@forgesworn/fold-kit 0.12.0 → 0.14.0

package/dist/seal.d.ts

@@ -56,6 +56,26 @@ export declare function credentialSeal(credential: DeviceCredential): string | u
  * exists to shut out.
  */
 export declare function sealTarget(device: string, credential?: DeviceCredential): string;
+/**
+ * The tag on a rekey (kind 1462) or an authority's grant (kind 20469) that
+ * names the one-time key it was sealed from. The event is still signed by
+ * the authority, so the tag is the authority's word; the one-time secret is
+ * discarded once the copies are sealed, so whoever later takes the
+ * authority's key cannot recompute them. Forward secrecy step 1, see
+ * docs/seal-key.md, "One-time senders".
+ */
+export declare const SENDER_TAG = "from";
+/**
+ * Who sealed the copies in `event`: the key its single `from` tag names, or
+ * its signer when it carries none, which is every rekey and grant written
+ * before one-time senders. Null when the tags are unusable: more than one
+ * `from`, or one that is not a point on the curve. Only the authority could
+ * have signed either, so a reader treats null as a copy it cannot open.
+ */
+export declare function sealSender(event: {
+    pubkey: string;
+    tags: string[][];
+}): string | null;
 /** Seal `plaintext` from `senderSk` to `device`, by `sealTarget`. */
 export declare function sealTo(plaintext: string, senderSk: Uint8Array, device: string, credential?: DeviceCredential): string;
 /**

package/dist/seal.js

@@ -84,6 +84,31 @@ export function sealTarget(device, credential) {
         return to;
     return credentialSeal(credential) ?? to;
 }
+/**
+ * The tag on a rekey (kind 1462) or an authority's grant (kind 20469) that
+ * names the one-time key it was sealed from. The event is still signed by
+ * the authority, so the tag is the authority's word; the one-time secret is
+ * discarded once the copies are sealed, so whoever later takes the
+ * authority's key cannot recompute them. Forward secrecy step 1, see
+ * docs/seal-key.md, "One-time senders".
+ */
+export const SENDER_TAG = 'from';
+/**
+ * Who sealed the copies in `event`: the key its single `from` tag names, or
+ * its signer when it carries none, which is every rekey and grant written
+ * before one-time senders. Null when the tags are unusable: more than one
+ * `from`, or one that is not a point on the curve. Only the authority could
+ * have signed either, so a reader treats null as a copy it cannot open.
+ */
+export function sealSender(event) {
+    const tags = event.tags.filter((t) => t[0] === SENDER_TAG);
+    if (tags.length === 0)
+        return normaliseHex(event.pubkey);
+    if (tags.length > 1)
+        return null;
+    const value = tags[0][1];
+    return isSealPubkey(value) ? normaliseHex(value) : null;
+}
 /** Seal `plaintext` from `senderSk` to `device`, by `sealTarget`. */
 export function sealTo(plaintext, senderSk, device, credential) {
     return nip44.v2.encrypt(plaintext, nip44.v2.utils.getConversationKey(senderSk, sealTarget(device, credential)));

package/docs/persistent-invitation-evidence.md

@@ -49,17 +49,50 @@ Unknown fields, non-data descriptors, custom prototypes, sparse arrays and
 noncanonical reload strings are refused. JavaScript proxies are outside this
 plain-data transport boundary; callers must not pass executable objects.
 
-Queries admit at most 64 delivered candidates, including invalid candidates and
-duplicates, with 16,384 UTF-8 bytes per canonical carrier and 262,144 UTF-8 bytes
-across all delivered canonical candidates. Work/bytes are charged before crypto;
-candidate 65 is refused before carrier copying. Retained evidence has the same
-limits. Event tags are bounded to 64 arrays of at most eight strings. These are
-evidence-profile limits, not new wire limits for the legacy API. Exact duplicates
-cost no additional retained capacity but consume query work and byte budget;
-the same ID with a different carrier fails the entire query. Capacity is checked
-before admitting another candidate, with no eviction or truncated success.
-Malformed/oversized object framing fails the query. Well-framed events that
-fail signature, capability or scope validation are ignored, never retained.
+Retained evidence holds at most 64 events, with 16,384 UTF-8 bytes per
+canonical carrier and 262,144 UTF-8 bytes across all retained carriers. Event
+tags are bounded to 64 arrays of at most eight strings. These are
+evidence-profile limits, not new wire limits for the legacy API.
+
+A query reads at most 512 deliveries
+(`MAX_PERSISTENT_INVITATION_EVIDENCE_DELIVERIES`): every relay's copy of every
+event, repeats, other authors and junk alike, each charged before it is parsed.
+Past that the query fails, because an event that could matter may be among
+those it did not read; delivery 513 is never inspected. The bound limits parse
+work only. It is eight times the retained limit so that 64 events heard from
+each of eight relays still fit.
+
+What is delivered is then sorted cheaply, before any signature check:
+
+- A malformed carrier (not plain data, a wrong type, bad hex), an event not by the inviter, not kind 1463
+  or 1461, or without exactly one `d` tag naming the invitation, is dropped.
+  It is not evidence and it does not fail the query.
+- An exact repeat, another carrier under an id already held, and a carrier
+  already checked and refused, are dropped. A held id was verified, so a second
+  carrier with it has the same signed fields.
+- An event in scope but over the carrier size limits (16,384 bytes, 64 tags,
+  eight strings in a tag) can never be retained. It is hashed and verified once,
+  charged to the signature bound below. If the authority signed it, the query
+  fails, because it may be a retirement or a newer list that no evidence can
+  hold. If not, it is dropped, and a repeat of it costs nothing.
+- Anything else in scope costs one signature check. A query is charged at most
+  128 (`MAX_PERSISTENT_INVITATION_EVIDENCE_VERIFICATIONS`): room for 64 retained
+  events and 64 more in-scope events that fail, forged or not a supported body.
+  The 129th is never checked and the query fails. The bound counts checks, not
+  Schnorr verifications. A retained retirement is verified twice, and the
+  finished query revalidates every event it kept, so a query that succeeds can
+  do up to 128 + 64 verifications. A forgery fails at its first, so a hostile
+  relay can cause at most 128.
+- A checked, valid authority event is retained. If that would be a 65th event
+  or pass 262,144 bytes, the query fails. Nothing is evicted or truncated.
+
+An in-scope, well-formed, validly signed authority event is never dropped, and
+neither is an over-limit one: each is retained or fails the query. What the
+query drops is what cannot be an authority event (malformed, out of scope,
+unsigned by the authority) or repeats what it already holds.
+`encodePersistentInvitation` refuses to sign an event over the size limits, so
+only another writer can produce one. The failures above reject with
+`PersistentInvitationEvidenceQueryError`.
 
