@interop/wallet-core 0.101.1 → 0.104.0

package/dist/keys/userKeyCascade.js

@@ -1,8 +1,108 @@
 import { addRecipient, epochKeyIdFor, hasKeyEpochs, replaceRecipient, trustRosterDidKeys } from '@interop/was-client/edv/core';
 import { isSealableDescriptorStore } from './rosterLogStore.js';
-import { currentEpochOf } from './userKeyRoster.js';
+import { currentEpochOf, UserKeyRosterIntegrityError } from './userKeyRoster.js';
 import { userKeyVaultKeys } from './userKey.js';
 import { unwrapUserKeyGenerations, userKeyAsRecipient } from './userKeyGenerations.js';
+/**
+ * Whether ONE encrypted collection's epoch roster is on the current user key:
+ * the decide-half of {@link rotateCollectionEpochsToUserKey}, extracted so the
+ * cascade and any auditor of the collection-epochs-name-the-current-user-key
+ * invariant apply one rule. Pure: it reads the descriptor and the generation
+ * ids alone, holds no key material, and writes nothing.
+ *
+ * The verdicts, tested in this order:
+ *
+ * - `unresolved-current-epoch` -- the descriptor carries no key epochs, or its
+ *   `currentEpoch` names no epoch in its own list. The cascade refuses both
+ *   fail-closed; an auditor attributes the state to the invariant that owns
+ *   it (that every encrypted collection carries an epoch roster).
+ * - `stale-current-epoch` -- the current epoch names a superseded user key
+ *   generation: the cascade's rotate branch.
+ * - `current-key-missing` -- the current epoch names neither the current
+ *   generation nor a superseded one: a roster this cascade cannot heal.
+ * - `escrow-incomplete` -- the current epoch is on the current user key, but
+ *   some epoch in the history lacks its wrap: the cascade's escrow branch.
+ * - `current` -- the current epoch names the current generation and no
+ *   superseded one, and every epoch carries the current generation's wrap. The
+ *   cascade's no-op branch, and nothing else, follows from it.
+ *
+ * The kids compared are `epochKeyIdFor`'s over the generation ids, as the
+ * cascade builds them.
+ *
+ * @param options {object}
+ * @param options.descriptor {CollectionEncryption}   the collection's
+ *   descriptor
+ * @param options.currentGeneration {string}   the roster's current epoch id
+ *   (the current user key's id)
+ * @param options.generations {string[]}   every user key generation id the
+ *   roster carries, the current one included
+ * @returns {CollectionEpochsVerdict}
+ */
+export function collectionEpochsCurrent(options) {
+    return readCollectionEpochs(options).verdict;
+}
+/**
+ * The one rule {@link collectionEpochsCurrent} and the cascade share, with
+ * each verdict's payload (see {@link CollectionEpochsReading}).
+ *
+ * @param options {object}
+ * @param options.descriptor {CollectionEncryption}
+ * @param options.currentGeneration {string}
+ * @param options.generations {string[]}
+ * @returns {CollectionEpochsReading}
+ */
+function readCollectionEpochs({ descriptor, currentGeneration, generations }) {
+    if (!hasKeyEpochs(descriptor)) {
+        return {
+            verdict: 'unresolved-current-epoch',
+            refusal: new Error('The collection descriptor carries no key epochs. Every encrypted ' +
+                'collection installs its epoch[0] at provision time, so an ' +
+                'epoch-less descriptor can only come from a tampering or ' +
+                'pre-provisioning host; refusing to rotate it.')
+        };
+    }
+    let currentEpoch;
+    try {
+        currentEpoch = currentEpochOf({
+            descriptor,
+            label: 'The collection descriptor'
+        });
+    }
+    catch (err) {
+        if (err instanceof UserKeyRosterIntegrityError) {
+            return { verdict: 'unresolved-current-epoch', refusal: err };
+        }
+        throw err;
+    }
+    const currentKids = new Set(currentEpoch.recipients.map(entry => entry.header.kid));
+    const userKeyKid = epochKeyIdFor(currentGeneration);
+    const keyed = generations.map(id => ({ id, kid: epochKeyIdFor(id) }));
+    const staleNamed = keyed.filter(generation => generation.id !== currentGeneration && currentKids.has(generation.kid));
+    if (staleNamed.length > 0) {
+        // The escrow owner: the newest stale generation still named by the
+        // current epoch, which the cascade invariant escrowed into every prior
+        // epoch -- so it unwraps the whole history for the fresh user key's
+        // escrow.
