("metadata");
+const sealed = await cose.seal(cbor.text.value("payload"), metadata, signer, recipient.publicKey(), domain);
+const opened = await cose.open(cbor.text.bytes(sealed), metadata, recipient, signer.publicKey(), domain, 60);
+```
+
 ## Native packages
 
 The underlying implementation exists in two sibling repos, which track the same feature set and API surfaces, released at corresponding version points.
@@ -50,3 +80,7 @@ Sibling wrapper exists in one other repo:
 Shoutout to Filippo Valsorda ([@filosottile](https://github.com/filosottile)) for lots of tips and nudges on what kind of cryptographic primitives to use and how to combine them properly; and also for his work in general on cryptography standards.
 
 Naturally, many thanks to the authors of all the libraries this project depends on.
+
+## License
+
+This library is licensed under the [BSD 3-Clause License](https://github.com/dark-bio/crypto-ts/blob/main/LICENSE).

package/dist/argon2.d.ts

@@ -1,16 +1,49 @@
 /**
- * Derive a key from password, salt, and cost parameters using Argon2id.
+ * Derives a key from the password, salt and cost parameters using Argon2id.
  *
- * RFC 9106 Section 7.4 recommends time=1, memory=2048*1024 (2GB) as sensible
- * defaults. If that much memory isn't available, increase time to compensate.
+ * RFC 9106 Section 4 recommends `time = 1`, `memory = 2 * 1024 * 1024`
+ * (2 GiB) and `threads = 4`. Its second recommendation uses `time = 3`,
+ * `memory = 64 * 1024` (64 MiB) and `threads = 4`. Both use a random 16-byte
+ * salt and a 32-byte output. A single WASM allocation stays below 2 GiB, so
+ * only the second profile fits within the memory limit below.
+ *
+ * `time` is the number of passes and `memory` is the total working memory in
+ * KiB. `threads` is Argon2's lane count, an algorithm parameter that changes
+ * the derived key. It does not select how many threads compute the key. Store
+ * the salt and all cost parameters so the same key can be reproduced on other
+ * devices.
+ *
+ * The parameters must stay within these limits:
+ *
+ * - `time` must be at least 1.
+ * - `threads` must be at least 1.
+ * - `memory` must be at least `8 * threads` KiB and at most 2097151 KiB, one
+ *   KiB short of 2 GiB.
+ * - `salt` must be at least 8 bytes.
+ * - `outLen` must be at least 4 bytes and at most 2147483647 bytes.
+ *
+ * @example
+ * ```ts
+ * import { argon2 } from "@darkbio/crypto";
+ *
+ * // Example salt only; generate and store a fresh random 16-byte salt in real code
+ * const salt = new TextEncoder().encode("example salt1234");
+ * const password = new TextEncoder().encode("password");
+ *
+ * // RFC 9106's recommended profile for memory-constrained environments
+ * const key = await argon2.key(password, salt, 3, 64 * 1024, 4, 32);
+ * console.log(key.length); // 32
+ * ```
  *
  * @param password - The password to derive from
- * @param salt - A random salt (min 8 bytes, at least 16 recommended)
- * @param time - Number of passes over memory (iterations)
- * @param memory - Memory size in KiB
- * @param threads - Degree of parallelism
- * @param outLen - Desired output length in bytes
+ * @param salt - A random salt, at least 8 bytes and 16 bytes recommended
+ * @param time - Number of passes over the memory
+ * @param memory - Size of the working memory in KiB
+ * @param threads - Argon2's lane count
+ * @param outLen - Length of the key in bytes
  * @returns The derived key
+ * @throws If a parameter is outside the limits above, or the working memory
+ *   cannot be allocated
  */
 export declare function key(password: Uint8Array, salt: Uint8Array, time: number, memory: number, threads: number, outLen: number): Promise<Uint8Array>;
 //# sourceMappingURL=argon2.d.ts.map

package/dist/argon2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"argon2.d.ts","sourceRoot":"","sources":["../src/argon2.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;GAaG;AACH,wBAAsB,GAAG,CACvB,QAAQ,EAAE,UAAU,EACpB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,CAYrB"}
+{"version":3,"file":"argon2.d.ts","sourceRoot":"","sources":["../src/argon2.ts"],"names":[],"mappings":"AAsBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAsB,GAAG,CACvB,QAAQ,EAAE,UAAU,EACpB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,CAUrB"}