 Evidence records, carrier strings and ID arrays are frozen owned copies.
 String memory is not claimed securely erased. Each admitted result has a fresh
@@ -102,8 +135,8 @@ custody and later independent revalidation.
 ## Completion and failure
 
 The query waits for the transport's EOSE even after an invitation or retirement
-arrives. Timeout, abort, subscription failure, contradictory duplicate or
-capacity failure rejects with `PersistentInvitationEvidenceQueryError`.
+arrives. Timeout, abort, subscription failure or a capacity failure (deliveries,
+signature checks, retained events or retained bytes) rejects with `PersistentInvitationEvidenceQueryError`.
 Its bounded `observation` is explicitly `completion: 'incomplete'`, diagnostic
 custody only. The revalidator always refuses incomplete observations. They
 cannot be relabelled to establish completeness; completion metadata itself is

package/docs/seal-key.md

@@ -89,6 +89,41 @@ Not covered here:
 - `decodeEpochRequest` and `decodeMemberEpochRequest` return what they did in
   0.6.0. The desks read the credential internally.
 
+## One-time senders
+
+Forward secrecy step 1 (KithMoot `docs/2026-10-06-key-schedule-next-steps.md`,
+phase 2b). Every rekey copy and every authority grant used to be sealed from
+the authority's long-lived key, so whoever later took that key could
+recompute every past copy's conversation key and open it with nothing else.
+
+With `oneTimeSender: true`, `encodeRekeyEvent` and `encodeEpochGrant` draw a
+fresh key, seal every copy from it, name its public half in one
+`["from", <x-only hex>]` tag, and zero the secret before signing. The event
+is still signed by the authority, so the tag is the authority's word and a
+forger's `from` is never read (the signer check comes first).
+
+- A reader opens a copy with `sealSender(event)`: the single `from` tag's key,
+  or the signer when there is none. More than one `from`, or one off the
+  curve, is null: a rekey is then read without a secret (the device asks for
+  the epoch), and a grant is refused.
+- Taking the authority's key later no longer opens a copy. It still lets the
+  taker sign new rekeys and grants; that is the healing question, not this
+  one.
+- A copy is still sealed to the recipient's seal key, so a past copy stays
+  open to whoever holds that seal secret. Retiring seal keys older than the
+  history window is step 3.
+- The member grant (20472) has always been signed by a one-time key, and is
+  unchanged.
+
+**Readers first.** A reader older than 0.13.0 opens no copy from a one-time
+key. For a rekey that costs a round trip (it asks for the epoch); for a grant
+it costs the epoch. So `oneTimeSender` stays off in every writer until readers
+have shipped on every client and had a release in the field. Off, every
+event is byte-identical to before.
+
+`hostRoomEpoch` takes `oneTimeSender` too and passes it to every grant it
+writes; it is off by default, like the encoders.
+
 ## Vectors
 
 `vectors/seal-vectors.json` (generated by `scripts/generate-seal.mjs`,
@@ -102,3 +137,7 @@ checked by `vectors/verify-seal.test.ts`):
   (byte-identical to a rekey with bare devices);
 - `epoch-grant-seal` and `member-grant-seal` (the thief replays the copied
   credential; the desk seals to the renewed one).
+- `rekey-one-time-sender` and `epoch-grant-one-time-sender` (the same rekey
+  and grant from a one-time key; the authority's key no longer opens a copy),
+  and the refusals `rekey-from-doubled`, `rekey-from-off-curve` and
+  `epoch-grant-from-off-curve`.

package/llms.txt

@@ -10,7 +10,7 @@ ESM-only, Node.js 22.13+. Four entry points: `@forgesworn/fold-kit` (circle prim
 npm install @forgesworn/fold-kit
 ```
 
-This file describes `main` (version 0.12.0), which can run ahead of the npm `latest` release; compare `npm view @forgesworn/fold-kit version` with the version of the API you need. To use an unreleased change, pin an immutable Git commit (a full SHA, for example from `git ls-remote https://github.com/forgesworn/fold-kit main`); the `prepare` script builds `dist/` on install:
+This file describes `main` (version 0.14.0), which can run ahead of the npm `latest` release; compare `npm view @forgesworn/fold-kit version` with the version of the API you need. To use an unreleased change, pin an immutable Git commit (a full SHA, for example from `git ls-remote https://github.com/forgesworn/fold-kit main`); the `prepare` script builds `dist/` on install:
 