+        return {
+            verdict: 'stale-current-epoch',
+            staleKids: staleNamed.map(generation => generation.kid),
+            ownerGenerationId: staleNamed[staleNamed.length - 1].id
+        };
+    }
+    if (!currentKids.has(userKeyKid)) {
+        return { verdict: 'current-key-missing' };
+    }
+    const incomplete = (descriptor.epochs ?? []).filter(epoch => !epoch.recipients.some(entry => entry.header.kid === userKeyKid));
+    if (incomplete.length === 0) {
+        return { verdict: 'current' };
+    }
+    // The escrow owner must unwrap exactly the incomplete epochs: the newest
+    // generation named by every one of them.
+    const escrowOwner = [...keyed]
+        .reverse()
+        .find(generation => incomplete.every(epoch => epoch.recipients.some(entry => entry.header.kid === generation.kid)));
+    return { verdict: 'escrow-incomplete', escrowOwnerId: escrowOwner?.id };
+}
 /**
  * Brings ONE encrypted collection's epoch roster onto the current user key --
  * the per-collection op of the revocation cascade and of the completion sweep:
@@ -50,78 +150,66 @@ export async function rotateCollectionEpochsToUserKey({ store, userKey, generati
         return 'noop';
     }
     const descriptor = current.descriptor;
-    const staleGenerations = generations.filter(generation => generation.id !== userKey.id);
-    if (!hasKeyEpochs(descriptor)) {
-        throw new Error('The collection descriptor carries no key epochs. Every encrypted ' +
-            'collection installs its epoch[0] at provision time, so an ' +
-            'epoch-less descriptor can only come from a tampering or ' +
-            'pre-provisioning host; refusing to rotate it.');
-    }
-    const currentEpoch = currentEpochOf({
+    // The decision is the reading's: this cascade dispatches on its verdict and
+    // acts on its payload alone, so it and any auditor of the collection cannot
+    // disagree.
+    const reading = readCollectionEpochs({
         descriptor,
-        label: 'The collection descriptor'
+        currentGeneration: userKey.id,
+        generations: generations.map(generation => generation.id)
     });
-    const currentKids = new Set(currentEpoch.recipients.map(entry => entry.header.kid));
-    const staleKids = staleGenerations
-        .map(generation => epochKeyIdFor(generation.id))
-        .filter(kid => currentKids.has(kid));
-    const userKeyKid = epochKeyIdFor(userKey.id);
-    if (staleKids.length === 0) {
-        const escrowComplete = (descriptor.epochs ?? []).every(epoch => epoch.recipients.some(entry => entry.header.kid === userKeyKid));
-        if (currentKids.has(userKeyKid) && escrowComplete) {
+    switch (reading.verdict) {
+        case 'unresolved-current-epoch': {
+            throw reading.refusal;
+        }
+        case 'current': {
             if (isSealableDescriptorStore(store)) {
                 return (await store.seal()) === 'sealed' ? 'sealed' : 'noop';
             }
             return 'noop';
         }
+        case 'stale-current-epoch': {
+            const ownerGeneration = generations.find(generation => generation.id === reading.ownerGenerationId);
+            const owner = userKeyVaultKeys({ userKey: ownerGeneration });
+            await replaceRecipient({
+                store,
+                retire: reading.staleKids,
+                recipient: userKeyAsRecipient({ userKey }),
+                owner: { keyAgreementKey: owner.keyAgreementKey },
+                resolveRecipientKey: isSealableDescriptorStore(store)
+                    ? trustRosterDidKeys
+                    : vouchNoSurvivor,
+                pull: async () => { }
+            });
+            return 'rotated';
+        }
+        case 'current-key-missing': {
+            // No stale generation to retire, but the current user key is not a
+            // recipient at all: this collection's roster is not user-key-owned in a
+            // shape this cascade can heal -- surface it rather than silently minting
+            // an epoch whose history the account cannot read.
+            throw new Error('The collection current epoch names no user key generation this ' +
+                'client can recognize; its roster cannot be rotated to the current ' +
+                'user key.');
+        }
+        case 'escrow-incomplete': {
+            // Escrow completion only: the current epoch is already on the current
+            // user key, but some historical epoch is missing its wrap.