package/dist/cbor.d.ts

@@ -1,11 +1,15 @@
 /** A value bound to the codec that encodes it. */
 export interface Encodable<T> {
+    /** The codec that encodes the value. */
     readonly codec: Codec<T>;
+    /** The value to encode. */
     readonly value: T;
 }
 /** Bytes bound to the codec that decodes them. */
 export interface Decodable<T> {
+    /** The codec that decodes the bytes. */
     readonly codec: Codec<T>;
+    /** The CBOR bytes to decode. */
     readonly bytes: Uint8Array;
 }
 /**
@@ -25,14 +29,20 @@ export interface Codec<T> {
 }
 /** A required field of a map, a codec at an integer key. */
 export interface Field<T> {
+    /** The integer key of the field in the map. */
     readonly key: number;
+    /** The codec of the field's value. */
     readonly codec: Codec<T>;
+    /** Marks the field as required. */
     readonly required: true;
 }
 /** An optional field of a map, absent from the map when undefined. */
 export interface OptionalField<T> {
+    /** The integer key of the field in the map. */
     readonly key: number;
+    /** The codec of the field's value. */
     readonly codec: Codec<T>;
+    /** Marks the field as optional. */
     readonly required: false;
 }
 /** The fields of a map codec, by name. */
@@ -43,7 +53,7 @@ export type Values<F extends Fields> = {
 } & {
     [K in keyof F as F[K] extends OptionalField<unknown> ? K : never]?: F[K] extends OptionalField<infer T> ? T : never;
 };
-/** The value types of a tuple codec's items. */
+/** The item codecs of a tuple codec, one per position of the value types. */
 export type Codecs<T extends unknown[]> = {
     [I in keyof T]: Codec<T[I]>;
 };
@@ -53,86 +63,166 @@ export type Codecs<T extends unknown[]> = {
  * the top.
  */
 export declare class CodecError extends Error {
+    /** What is wrong with the value. */
     readonly reason: string;
+    /** Where in the value the mismatch is, empty at the top. */
     readonly path: string;
+    /**
+     * Creates an error for a value of the wrong shape.
+     *
+     * @param reason - What is wrong with the value
+     * @param path - Where in the value the mismatch is, empty at the top
+     */
     constructor(reason: string, path?: string);
 }
 /**
- * Builds a codec from its two directions, the bindings coming for free.
+ * Builds a codec from its two directions, adding the value and bytes bindings.
+ * Both directions should throw a {@link CodecError} on a value of the wrong
+ * shape.
+ *
+ * @example
+ * ```ts
+ * import { cbor } from "@darkbio/crypto";
+ *
+ * // A date carried as whole seconds since the Unix epoch
+ * const date = cbor.codec<Date>(
+ *   (value) => cbor.uint.encode(BigInt(Math.floor(value.getTime() / 1000))),
+ *   (value) => new Date(Number(cbor.uint.decode(value)) * 1000),
+ * );
+ * const bytes = await cbor.encode(date.value(new Date("2026-01-01T00:00:00Z")));
+ * console.log(await cbor.decode(date.bytes(bytes))); // 2026-01-01T00:00:00.000Z
+ * ```
  *
  * @param encode - Converts a value into what cborg encodes
  * @param decode - Converts what cborg decoded into a value
+ * @returns The codec
  */
 export declare function codec<T>(encode: (value: T) => unknown, decode: (value: unknown) => T): Codec<T>;
 /** A boolean. */
 export declare const bool: Codec<boolean>;
-/** Null, the value of `Option<T>::None` and of a CWT's authenticated data. */
+/** Null, the counterpart of Rust's `cbor::Null` and of a `None` option. */
 export declare const nil: Codec<null>;
-/** A UTF-8 text string. */
+/**
+ * A UTF-8 text string. Decoding keeps every character, a leading U+FEFF
+ * included. Encoding rejects a string with a lone surrogate, since it has no
+ * UTF-8 form.
+ */
 export declare const text: Codec<string>;
 /** A byte string. */
 export declare const bytes: Codec<Uint8Array>;
-/** Anything, passed through as cborg decoded it, the counterpart of `cbor::Raw`. */
+/**
+ * Anything, passed through as cborg decoded it, the counterpart of
+ * `cbor::Raw`. The value is not checked against any shape, but {@link encode}
+ * and {@link decode} still check its encoding.