 ```bash
 npm install "github:forgesworn/fold-kit#<commit>"
@@ -124,6 +124,7 @@ Invitation versions: v1 (`encodeJoinUrl`, the room secret in the link) is legacy
 - Same optional entry: `revalidatePersistentInvitationSource({ event, invitation, expectedRoomSecret })` independently authenticates one actual encoder Event or exact canonical stored carrier against a mandatory room-root pin. Returns a frozen `PersistentInvitationSource` with `version`, `invitationId`, `inviter`, `eventId`, `createdAt`, `event` string and owned `admission`. No completion/EOSE, publication, newest-selection, currentness or non-retirement claim. Rejects retirement, unsupported bodies/tags, forged signature caches, noncanonical strings and oversize before parsing/crypto. Creator clients retain exact event bytes and publication intent before pools; retry those bytes under fresh effect guards. Erase returned admission.secret after use.
 - Conference rooms: `encodePersistentInvitation({ ..., endsAt })` puts `ends` in the body and `['expiration', String(endsAt)]` on the 1463; `decodePersistentInvitation` returns `endsAt` and is null when an `expiration` tag disagrees with the body; `encodeInvitationRetirement({ ..., endsAt })` tags the 1461 the same way
 - Room relays: `encodePersistentInvitation({ ..., relays })` puts the room's own relays (1-8 distinct canonical `wss://host/` URLs, else it throws) in the body after `ends`; the decoder returns `relays` and is null on a malformed list; `requestPersistentRoomAdmission` keeps the newest signed copy's list (a copy without one says nothing); `isInvitationRelays`, `requireInvitationRelays`, `MAX_INVITATION_RELAYS` (8)
+- Room storage nodes: `encodePersistentInvitation({ ..., storage })` puts the room's group storage nodes (0-8 canonical base URLs on distinct hosts, e.g. `https://grove.example.net`; `http` only for `localhost`, `127.x.y.z` or an onion host; no default port, no trailing slash, no user info, query or fragment; else it throws) last in the body after `relays`, never a tag; `[]` means the authority withdrew every node, an absent key says nothing and leaves the body byte-identical to 0.13.0's. The decoder returns `storage` and `storageAt` (the `created_at` of the copy whose list stood) and is null on a malformed list; `requestPersistentRoomAdmission` and the strict evidence path keep the newest signed copy that names storage (a copy without the key says nothing), independently of `relays`; the strict path holds a same-second disagreement as `conflicting-storage` and `contributors.storage` names the copy that stood (present only when a copy names storage). `storageNodeFromBase(text)` → `{ base, server }` canonicalises an operator's URL (throws a message fit to show an operator); `storageNodeServer(base)` → the `server` (host) of a canonical base by grammar alone, `undefined` when not canonical, no URL parser; `isStorageNodeBase`, `isInvitationStorage`, `requireInvitationStorage`, `MAX_INVITATION_STORAGE_NODES` (8), `MAX_STORAGE_NODE_URL_LENGTH` (256). Vectors: `vectors/storage-vectors.json`
 - Self-destructing rooms (see `docs/room-destruct.md`): `encodePersistentInvitation({ ..., destruct: true })` puts `"destruct": true` in the encrypted body after `ends` (valid without `ends`), never a tag; `decodePersistentInvitation` returns `destruct: true` and is null when the field is present and not `true`; `requestPersistentRoomAdmission` keeps `destruct` if any valid copy carries it (sticky, like the earliest `ends`). `encodeInvitationRetirement({ ..., ended: true, destruct: true })` writes `{"v":1,"ended":true,"destruct":true}` (plain JSON, like `ended`) and throws on `destruct` without `ended`; `decodeInvitationRetirementNotice` returns `{ ended, destruct?: true }`, believing `destruct` only beside `ended`. `encodeRekeyEvent({ ..., closed: true, destruct: true })` writes it in the encrypted body after `closed` and throws without `closed`; `RekeyNotice.destruct` / `RekeyEvidence.destruct` are set only on a closing body, and a flag on an open rekey is dropped, not refused. Without the flag every event is byte-identical to 0.8.0, and a 0.8.0 reader ignores it
 - `withExpiration(tags, expiresAt?)` - NIP-40 rule for a room that ends: add the tag, keep an earlier one, lower a later one; `isRoomEnds`, `requireRoomEnds(endsAt, now)`, `MAX_ROOM_ENDS_SECONDS` (30 days)
 - Epoch encoders (`encodeRekeyEvent`, `encodeEpochRequest`, `encodeEpochGrant`) and `hostRoomEpoch` / `requestRoomEpoch` take `expiresAt?` for a conference room
@@ -139,7 +140,7 @@ Invitation versions: v1 (`encodeJoinUrl`, the room secret in the link) is legacy
 - Quiet replies (see `docs/quiet-replies.md`): `hostRoomEpoch` waits a random `replyDelayMs` (`[min, max]` ms, default `DEFAULT_REPLY_DELAY_MS` = `[500, 2000]`, `[0, 0]` answers at once) before every grant or refusal, deciding when the wait ends; closing cancels waits. A participant is sent `removed`/`closed` at most once per `refuseAgainAfter` seconds (default `REFUSE_AGAIN_AFTER_SECONDS` = 3600) and `unknown` once per `reportUnknownEvery` (60); at most `maxRefusalsPerMinute` refusals (default `MAX_REFUSALS_PER_MINUTE` = 20) go out in any minute in all. Grants are never limited. A suppressed refusal still calls `onRefused`/`onUnknown`; its asker times out with the plain error. `random` and `schedule` (`ReplySchedule`) are injectable. `RefusalLimiter` (bounded to `REFUSAL_LIMITER_CAPACITY` = 256 keys) and `replyDelay(range, random)` are exported. Events and vectors are unchanged
 - Member epoch catch-up (see `docs/member-epoch-catch-up.md`): `encodeRekeyEvent({ ..., commit: true })` writes `epochCommitment(roomId, epoch, secret)` into the rekey body; `hostMemberEpochDesk(opts)` lets any current member answer; `requestRoomEpoch({ ..., members: memberEpochSource(opts) })` asks the authority and members, first verifiable answer wins; `requestMemberEpoch(opts)` asks members alone. Kinds `MEMBER_EPOCH_KINDS` = `{ REQUEST: 20471, GRANT: 20472 }`. A member grant carries the authority-signed rekeys from the asker's epoch to the current one; the asker verifies the chain itself (`decodeMemberEpochGrant`) and refuses a last epoch with no commitment (legacy: authority only), a chain that removes it or closes the room, and one that stops short of `expected`. A verified grant is `{ epoch, removed, passed }`: `passed` holds the epochs between the asker's and `epoch`, oldest first, and `requestRoomEpoch` carries it as an optional `passed` when a member answered. Codecs: `encodeMemberEpochRequest`, `decodeMemberEpochRequest`, `encodeMemberEpochGrant`, `readRekeyEvidence`, `deriveMemberEpochRequestKey`, `MAX_MEMBER_EPOCH_CHAIN` (32)