+            const escrowOwner = generations.find(generation => generation.id === reading.escrowOwnerId);
+            if (!escrowOwner) {
+                throw new Error("The current user key cannot be escrowed into this collection's " +
+                    'history: no held user key generation is a recipient of every ' +
+                    'incomplete epoch.');
+            }
+            const owner = userKeyVaultKeys({ userKey: escrowOwner });
+            await addRecipient({
+                store,
+                recipient: userKeyAsRecipient({ userKey }),
+                owner: { keyAgreementKey: owner.keyAgreementKey }
+            });
+            return 'escrowed';
+        }
     }
-    if (staleKids.length > 0) {
-        // The escrow owner: the newest stale generation still named by the
-        // current epoch, which the cascade invariant escrowed into every prior
-        // epoch -- so it unwraps the whole history for the fresh user key's escrow.
-        const ownerGeneration = [...staleGenerations]
-            .reverse()
-            .find(generation => currentKids.has(epochKeyIdFor(generation.id)));
-        const owner = userKeyVaultKeys({ userKey: ownerGeneration });
-        await replaceRecipient({
-            store,
-            retire: staleKids,
-            recipient: userKeyAsRecipient({ userKey }),
-            owner: { keyAgreementKey: owner.keyAgreementKey },
-            resolveRecipientKey: isSealableDescriptorStore(store)
-                ? trustRosterDidKeys
-                : vouchNoSurvivor,
-            pull: async () => { }
-        });
-        return 'rotated';
-    }
-    if (!currentKids.has(userKeyKid)) {
-        // No stale generation to retire, but the current user key is not a recipient
-        // at all: this collection's roster is not user-key-owned in a shape this
-        // cascade can heal -- surface it rather than silently minting an epoch
-        // whose history the account cannot read.
-        throw new Error('The collection current epoch names no user key generation this client ' +
-            'can recognize; its roster cannot be rotated to the current user key.');
-    }
-    // Escrow completion only: the current epoch is already on the current user key,
-    // but some historical epoch is missing its wrap. The owner must unwrap
-    // exactly those epochs -- the newest generation named by every incomplete
-    // epoch.
-    const incomplete = (descriptor.epochs ?? []).filter(epoch => !epoch.recipients.some(entry => entry.header.kid === userKeyKid));
-    const escrowOwner = [...generations]
-        .reverse()
-        .find(generation => incomplete.every(epoch => epoch.recipients.some(entry => entry.header.kid === epochKeyIdFor(generation.id))));
-    if (!escrowOwner) {
-        throw new Error("The current user key cannot be escrowed into this collection's history: " +
-            'no held user key generation is a recipient of every incomplete epoch.');
-    }
-    const owner = userKeyVaultKeys({ userKey: escrowOwner });
-    await addRecipient({
-        store,
-        recipient: userKeyAsRecipient({ userKey }),
-        owner: { keyAgreementKey: owner.keyAgreementKey }
-    });
-    return 'escrowed';
 }
 /**
  * The survivor resolver for a store whose roster is not authenticated: it

package/dist/keys/userKeyCascade.js.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyCascade.js","sourceRoot":"","sources":["../../src/keys/userKeyCascade.ts"],"names":[],"mappings":"AAqCA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAGnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAgB,MAAM,cAAc,CAAA;AAC7D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AAahC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,OAAO,EACP,WAAW,EAKZ;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CACzC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAC3C,CAAA;IAED,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,4DAA4D;YAC5D,0DAA0D;YAC1D,+CAA+C,CAClD,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC;QAClC,UAAU;QACV,KAAK,EAAE,2BAA2B;KACnC,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CACvD,CAAA;IACD,MAAM,SAAS,GAAG,gBAAgB;SAC/B,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAE5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC7D,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAChE,CAAA;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,EAAE,CAAC;YAClD,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,mEAAmE;QACnE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,eAAe,GAAG,CAAC,GAAG,gBAAgB,CAAC;aAC1C,OAAO,EAAE;aACT,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;QACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;QAC5D,MAAM,gBAAgB,CAAC;YACrB,KAAK;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;YAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YACjD,mBAAmB,EAAE,yBAAyB,CAAC,KAAK,CAAC;gBACnD,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,eAAe;YACnB,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;SACrB,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,6EAA6E;QAC7E,yEAAyE;QACzE,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,uEAAuE;IACvE,0EAA0E;IAC1E,SAAS;IACT,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAC1E,CAAA;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,CAAC;SACjC,OAAO,EAAE;SACT,IAAI,CAAC,UAAU,CAAC,EAAE,CACjB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAC3D,CACF,CACF,CAAA;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,uEAAuE,CAC1E,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IACxD,MAAM,YAAY,CAAC;QACjB,KAAK;QACL,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;KAClD,CAAC,CAAA;IACF,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe;IAC5B,OAAO,IAAI,CAAA;AACb,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,aAAa,EACb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EACP,UAAU,EASX;IACC,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC;QACjD,UAAU,EAAE,gBAAgB;QAC5B,qBAAqB;KACtB,CAAC,CAAA;IACF,MAAM,QAAQ,GAAqD,EAAE,CAAA;IACrE,MAAM,MAAM,GAAoD,EAAE,CAAA;IAClE,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QACrC,IAAI,CAAC;YACH,IAAI,WAAW,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;YACpC,IAAI,UAAU,KAAK,SAAS,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,KAAK,CAAC,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;YACnD,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,MAAM,+BAA+B,CAAC;gBAC7D,KAAK;gBACL,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC"}
+{"version":3,"file":"userKeyCascade.js","sourceRoot":"","sources":["../../src/keys/userKeyCascade.ts"],"names":[],"mappings":"AAqCA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAGnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAgB,MAAM,cAAc,CAAA;AAC7D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AA6ChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAIvC;IACC,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,EAC5B,UAAU,EACV,iBAAiB,EACjB,WAAW,EAKZ;IACC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,OAAO,EAAE,0BAA0B;YACnC,OAAO,EAAE,IAAI,KAAK,CAChB,mEAAmE;gBACjE,4DAA4D;gBAC5D,0DAA0D;gBAC1D,+CAA+C,CAClD;SACF,CAAA;IACH,CAAC;IACD,IAAI,YAAY,CAAA;IAChB,IAAI,CAAC;QACH,YAAY,GAAG,cAAc,CAAC;YAC5B,UAAU;YACV,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;QAC9D,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CACvD,CAAA;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC7B,UAAU,CAAC,EAAE,CACX,UAAU,CAAC,EAAE,KAAK,iBAAiB,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CACzE,CAAA;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,UAAU;QACV,OAAO;YACL,OAAO,EAAE,qBAAqB;YAC9B,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YACvD,iBAAiB,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE;SACzD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAC3C,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAC1E,CAAA;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAC/B,CAAC;IACD,yEAAyE;IACzE,yCAAyC;IACzC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC;SAC3B,OAAO,EAAE;SACT,IAAI,CAAC,UAAU,CAAC,EAAE,CACjB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC,CACpE,CACF,CAAA;IACH,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,OAAO,EACP,WAAW,EAKZ;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,4EAA4E;IAC5E,4EAA4E;IAC5E,YAAY;IACZ,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACnC,UAAU;QACV,iBAAiB,EAAE,OAAO,CAAC,EAAE;QAC7B,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAA;IACF,QAAQ,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,0BAA0B,CAAC,CAAC,CAAC;YAChC,MAAM,OAAO,CAAC,OAAO,CAAA;QACvB,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CACtC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,iBAAiB,CACzD,CAAA;YACF,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;YAC5D,MAAM,gBAAgB,CAAC;gBACrB,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,SAAS;gBACzB,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;gBAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;gBACjD,mBAAmB,EAAE,yBAAyB,CAAC,KAAK,CAAC;oBACnD,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,eAAe;gBACnB,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;aACrB,CAAC,CAAA;YACF,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,mEAAmE;YACnE,wEAAwE;YACxE,yEAAyE;YACzE,kDAAkD;YAClD,MAAM,IAAI,KAAK,CACb,iEAAiE;gBAC/D,oEAAoE;gBACpE,WAAW,CACd,CAAA;QACH,CAAC;QACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAClC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