+ */
 export declare const raw: Codec<unknown>;
-/** An unsigned 64 bit integer. */
+/** An unsigned 64-bit integer, a bigint in both directions. */
 export declare const uint: Codec<bigint>;
-/** A signed 64 bit integer. */
+/** A signed 64-bit integer, a bigint in both directions. */
 export declare const int: Codec<bigint>;
 /**
  * A value or null, the counterpart of `Option<T>` in an array or as a
  * nullable map field.
+ *
+ * @param item - The codec of the value when it is not null
+ * @returns The codec
  */
 export declare function nullable<T>(item: Codec<T>): Codec<T | null>;
 /**
  * A member of a set of small integers, the counterpart of a Rust enum encoded
  * as its discriminant.
+ *
+ * @param values - The integers the value may take
+ * @returns The codec
  */
 export declare function enumeration<E extends number>(values: readonly E[]): Codec<E>;
-/** An array of any length of one kind of item, the counterpart of `Array<T>`. */
+/**
+ * An array of any length of one kind of item, the counterpart of `Array<T>`.
+ *
+ * @param item - The codec of every item
+ * @returns The codec
+ */
 export declare function array<T>(item: Codec<T>): Codec<T[]>;
 /**
  * An array of a fixed length with an item codec per position, the counterpart
  * of a tuple or a struct with `#[cbor(array)]`.
+ *
+ * @param items - The codec of each item, in order
+ * @returns The codec
  */
 export declare function tuple<T extends unknown[]>(...items: Codecs<T>): Codec<T>;
-/** Declares a required map field. */
+/**
+ * Declares a required map field.
+ *
+ * @param key - The integer key of the field in the map
+ * @param codec - The codec of the field's value
+ * @returns The field
+ * @throws CodecError if the key is not a safe integer
+ */
 export declare function field<T>(key: number, codec: Codec<T>): Field<T>;
 /**
  * Declares a map field that may be absent, the counterpart of an
- * `Option<T>` field, absent when undefined.
+ * `Option<T>` field. The field is left out of the map when its value is
+ * undefined.
+ *
+ * @param field - The field to make optional
+ * @returns The optional field
  */
 export declare function optional<T>(field: Field<T>): OptionalField<T>;
 /**
- * An integer keyed map with exactly the declared fields, the counterpart of
+ * An integer-keyed map with exactly the declared fields, the counterpart of
  * a struct with `#[cbor(key = N)]` fields. Both ways, a field the map does
  * not declare and a required field missing are refused, as is a key that is
  * not an integer. Only own properties of a value count as its fields.
+ *
+ * @example
+ * ```ts
+ * import { cbor } from "@darkbio/crypto";
+ *
+ * const Bar = cbor.map({
+ *   x: cbor.field(1, cbor.uint), // required
+ *   y: cbor.optional(cbor.field(2, cbor.bytes)), // omitted when undefined
+ *   z: cbor.field(3, cbor.nullable(cbor.uint)), // always present, a value or null
+ * });
+ * const bytes = await cbor.encode(Bar.value({ x: 7n, z: null }));
+ * // bytes holds a2 01 07 03 f6 in hex
+ *
+ * console.log(await cbor.decode(Bar.bytes(bytes))); // { x: 7n, z: null }
+ * ```
+ *
+ * @param fields - The fields of the map, by name
+ * @returns The codec
+ * @throws CodecError if two fields share a key
  */
 export declare function map<F extends Fields>(fields: F): Codec<Values<F>>;
 /**
- * Encodes a value bound to its codec into canonical CBOR, the bytes checked
- * by the Rust validator before they are returned.
+ * Encodes a value bound to its codec into deterministic CBOR.
  *
  * @param item - The value and the codec to encode it with
+ * @returns The CBOR bytes
  * @throws CodecError on a value of the wrong shape
+ * @throws If the encoding falls outside the restricted type system, such as a
+ *   float in a raw value or text with a lone surrogate
  */
 export declare function encode<T>(item: Encodable<T>): Promise<Uint8Array>;
 /**
- * Decodes canonical CBOR bound to its codec, the bytes checked by the Rust
- * validator before anything is decoded.
+ * Decodes deterministic CBOR bound to its codec. The bytes must pass
+ * {@link verify} before anything is decoded.