 - The known-members gate (#207, see `docs/member-epoch-catch-up.md`): once a room has removed anybody (`removed()` not empty), `hostRoomEpoch` and `hostMemberEpochDesk` grant only to a participant for which `known(participant)` is true; anybody else is reported through `onUnknown` (once per participant, and again every `reportUnknownEvery` seconds, default `REPORT_UNKNOWN_EVERY_SECONDS` = 60, while they keep asking) and refused: the authority answers `refused: 'unknown'` (an `EpochRefusal`), a member stays silent. `unknown` is not final: `requestRoomEpoch` keeps asking, calls its `onUnknown` once, and rejects with `EpochRefusedError('unknown')` only at its timeout; a desk looks at the requester's next ask afresh, so letting somebody in is making `known` say yes. No `known` after a removal means nobody is known. Member lists: `encodeRekeyEvent({ members })` writes the authority's list (removed dropped, sorted) into the body, read back as `RekeyNotice.members` and `RekeyEvidence.members`, and as `MemberEpochGrant.members` (newest in the chain); `hostRoomEpoch({ members })` puts it in its grants (`EpochGrant.members`). `readMemberList(raw)` reads one, undefined when malformed. Without `members` and with no removal every event is byte-identical to 0.5.1
-- Seal keys (see `docs/seal-key.md`): `createDeviceCredential({ ..., seal })` appends `["seal", <x-only pubkey>]` last, under the participant's signature; mint a fresh one per credential with `generateSealKey()` and keep its secret as you keep the device key (old copies are sealed to old seal keys; healing needs only that each new one is fresh). `encodeRekeyEvent` recipients may be `{ device, credential }`; `encodeEpochGrant` and `encodeMemberEpochGrant` take `credential`; each copy is sealed to `sealTarget(device, credential)`: the credential's seal key, else the device key (never back to the device key because the credential lapsed). Readers take `sealSks` (`decodeRekeyEvent`, `decodeEpochGrant`, `decodeMemberEpochGrant`) or a `sealSks()` getter (`requestRoomEpoch`, `memberEpochSource`) and try them before the device key (`openSealed`); a rekey copy nothing opens reads as no copy. Desks take `credentialFor(device)`, the newest credential the room has seen (keep it monotone), and seal to the newer of that and the presented one (`sealCredential`, `newerCredential`: later expiration, then later created_at). `credentialSeal(c)` is the pubkey, undefined for none, null when doubled or off the curve (sealed to the device key). Without seal keys every event is byte-identical to 0.6.0
+- Seal keys (see `docs/seal-key.md`): `createDeviceCredential({ ..., seal })` appends `["seal", <x-only pubkey>]` last, under the participant's signature; mint a fresh one per credential with `generateSealKey()` and keep its secret as you keep the device key (old copies are sealed to old seal keys; healing needs only that each new one is fresh). `encodeRekeyEvent` recipients may be `{ device, credential }`; `encodeEpochGrant` and `encodeMemberEpochGrant` take `credential`; each copy is sealed to `sealTarget(device, credential)`: the credential's seal key, else the device key (never back to the device key because the credential lapsed). Readers take `sealSks` (`decodeRekeyEvent`, `decodeEpochGrant`, `decodeMemberEpochGrant`) or a `sealSks()` getter (`requestRoomEpoch`, `memberEpochSource`) and try them before the device key (`openSealed`); a rekey copy nothing opens reads as no copy. Desks take `credentialFor(device)`, the newest credential the room has seen (keep it monotone), and seal to the newer of that and the presented one (`sealCredential`, `newerCredential`: later expiration, then later created_at). `credentialSeal(c)` is the pubkey, undefined for none, null when doubled or off the curve (sealed to the device key). Without seal keys every event is byte-identical to 0.6.0 - One-time senders (see `docs/seal-key.md`, "One-time senders"): `encodeRekeyEvent` and `encodeEpochGrant` take `oneTimeSender: true`, sealing every copy from a fresh key named in one `["from", <x-only pubkey>]` tag (still authority-signed) and zeroing it, so a later copy of the authority key opens no past copy; readers open with `sealSender(event)` (the `from` key, else the signer; null when doubled or off the curve: a rekey reads without a secret, a grant is refused). `hostRoomEpoch({ oneTimeSender: true })` does the same for every grant the desk writes. Keep writers off until every client's readers have shipped; off, events are byte-identical to 0.12.0.
 - Scheduled rekeys and the history window (see `docs/scheduled-rekey.md`): `encodeRekeyEvent({ ..., scheduled: true })` writes `"scheduled": true` inside the encrypted body (never a tag), and throws beside a non-empty `removed` or `closed`; `decodeRekeyEvent` (`RekeyNotice.scheduled`) and `readRekeyEvidence` (`RekeyEvidence.scheduled`) report `true` only when `removed` is empty and the room is not closed, so a contradictory body is still announced. `HISTORY_WINDOW_SECONDS` (30 days) and `MAX_HISTORY_EPOCHS` (16); `epochsInWindow(left, now)` keeps entries with `leftAt >= now - HISTORY_WINDOW_SECONDS`, newest first by epoch, first of a doubled epoch, at most 16, never throws. `encodeEpochGrant({ ..., passed })` takes `LeftEpoch[]` (`{ epoch, secret, leftAt }`) and writes `passed: [{ epoch, secret (base64url), left }]` oldest first, only when non-empty; it throws on more than 16, epoch 0 (the room secret is never carried), an epoch not below the granted one, a doubled epoch, a non-32-byte secret or a bad `leftAt`. `hostRoomEpoch({ past })` is asked on every grant, filtered to what the encoder accepts and to `epochsInWindow`, so a bad `past()` costs the history, not the grant. `decodeEpochGrant` returns `EpochGrant.passed` (`leftAt` set) only when the list is exactly in that form, else drops the field and keeps the grant; `decodeMemberEpochGrant` sets `leftAt` on each passed epoch from the next rekey's `created_at`. `MAX_MEMBER_EPOCH_CHAIN` (32) is a different limit. Without the marker and `passed` every event is byte-identical to 0.7.0, and a 0.7.0 reader ignores both
 - `canonicalAdmins(admins)` / `signAdmins(opts)` / `verifyAdmins(opts)` - the authority's signed admin list
 - `canonicalChannels(channels)` / `signChannels(opts)` / `verifyChannels(opts)` - the authority's signed channel list; `CHANNEL_NAME`, `RESERVED_CHANNELS`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/fold-kit",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Circle primitives for private Nostr groups nobody operates: epoch keys, link invites, removal by rekey, device credentials.",
   "type": "module",
   "main": "./dist/index.js",
@@ -32,6 +32,7 @@
     "vectors/seal-vectors.json",
     "vectors/schedule-vectors.json",
     "vectors/destruct-vectors.json",
+    "vectors/storage-vectors.json",
     "LICENSE",
     "README.md",
     "llms.txt",
@@ -55,6 +56,7 @@
     "generate-seal": "node scripts/generate-seal.mjs",
     "generate-schedule": "node scripts/generate-schedule.mjs",
     "generate-destruct": "node scripts/generate-destruct.mjs",
+    "generate-storage": "node scripts/generate-storage.mjs",
     "bundle-check": "node scripts/bundle-check.mjs",
     "tarball-smoke": "node scripts/tarball-smoke.mjs",
     "vectors": "vitest run vectors/",