,aAAa,CACtD,CAAA;YACD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,iEAAiE;oBAC/D,+DAA+D;oBAC/D,mBAAmB,CACtB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;YACxD,MAAM,YAAY,CAAC;gBACjB,KAAK;gBACL,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;gBAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;aAClD,CAAC,CAAA;YACF,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe;IAC5B,OAAO,IAAI,CAAA;AACb,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,aAAa,EACb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EACP,UAAU,EASX;IACC,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC;QACjD,UAAU,EAAE,gBAAgB;QAC5B,qBAAqB;KACtB,CAAC,CAAA;IACF,MAAM,QAAQ,GAAqD,EAAE,CAAA;IACrE,MAAM,MAAM,GAAoD,EAAE,CAAA;IAClE,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QACrC,IAAI,CAAC;YACH,IAAI,WAAW,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;YACpC,IAAI,UAAU,KAAK,SAAS,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,KAAK,CAAC,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;YACnD,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,MAAM,+BAA+B,CAAC;gBAC7D,KAAK;gBACL,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC"}

package/dist/keys/userKeyRoster.d.ts

@@ -369,6 +369,55 @@ export declare function rosterRecipientsToRetire({ descriptor, keepRecipientIds
 export declare function enrolledClientRosterRecipients({ document }: {
     document: KeyAgreementDocument;
 }): RecipientPublicKey[];
+/**
+ * What the user key roster's current epoch and the account document disagree
+ * on, read from the two alone: the decide-half of
+ * {@link convergeUserKeyRosterToDocument}, extracted so the converger and any
+ * auditor of the roster-wraps-exactly-the-document-key-set invariant apply one
+ * rule. Pure: no I/O, no key material, no write.
+ *
+ * - `staleRecipientIds` -- the current epoch's kids no document verification
+ *   method backs ({@link userKeyRosterRecipientResolver}'s rule): the retire
+ *   direction's input.
+ * - `unwrappedClientRecipients` -- the enrolled clients the document keys that
+ *   hold no wrap in the current epoch
+ *   ({@link enrolledClientRosterRecipients}, less the wrapped kids): the
+ *   escrow direction's input, as the recipients to escrow.
+ * - `unwrappedCredentialMethodIds` -- the credential-class `keyAgreement`
+ *   method ids (`credentialKeyAgreementMethods`) no current-epoch wrap
+ *   answers for: a verbatim method whose `publicKeyMultibase` no wrapped kid
+ *   names, or a `MultikeyCommitment` that commits to no wrapped kid's key. The
+ *   converger never acts on this member (a credential's roster kid is not
+ *   rebuildable from the document, so the ceremony holding the credential
+ *   mends its wrap), but an auditor reads it, and the one predicate reports
+ *   every direction of the drift.
+ *
+ * A healthy roster reads as three empty lists.
+ *
+ * @param options {object}
+ * @param options.descriptor {CollectionEncryption}   the roster descriptor
+ * @param options.document {KeyAgreementDocument}   the locally verified
+ *   did:webvh document
+ * @param options.did {string}   the account DID the document resolves to,
+ *   which tells a credential-class method from an enrolled client's
+ * @returns {UserKeyRosterDrift}
+ * @throws {UserKeyRosterIntegrityError}   the descriptor's `currentEpoch`
+ *   names no epoch in its own list
+ */
+export declare function userKeyRosterDrift({ descriptor, document, did }: {
+    descriptor: CollectionEncryption;
+    document: KeyAgreementDocument;
+    did: string;
+}): UserKeyRosterDrift;
+/**
+ * {@link userKeyRosterDrift}'s result: the three directions the roster's
+ * current epoch can disagree with the account document in.
+ */
+export interface UserKeyRosterDrift {
+    staleRecipientIds: string[];
+    unwrappedClientRecipients: RecipientPublicKey[];
+    unwrappedCredentialMethodIds: string[];
+}
 /**
  * Converges the roster onto the account document: the standing detector for a
  * revocation cascade torn between its two halves. The cascade edits the
@@ -377,12 +426,13 @@ export declare function enrolledClientRosterRecipients({ document }: {
  * recipient the document no longer keys -- durable, silent, and permanent,
  * since the revoked client's document edit will never be re-run.
  *
- * The detection is pure durable state: a current-epoch recipient the
- * document-backed resolver cannot answer for is exactly a recipient the
- * document no longer keys, so a healthy account reads the descriptor and
- * writes nothing. When any such recipient is found the roster is rotated away
- * from ALL of them at once, because the resolver drops every unbacked entry
- * from the fresh epoch, not just the one named as retiring.