  *
  * @param item - The bytes and the codec to decode them with
+ * @returns The decoded value
+ * @throws If the bytes are not valid restricted CBOR
  * @throws CodecError on bytes of the wrong shape
  */
 export declare function decode<T>(item: Decodable<T>): Promise<T>;
 /**
- * Verify that data is valid CBOR under the restricted deterministic type
- * system used across the darkbio ecosystem (booleans, null, 64-bit integers,
- * text strings, byte strings, arrays, and integer-keyed maps).
+ * Verifies that data is exactly one complete CBOR item under the restricted
+ * type system.
  *
- * The COSE and CWT functions run this check internally on every payload they
- * sign, embed or hand back; use it directly to pre-check hand-rolled
- * encodings.
+ * It checks UTF-8 text, deterministic integer and length encodings, integer
+ * map keys in order without duplicates, and the nesting limit. It does not
+ * check application-specific schemas or values. The `cose` and `cwt`
+ * functions apply the same check to every payload they sign, embed or return.
  *
  * @param data - The CBOR bytes to validate
  * @throws If the data is not valid restricted CBOR

package/dist/cbor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cbor.d.ts","sourceRoot":"","sources":["../src/cbor.ts"],"names":[],"mappings":"AA6BA,kDAAkD;AAClD,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;CACnB;AAED,kDAAkD;AAClD,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;IAC1B,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC;IAC1B,gDAAgD;IAChD,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,8CAA8C;IAC9C,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;CACvC;AAED,4DAA4D;AAC5D,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7E,yFAAyF;AACzF,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,MAAM,IAAI;KACpC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAC3E,MAAM,CAAC,CACR,GACG,CAAC,GACD,KAAK;CACV,GAAG;KAEA,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAChE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CACpD,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE1E;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,MAAM,EAAE,IAAI,SAAK;CAMtC;AAcD;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,CAAC,EACrB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,EAC7B,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,GAC5B,KAAK,CAAC,CAAC,CAAC,CAQV;AA8BD,iBAAiB;AACjB,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,OAAO,CAG/B,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,GAAG,EAAE,KAAK,CAAC,IAAI,CAG3B,CAAC;AAEF,2BAA2B;AAC3B,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,MAAM,CAG9B,CAAC;AAEF,qBAAqB;AACrB,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,UAAU,CAGnC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,GAAG,EAAE,KAAK,CAAC,OAAO,CAG9B,CAAC;AAEF,kCAAkC;AAClC,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,MAAM,CAc9B,CAAC;AAEF,+BAA+B;AAC/B,eAAO,MAAM,GAAG,EAAE,KAAK,CAAC,MAAM,CAc7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAK3D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAS5E;AAED,iFAAiF;AACjF,wBAAgB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAmBnD;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAoBxE;AAED,qCAAqC;AACrC,wBAAgB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAK/D;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAqEjE;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAKvE;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAI9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5D"}
+{"version":3,"file":"cbor.d.ts","sourceRoot":"","sources":["../src/cbor.ts"],"names":[],"mappings":"AA4CA,kDAAkD;AAClD,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;CACnB;AAED,kDAAkD;AAClD,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;IAC1B,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC;IAC1B,gDAAgD;IAChD,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,8CAA8C;IAC9C,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;CACvC;AAED,4DAA4D;AAC5D,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7E,yFAAyF;AACzF,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,MAAM,IAAI;KACpC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAC3E,MAAM,CAAC,CACR,GACG,CAAC,GACD,KAAK;CACV,GAAG;KAEA,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAChE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CACpD,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAE1E;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;OAKG;gBACS,MAAM,EAAE,MAAM,EAAE,IAAI,SAAK;CAMtC;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,KAAK,CAAC,CAAC,EACrB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,EAC7B,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,GAC5B,KAAK,CAAC,CAAC,CAAC,CAQV;AA8BD,iBAAiB;AACjB,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,OAAO,CAG/B,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,GAAG,EAAE,KAAK,CAAC,IAAI,CAG3B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,MAAM,CAG9B,CAAC;AAEF,qBAAqB;AACrB,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,UAAU,CAGnC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,GAAG,EAAE,KAAK,CAAC,OAAO,CAG9B,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,IAAI,EAAE,KAAK,CAAC,MAAM,CAc9B,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,GAAG,EAAE,KAAK,CAAC,MAAM,CAc7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAK3D;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAS5E;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAmBnD;AAED;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAoBxE;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAK/D;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAE7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,GAAG,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAqEjE;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAKvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAI9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5D"}

package/dist/cose.d.ts

@@ -2,50 +2,181 @@ import { Decodable, Encodable } from './cbor.js';
 import { SecretKey as XdsaSecretKey, PublicKey as XdsaPublicKey, Fingerprint as XdsaFingerprint } from './xdsa.js';
 import { SecretKey as XhpkeSecretKey, PublicKey as XhpkePublicKey, Fingerprint as XhpkeFingerprint } from './xhpke.js';
 /**
- * Create a COSE_Sign1 signature with an embedded payload.