package/vectors/seal-vectors.json

@@ -623,6 +623,310 @@
           },
           "thief": null
         }
+      },
+      {
+        "name": "rekey-one-time-sender",
+        "kind": "positive",
+        "note": "rekey-seal's rekey with `oneTimeSender`: tags d, epoch, then [\"from\", x-only pubkey of a key made for this rekey alone], still signed by the authority, so the tag is the authority's word. Every copy is sealed from that one-time key to the recipient's seal key (or device key), and the one-time secret is discarded, so whoever later takes the authority's key cannot recompute the copies (`authorityOpens` false). A reader opens its copy with the key the single `from` tag names (`sealSender`), and with the signer when there is none, which is every earlier rekey. `randomHex`: the 48-byte seed for the one-time key (`senderSkHex`), one seal nonce per recipient in order, the body nonce, the signature aux-rand. A reader older than this opens no copy, reads the rekey without a secret and asks for the epoch.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "authoritySkHex": "bb058b43370d37b7ed3f09e3a36a6ffcc88a8dad56c5ee204b1715240a1466e0",
+          "previousKeyHex": "09126b23a6148694280325e5a433c1badbc853026c8e71c0833ffd4bd0ea08ab",
+          "next": {
+            "epoch": 1,
+            "secretHex": "cc4e6941abd893daab2fdce0bbb182816b531fbc04b9531fdc5d03fd742fb26b"
+          },
+          "recipients": [
+            {
+              "device": "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b",
+              "credential": {
+                "id": "3c3f64a769c826a89f2712ed9898e43afacc5f2784201999e8ca0ed5cdcf3d6c",
+                "pubkey": "3683caad0bf9bb5a653582155c0ba9192fd23d7d6c717a7b0d233c8356a7042f",
+                "created_at": 1800000000,
+                "kind": 20460,
+                "tags": [
+                  [
+                    "d",
+                    "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+                  ],
+                  [
+                    "device",
+                    "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+                  ],
+                  [
+                    "expiration",
+                    "1800043200"
+                  ],
+                  [
+                    "seal",
+                    "63a40c9bc84c065f4aab7e63208ea37c3edcd3ab47a334b157cf000409c7eaaf"
+                  ]
+                ],
+                "content": "",
+                "sig": "fdd0c5f23d2f1531594100470d6fe6c87d6c28d2185898b49844b664ffcb65f3c76ce0b9fcef3166708baca068d7f9d2ee74a827f56140b6cef11591ce942049"
+              }
+            },
+            "1cddb17ae843752d2469ea50b2a6bd1468edbb75b7913ea58ba7847663cb1b8e"
+          ],
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "bareDeviceSkHex": "32796464cb7434a5d397f03cce5055df28f9be8d15ce4bf14760d764bbd2e156",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "copiedSealSkHex": "22b29538be86feaf0dbe57fcd046cc95ca39082e813d450d8d9d653a2434a374",
+          "createdAt": 1800000000,
+          "event": {
+            "id": "3f38d5f8a93cb0818f9a62fccc8ba59b44ebc413c1369205447f840e46bfb474",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 1462,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "epoch",
+                "1"
+              ],
+              [
+                "from",
+                "02f71d0f7235cbe6e623bc1542539c9db10601a3a892af483783614c00c7fd99"
+              ]
+            ],