+ * The detection is pure durable state, and it is {@link userKeyRosterDrift}'s
+ * alone: a current-epoch recipient the document-backed resolver cannot answer
+ * for is exactly a recipient the document no longer keys, so a healthy account
+ * reads the descriptor and writes nothing. When any such recipient is found
+ * the roster is rotated away from ALL of them at once, because the resolver
+ * drops every unbacked entry from the fresh epoch, not just the one named as
+ * retiring.
  *
  * The convergence runs in TWO directions, in one append. The retire direction
  * is above. The escrow direction is its mirror: an enrolled client the
@@ -421,6 +471,8 @@ export declare function enrolledClientRosterRecipients({ document }: {
  *   store
  * @param options.document {KeyAgreementDocument}   the locally verified
  *   did:webvh document -- the recipient source of record
+ * @param options.did {string}   the account DID the document resolves to
+ *   (the drift predicate's credential-class reading takes it)
  * @param [options.descriptor] {CollectionEncryption}   a descriptor the caller
  *   has just read (a login-time roster read), to save a re-read; omitted, the
  *   roster is read fresh
@@ -435,9 +487,10 @@ export declare function enrolledClientRosterRecipients({ document }: {
  *   stale recipient kids found, the kids escrowed, and the roster descriptor
  *   as it now stands (`null` when the account has no roster yet)
  */
-export declare function convergeUserKeyRosterToDocument({ store, document, descriptor, etag, ownerKeyAgreementKey }: {
+export declare function convergeUserKeyRosterToDocument({ store, document, did, descriptor, etag, ownerKeyAgreementKey }: {
     store: EncryptionDescriptorStore;
     document: KeyAgreementDocument;
+    did: string;
     descriptor?: CollectionEncryption;
     etag?: string;
     ownerKeyAgreementKey?: IKeyAgreementKey;

package/dist/keys/userKeyRoster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyRoster.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAOL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAO/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,yBAAyB,CAU5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAKV;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,aAAa,EAAE,MAAM,CAAA;gBACT,EAAE,aAAa,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAQzD;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,iBAAiB,CAgBpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAqCtD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EACtB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAUhC;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAC3C,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CACvD,CAAA;AAyDD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,oBAAoB,EAAE,gBAAgB,CAAA;CACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,OAAO,EACR,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,iBAAiB,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;AA8GD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,QAAQ,EACR,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,OAAO,EACR,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,oBAAoB,EAAE,gBAAgB,CAAA;IACtC,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAShC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EACjB,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,MAAM,EAAE,CAaX;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B,GAAG,kBAAkB,EAAE,CA6BvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,CAAC,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACxC,CAAC,CAkHD;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,yBAAyB,CAAA;IAChC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;AACpC,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,yBAAyB,CAAA;IAChC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA"}
+{"version":3,"file":"userKeyRoster.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAOL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAU/E,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,yBAAyB,CAU5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAKV;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,aAAa,EAAE,MAAM,CAAA;gBACT,EAAE,aAAa,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAQzD;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,iBAAiB,CAgBpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAOtD;AAqFD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EACtB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAUhC;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAC3C,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CACvD,CAAA;AAyDD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,oBAAoB,EAAE,gBAAgB,CAAA;CACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,OAAO,EACR,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,iBAAiB,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;AA8GD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,QAAQ,EACR,kBAAkB,EAClB,UAAU,EACV,oBAAoB,EACpB,OAAO,EACR,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,oBAAoB,EAAE,gBAAgB,CAAA;IACtC,OAAO,CAAC,EAAE,mBAAmB,CAAA;CAC9B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAShC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EACjB,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,MAAM,EAAE,CAaX;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B,GAAG,kBAAkB,EAAE,CA6BvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,UAAU,EACV,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,kBAAkB,CAMrB;AA0DD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,yBAAyB,EAAE,kBAAkB,EAAE,CAAA;IAC/C,4BAA4B,EAAE,MAAM,EAAE,CAAA;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,GAAG,EACH,UAAU,EACV,IAAI,EACJ,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,CAAC,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACxC,CAAC,CAwGD;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,yBAAyB,CAAA;IAChC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;AACpC,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,yBAAyB,CAAA;IAChC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAA"}