+ * Creates a COSE_Sign1 signature with an embedded payload.
+ *
+ * Uses the current system time as the signature timestamp.
+ *
+ * @param msgToEmbed - The message to sign, embedded in the envelope
+ * @param msgToAuth - Additional authenticated data, signed but not embedded
+ * @param signer - The xDSA secret key to sign with
+ * @param domain - Application domain for separating protocol purposes
+ * @returns The serialized COSE_Sign1 envelope
+ * @throws CodecError if a message does not fit its codec
+ * @throws If a message falls outside the restricted CBOR type system
  */
 export declare function sign<E, A>(msgToEmbed: Encodable<E>, msgToAuth: Encodable<A>, signer: XdsaSecretKey, domain: Uint8Array): Promise<Uint8Array>;
 /**
- * Create a COSE_Sign1 signature without an embedded payload (detached mode).
+ * Creates a COSE_Sign1 signature without an embedded payload, the envelope
+ * payload being null.
+ *
+ * The caller's message is authenticated in external_aad, and the payload in
+ * the signature input is empty. See the module's wire profile for
+ * interoperability. Uses the current system time as the signature timestamp.
+ *
+ * @param msgToAuth - The message to sign, not embedded in the envelope
+ * @param signer - The xDSA secret key to sign with
+ * @param domain - Application domain for separating protocol purposes
+ * @returns The serialized COSE_Sign1 envelope
+ * @throws CodecError if the message does not fit its codec
+ * @throws If the message falls outside the restricted CBOR type system
  */
 export declare function signDetached<A>(msgToAuth: Encodable<A>, signer: XdsaSecretKey, domain: Uint8Array): Promise<Uint8Array>;
 /**
- * Verify a COSE_Sign1 signature and return the embedded payload.
+ * Verifies a COSE_Sign1 signature and returns the embedded payload.
+ *
+ * Uses the current system time for the drift check.
+ *
+ * @param msgToCheck - The serialized COSE_Sign1 envelope, bound to the codec
+ *   of its payload
+ * @param msgToAuth - The same additional authenticated data used during signing
+ * @param verifier - The xDSA public key to verify against
+ * @param domain - Application domain for separating protocol purposes
+ * @param maxDriftSecs - Maximum allowed timestamp difference in seconds, past
+ *   or future. A value of n accepts differences up to and including n, with
+ *   fractions rounded down. Undefined skips the check.
+ * @returns The decoded payload
+ * @throws If the envelope is malformed, carries no payload or does not verify
+ *   for this key, `msgToAuth` and `domain`, or its timestamp drifts too far
+ * @throws If `maxDriftSecs` is negative or beyond 64 bits
+ * @throws CodecError if the payload or `msgToAuth` does not fit its codec
  */
 export declare function verify<T, A>(msgToCheck: Decodable<T>, msgToAuth: Encodable<A>, verifier: XdsaPublicKey, domain: Uint8Array, maxDriftSecs?: number): Promise<T>;
 /**
- * Verify a COSE_Sign1 signature with a detached payload.
+ * Verifies a COSE_Sign1 signature with a detached payload.
+ *
+ * Uses the current system time for the drift check.
+ *
+ * @param msgToCheck - The serialized COSE_Sign1 envelope, with a null payload
+ * @param msgToAuth - The same message used during signing
+ * @param verifier - The xDSA public key to verify against
+ * @param domain - Application domain for separating protocol purposes
+ * @param maxDriftSecs - Maximum allowed timestamp difference in seconds, past
+ *   or future. A value of n accepts differences up to and including n, with
+ *   fractions rounded down. Undefined skips the check.