+            "content": "AmcNeMrs/5cl6E/Z1PoCcQXOxzckQIRSjE9XOZJKvrsqFN0ZfMu/0hPX0dWFqdgAWRDZ5/K+9O3ajNsKlDmnx5zcAtlrzeJUTDGtN6YrwcorfL6NRMeSz9bnic0jAGAxo+Zj5n0FUV9qOzAkjKktseXy6y2oQeQ3gN2uPW1GXSOcaH++d3YwmiND6c48I8SlsNB5wRVawNb5Dm6UViC4h0wpbBR9sLqA08+p8IMFx2HxmENDbNNMfeQVcMhNGZ+XobZcsH4Zd0JNVxRVUGF0TOYCfaOQFAzO3LxfXI9tcC9vaisCA/DbGoGiz5nqOwU4xnsF5RgdX6yX+xIQXSzCtne69p/tdjePhsL8WmlENE131aSBdY/L7bUAumu+FJxfVJBzNCz+y/o0noBLirOrUuUIqWxFnQ/zoWsE+gYCU9Um9LvtbhK+m1+COhl6K09ruh/qlcZBn7OEciUywGZSkRadpm4kktc5cCfGbdrlkfVPwgrJiRVYLkIC+O+N+xqx037XLOtI3wC460QDnaoii207OrsdGip8F5K1sZ8ZV/Mc+gNmcCKAZJEGaoyowPvP4cYXMyos7j3MCZ0lpwi1E8jwyXYJZK17JKXmykEpBywPpYLSgBQR9C9yJ6oCfaVsxkOBVgbEiPKpA+hGngsiDmGBoy41VdgpA9ZCBTIH5W8B2z1xqCk+dHVkczJqYNpM+Dad0Xagq42rnK1kLff2bFsIKxly3ak1uFRYBCQbS74BEo2kbczOAn1XLfPYMLiEiMCdjXgILzVgqe4TVjue9Nv7Zak5iheUPqLVZfxTbuQUWIWrLakQWSVHfQ8c+/L98/5M9TsgYSIV5BS5JCABvbCVe4RHeq4ibECcsf41I2qPUeCSXxHuTvJ26L/T3ONpAEzXRw2+8tJNaK3Plczm5f9TfYPL3yuZGcplKsgPwogm0us=",
+            "sig": "a6e036a4b6ac94703f747337bf28c308a295fcfc2ab3c028d5a35cc50969ba19807a9ba14252ef7782e4b4bfd3395c71986eea1cdcdc36e2fe18a77d9ce1219d"
+          },
+          "randomHex": [
+            "a110c4cffaadabb2fedbf6279627cc857757f036ecaffdcb89452e2eb12acc8349c693f9cce385720b83f75629ae26e6",
+            "6d4bbae698b19d076387d818c6a9b8aaaa23ab42850bb933ab1ab0ab4a36ce91",
+            "a25e6555c2cbbf30733f70ba666453a3712cf5dbefd4c1cea47fa9b70b1b691a",
+            "670d78caecff9725e84fd9d4fa027105cec737244084528c4f5739924abebb2a",
+            "18c1fc0b6372dc662bcafd2d4704e5c1f4bcc9c61b1e129a91dec165a6296212"
+          ],
+          "senderSkHex": "4405467674110e0cb5278a657356cac70724f7442d2dc3ade9e350768088ff67"
+        },
+        "output": {
+          "sealSender": "02f71d0f7235cbe6e623bc1542539c9db10601a3a892af483783614c00c7fd99",
+          "renewedDevice": {
+            "epoch": 1,
+            "secretHex": "cc4e6941abd893daab2fdce0bbb182816b531fbc04b9531fdc5d03fd742fb26b"
+          },
+          "thief": {
+            "epoch": 1
+          },
+          "bareDevice": {
+            "epoch": 1,
+            "secretHex": "cc4e6941abd893daab2fdce0bbb182816b531fbc04b9531fdc5d03fd742fb26b"
+          },
+          "authorityOpens": {
+            "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b": false,
+            "1cddb17ae843752d2469ea50b2a6bd1468edbb75b7913ea58ba7847663cb1b8e": false
+          }
+        }
+      },
+      {
+        "name": "rekey-from-doubled",
+        "kind": "negative",
+        "note": "rekey-one-time-sender's content re-signed by the authority with two `from` tags. Only the authority could sign it, so it is a broken writer, not an attack: `sealSender` is null, the rekey is still read for its epoch and removals, and no copy is opened (no secretHex); the device asks for the epoch.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "previousKeyHex": "09126b23a6148694280325e5a433c1badbc853026c8e71c0833ffd4bd0ea08ab",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "event": {
+            "id": "fc8be7e8e1965a5888ca5351706456d76c8e548c3fc0a9378e0bb1caf4be23f6",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 1462,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "epoch",
+                "1"
+              ],
+              [
+                "from",
+                "02f71d0f7235cbe6e623bc1542539c9db10601a3a892af483783614c00c7fd99"
+              ],
+              [
+                "from",
+                "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533"
+              ]
+            ],
+            "content": "AmcNeMrs/5cl6E/Z1PoCcQXOxzckQIRSjE9XOZJKvrsqFN0ZfMu/0hPX0dWFqdgAWRDZ5/K+9O3ajNsKlDmnx5zcAtlrzeJUTDGtN6YrwcorfL6NRMeSz9bnic0jAGAxo+Zj5n0FUV9qOzAkjKktseXy6y2oQeQ3gN2uPW1GXSOcaH++d3YwmiND6c48I8SlsNB5wRVawNb5Dm6UViC4h0wpbBR9sLqA08+p8IMFx2HxmENDbNNMfeQVcMhNGZ+XobZcsH4Zd0JNVxRVUGF0TOYCfaOQFAzO3LxfXI9tcC9vaisCA/DbGoGiz5nqOwU4xnsF5RgdX6yX+xIQXSzCtne69p/tdjePhsL8WmlENE131aSBdY/L7bUAumu+FJxfVJBzNCz+y/o0noBLirOrUuUIqWxFnQ/zoWsE+gYCU9Um9LvtbhK+m1+COhl6K09ruh/qlcZBn7OEciUywGZSkRadpm4kktc5cCfGbdrlkfVPwgrJiRVYLkIC+O+N+xqx037XLOtI3wC460QDnaoii207OrsdGip8F5K1sZ8ZV/Mc+gNmcCKAZJEGaoyowPvP4cYXMyos7j3MCZ0lpwi1E8jwyXYJZK17JKXmykEpBywPpYLSgBQR9C9yJ6oCfaVsxkOBVgbEiPKpA+hGngsiDmGBoy41VdgpA9ZCBTIH5W8B2z1xqCk+dHVkczJqYNpM+Dad0Xagq42rnK1kLff2bFsIKxly3ak1uFRYBCQbS74BEo2kbczOAn1XLfPYMLiEiMCdjXgILzVgqe4TVjue9Nv7Zak5iheUPqLVZfxTbuQUWIWrLakQWSVHfQ8c+/L98/5M9TsgYSIV5BS5JCABvbCVe4RHeq4ibECcsf41I2qPUeCSXxHuTvJ26L/T3ONpAEzXRw2+8tJNaK3Plczm5f9TfYPL3yuZGcplKsgPwogm0us=",