+ * @throws If the envelope is malformed, embeds a payload or does not verify
+ *   for this key, `msgToAuth` and `domain`, or its timestamp drifts too far
+ * @throws If `maxDriftSecs` is negative or beyond 64 bits
+ * @throws CodecError if `msgToAuth` does not fit its codec
  */
 export declare function verifyDetached<A>(msgToCheck: Uint8Array, msgToAuth: Encodable<A>, verifier: XdsaPublicKey, domain: Uint8Array, maxDriftSecs?: number): Promise<void>;
 /**
- * Extract the signer's fingerprint from a COSE_Sign1 without verifying.
+ * Extracts the signer's fingerprint from a COSE_Sign1 envelope without
+ * verifying it.
+ *
+ * This allows looking up the appropriate verification key before attempting
+ * full signature verification. The fingerprint is unauthenticated.
+ *
+ * @param signature - The serialized COSE_Sign1 envelope
+ * @returns The signer's fingerprint from the protected header's `kid`
+ * @throws If the envelope is malformed
  */
 export declare function signer(signature: Uint8Array): Promise<XdsaFingerprint>;
 /**
- * Extract the embedded payload from a COSE_Sign1 without verifying.
+ * Extracts the embedded payload from a COSE_Sign1 envelope without verifying
+ * it.
+ *
+ * The payload is unauthenticated and must not be trusted until verified with
+ * {@link verify}. Use {@link signer} to extract the signer's fingerprint for
+ * key lookup.
  *
- * Warning: The returned payload is unauthenticated and should not be
- * trusted until verified with `verify`.
+ * @param signature - The serialized COSE_Sign1 envelope, bound to the codec of
+ *   its payload
+ * @returns The decoded, unverified payload
+ * @throws If the envelope is malformed or carries no payload
+ * @throws CodecError if the payload does not fit its codec
  */
 export declare function peek<T>(signature: Decodable<T>): Promise<T>;
 /**
- * Extract the recipient's fingerprint from a COSE_Encrypt0 without decrypting.
+ * Extracts the recipient's fingerprint from a COSE_Encrypt0 envelope without
+ * decrypting it.
+ *
+ * This allows looking up the appropriate decryption key before attempting
+ * full decryption. The fingerprint is unauthenticated.
+ *
+ * @param ciphertext - The serialized COSE_Encrypt0 envelope
+ * @returns The recipient's fingerprint from the protected header's `kid`
+ * @throws If the envelope is malformed
  */
 export declare function recipient(ciphertext: Uint8Array): Promise<XhpkeFingerprint>;
 /**
- * Sign a message then encrypt it to a recipient (sign-then-encrypt).
+ * Signs a message then encrypts it to a recipient.
+ *
+ * Uses the current system time as the signature timestamp.
+ *
+ * @param msgToSeal - The message to sign and encrypt
+ * @param msgToAuth - Additional authenticated data, signed and bound to the
+ *   encryption but not embedded
+ * @param signerKey - The xDSA secret key to sign with
+ * @param recipientKey - The xHPKE public key to encrypt to
+ * @param domain - Application domain for HPKE key derivation
+ * @returns The serialized COSE_Encrypt0 envelope holding the encrypted
+ *   COSE_Sign1
+ * @throws CodecError if a message does not fit its codec
+ * @throws If a message falls outside the restricted CBOR type system
  */
 export declare function seal<S, A>(msgToSeal: Encodable<S>, msgToAuth: Encodable<A>, signerKey: XdsaSecretKey, recipientKey: XhpkePublicKey, domain: Uint8Array): Promise<Uint8Array>;
 /**
- * Decrypt and verify a sealed message.
+ * Decrypts and verifies a sealed message.
+ *
+ * Uses the current system time for the drift check.
+ *
+ * @param msgToOpen - The serialized COSE_Encrypt0 envelope, bound to the codec
+ *   of its payload
+ * @param msgToAuth - The same additional authenticated data used during sealing
+ * @param recipientKey - The xHPKE secret key to decrypt with
+ * @param senderKey - The xDSA public key to verify the signature against
+ * @param domain - Application domain for HPKE key derivation
+ * @param maxDriftSecs - Maximum allowed timestamp difference in seconds, past
+ *   or future. A value of n accepts differences up to and including n, with
+ *   fractions rounded down. Undefined skips the check.