+            "sig": "6f034c009f3eb02e069355d5a065f3aa72d1fe92dd5e6bc1bedbd905dfca08370fdc39b21470341397eafc2a5ad1c977c4658811aab3198937099ce844f0db37"
+          }
+        },
+        "output": {
+          "sealSender": null,
+          "renewedDevice": {
+            "epoch": 1
+          }
+        }
+      },
+      {
+        "name": "rekey-from-off-curve",
+        "kind": "negative",
+        "note": "The same with one `from` tag that is not the x coordinate of any point (x = 5): `sealSender` null, read without a secret.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "previousKeyHex": "09126b23a6148694280325e5a433c1badbc853026c8e71c0833ffd4bd0ea08ab",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "event": {
+            "id": "3d0722b71fa5a04938936d6fd89ba718830a59c89ecb060931f442394e1702ab",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 1462,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "epoch",
+                "1"
+              ],
+              [
+                "from",
+                "0000000000000000000000000000000000000000000000000000000000000005"
+              ]
+            ],
+            "content": "AmcNeMrs/5cl6E/Z1PoCcQXOxzckQIRSjE9XOZJKvrsqFN0ZfMu/0hPX0dWFqdgAWRDZ5/K+9O3ajNsKlDmnx5zcAtlrzeJUTDGtN6YrwcorfL6NRMeSz9bnic0jAGAxo+Zj5n0FUV9qOzAkjKktseXy6y2oQeQ3gN2uPW1GXSOcaH++d3YwmiND6c48I8SlsNB5wRVawNb5Dm6UViC4h0wpbBR9sLqA08+p8IMFx2HxmENDbNNMfeQVcMhNGZ+XobZcsH4Zd0JNVxRVUGF0TOYCfaOQFAzO3LxfXI9tcC9vaisCA/DbGoGiz5nqOwU4xnsF5RgdX6yX+xIQXSzCtne69p/tdjePhsL8WmlENE131aSBdY/L7bUAumu+FJxfVJBzNCz+y/o0noBLirOrUuUIqWxFnQ/zoWsE+gYCU9Um9LvtbhK+m1+COhl6K09ruh/qlcZBn7OEciUywGZSkRadpm4kktc5cCfGbdrlkfVPwgrJiRVYLkIC+O+N+xqx037XLOtI3wC460QDnaoii207OrsdGip8F5K1sZ8ZV/Mc+gNmcCKAZJEGaoyowPvP4cYXMyos7j3MCZ0lpwi1E8jwyXYJZK17JKXmykEpBywPpYLSgBQR9C9yJ6oCfaVsxkOBVgbEiPKpA+hGngsiDmGBoy41VdgpA9ZCBTIH5W8B2z1xqCk+dHVkczJqYNpM+Dad0Xagq42rnK1kLff2bFsIKxly3ak1uFRYBCQbS74BEo2kbczOAn1XLfPYMLiEiMCdjXgILzVgqe4TVjue9Nv7Zak5iheUPqLVZfxTbuQUWIWrLakQWSVHfQ8c+/L98/5M9TsgYSIV5BS5JCABvbCVe4RHeq4ibECcsf41I2qPUeCSXxHuTvJ26L/T3ONpAEzXRw2+8tJNaK3Plczm5f9TfYPL3yuZGcplKsgPwogm0us=",
+            "sig": "eff2cc0225466dd6367fda5509d36fcb17e88b28039148b17870100ebe65b7658b005a18d0563ae01003ff88833d0716d01029b2e1b78456d63e19d27261cb24"
+          }
+        },
+        "output": {
+          "sealSender": null,
+          "renewedDevice": {
+            "epoch": 1
+          }
+        }
+      },
+      {
+        "name": "epoch-grant-one-time-sender",
+        "kind": "positive",
+        "note": "epoch-grant-seal's grant with `oneTimeSender`: tags d, p, then [\"from\", one-time pubkey], signed by the authority, content sealed from the one-time key to the renewed seal key. `randomHex`: the 48-byte seed for the one-time key (`senderSkHex`), body nonce, aux-rand. The renewed device opens it; the thief does not; the authority's key no longer opens it. A reader older than this cannot open it at all, which is why writers wait for readers.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "authoritySkHex": "bb058b43370d37b7ed3f09e3a36a6ffcc88a8dad56c5ee204b1715240a1466e0",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "now": 1800000000,
+          "request": "ef8f52180b25300214a75780fc12a89cb1d4ee1a88a78b2f8afb92605769e87a",
+          "credential": {
+            "id": "3c3f64a769c826a89f2712ed9898e43afacc5f2784201999e8ca0ed5cdcf3d6c",
+            "pubkey": "3683caad0bf9bb5a653582155c0ba9192fd23d7d6c717a7b0d233c8356a7042f",
+            "created_at": 1800000000,
+            "kind": 20460,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "device",
+                "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+              ],
+              [
+                "expiration",
+                "1800043200"
+              ],
+              [