+ * @returns The decoded payload
+ * @throws If the envelope is malformed, does not decrypt or verify for these
+ *   keys, `msgToAuth` and `domain`, or its timestamp drifts too far
+ * @throws If `maxDriftSecs` is negative or beyond 64 bits
+ * @throws CodecError if the payload or `msgToAuth` does not fit its codec
  */
 export declare function open<T, A>(msgToOpen: Decodable<T>, msgToAuth: Encodable<A>, recipientKey: XhpkeSecretKey, senderKey: XdsaPublicKey, domain: Uint8Array, maxDriftSecs?: number): Promise<T>;
 /**
- * Encrypt an already-signed COSE_Sign1 to a recipient.
+ * Encrypts an already signed COSE_Sign1 envelope to a recipient.
+ *
+ * For most use cases, prefer {@link seal}, which signs and encrypts in one
+ * step. Use this only when re-encrypting a message from {@link decrypt} to a
+ * different recipient without access to the original signer's key. The
+ * envelope is encrypted as given, without being checked.
+ *
+ * @param sign1 - The COSE_Sign1 envelope, such as one from {@link decrypt}
+ * @param msgToAuth - The same additional authenticated data used during sealing
+ * @param recipientKey - The xHPKE public key to encrypt to
+ * @param domain - Application domain for HPKE key derivation
+ * @returns The serialized COSE_Encrypt0 envelope
+ * @throws CodecError if `msgToAuth` does not fit its codec
  */
 export declare function encrypt<A>(sign1: Uint8Array, msgToAuth: Encodable<A>, recipientKey: XhpkePublicKey, domain: Uint8Array): Promise<Uint8Array>;
 /**
- * Decrypt a sealed message without verifying the signature.
+ * Decrypts a sealed message without verifying the signature.
+ *
+ * This allows inspecting the signer before verification. Use {@link signer}
+ * to extract the signer's fingerprint, then {@link verify} with the same
+ * `msgToAuth` and `domain` to verify.
+ *
+ * @param msgToOpen - The serialized COSE_Encrypt0 envelope
+ * @param msgToAuth - The same additional authenticated data used during sealing
+ * @param recipientKey - The xHPKE secret key to decrypt with
+ * @param domain - Application domain for HPKE key derivation
+ * @returns The decrypted COSE_Sign1 envelope, not yet verified
+ * @throws If the envelope is malformed or does not decrypt for this key,
+ *   `msgToAuth` and `domain`
+ * @throws CodecError if `msgToAuth` does not fit its codec
  */
 export declare function decrypt<A>(msgToOpen: Uint8Array, msgToAuth: Encodable<A>, recipientKey: XhpkeSecretKey, domain: Uint8Array): Promise<Uint8Array>;
 //# sourceMappingURL=cose.d.ts.map

package/dist/cose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../src/cose.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAiBtD,OAAO,EACL,SAAS,IAAI,aAAa,EAC1B,SAAS,IAAI,aAAa,EAC1B,WAAW,IAAI,eAAe,EAC/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,SAAS,IAAI,cAAc,EAC3B,SAAS,IAAI,cAAc,EAC3B,WAAW,IAAI,gBAAgB,EAChC,MAAM,YAAY,CAAC;AAqBpB;;GAEG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,CAAC,EAC7B,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,EACxB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAUrB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,CAAC,EAC/B,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,EACxB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,UAAU,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,UAAU,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAG5E;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAKjE;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;GAEG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,CAAC,EAC7B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,SAAS,EAAE,aAAa,EACxB,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED;;GAEG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,CAAC,EAC7B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,YAAY,EAAE,cAAc,EAC5B,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,UAAU,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAKrB"}
+{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../src/cose.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAiBtD,OAAO,EACL,SAAS,IAAI,aAAa,EAC1B,SAAS,IAAI,aAAa,EAC1B,WAAW,IAAI,eAAe,EAC/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,SAAS,IAAI,cAAc,EAC3B,SAAS,IAAI,cAAc,EAC3B,WAAW,IAAI,gBAAgB,EAChC,MAAM,YAAY,CAAC;AAqBpB;;;;;;;;;;;;GAYG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,CAAC,EAC7B,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,EACxB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,CAAC,EAC/B,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,EACxB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,UAAU,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,UAAU,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,MAAM,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAG5E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAGjE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,CAAC,EAC7B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,SAAS,EAAE,aAAa,EACxB,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAAE,CAAC,EAC7B,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,YAAY,EAAE,cAAc,EAC5B,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,UAAU,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAC7B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EACvB,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAQrB"}