+                "seal",
+                "63a40c9bc84c065f4aab7e63208ea37c3edcd3ab47a334b157cf000409c7eaaf"
+              ]
+            ],
+            "content": "",
+            "sig": "fdd0c5f23d2f1531594100470d6fe6c87d6c28d2185898b49844b664ffcb65f3c76ce0b9fcef3166708baca068d7f9d2ee74a827f56140b6cef11591ce942049"
+          },
+          "epoch": {
+            "epoch": 2,
+            "secretHex": "1173b8e8457a46fdb6ae949e37aa41ce259534d4bb4f15a5fdb74aefc83344f5"
+          },
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "copiedSealSkHex": "22b29538be86feaf0dbe57fcd046cc95ca39082e813d450d8d9d653a2434a374",
+          "event": {
+            "id": "38ad58597fa0c34a18e3975e755c27523b4c1cdf60d4a49aa89d2817f734dc76",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 20469,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "p",
+                "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+              ],
+              [
+                "from",
+                "0f44811c4dab721de6ee8e8d740b264fe8e106453fca7fe2a4543656cf10bb98"
+              ]
+            ],
+            "content": "Ar+D/3yOjgZRgyeW88MD9C17M37/kTTSSXfT5gTHvH8ecKBRUai4cGo/MMEiMBPN7b/YLj+HKOab20VjFGh1b6+CwWjoruSUpgvxNvZUcKiOF2lmZp6Awd2R46k55IJ8ShyGHQ674wyHyBs7J2GbZeEZZlsAPOztW0iCXEB4RzdUP4HrmyYbhKxY9g+8juxhT91aMIH7bmFN+kOCrOO3W+4gaj73tGRyB6OBvMKledoK1ypL+COkXqj4GzFUcDsG88fFOD6+JMnVoUDNhyobovbxRsj6B5wApTkr6Bj6nAr5+er5RTTEBAwmUuIc/V7qFzK76NUmYGunr6r5bZHaxLld3Q==",
+            "sig": "7992b0b101abb281e45c6066132e571a30ef8b02fcd0eb25f8764cf967c960d89f8d6def75e7bf91cf31d6af1efaa7b9d0171eaeba7482521afe9bc07d1fde17"
+          },
+          "randomHex": [
+            "5ac80b90d9396022bf334b58968aec74e7c8c72a7f62635b91a13924910c605a62efa5fac4e4ce2c169755acc6d1b49c",
+            "bf83ff7c8e8e0651832796f3c303f42d7b337eff9134d24977d3e604c7bc7f1e",
+            "a100e717ef4874d688fb51f37339cc25d5eddb8a17f3c554f939a7d3098ad8fa"
+          ],
+          "senderSkHex": "5b2583975fba6efa84bdfd6fa48d2422e1d31090140b71d4cadc19e4ed5ee25d"
+        },
+        "output": {
+          "sealSender": "0f44811c4dab721de6ee8e8d740b264fe8e106453fca7fe2a4543656cf10bb98",
+          "renewedDevice": {
+            "epoch": 2,
+            "secretHex": "1173b8e8457a46fdb6ae949e37aa41ce259534d4bb4f15a5fdb74aefc83344f5"
+          },
+          "thief": null,
+          "authorityOpens": false
+        }
+      },
+      {
+        "name": "epoch-grant-from-off-curve",
+        "kind": "negative",
+        "note": "epoch-grant-one-time-sender's content re-signed by the authority with a `from` tag off the curve: the grant is refused (null).",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "now": 1800000000,
+          "request": "ef8f52180b25300214a75780fc12a89cb1d4ee1a88a78b2f8afb92605769e87a",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "event": {
+            "id": "3185002094d21dd5f585b6e718c8587a5ab494235e73a5351f51ba0648af5db9",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 20469,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "p",
+                "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+              ],
+              [
+                "from",
+                "0000000000000000000000000000000000000000000000000000000000000005"
+              ]
+            ],
+            "content": "Ar+D/3yOjgZRgyeW88MD9C17M37/kTTSSXfT5gTHvH8ecKBRUai4cGo/MMEiMBPN7b/YLj+HKOab20VjFGh1b6+CwWjoruSUpgvxNvZUcKiOF2lmZp6Awd2R46k55IJ8ShyGHQ674wyHyBs7J2GbZeEZZlsAPOztW0iCXEB4RzdUP4HrmyYbhKxY9g+8juxhT91aMIH7bmFN+kOCrOO3W+4gaj73tGRyB6OBvMKledoK1ypL+COkXqj4GzFUcDsG88fFOD6+JMnVoUDNhyobovbxRsj6B5wApTkr6Bj6nAr5+er5RTTEBAwmUuIc/V7qFzK76NUmYGunr6r5bZHaxLld3Q==",
+            "sig": "ba59c2a57832972de1b73a75724f6636fd2cea73e6a9040e05bc3ea022a10a5260d866d94c49dd16408237ea62a65e9bfb39cf332099a23f560ff7ca463eed02"
+          }
+        },
+        "output": {
+          "renewedDevice": null
+        }
       }
     ]
   }